Change Auditor for Windows File Servers 7.1.1

Introduction File System Auditing page File System Auditing templates File System Auditing wizard File System Event settings File System event logging

File System Searches/Reports

Introduction Create custom File System search

File System Protection

Introduction File System Protection page File System Protection templates File System Protection wizard

File System Events File/Folder Inclusion and Exclusion Examples

Inclusions tab Exclusions tab

File System Auditing page

The File System Auditing page displays when File System is selected from the Auditing task list in the navigation pane of the Administration Tasks tab. From this page you can launch the File System Auditing wizard to specify the file, folder or all drives in a system that are to be audited. You can also edit existing templates, disable a template, and remove templates that are no longer being used.


	NOTE: Authorization to use the administration tasks on the Administrations Tasks tab is defined using the Application User Interface page under the Configuration task list. If you are denied access to the tasks on this page, refer to the Change Auditor User Guide for more information on how to gain access.

The File System Auditing page contains an expandable view of all the File System Auditing templates that have been previously defined. To add a new template to this list, click Add. Once added, the following information is provided for each template:

Template

Displays the name assigned to the template when it was created.

Status

Indicates whether the auditing template is enabled or disabled.

Paths

This field is used for filtering data.

Excluded Processes

This field is used for filtering data.

Click the expansion box to the left of the Template name to expand this view and display the following details for each template:

Path

Displays the name of the file paths or folders included in the File System Auditing template.

Status

Indicates whether auditing for the selected file path is enabled or disabled.

Scope

Indicates the scope of coverage specified for each file path in the selected template:

•

This object only

•

This object and child objects only

•

This object and all child objects

Include

Displays the names of the subfolders or files to be audited (or a file mask) as specified on the Inclusions tab of the wizard.

Exclude

Displays the names and paths of subfolders and files to be excluded from auditing as specified on the Exclusions tab of the wizard.

Operations

Displays the events selected for auditing on the Events tab of the wizard. Hover your mouse over this cell to view all of the events included in the template.

Excluded Process

Displays a list of the processes excluded from auditing (i.e., changes from these processes are not audited) as specified on the last page of the File System Auditing wizard.


	NOTE: The cells directly under the main heading rows are used for filtering data. That is, as you enter characters into these cells, the client will redisplay the templates that meet the search criteria (i.e., comparison operator and characters entered). For more details about using the data filtering function provided throughout the Change Auditor client, see the Change Auditor User Guide.

File System Auditing templates

To enable File System auditing in Change Auditor, you must first create a File System Auditing template which specifies the files, folders, or all drives on a system that are to be audited. This template must then be assigned to the appropriate agents’ configuration to audit the specified files and folders.

To create an auditing template for a file:

Open the Administration Tasks tab.

Click Auditing.

Select File System (under the Server heading in the Auditing task list) to open the File System Auditing page.

Click Add to open the File System Auditing wizard which will step you through the process of creating a File System Auditing template.

On the first page of the wizard, enter the following information:

•

Template Name - Enter a name for the template.

•

Audit Path - Select the File option. Enter a file name (Drive:\Folder\FileName.ext) or click the browse button and select the file to be audited.


	NOTE: This must be a local path. Auditing of network shares or mapped drives is not supported. To audit those files/folders, a Change Auditor agent must be deployed on the share's hosting server.

Click Add to move the specified file to the selection list.

•

Events tab - Select the file events to be audited for the file selected in the selection list.

Repeat this step to add additional files to this auditing template.


	NOTE: Selecting the File Events check box at the top of the events list on the Events tab will select all of the events listed. Similarly, clearing this check box will clear all of the selected events.

Multiple folder open events are generated by tooltips (folder content information that is displayed when you hover your mouse over a folder) because Windows Explorer navigates the folder tree for all the sub-folders when you hover over the parent folder to see the tooltip. To ignore the folder opened events generated by this action, select the Discard Windows Explorer tooltip events from folder browsing option.

Multiple file open events are generated by file scans because Windows Explorer opens and reads the header of all files contained in an opened folder for information to display in the window. To ignore the file open events generated by this action, select the Discard file open events from browsing option.

(Optional) Click Next to proceed to the next page to select processes that are to be excluded from auditing (for example, changes made by the processes specified on this page will not be audited).

Select one or more processes from the process list and click Add to move these processes to the exclusion list at the bottom of the page.


	NOTE: You can also view processes on a different server or enter a process not listed in the process list.

To create the template without assigning it to an agent configuration, click Finish.

This creates the template, closes the wizard, and returns you to the File System Auditing page where the newly created template is now listed.

To create the template and assign it to an agent configuration, expand Finish and select Finish and Assign to Agent Configuration.

On the Configuration Setup dialog, use one of the following methods to assign this template to an agent configuration:

•

Select the newly created template and drag and drop it onto a configuration in the Configuration list.

•

Select a configuration from the Configuration list and ‘drag and drop’ it onto the newly created template.

•

Select a configuration, then select the newly created template, right-click and select Assign.

•

Select a configuration, then select the newly created template, click in the corresponding Assigned cell and click Yes.

If this configuration is not assigned to any agents, you will need to assign it to one or more installed agents to capture the specified file system events.

•

On the Agent Configuration page, select one or more agents from the agent list and click Assign.

•

On the Agent Assignment dialog, select the configuration definition to be assigned to the selected agents and click OK.

•

On the Agent Configuration page, select the agents assigned to use the modified agent configuration and click Refresh Configuration to ensure the agents are using the latest configuration.

To create an auditing template for a folder:


	NOTE: If you do not refresh the agent’s configuration, the agent will automatically check for a new agent configuration based on the polling interval setting (located on the System Settings tab of the Configuration Setup dialog). The default is every 15 minutes.

Open the Administration Tasks tab.

Click Auditing.

Select File System (under the Server heading in the Auditing task list) to open the File System Auditing page.

Click Add to launch the File System Auditing Wizard which steps you through the process of creating a File System Auditing template.

On the first page of the wizard, enter the following information:

•

Template Name - Enter a name for the template.

•

Audit Path - Select the Folder option. Enter a folder name (i.e., Drive:\Folder\) or click the Browse button to select the folder to audit.


	NOTE: This must be a local path. Auditing and/or protecting network shares is not supported. To audit or protect those files/folders, an agent must be deployed on the share's hosting server.

NOTE: Once the Folder option is selected, you can select a system variable using the drop-down menu. Click the arrow to the far right of the text box and select one of the following options:

•

•

•

•

•

All Shares (Change Auditor does NOT audit any shares that are hidden using the dollar sign character ($) appended to the end of the share name.)

Click Add to add the specified folder to the Selection list (middle of the page).

By default, the scope of coverage for the selected folder will be This object and all child objects. However, you can change the scope, by selecting a different option from the drop-down box in the scope cell of the selection list:

•

This object only- select this option to audit only the selected folder, not its files or subfolders.

•

This object and child objects only - select this option to audit the selected folder and its direct files and subfolders. This is not recursive.

•

This object and all child objects - select this option to audit this folder and all of its files and subfolders.

In addition, selecting the folder entry in the Selection list activates the tabs across the bottom of the page. The settings specified on these tabs apply to the entry selected.

On the Events tab, select the file and folder events to be audited.


	NOTE: Selecting the File Events or Folder Events check box at the top of the events list on the Events tab will select all of the events listed. Similarly, clearing these check boxes will clear all of the selected events.

On the Inclusions tab, specify the file masks to audit.


	NOTE: Do NOT use the Inclusion tab to add additional subfolder paths onto the monitored base path (audit path specified above). It is meant to specify an inclusion mask for ONLY objects located under the monitored base path.

Enter a file mask to specify what is to be included in the audit. The file mask can contain any combination of the following:

•

Fixed characters such as letters, numbers and other characters that are allowed in file names.

•

Asterisk (*) wildcard character to substitute zero or more characters.

•

Question mark (?) wildcard character to substitute a single character.


	NOTE: For file system auditing, the slash characters (\) and double asterisks (*) are not allowed in file masks; therefore, to include a specific folder (or share), use the Audit Path field at the top of the page to specify the folder (or share) to be audited and enter an on the Inclusions tab.

For example, entering * will include all subfolders and files in the selected audit path.

You can also enter the name of an individual subfolder or file to be audited. However, if you enter the name of an individual subfolder, you will only receive events for operations performed against that subfolder. You will NOT receive events for operations performed against any child objects under the specified subfolder.

Once you have specified the subfolders/files for inclusion, click Add to add it to the Inclusion list at the bottom of the page.

Repeat this step to add additional subfolders and files to the Inclusion list.

(Optional) On the Exclusions tab, specify the names and paths of any subfolders or files in the selected audit path that are to be excluded from auditing.

Enter a file mask to specify the name and path of subfolders and files to be excluded from auditing. The file mask can contain any combination of the following:

•

Fixed characters such as letters, numbers and other characters that are allowed in file names.

•

Asterisk (*) wildcard character to substitute zero or more characters. Use a single asterisk (*) to specify a non-recursive match (i.e., find match in the folder only; does not match any slash characters (\)). Use a double asterisk (**) to specify a recursive match (i.e., find match in the folder and all subfolders in audit path; matches slash characters (\) and directory names in paths).

•

Question mark (?) wildcard character to substitute a single character. The ? wildcard character does not match slash (\) characters.

For example, entering *.log will exclude all files in the audit folder with the .log file extension. Whereas, entering **.log will exclude all files with the .log file extension found in the audit folder or in any subfolders.

You can also enter the name of an individual subfolder or file to be excluded from auditing or click the browse button and select one of the options to browse for and select an individual subfolder or file in the specified audit path:

•

Browse Files - selecting this browse option displays the Select a file system path dialog allowing you to select a file for exclusion from auditing.

•

Browse Folders - selecting this browse option displays the Browse for Folder dialog allowing you to select a folder for exclusion from auditing.


	NOTE: If you select a file or subfolder that does not belong to the selected audit path, the wizard will not allow you to continue. A red flashing icon is displayed indicating that you have selected a file or folder outside of the selected audit path. However, the wizard will not prevent you from entering the name of a file or subfolder that is outside of the audited path. If this happens, Change Auditor will NOT exclude it from auditing.

Once you have specified a subfolder or file for exclusion, use the appropriate Add command to add it to the Exclusion list at the bottom of the page:

•

Add | Folder - use this option to exclude activity against files/subfolders in any folders that match the exclusion string.

•

Add | File - use this option to exclude activity against any files that match the exclusion string.

Repeat this step to add additional subfolders and files to the Exclusion list.

(Optional) Click Next to proceed to the next page to select processes that are to be excluded from auditing (for example, changes made by the processes specified on this page will not be audited).

From this page, select one or more processes from the process list and click Add to move these processes to the list at the bottom of the page.


	NOTE: You can also view processes on a different server or enter a process not listed in the process list.

To create the template without assigning it to an agent configuration, click Finish.

This creates the template, closes the wizard, and returns you to the File System Auditing page, where the newly created template is now listed.

To create the template and assign it to an agent configuration, expand Finish and select Finish and Assign to Agent Configuration.

On the Configuration Setup dialog, use one of the following methods to assign this template to an agent configuration:

•

Select the newly created template and drag and drop it onto a configuration in the Configuration list.

•

Select a configuration from the Configuration list and ‘drag and drop’ it onto the newly created template.

•

Select a configuration, then select the newly created template, right-click and select Assign.

•

Select a configuration, then select the newly created template, click in the corresponding Assigned cell and click Yes.

If this configuration is not assigned to any agents, you will need to assign it to one or more installed agents to capture the specified file system events.

•

On the Agent Configuration page, select one or more agents from the agent list and click Assign.

•

On the Agent Assignment dialog, select the configuration definition to be assigned to the selected agents and click OK.

•

On the Agent Configuration page, select the agent(s) assigned to use the modified agent configuration and click Refresh Configuration to ensure the agents are using the latest configuration.

To modify a template:


	NOTE: If you do not refresh the agent’s configuration, the agent will automatically check for a new agent configuration based on the polling interval setting (located on the System Settings tab of the Configuration Setup dialog). The default is every 15 minutes.

On the File System Auditing page, select the template to be modified and click Edit.

This displays the File System Auditing wizard, where you can modify the files, folders, events and/or processes included in the template.

Click Finish or expand the Finish and select Finish and Assign to Agent Configuration.

To disable an auditing template:

The disable feature allows you to temporarily stop auditing the specified file path without having to remove the auditing template or individual file path from a template.

On the File System Auditing page, use one of the following methods to disable a File System Auditing template:

•

Place your cursor in the Status cell for the template to be disabled, click the arrow control and select Disabled.

•

Right-click the template to be disabled and select Disable.

The entry in the Status column for the template will change to ‘Disabled’.

To re-enable the auditing template, use the Enable option in either the Status cell or right-click menu.

To disable the auditing of a file path in a template:

On the File System Auditing page, use one of the following methods to disable a file path in an auditing template:

•

Place your cursor in the Status cell for the file path to be disabled, click the arrow control and select Disabled.

•

Right-click the file path to be disabled and select Disable.

The entry in the Status column for the selected file path will change to ‘Disabled’.

To re-enable the auditing of a file path, use the Enable option in either the Status cell or right-click menu.

To delete an auditing template:

On the File System Auditing page, select the template to be deleted and click Delete | Delete Template.

A dialog displays confirming that you want to delete the selected template. Click Yes.

To delete a file path from a template:

On the File System Auditing page, select the file path to be deleted and click Delete | Delete File Path.

A dialog displays confirming that you want to delete the selected file path from the template. Click Yes.


	NOTE: If the file path is the last one in the template, deleting this file path will also delete the template.

To delete an excluded process from a template:

On the File System Auditing page, right-click the excluded process to be deleted from the auditing template and select Delete.

A dialog will be displayed confirming that you want to delete the selected process from the template. Click Yes.

File System Auditing wizard

The File System Auditing wizard displays when you click Add or Edit on the File System Auditing page. This wizard steps you through the process of creating a new file system auditing template, identifying the files, folders or all drives on a system that are to be included in the auditing template.

The following table provides a description of the fields and controls in the File System Auditing wizard:


	NOTE: A red flashing icon indicates that you have not yet entered the required information. Hovering your cursor over this icon displays a tool tip explaining what needs to be entered. A green check mark indicates that the required information has been specified and you are ready to proceed.

Table 2. File System Auditing wizard

Create or modify a File System Auditing Template page

Use the first page of the wizard to enter a name for the template and specify the individual file or folder or all drives to be audited.

Template Name

Enter a descriptive name for the template being created.

Audit Path

Select one of the following options to define auditing for a file, folder or all drives:

•

File - select this option to audit a single file. Then enter a file name and path (i.e., Drive:\Folder\FileName.ext) or use the browse button to locate and select the file to be audited.

•

Folder - select this option to audit a folder or a set of files. To specify a particular folder, enter the folder’s name (for example, Drive:\Folder\) or use the browse button to select the folder to be audited.

Use the drop-down menu to specify a system variable: Common Program Files, Program Files, System Drive, Windows Directory, or All Shares.

NOTE: This must be a local path. Auditing of network shares or mapped drives is not supported. To audit those files/folders, a Change Auditor agent must be deployed on the share's hosting server.

NOTE: Change Auditor does NOT audit any shares that are hidden using the dollar sign character ($) appended to the end of the share name.

•

All Drives - select this option to audit all drives. The Audit Path text box will contain an asterisk (*) which cannot be changed.

Once you have entered the audit path to be audited, use the Add button to add it to the selection list.

When the File or Folder option is selected as the audit path, click the browse button to locate and select a file or folder to be audited.

Add

Click Add to move the entry in the Audit Path text box to the selection list.

NOTE: Even though you cannot edit the Audit Path when the All Drives option is selected, you must still use Add to move it to the selection list.

Remove

Select an entry in the selection list and click Remove to remove it from the template.

Selection list

The list box, located across the middle of this page, displays the files, folders or All Drives selected for auditing.

When a Folder is selected, you can use the drop-down menu in the Scope field to change the scope of coverage for a folder:

•

This object only - select this option to audit only the selected folder, not its files or subfolders.

