Chat now with support
Chat with Support

Change Auditor 7.1 - Quick Start Guide

Create a File System Auditing template

For this scenario, we will create a template to audit all changes made to the folder you just created.

1
Open the Administration Tasks tab.
2
Click Auditing.
3
Select File System in the Auditing task list to open the File System Auditing page.
4
Click Add to launch the File System Auditing wizard which will step you through the process of creating a File System Auditing template.
5
On the first page of the wizard, enter the following information:
•
Enter a name for the template.
•
Select the Folder option.
•
Enter the name of the folder or click the browse button to select the folder you previously created on the C: drive.
Click Add to add the specified folder to the selection list (middle of the page). This new entry is automatically selected in the list, which enables the following settings/tabs:
•
By default, the scope of coverage for the selected folder will be This Object and All Child Objects. Leave this setting for this scenario; however, if you wanted to change this setting, use the drop-down arrow in the Scope cell.
•
On the Events tab, select the File Events and Folder Events check boxes to track all changes made to the selected folder.
•
Open the Inclusions page, enter * and click Add to add it to the Included Names list. Entering * will audit all files and folders in the selected folder.
•
Skip the Exclusions tab. In this scenario, we will not be excluding any subfolders or files from auditing.
6
(Optional) If you want to define any processes that are to be allowed to change audited objects without generating an event, click Next. Select one or more processes from the list at the top of the page and click Add to add them to the list box at the bottom of the page.
7
To create the template and assign it to an agent configuration, expand the Finish button and select Finish and Assign to Agent Configuration.
8
On the Configuration Setup dialog select the agent configuration (right pane) to which the template is to be assigned and ‘drag and drop’ it onto the newly created template.
The Assigned cell for the template will change to Yes.
9
Click OK to save your selection, close the dialog and display the Agent Configuration page.
10
If this configuration is not assigned to any agents, you will need to assign it to one or more installed agents at this time.
•
On the Agent Configuration page, select one or more agents from the agent list and click the Assign tool bar button.
•
On the Agent Assignment dialog, select the configuration definition to be assigned to the selected agents and click OK.
11
On the Agent Configuration page, select the agents assigned to use the modified agent configuration and click Refresh Configuration. This will ensure the agents use the latest configuration.
* 
NOTE: If you do not refresh the agent’s configuration, the client will automatically check for a new agent configuration based on the polling interval setting (located on the Systems Setting tab of the Configuration Setup dialog). The default is every 15 minutes.

Make file system changes and run a query

1
To test file system auditing, make some changes to the folder specified above, for example:
•
add a .docx file
•
change the security permissions on a file (right-click file, open the Security tab and add another user with full control)
•
delete the sample .txt file
•
add a sub-folder
•
change the security permission of the new folder
2
Go back to the client to review the events generated. You can display them by either:
•
Opening the Agent Statistics tab, locating the agent where these changes were made and clicking the number link in the Events Today column.
•
Opening the Searches tab and running the All File System Events report.
•
Expand the Shared | Built-in | All Events folder in the left pane.
•
Locate and double-click All File System Events in the right pane.

 

Change Auditor for Exchange

Change Auditor for Exchange provides extensive, customizable auditing and reporting for all critical changes to Exchange, including administrative groups, mailbox policies, public and private information store auditing, organizational changes such as ActiveSync mailbox policy changes, distribution list changes and more. The scenarios in this chapter introduce you to Exchange auditing and how to set up Exchange mailbox auditing for your Exchange environment.

•
Getting started
•
Make changes in Exchange and run a query
•
Enable Exchange mailbox auditing
* 
NOTE: Exchange auditing is only available if you have licensed the Change Auditor for Exchange auditing module. You will not be prevented from specifying Exchange auditing; however, associated events will not be captured unless the proper license is applied.

See Change Auditor Product Specific Features for a list of Quest features/functionality dependent on a specific product license. For more detailed information about Exchange auditing, see theChange Auditor for Exchange User Guide.

Getting started

1
Verify that Change Auditor for Exchange is licensed.
2
To view applied licenses, select Help | Licensing from the client.
OR
To view and apply a license, right-click the coordinator icon in the system tray and select Licensing. If required, click Select License to locate and apply the license.
3
Verify that Change Auditor is setup to monitor all users in the domain.
•
Launch the Change Auditor client and open the Administration Tasks tab.
•
Open the Active Directory Auditing page. Verify that the user object class is listed. (This object class is included by default, however, we removed the user object class as part of the 'Auditing Users Based on Their Group Membership' scenario from the Change Auditor for Active Directory Auditing section.)
•
If it is not listed, click Add to add it. Restart the agent to use the latest configuration.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating