Chat now with support
Chat with Support

Change Auditor 7.2 - Quick Start Guide

Set up email alert notifications and reporting

To use the alerting and reporting features, first enable SMTP and define the Mail Server to use in the SMTP Configuration pane on the Coordinator Configuration page.

* 
NOTE: The following procedure assumes that SMTP has been configured to receive Change Auditor notifications.
To configure STMP Mail Server for alerting and reporting:
1
Select View | Administration to open the Administration Tasks page.
2
Click Configuration task button at the bottom of the navigation pane (left pane).
3
Select Coordinator in the Configuration task list to open the Coordinator Configuration page.
4
On the SMTP Configuration pane, select the Enable SMTP for Alerts and Reporting check box to enable email notifications.
5
Checking this option activates the remaining fields on this pane to configure email notifications. Enter the following information:
•
Mail Server - enter the name or IP address of the Mail Server
•
From Address - enter or click the browse button to the far right of this field to specify the email address from which email notifications are to originate
•
Reply To (optional) - enter or click the browse button to the far right of this field to specify the email address where replies to email notifications are to be sent (leave blank for this scenario).
•
Subject Line (leave default entry for this scenario)
6
If the specified Mail Server requires authentication, select the My Server Requires Authentication check box and enter the account information.
* 
NOTE: Leave the Exchange Host information blank for this scenario. Providing this additional information allows you to look up user accounts in Exchange and Active Directory.
7
Click Test SMTP to test the Mail Server configuration.
8
After the Mail Server configuration is verified, click Apply Changes to save the configuration.
9
Now that SMTP is enabled and configured, you can enable email alerts for individual search definitions. In addition, you can also enable email reporting for individual searches.

Enable email alerts for 'all events'

Using the Searches page, you can enable and disable alert notifications for individual search definitions and dispatch them via SMTP (email).

To enable email alerting:
1
Click the Searches tab.
2
In the left pane, expand the Shared | Built-in folder and then the All Events folder.
3
In the right pane, locate the All Events search definition, right-click, and select the Alert | Enable Transport | SMTP command.
4
Click Yes to confirm that you want to enable alerting for the selected search.
5
On the Alert Custom Email dialog, enter the email address of the persons who are to receive the alert.
* 
NOTE: To send an alert to the user who initiated the change that triggered the alert, select the Add Who check box at the bottom of the Alert Custom Email dialog.
To later disable the alerts, return to the Searches tab, right-click the All Events search definition and select Alert | Disable Alert. Click Yes to confirm that you want to disable the alert.

Enable and schedule email reporting for 'all events'

Enable and schedule email reporting for ‘all events’

When reporting is enabled, a report containing the search results of an individual search is sent as an attachment via email to the designated recipients.

To enable and schedule reporting:
1
Open the Searches page.
2
In the left pane, expand the Shared | Built-in folder and then the All Events folder.
3
In the right pane, locate and select the All Events search definition.
4
Open the Report tab, select the Send to a mailbox option, enter a valid email address in the To field and then select the Report Enabled check box.
5
Specify the report configuration settings:
•
Layout: Select the report layout template to be used. Leave this set to Default.
•
Report: Specify when the report is to be generated/sent (that is, on a weekly or monthly schedule).
•
Run Time: Specify the time at which the report is to be run.
•
Attach: Select the report format to be used. PDF is the default.
•
Columns: Define how the report content is to fill the page. Leave this set to Fit to Page.
•
Time Zone: Select the time zone to be used for the report’s time stamp in the report email. By default, the time zone of the computer where the client resides is used.
6
Click Save.
To later disable reporting, return to the Searches tab, right-click the All Events search definition and select Report | Disable Report. Click Yes to confirm that you want to disable reporting for the selected search.
To test the alerting and reporting:
1
To test alerting and reporting, undo the Active Directory changes previously made:
•
Open Active Directory Users and Computers and delete the 'Quest Test' OU.
•
Delete the 'Sample GPO' GPO.
•
Remove the user you added to the Domain Admins security group.
•
Open Active Directory Sites and Services and expand the Inter-Site Transport folder, then the IP folder. Double-click the DEFAULTSITELINK and change the replication interval back to its original setting.
2
Wait approximately two minutes for the coordinator to pick up the events and trigger the alert and report to be sent. (This time may be quicker or slower depending on email latency.)

 

Change Auditor for Active Directory

The scenarios presented in this section show you how to use some additional Active Directory auditing features offered in Change Auditor for Active Directory.

•
Audit custom user attributes
•
Audit users based on their group membership
* 
NOTE: Active Directory auditing is only available if you have licensed the Change Auditor for Active Directory auditing module. You will not be prevented from specifying Active Directory auditing; however, associated events will not be captured unless the proper license is applied.

See Change Auditor Product Specific Features for the list of features/functionality dependent on the different product licenses. For more detailed information on Active Directory auditing, see the Change Auditor for Active Directory User Guide.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating