Chat now with support

Get Live Help
Complete Registration

Sign In

Request Pricing

Contact Sales

Change Auditor for Windows File Servers 7.0.2 - User Guide

Table of Contents

Change Auditor for Windows Files Servers Overview

Introduction Deployment requirements Client components/features

Getting Started

Introduction Getting started Create File System Auditing template Make File System changes and run a report Troubleshooting steps

File System Auditing

Introduction File System Auditing page File System Auditing templates File System Auditing wizard File System Event settings File System event logging

File System Searches/Reports

Introduction Create custom File System search

File System Protection

Introduction File System Protection page File System Protection templates File System Protection wizard

File System Events File/Folder Inclusion and Exclusion Examples

Inclusions tab Exclusions tab

Exclusions tab

If you do not want to exclude anything (folders or files) in the audit path from auditing, skip this tab. However, if you want to exclude a specific folder/file or group of folders/files, use the following characters to specify what is to be excluded:

•

Fixed characters such as letters, numbers and other characters that are allowed in file names.

•

An asterisk (*) wildcard character to substitute zero or more characters.


	NOTE: Use a single asterisk () to specify a non-recursive match (find match in the folder only; does not match any slash characters (\)). Use a double asterisk (*) to specify a recursive match (find match in the folder and all subfolders in audit path; matches slash characters (\) and directory names in paths).

•

Question mark (?) wildcard character to substitute a single character (does not match any slash characters (\).


	NOTE: Be sure to select the appropriate Add option (Folder or File) when adding an exclusion or you may not get the results expected. That is, use Add \| Folder to exclude the auditing of activity against files/subfolders in folder(s) that match the exclusion string. Use Add \| File to exclude the auditing of activity against file(s) that match the exclusion string.

The following tables provide some examples of file masks that can be used on the Exclusions tab of the auditing wizard. Note that <String> in these tables may contain any of the file mask characters described above (i.e., fixed characters, * or ?).

Audit Path = Folder (<Drive>:\<FolderName>\)


	NOTE: When the Auditing Path is All Shares, you cannot specify to exclude an individual share or folders/files found on an individual shares; you can only specify to exclude files and/or folders which may be found on all shares. Change Auditor automatically appends *\ to the beginning of all exclusion entries when the Audit Path is All Shares.

In the following examples the Audit Path is C:\TEMP\.

Table 5. Exclusion examples: Audit Path = Folder
What to exclude:	Exclusion syntax/examples:
Exclude activity against files/subfolders in the specified folder in the base audit path. (Add \| Folder)	Exclusion Syntax: <FolderName> Example: DOCS Excludes: C:\TEMP\DOCS
Exclude activity against files/subfolders in all folders with a specific name, which may be found anywhere in the audit path. (Add \| Folder)	Exclusion Syntax: \<FolderName> Example: \MYDOCS Excludes: C:\TEMP\MYDOCS C:\TEMP\DOCUMENTS\MYDOCS C:\TEMP\DOCS\PRIVATE\MYDOCS
Exclude activity against files/subfolders in all folders that contain a specific string in their name. (Add \| Folder)	Exclusion Syntax: <FolderNameString> Example 1: DOC* Excludes: Folders whose name begins with ‘DOC’ which are located in the base audit path. HOME\TEMP\DOCS HOME\TEMP\DOCUMENTS Example 2: DOC Excludes: Folders whose name ends in ‘DOC’ which may be located anywhere in the audit path. C:\TEMP\MYDOC C:\TEMP\DOCS\PRIVATE\DOC Example 3: DOC* Excludes: Folders whose name contains ‘DOC’ which may be located anywhere in the audit path. C:\TEMP\DOCS C:\TEMP\DOCUMENTS C:\TEMP\MYDOCS C:\TEMP\FINALDOC C:\TEMP\PUBLIC\DOCS C:\TEMP\TEST\BETA\DOCUMENTS
Exclude activity against files whose name contains a specific character string, which may be found anywhere in the audit path. (Add \| File)	Exclusion Syntax: *<CharString> Example: *DOC Excludes: C:\TEMP\Test1.docx C:\TEMP\Doc1.tmp C:\TEMP\TEST\BETA\FinalDocument.pdf
Exclude activity against a specific file in the base audit path. (Add \| File)	Exclusion Syntax: <FileName.Ext> Example: Test1.docx Excludes: C:\TEMP\Test1.docx
Exclude activity against all files with a specific extension, which are located in the base audit path. (Add \| File)	Exclusion Syntax: .<Ext> Example: .tmp Excludes: C:\TEMP\Doc1.tmp C:\TEMP\Testing123.tmp
Exclude activity against all files with a specific extension, which may be found anywhere in audit path. (Add \| File)	Exclusion Syntax: .<Ext> Example: .tmp Excludes: C:\TEMP\Doc1.tmp C:\TEMP\DOCUMENTS\Testing.tmp C:\TEMP\TEST\BETA\Draft1.tmp
Exclude activity against all files that contain a specific string in their name and/or file extension, which are located in the base audit path. (Add \| File)	Exclusion Syntax: <FileNameString>.<ExtString> Example 1: ??word.??? Excludes: Files whose name contains six characters and ends in ‘word’, with a three character file extension, found in the base audit path. C:\TEMP\Myword.doc C:\TEMP\12word.txt Example 2: word.??p Excludes: Files whose name contains the string ‘word’, with a three character file extension that ends with the letter ‘p’. C:\TEMP\Word.tmp C:\TEMP\Mywordtest.tmp C:\TEMP\Nowords.bmp

Audit Path = All Drives

In the following examples, there are two drives: C and D.


	NOTE: When the Auditing Path is All Drives, you cannot specify to exclude an individual drive or folders/files found on an individual drive; you can only specify to exclude files and/or folders which may be found on all drives. Change Auditor automatically appends *\ to the beginning of all exclusion entries when the Audit Path is All Drives.

Table 6. Exclusion examples: Audit Path = All Drives
What’s to be excluded:	Exclusion syntax/examples:
Exclude activity against files/subfolders in a specific folder and path that may be found anywhere on all drives. (Add \| Folder) NOTE: You cannot specify an absolute path when the Audit Path is All Drives.	Exclusion Syntax: <Path>\<FolderName> Example: USERS\TEMP\DOCS Excludes: C:\USERS\TEMP\DOCS D:\USERS\TEMP\DOCS D:\SHARED\APPS\USERS\TEMP\DOCS
Exclude activity against files/subfolders in all folders with the specified folder name, which may be found anywhere on all drives. (Add \| Folder)	Exclusion Syntax: \<FolderName> Example: \DOCS Excludes: C:\USERS\TEMP\DOCS C:\DOCUMENTS\CHANGEAUDITOR\TEST\DOCS D:\USERS\TEMP\DOCS D:\SHARED\APPS\USERS\TEMP\DOCS
Exclude activity against files/subfolders in all folders whose name ends in a specified string, which is located in the base audit path. NOTE: The base audit path refers to the top level drive letter when All Drives is specified. (Add \| Folder)	Exclusion Syntax: <FolderNameString> Example: DOC Excludes: C:\DOC C:\TESTDOC D:\DOC
Exclude activity against files/subfolders in all folders whose name contains a specific string of characters, which may be found anywhere on all drives. (Add \| Folder)	Exclusion Syntax: *<CharString> Example: *DOC Excludes: C:\DOCUMENTS C:\MYDOCS C:\USERS\TEMP\DOCS D:\USERS\TEMP\DOCS D:\SHARED\APPS\INSTALLDOC D:\SHARED\APPS\USERS\TEMP\DOCS
Exclude activity against files whose name contains a specific string of characters, which may be found anywhere on all drives. (Add \| File)	Exclusion Syntax: *<CharString> Example: *DOC Excludes: C:\TEMP\Test1.docx C:\TEMP\Doc1.tmp C:\USERS\TEMP\DOCS\Test1.doc C:\TEMP\TEST\BETA\FinalDocument.pdf D:\SHARED\APPS\USERS\TEMP\OldDocPlan
Exclude activity against files whose name ends with a specific string (regardless of the extension), that may be found anywhere on all drives. (Add \| File)	Exclusion Syntax: *<FileName>. Entering: *test1. Excludes: C:\TEMP\Test1.docx C:\DEPTS\TECHNICALDOCS\MyTest1.doc C:\USERS\DOCS\NewTest1.docx D:\SHARED\APPS\USERS\TEMP\Test1.xlsx
Exclude a file with a specific file name (regardless of the extension), that is found at the second level of a path on all drives. (Add \| File)	Exclusion Syntax: \<FileName>. Entering: \test1. Excludes: C:\TEMP\Test1.docx D:\SHARED\Tests1.xls
Exclude activity against all files with a specific extension, which are located in the base audit path. NOTE: The base audit path refers to only the top level drive letter when All Drives is specified. (Add \| File)	Exclusion Syntax: .<Ext> Example: .tmp Excludes: C:\Doc1.tmp C:\Testing123.tmp D:\MyTest.tmp
Exclude activity against all files with the specified file extension found anywhere on all drives. (Add \| File)	Exclusion Syntax: .<Ext> Example: .pdf Excludes: C:\DOCUMENTS\Test123.pdf C:\TEST\DOCS\Current.pdf C:\TEMP\TEST\BETA\FinalDocument.pdf D:\ReleaseHistory.pdf D:\SHARED\APPS\WhatsNew.pdf

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating

© ALL RIGHTS RESERVED. Feedback Terms of Use Privacy Cookie Preference Center