Chat now with support
Chat with Support

Quest has tools and processes in place to identify, protect, detect, and remediate vulnerabilities and incidents when they occur, including external security partners. As part of our standard security operations, Quest does not use CrowdStrike in any of our operations. We are reviewing our third parties, and so far, there is minimal affect. It is Quest's policy not to provide further technical details unless they directly impact customer data.

Change Auditor for Logon Activity 7.4 - User Guide

Client components and features

The following table lists the client components and features that require a valid Change Auditor for Logon Activity license. The product will not prevent you from using these features; however, associated events will not be captured unless the proper license is applied.

* 
NOTE: To hide unlicensed Change Auditor features from the Administration Tasks tab (including unavailable audit events throughout the client), use the Action | Hide Unlicensed Components menu command. Note this command is only available when the Administration Tasks tab is the active page.

 

 
Table 1. Change Auditor for Logon Activity client components/features
Client Page
Feature

Event Details Pane

What Details:

•
Subsystem: Logon Activity
•
Logon Start (Logon Session events)
•
Logon End (Logon Session events)
•
Duration (Logon Session events)
•
Session Start (Logon Session events)
•
Session End (Logon Session events)
NOTE: See Search Results for more information.

Events

Facilities:

•
Authentication Activity
•
Domain Controller Authentication (only available with Change Auditor for Logon Activity User auditing module for server agents)
•
Logon Session

Layout Tab/Search Results Page/Reports

Columns:

•
Subsystem: Logon Activity
•
Logon Type
•
Logon Start (Logon Session events)
•
Logon End (Logon Session events)
•
Logon Failure Reason
•
Logon Session Start (Logon Session events)
•
Logon Session End (Logon Session events)
•
Logon Status Code
•
Logon Duration (Logon Session events)

Search Properties

What Tab:

•
Subsystem | Logon Activity
NOTE: See User Logon Activity Searches/Reports for information on creating custom logon activity search queries.

Searches Page

Built-in Reports:

•
All Failed Logons in the last 7 days
•
All Interactive Logons in the past 24 hours
•
All Kerberos Logons in the past 24 hours
•
All Logons in the past 24 hours
•
All Remote Interactive Logons in the past 24 hours
•
All User Sessions in the past 24 hours
NOTE: See Built-in logon activity searches for a description of these search queries.

Alert Body Configuration dialog - Event Details tab

Variables (email tags):

•
LOGON_DURATION
•
LOGON_END
•
LOGON_SESSIONEND
•
LOGON_SESSIONSTART
•
LOGON_START
•
LOGON_TYPE
NOTE: See the Change Auditor User Guide for a description of these email tags and how to configure alert email notifications.
 

 

 

 

Getting Started

•
Deployment requirements
•
Run reports

Deployment requirements

Before you can begin to capture logon activity events, you must:

•
Ensure you meet the minimum system requirements.
•
Apply the Change Auditor for Logon Activity User license to monitor servers. (All DCs and Member Servers with an agent installed will be included.)
•
Apply the Change Auditor for Logon Activity Workstation license and deploy workstation agents to the workstations to be monitored. See the Change Auditor Installation Guide for more information on deploying workstation agents.
•
Deploy agents. Depending on your implementation, you can deploy server and/or workstation agents.
* 
NOTE: See Appendix: Agent Comparison for more information.
The recommended installation for domain workstations is through the Deployment tab. However, for non-domain workstations you must manually install the Change Auditor workstation agent. See Appendix: Workstation Agent Deployment for recommendations on deploying agents necessary for auditing both domain workstations and non-domain workstations.
•
Enable the following policies through the Group Policy Management Console to allow Change Auditor to capture Authentication Activity events. (See the Change Auditor for Logon Activity Event Reference Guide for details about authentication activity events).
When Local Policies\Audit Policy is used:
1
Enable the ‘Audit Logon events’ audit policy for all servers and workstations. (Set to audit Success and Failure)
•
Domain - Group Policy:
•
Default Domain Policy\Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Audit Policy\Audit logon events
•
Default Domain Controller Policy:
•
Default Domain Controllers Policy\Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Audit Policy\Audit logon events
•
Default Domain Controllers Policy\Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Logon/Logoff\Audit Logon
•
Workgroup - Local Group Policy:
•
Local Computer Policy\Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Audit Policy\Audit logon events
2
Wait 30-90 minutes for the policy to refresh.
When Security Settings\Advanced Audit Policy Configuration is used:
1
Enable the ‘Audit Logon’ advanced audit policy for all servers and workstations. (Set to audit Success and Failure)
•
Domain - Group Policy:
•
Default Domain Policy\Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Logon/Logoff\Audit Logon
•
Default Domain Controller Policy:
•
Default Domain Controllers Policy\Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Audit Policy\Audit logon events
•
Default Domain Controllers Policy\Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Logon/Logoff\Audit Logon
•
Workgroup - Local Group Policy:
•
Local Computer Policy\Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\System Audit Policies - Local Group Policy Object\Logon/Logoff\Audit Logon
2
Wait 30-90 minutes for the policy to refresh.
* 
NOTE: The following Domain Controller Authentication events do not require Windows system provided auditing enabled and are recorded in Change Auditor even if they are not recorded in the Windows Event log:
•
User authenticated through Kerberos
•
User failed to authenticate through Kerberos
Additional notes
•
Quest recommends that you deploy a server agent to all servers (domain controllers and member servers) to track configuration changes in real-time.
•
For workstation events, the agent is stored locally to capture logon, logoff, and calculated session activity.
•
If a computer is disconnected from the network, the agent continues to work and store the information locally. Once the computer connects to the network again, the events are sent to the database and integrated at the time they were captured.
* 
NOTE: Logon activity is only available if you have applied the Change Auditor for Logon Activity User license to monitor servers and the Change Auditor for Logon Activity Workstation license to monitor workstations.

To verify that it is licensed, right-click the coordinator icon in the system tray and select Licensing.

Run reports

Using reports, you can obtain valuable information. For example, you can:

•
Group, sort, and filter the information to help answer key questions for security, HR, and auditors. You can run reports to see who is logging into your servers, gather remote user session information, and access related search information to see what activities specific users have been performing.
•
Create simplified reports by user, computers, logon type, etc.
•
Create private searches and alerts for specific events that need urgent attention. For example, “all server logons in the last 24 hours”.
•
Create dashboards, viewable in the web client, to help facilitate user management. You can then, enable shared overviews to be used by the Helpdesk to see information such as account logons, session activity, and account lockouts.
To test that events are being captured:
1
Select Start | All Programs | Quest | Change Auditor | Change Auditor Client to review the events generated.
2
Open the Searches tab.
3
Expand the Shared | Built-in | Logon Activity folder in the left pane.
4
Locate and double-click All User Sessions in the past 24 hours in the right pane.
A new Search Results tab is added to the client displaying the events captured over the last 24 hours.
5
Select an event from the Search Results grid to display the event details for the selected event.
* 
NOTE: If the Search Properties tabs are displayed across the bottom of the Search Results page, double-click an event to display the event details for the selected event.

 

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating