Change Auditor for Authentication Services 7.4

Chat now with support

Get Live Help
Complete Registration

Sign In

Request Pricing

Contact Sales

Introduction Change Auditor for Authentication Services Events Built-in Reports

Introduction

Authentication Services is patented technology that enables organizations to extend the security and compliance of Active Directory to UNIX, Linux, and Mac platforms and enterprise applications. Using Change Auditor, you can track, audit, report and alert on all critical changes to:

•

Unix/Linux/Mac-related data for Active Directory users, groups, computers, NIS objects and Authentication Services personalities

•

Unix/Linux/Mac settings in Group Policy Objects


	NOTE: Authentication Services auditing is only available when you have Authentication Services 4.0 (or later) installed and a Change Auditor for Active Directory license.

This guide lists the events that can be captured by Change Auditor for Authentication Services. Separate event reference guides are provided that list the core Change Auditor events (when any Change Auditor license is applied) and the events captured when the different auditing modules are licensed.

Change Auditor for Authentication Services Events

Change Auditor for Authentication Services queries Active Directory for modifications made to the Authentication Services configuration container. This section lists the audited events captured by Change Auditor for Authentication Services. They are listed in alphabetical order by facility.


	IMPORTANT: When expecting large numbers of events, it may be necessary to increase the Max Events per Connection setting in the client (Agent Configuration on the Administration Tasks tab) to avoid an ever-increasing backlog of events waiting to be sent from the agent to the coordinator database.


	NOTE: To view a complete list of all the Change Auditor events, open the Audit Events page on the Administration Tasks tab in the client. This page contains a list of all the events available for auditing by Change Auditor. It also displays the facility to which the event belongs, the severity assigned to each event, if the event is enabled or disabled, and the type of Change Auditor license that is required to capture each event.

Authentication Services Monitoring

Table 1. Authentication Services Monitoring events
Event	Description	Severity
Authentication Services Computer Object Added	Created when a new Authentication Services computer object is added to an Active Directory domain.	Medium
Authentication Services Computer Object Attribute Changed	Created when an attribute for an Authentication Services computer object is changed.	Medium
Authentication Services Computer Object Deleted	Created when an Authentication Services computer object is removed from an Active Directory domain.	Medium
Authentication Services Computer Object Moved	Created when an Authentication Services computer object is moved in an Active Directory domain.	Medium
Authentication Services Computer Object Renamed	Created when an Authentication Services computer object is renamed in an Active Directory domain.	Medium
Authentication Services GPO Setting Changed	Created when an Authentication Services group policy settings is changed.	Medium
NIS Object Added	Created when an NIS object is added to Active Directory.	Medium
NIS Object Attribute Changed	Created when the data stored in an NIS object in Active Directory is changed.	Medium
NIS Object Deleted	Created when an NIS object is deleted from Active Directory.	Medium
NIS Object Moved	Created when an NIS object is moved within Active Directory.	Medium
NIS Object Renamed	Created when an NIS object is renamed within Active Directory.	Medium
Personality Object Added	Created when a UNIX user or group personality object is added to Active Directory.	Medium
Personality Object Attribute Changed	Created when the data stored in a Unix personality object in Active Directory is changed.	Medium
Personality Object Deleted	Created when a Unix user or group personality object is deleted from Active Directory.	Medium
Personality Object Moved	Created when a Unix personality object is moved within Active Directory.	Medium
Personality Object Renamed	Created when a Unix personality object is renamed within Active Directory.	Medium
UNIX GECOS Changed	Created when the GECOS attribute of a Unix-enabled Active Directory user is changed.	Medium
UNIX Group ID Number Changed for Group	Created when the group ID number of a Unix-enabled Active Directory group is changed.	Medium
UNIX Group ID Number Changed for User	Created when the primary group ID number of a Unix-enabled Active Directory user is changed.	Medium
UNIX Group Name Changed	Created when the Unix name of a Unix-enabled Active Directory group is changed.	Medium
UNIX Home Directory Changed	Created when the Unix home directory of a Unix-enabled Active Directory user is changed.	Medium
UNIX Login Name Changed	Created when the Unix login name of a Unix-enabled Active Directory user is changed.	Medium
UNIX Login Shell Changed	Created when the Unix login shell of a Unix-enabled Active Directory user is changed.	Medium
UNIX User ID Number Changed	Created when the user ID number of a Unix-enabled Active Directory user is changed.	Medium
UNIX-Enabled Changed for Group	Created when the Unix attributes of an Active Directory group are changed such that it no longer exists on a Unix or Linux® system.	Medium
UNIX-Enabled Changed for User	Created when the Unix attributes of an Active Directory user are changed such that it no longer exists on a Unix or Linux system.	Medium
UNIX-Enabled Group Created	Created when a new Active Directory group with configured Unix attributes is created.	Medium
UNIX-Enabled Group Deleted	Created when a Unix-enabled Active Directory group is deleted.	Medium
UNIX-Enabled User Created	Created when a new Active Directory user with configured Unix attributes is created.	Medium
UNIX-Enabled User Deleted	Created when a Unix-enabled Active Directory user is deleted.	Medium

Built-in Reports

Change Auditor provides predefined reports which allow you to quickly retrieve valuable change information from a variety of perspectives.


	NOTE: The terms ‘searches’ and ‘reports’ are used in conjunction to acquire the desired output. You run a ‘search’ and the results returned are referred to as a ‘report’.

To run a built-in search:

Click on the Searches tab or select the View | Searches menu command or Ctrl+F10 to open the Searches page.

Expand and select the appropriate folder in the explorer view (left-hand pane) to display the list of search definitions stored in the selected folder. For example, selecting the Shared | Built-in | Authentication Services will display all the built-in searches available for Authentication Services.

In the right-hand pane, locate the search to be run and use one of the following methods to run the selected search:

•

Double-click a search definition

•

Right-click a search definition and select the Run menu command

•

Select the search definition and click the Run tool bar button at the top of the Searches page

A new Search Results Page will be displayed populated with the audited events that met the search criteria defined in the selected search definition.