Chat now with support
Chat with Support

Change Auditor 7.1.1 - Built-in Reports Reference Guide

Introduction Built-in reports
Active Directory Federation Services AD Query All Events Authentication Services Azure Active Directory Defender Office 365 Logon Activity Skype for Business Recommended Best Practices Regulatory Compliance
FISMA (Federal Information Security Management Act)
NIST SP 800-53 | Technical Controls | Accountability (Including Audit Trails) | A01 – User Association NIST SP 800-53 | Technical Controls | Accountability (Including Audit Trails) | A02 – Content of Audit Records NIST SP 800-53 | Technical Controls | Accountability (Including Audit Trails) | A03 – Auditable Events NIST SP 800-53 | Technical Controls | Accountability (Including Audit Trails) | A04 – Audit Processing NIST SP 800-53 | Technical Controls | Identification and Authentication | IA02 – Remote, Privileged Access Authentication NIST SP 800-53 | Technical Controls | Identification and Authentication | IA03 – Password Protection Mechanisms NIST SP 800-53 | Technical Controls | Identification and Authentication | IA04 – Password Life NIST SP 800-53 | Technical Controls | Identification and Authentication | IA05 – Password Content NIST SP 800-53 | Technical Controls | Identification and Authentication | IA12 – Remote Access Identification Authentication NIST SP 800-53 | Technical Controls | Identification and Authentication | IA16 – Password Management NIST SP 800-53 | Technical Controls | Logical Access Control | AC01 - Remote Access Restrictions NIST SP 800-53 | Technical Controls | Logical Access Control | AC02 - Logon Notification Message NIST SP 800-53 | Technical Controls | Logical Access Control | AC05 - Session Inactivity NIST SP 800-53 | Technical Controls | Logical Access Control | AC06 - Limited Connection Time NIST SP 800-53 | Technical Controls | Logical Access Control | AC09 - Enforcement Mechanisms NIST SP 800-53 | Technical Controls | Logical Access Control | AC10 - Automated Account Controls NIST SP 800-53 | Technical Controls | Logical Access Control | AC12 - Supervision and Review NIST SP 800-53 | Technical Controls | Logical Access Control | AC14 - Authorization Procedures NIST SP 800-53 | Technical Controls | System and Communications Protection | SP02 - Information System Partitioning NIST SP 800-53 | Technical Controls | System and Communications Protection | SP04 - Denial of Service Protection NIST SP 800-53 | Technical Controls | System and Communications Protection | SP05 - Resource Priority NIST SP 800-53 | Technical Controls | System and Communications Protection | SP06 - Boundary Protection NIST SP 800-53 | Technical Controls | System and Communications Protection | SP07 - Network Segregation NIST SP 800-53 | Technical Controls | System and Communications Protection | SP09 - Network Disconnect NIST SP 800-53 | Technical Controls | System and Communications Protection | SP11 - Trust Path NIST SP 800-53 | Technical Controls | System and Communications Protection | SP16 - Use of Encryption
GLBA (Gramm-Leach-Bliley Act) GDPR HIPAA (Health Insurance Portability and Accountability Act) Payment Card Industry SAS 70 (Statement on Auditing Standards, Service Organizations) SOX (Sarbanes-Oxley General IT Controls Evidence based on the COBIT Framework)
Security SharePoint SQL Data Level Threat Detection VMware

Service Admins Group Membership

Membership changed in critical groups in last 7 days
Who = All Users
What = Member Added to Critical Enterprise Group; Member Removed from Critical Enterprise Group
Where = All sources
When = Last 7 days
Origin = All workstations/servers

Domain Controller Changes

Changes in Domain Controller Services
Who = All Users
What = Service Monitoring facility
Where = Domain Controller
When = Last 7 days
Origin = All domain controllers
Changes in Domain Controller System State, Registry and Configuration Files
Who = All Users
What = Custom File System Monitoring facility; Custom Registry Monitoring facility; System Events facility; Service Monitoring facility
Where = Domain Controller
When = Last 7 days
Origin = All domain controllers

