Submitting forms on the support site are temporary unavailable for schedule maintenance. If you need immediate assistance please contact technical support. We apologize for the inconvenience.
Get Live Help
You have selected a product bundle. Can you please select the individual product for us to better serve your request.*
There is not a technical support engineer currently available to respond to your chat. For prompt service please submit a request using our service request form.
The following articles may solve your issue based on your description.
The following tables contain indicators (and the alert that they are associated with) available for each Change Auditor subsystem:
Abnormal File Access Time
A user accessed a file at an abnormal time.
Abnormal File Access Permission Change
Mass Permission Changes
A user changed multiple share permissions.
Abnormal File Access Event
Abnormal File Access
A user accessed a file abnormally.
Multiple File Access Permission Changes
A user changed multiple file share permissions.
Multiple File Access Events
A user accessed multiple file share permissions.
Multiple Failed File Access Permission Changes
A user failed multiple times to change file access permissions.
Multiple Failed File Access Events
A user failed multiple times to access a file.
Multiple File Open Events
A user opened multiple files.
Multiple Folder Open Events
A user opened multiple folders.
Multiple File Delete Events
A user deleted multiple files.
Multiple File Rename Events
Mass File Rename
A user renamed multiple files.
Excessive Number of Files Moved from File System
A user moved multiple files from a shared drive.
Excessive Number of Files Moved to File System
A user moved multiple files to a shared drive.
Abnormal Active Directory Change Time
A user made Active Directory changes at an abnormal time.
Abnormal Active Directory Change
Abnormal AD Changes
A user made an abnormal change to AD attribute.
Abnormal Site Access
A user logged on from a computer in an abnormal site.
Multiple Member Additions to Enterprise Critical Groups
See the list of groups in the Change Auditor for Active Directory Event Reference Guide for "Member Added to Critical Enterprise Group”.
Mass Changes to Critical Enterprise Groups
A user successfully made multiple changes to sensitive groups.
Multiple Group Membership Changes
Mass Changes to Groups
A user successfully made multiple changes to groups.
Multiple Account Management Changes
A user successfully made multiple Active Directory changes.
Multiple User Account Management Changes
A user successfully made multiple sensitive Active Directory changes.
Multiple Failed Account Management Changes
A user failed to make multiple Active Directory changes.
Admin Password Changed
Admin Password Change
An admin's password was changed.
User Account Enabled
Sensitive User Status Changes
A user enabled another user account.
User Account Disabled
A user disabled another user account.
User Account Unlocked
A user unlocked another user account.
User Account Type Changed
A user account type was changed by another user account.
User Account Locked
A user locked another user account.
User Password Never Expires Option Changed
A user password policy was changed by another user account.
User Password Changed by Non-Owner
A user's password was changed by non-owner.
User Password Changed
A user changed the password for another user account.
Member Added to Critical Enterprise Group
Elevated Privileges Granted
A user was added to a privileged group.
Abnormal Logon Time
A user logged on at an abnormal time.
Abnormal Remote Computer
User Login to Abnormal Remote Host
A user attempted to remotely access an abnormal computer.
User Login to Abnormal Host
A user attempted to access an abnormal computer.
Multiple Successful Authentications
Multiple Logons by User
A user logged on multiple times.
Multiple Failed Authentications
Multiple Failed Logons
A user failed to log on multiple times.
Logged into Multiple Domains
User Logins to Multiple AD Sites
A user attempted to log on to multiple domains.
Logged onto Multiple Computers
User Logged into Multiple Hosts
A user attempted to log on from multiple computers.
You can find online support help for Quest *product* on an affiliate support site. Click continue to be directed to the correct support content and assistance for *product*.
The document was helpful.
I easily found the information I needed.
© 2023 Quest Software Inc. ALL RIGHTS RESERVED.
The Quest Software Portal no longer supports IE8, 9, & 10 and it is recommended to upgrade your browser to the latest version of Internet Explorer or Chrome.
Upgrade to IE 11 Click here
Upgrade to Chrome Click here
If you continue in IE8, 9, or 10 you will not be able to take full advantage of all our great self service features.