Chat now with support
Chat with Support

Change Auditor 7.0.3 - User Guide

Change Auditor Overview Agent Deployment Change Auditor Client Overview Overview Page Searches Search Results and Event Details Custom Searches and Search Properties Enable Alert Notifications Administration Tasks Agent Configurations Coordinator Configuration Purging and Archiving your Change Auditor Database Disable Private Alerts and Reports Generate and Schedule Reports SQL Reporting Services Configuration Change Auditor User Interface Authorization Client Authentication Integrating with On Demand Audit Enable/Disable Event Auditing Account Exclusion Registry Auditing Service Auditing Agent Statistics and Logs Coordinator Statistics and Logs Change Auditor Commands Change Auditor Email Tags

Introduction

Windows services are the backbone of applications and require frequent administrator actions. Changes can be simple, such as changing a startup type or service account password. But, even the simple changes can cause major issues. In fact, in this case it would render an application useless to its users. Change Auditor provides service auditing capabilities, including the ability to track who starts and stops a service.

To capture service events, you must first define the services to audit:

Services Auditing page

The Services Auditing page is displayed when Services is selected from the Auditing task list in the navigation pane of the Administration Tasks tab. From this page, you can start the Service Auditing wizard to define the system services to include in the auditing template. You can also edit existing templates, disable and enable templates and remove templates that are no longer being used.

The Service Auditing page contains an expandable view of all the Service Auditing templates that have been previously defined. To add a new template to this list, use the Add tool bar button. Once added, the following information is provided for each template:

Indicates whether the template is enabled or disabled. To enable and disable the template, place your cursor in this Status cell, click the arrow control, and select the appropriate option from the drop-down menu.

When individual services have been included in a Service Auditing template, click the expansion box to the left of the Template name to expand this view and display the following details:

Indicates whether auditing of the service is enabled or disabled. To enable and disable the auditing of the service, place your cursor in this Status cell, click the arrow control, and select the appropriate option from the drop-down menu.

Service Auditing templates

To enable service auditing, create a Service Auditing template which to specify the system services to audit or to exclude from auditing. You can then assign this template to an agent configuration, which then needs to be assigned to the appropriate Change Auditor agents.

2
Select Services (under the Server heading in the Auditing task list) to open the Services Auditing page.
3
Click Add to start the Service Auditing wizard which allows you to define the system services to be included in the template.
6
If you selected either the Audit ALL services except the following or the Audit ONLY the following services option, the data grid is activated allowing you to select the services to be included or excluded depending on the option selected.
From the services listed, select one or more services and click Add to move them to the list box. Or you can use Add All to move all the services.
Clicking the browse button displays the Select a Directory Object dialog, where you can use either the Browse or Search pages to locate and select a different server. After selecting the server, click Select to close the dialog and display the services found on the selected server.
Clicking Finish creates the template, close the wizard and return to the Services Auditing page, where the newly created template is listed.
9
To create the template and assign it to an agent configuration, expand Finish and click Finish and Assign to Agent Configuration.This displays the Configuration Setup dialog allowing you to select the agent configuration to which this template is to be assigned.
10
On the Agent Configuration page, select the agents assigned to use the modified agent configuration and click Refresh Configuration to ensure that the agents are using the latest configuration.
2
Click Finish or expand Finish and click Finish and Assign to Agent Configuration.

Disabling allows you to temporarily stop auditing the specified service without having to remove the auditing template or individual service from an active template.

1
On the Auditing page, place your cursor in the Status cell for the required template, click the arrow control, and select Disabled.
The entry in the Status column for the template changes to ‘Disabled’.
2
To re-enable the auditing template, use the Enable option in either the Status cell or right-click menu.
1
On the Services Auditing page, place your cursor in the Status cell for the required service, click the arrow control, and select Disabled
The entry in the Status column for the service changes to ‘Disabled’.
2
To re-enable the auditing of a service, use the Enable option in either the Status cell or right-click menu.

Service Auditing wizard

The Service Auditing wizard is displayed when you click Add on the Services Auditing page. Using this wizard you can define the system services to be included in the template.

The following table provides a description of the fields and controls in the Service Auditing wizard.

Use this page to enter a name for the template and select the services that are to be audited.

Template Name

Enter a descriptive name for the Service Auditing template being created.

Inclusion/Exclusion options

Select one of the following options to define whether this template is to include or exclude system services for auditing:

Service data grid

If you selected either the Audit ALL services except the following or the Audit ONLY the following services option, the data grid will be activated allowing you to select the services to be included or excluded depending on the option selected.

Select the services to be included in the template and click Add to add them to the list box at the bottom of the dialog.

You are viewing services on

Displays the name of the server from which the service data grid was populated.

Use the browse button to the right of this field to select a different server. The services found on the selected server will then be displayed.

Services list

The list box located across the bottom of the page displays the individual services to be included in the Services Auditing template. Use the buttons above this list box to add or remove services.

Add - Use the Add button to add the service(s) selected in the Services data grid to the list.
Add All - Use the Add All button to add all of the services listed in the Service data grid to the list.
Remove - Select a service entry in the list and click the Remove button to remove it from the template (move it back into the Services data grid).

 

Related Documents