•

This object and child objects only - select this option to audit the selected folder and its direct files and subfolders. This is not recursive.

•

This object and all child objects - select this option to audit this folder and all of its files and subfolders. (Default)

Select an entry in this list to enable the corresponding Events, Inclusions and Exclusions tabs at the bottom of the page.

Events tab

Use the Events tab to select the file and/or folder events to audit in the selected audited path. The contents of this tab are based on the entry selected above in the Selection list.

File Events

Select the file events to audit. Select the File Events check box to select all of the file events listed or select individual events from the list.

NOTE: Due to the potential of generating a very large number of events, File Open events are NOT captured when This object and all child objects is selected in the Scope cell. Therefore, File Open is NOT included in the File Events list on this page when This object and all child objects is selected above.

Folder Events

Select the folder events to audit. Select the Folder Events check box to select all of the folder events listed or select individual events from the list.

NOTE: Due to the potential of generating a very large number of events, Folder Open events are NOT captured when This object and all child objects is selected in the Scope cell. Therefore, Folder Open is NOT included in the Folder Events list on this page when This object and all child objects is selected above.

Ignore specific events

Inclusions tab

When the Folder or All Drives option is selected in the Audit Path field and the Scope includes child objects, the Inclusions tab will be displayed allowing you to specify what in the selected audit path is to be audited.

NOTE: Do NOT use the Inclusion tab to add additional subfolder paths onto the monitored base path (audit path specified above). It is meant to specify an inclusion mask for ONLY objects located under the monitored base path.

Add the names of subfolders and files to audit

Enter a file mask to specify what in the selected audit path is to be audited. The file mask can contain any combination of the following:

•

Fixed characters such as letters, numbers and other characters that are allowed in file names.

•

Asterisk (*) wildcard character to substitute zero or more characters.

•

Question mark (?) wildcard character to substitute a single character.

NOTE: For file system auditing, the slash characters (\) and double asterisks (**) are not allowed in file masks; therefore to include a specific folder (or share), use the Audit Path field at the top of the page to specify the folder ( or share) to be audited and enter an * on the Inclusions tab.

For example, entering * will include all folders and files in the selected audit path. See File/Folder Inclusion and Exclusion Examples for more file mask examples.

You can also enter the name of an individual subfolder or file to be included. However, if you enter the name of a subfolder, you will only receive events for operations performed against that subfolder. You will NOT receive any events for operations performed against any child objects under the specified subfolder.

Once you have specified the subfolder or file to be included, click Add to add it to the Inclusions list.

Inclusions list

The list across the bottom of this page contains the subfolders and files selected for auditing. Use the buttons to the right of the text box to add and remove entries.

•

Add - Click to move the entry in the text box to the Inclusions list.

•

Remove - Select an entry in the Inclusions list and click Remove to remove it.

Exclusions tab (Optional)

When the Folder or All Drives option is selected in the Audit Path field and the Scope includes child objects, the Exclusions tab will be displayed allowing you to refine the settings defined on the Inclusions tab. That is, you can optionally specify the names and paths of any subfolders and files in the selected audit path that are to be excluded from auditing.

NOTE: To reduce the number of events generated by document File | Save operations in Microsoft Word, Excel, Visio, and PowerPoint (Microsoft Office version 2010, 2013, and 2016), Change Auditor uses event consolidation rules. Excluding temporary files will remove the ability to consolidate these events and you will lose file modified events. Consolidation rules are not supported in multiple agent auditing scenarios.

Add the names and paths of subfolders and files to exclude from auditing

Enter a file mask to specify the name and path of subfolders and files to be excluded from auditing. The file mask can contain any combination of the following:

•

Fixed characters such as letters, numbers and other characters that are allowed in file names.

•

Question mark (?) wildcard character to substitute a single character. The ? wildcard character does not match slash (\) characters.

See File/Folder Inclusion and Exclusion Examples for more examples.

You can also enter the name of an individual subfolder or file to be excluded or use one of the browse options to browse for and select an individual subfolder or file.

Click the browse button and select one of the following options:

•

Browse Files - selecting this option displays the Select a file system path dialog allowing you to select an individual file for exclusion.