Domain-Level Changes

Changes in domain-wide operations master roles
Who = All Users
What = RID FSMO Role Owner Moved; PDC FSMO Role Owner Moved; Infrastructure FSMO Role Owner Moved
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Changes in the GPO assignments
Who = All Users
What = Group Policy Block Inheritance Setting Changed on OU; Group Policy Disabled Setting on Domain Changed; Group Policy Disabled Setting on OU Changed; Group Policy Inheritance Blocked Setting Changed; on Domain; Group Policy Link Added to OU; Group Policy Link Removed from OU; Group Policy Link Settings Modified; Group Policy Linked; Group Policy No Override Setting Changed on Domain; Group Policy Unlinked; Group Policy No Override Setting Changed on OU
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Changes in the linked GPOs
Who = All Users
What = Linked Group Policy on Domain Changed; Linked Group Policy on OU Changed
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Changes in the membership of built-in groups
Who = All Users
What = Member Added to Critical Enterprise Group; Member Removed from Critical Enterprise Group
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Changes in trust
Who = All Users
What = Cross-forest Trust Added; Cross-forest Trust Removed; Trust Added; Trust Removed
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Changes to the audit policy settings
Who = All Users
What = Audit Account Logon Events Policy Changed; Audit Account Management Policy Changed; Audit Directory Service Access Policy Changed; Audit Logon Events Policy Changed; Audit Object Access Policy Changed; Audit Policy Change Policy Changed; Audit Privilege Use Policy Changed; Audit Process Tracking Policy Changed; Audit System Events Policy Changed
Where = All sources
When = Last 7 days
Origin = All workstations/servers

Exchange

Address List Added to the Organization Configuration
Who = All Users
What = Address List Added to Organization Configuration; Address List - Created; Address List - Moved; Address List - Recipient Container; Address List - Updated; Global Address List - Created; Global Address List - Recipient Container; Global Address List - Updated
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All ActiveSync Mailbox Policy Events
Who = All Users
What = ActiveSync Mailbox Policy Added to Organization Client Access Configuration; ActiveSync Mailbox Policy Allow Attachments to be Downloaded Option Changed; ActiveSync Mailbox Policy Allow Non-Provisionable Devices Options Changed; ActiveSync Mailbox Policy Allow Simple Password Option Changed; ActiveSync Mailbox Policy Enable Password Recovery Option Changed; ActiveSync Mailbox Policy Maximum Attachment Size Changed; ActiveSync Mailbox Policy Minimum Password Length Changed; ActiveSync Mailbox Policy Password Expiration Changed; ActiveSync Mailbox Policy Password History Changed; ActiveSync Mailbox Policy Password Required Option Changed; ActiveSync Mailbox Policy Removed from Organization Client Access Configuration; ActiveSync Mailbox Policy Renamed; ActiveSync Mailbox Policy Require Alphanumeric Password Option Changed; ActiveSync Mailbox Policy Require Encryption On Device Option Changed; ActiveSync Mailbox Policy User Idle Timeout Changed; ActiveSync Mailbox Policy Windows File Shares Access Option Changed; ActiveSync Mailbox Policy Windows SharePoint Services Access Option Changed; ActiveSync Mailbox Policy Number of Failed Attempts Allowed Changed; ActiveSync Mailbox Policy Refresh Interval Changed; ActiveSync Mailbox Policy Require Encryption On Device Option Changed; Mobile Device - ActiveSync Device Policy
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All Email Address Policy Events
Who = All Users
What = Email Address Policy Added to Organization Configuration; Email Address Policy Email Address Filter List Changed; Email Address Policy Priority Changed; Email Address Policy Query Filter Changed; Email Address Policy Removed from Organization Configuration; Email Address Policy Renamed; Email Address Policy Storage Filter Changed; Distribution List - Email Address Policy Enabled Changed; Mailbox - Email Address Policy Enabled Changed
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All Exchange Administrative Group Events
Who = All Users
What = Exchange Administrative Group facility
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All Exchange Distribution List (Group) Events
Who = All Users
What = Exchange Distribution List facility
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All Exchange Events in the last 24 hours
Who = All Users
What = Exchange subsystem
Where = All sources
When = Last 24 hours
Origin = All workstations/servers
All Exchange Organization Events
Who = All Users
What = Exchange Organization facility
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All Exchange Permission Tracking Events
Who = All Users
What = Exchange Permission Tracking facility
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All Journaling Rule Change Events
Who = All Users
What = Journaling Rule Added to Organization Configuration; Journaling Rule Changed; Journaling Rule Removed from Organization Configuration; Journaling Rule Renamed
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All Send Connector Change Events
Who = All Users
What = Mutual Auth TLS Option Changed on Send Connector; Send Connector Added to Organization Configuration; Send Connector Protocol Logging Changed; Send Connector Removed from Organization Configuration; Send Connector Renamed; Send Connector Response FQDN Changed; Send Connector Status Changed; Address Space Added to Send Connector; Address Space Removed from Send Connection; External DNS Lookup Option Changed on Send Connector; Send Connector Maximum Message Size Changed; Smart Host Added to Send Connector; Smart Host Authentication Settings Changed on Send Connector; Smart Host Removed from Send Connector; Source Server Added to Send Connector; Source Server Removed from Send Connector
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All Transport Rule Change Events
Who = All Users
What = Transport Rule Added to Organization Configuration; Transport Rule Changed; Transport Rule Priority Changed; Transport Rule Removed from Organization Configuration; Transport Rule Renamed
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All Unified Messaging (UM) Dial Plan Change Events
Who = All Users
What = Allow Announcement Interruption Option Changed in UM Dial Plan; Allow Callers To Send Voice Message Option Changed in UM Dial Plan; Allow Callers to Transfer Option Changed in UM Dial Plan; Allow Faxes Option Changed in UM Dial Plan; Announcement Changed in UM Dial Plan; Audio Codec Changed in UM Dial Plan; Callers Can Contact Address List Changed in UM Dial Plan; Callers Can Contact Auto Attendant Changed in UM Dial Plan; Callers Can Contact Extension Changed in UM Dial Plan; Callers Can Contact Option Changed in UM Dial Plan; Country Code Changed in UM Dial Plan; Default Language Changed in UM Dial Plan; Greeting Changed in UM Dial Plan; In-Country Number Format Changed in UM Dial Plan; In-Country Rule Group Added to UM Dial Plan; In-Country Rule Group Removed From UM Dial Plan; Input Failures Before Disconnect Changed in UM Dial Plan; Input Idle Timeout Changed in UM Dial Plan; Input Retries Changed in UM Dial Plan; International Access Code Changed in UM Dial Plan; International Number Format Changed in UM Dial Plan; International Rule Group Added to UM Dial Plan; International Rule Group Removed from UM Dial Plan; Logon Failure Count Changed in UM Dial Plan; Maximum Call Duration Changed in UM Dial Plan; Maximum Recording Duration Changed in UM Dial Plan; Name Match Option Changed in UM Dial Plan; National Number Prefix Changed in UM Dial Plan; Non-Delivery Report Option Changed in UM Dial Plan; Operator Extension Changed in UM Dial Plan; Outside Line Access Code Changed in UM Dial Plan; Primary Dialing Methods Changed in UM Dial Plan; Prompt Publishing Point Changed for UM Dial Plan; Recording Idle Timeout Changed in UM Dial Plan; Secondary Dialing Method Changed in UM Dial Plan; Subscriber Access Number Added to UM Dial Plan; Subscriber Access Number Removed from UM Dial Plan; UM Dial Plan Added to Organization Configuration; UM Dial Plan Removed from Organization Configuration; UM Dial Plan Renamed; UM Dial Plan - Access Telephone Numbers; UM Dial Plan - Allow Calling Line ID Resolution via Active Directory; UM Dial Plan - Allow Calls to Extensions; UM Dial Plan - Allow Calls to Users Within Same Dial Plan; UM Dial Plan - Allowed In-Country/Region Rule Groups; UM Dial Plan - Allowed International Rule Groups; UM Dial Plan - Audio Codec; UM Dial Plan - Automatic Speech Recognition Enabled/Disabled; UM Dial Plan - Call Answering Rules Enabled/Disabled; UM Dial Plan - Callers Can Contact; UM Dial Plan - Callers Can Contact Address List; UM Dial Plan - Callers Can Contact Auto Attendant; UM Dial Plan - Callers Can Contact Extension; UM Dial Plan - Callers Can Contact Recipient List; UM Dial Plan - Country/Region Code; UM Dial Plan - Created; UM Dial Plan - Default Language; UM Dial Plan - Default Outbound Calling Line ID; UM Dial Plan - Dial By Name Primary Method; UM Dial Plan - Dial By Name Secondary Method; UM Dial Plan - Equivalent Dial Plans; UM Dial Plan - Fax Enabled/Disabled; UM Dial Plan - In-Country/Region Number Format; UM Dial Plan - In-Country/Region Rule Groups; UM Dial Plan - Informational Announcement; UM Dial Plan - Informational Announcement File; UM Dial Plan - Input Failures Before Disconnect; UM Dial Plan - International Access Code; UM Dial Plan - International Number Format; UM Dial Plan - International Rule Groups; UM Dial Plan - Legacy Prompt Publishing Point; UM Dial Plan - Logon Failures Before Disconnect; UM Dial Plan - Matched Name Selection Method; UM Dial Plan - Maximum Call Duration; UM Dial Plan - Maximum Recording Duration; UM Dial Plan - National Number Prefix; UM Dial Plan - Numbering Plan Formats; UM Dial Plan - Operator Extension; UM Dial Plan - Outside Line Access Code; UM Dial Plan - Pilot Numbers; UM Dial Plan - Recording Idle Time-out; UM Dial Plan - Removed; UM Dial Plan - Send Voice Messages Enabled/Disabled; UM Dial Plan - Telephone User Interface Prompt Editing; UM Dial Plan - Transfer to Users Enabled/Disabled; UM Dial Plan - VOIP Security; UM Dial Plan - Welcome Greeting; UM Dial Plan - Welcome Greeting Filename
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All Unified Messaging (UM) Policy Change Events
Who = All Users
What = Allow Calls to Extensions Option Changed in UM Mailbox Policy; Allow Calls to Same-Plan Users Option Changed in UM Mailbox Policy; Allow Common PIN Pattern Option Changed in UM Mailbox Policy; Fax Identity Changed in UM Mailbox Policy; Fax Message Text Changed in UM Mailbox Policy; Incorrect PIN Mailbox Lockout Setting Changed in UM Mailbox Policy; Incorrect PIN Reset Setting Changed in UM Mailbox Policy; In-Country Rule Group Added to UM Mailbox Policy; In-Country Rule Group Removed From UM Mailbox Policy; International Rule Group Added to UM Mailbox Policy; International Rule Group Removed from UM Mailbox Policy; Mailbox Enabled Text Changed in UM Mailbox Policy; Maximum Greeting Duration Changed in UM Mailbox Policy; Maximum Greeting Duration Enabled Option Changed in UM Mailbox Policy; Minimum PIN Length Changed in UM Mailbox Policy; PIN History Length Changed in UM Mailbox Policy; PIN Lifetime Changed in UM Mailbox Policy; PIN Reset Text Changed in UM Mailbox Policy; UM Mailbox Policy Added to Organization Configuration; UM Mailbox Policy Removed from Organization Configuration; UM Mailbox Policy Renamed; Voice Message Text Changed in UM Mailbox Policy
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Deleted Items Retention Period Changed for a user
Who = All Users
What = Deleted Item Retention Period Changed; Deleted Item Retention Use Defaults Storage Option Changed; Mailbox - End Date Retention Hold; Mailbox - Retention Hold Enabled; Mailbox - Retention Policy; Mailbox - Start Date for Retention Hold; Mailbox - Use Database Retention Defaults
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Exchange Database Location Changed for Mailbox Store
Who = All Users
What = Exchange Database Location Changed for Mailbox Store
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Exchange Database Location Changed for Public Store
Who = All Users
What = Exchange Database Location Changed for Public Store
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Mail Enabled for Group
Who = All Users
What = Mail Enabled for Group (Exchange 2003); Distribution List - Created; Distribution List - Enabled
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Mailbox Store Dismounted
Who = All Users
What = Mailbox Store Dismounted
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Mailbox Store Mounted
Who = All Users
What = Mailbox Store Mounted
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Message Tracking Options Changed on an Exchange 2007 Server
Who = All Users
What = Message Tracking Option Changed on Server
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Outlook Anywhere Enabled or Disabled for a Server
Who = All Users
What = Outlook Anywhere Disabled for Server; Outlook Anywhere Enabled for Server
Where = All sources
When = Last 7 days
Origin = All workstations/servers
OWA Website Added to Server
Who = All Users
What = OWA Web Site Added to Server; OWA Web Site - Created
Where = All sources
When = Last 7 days
Origin = All workstations/servers
OWA Website Removed from the Server
Who = All Users
What = OWA Web Site Removed from Server; OWA Web Site - Removed
Where = All sources
When = Last 7 days
Origin = All workstations/servers
OWA Website Renamed
Who = All Users
What = OWA Web Site Renamed on Server
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Public Folder Created
Who = All Users
What = Public Folder Store Created in Server Storage Group
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Public Folder Removed
Who = All Users
What = Public Folder Store Removed from Server Storage Group
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Public Folder Renamed
Who = All Users
What = Public Folder Store Renamed in Server Storage Group
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Public Store Dismounted
Who = All Users
What = Public Store Dismounted
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Public Store Mounted
Who = All Users
What = Public Store Mounted
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Storage Group Added to Exchange Server
Who = All Users
What = Storage Group Added to Exchange Server
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Storage Group Removed from Exchange Server
Who = All Users
What = Storage Group Removed from Exchange Server
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Storage Group Renamed in Exchange Server
Who = All Users
What = Storage Group Renamed in Exchange Server
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating