Chat now with support
Chat with Support

Change Auditor 7.3 - Web Client User Guide

Install Change Auditor Web Client Web Client Overview Overview Page Shared Overviews Administration Page Searches Page Search Results Page Administration Tasks Page Configuration Tasks (Administration Tasks Page) Auditing Tasks (Administration Tasks Page) Protection Tasks (Administration Tasks Page) Change Auditor Client Comparison

Search results grid

The search results grid displays a default set of data, which can be customized by using the controls in the column headings. As on other web client pages, you can modify the sort criteria and filter the contents to be displayed (see Customize table content). In addition, the search results grid allows you to group the results by column heading in order to create an expandable view of the events.

Group data on search results grid

The grouping feature allows you to group data to create a collapsed view that can be expanded to view the individual events pertaining to that group.

To group data:
1
Click and hold on a column heading (the column heading will pop off the table) and drag it to the space above the grid. For example, use the left mouse button to click the Subsystem heading and drag that column heading to the space above the table.
2
Optionally, repeat this step to select additional headings to create a hierarchy of groupings.
This will collapse the table and display the groupings that can be expanded to view the detailed information that applies to that group.
3
To expand a group and display the individual events listed, click on the expand properties button (right arrow) to the left of the label. Click the arrow again to collapse an expanded group.
4
To remove a grouping, select the heading and drag it back down into the table area or click the X on the group heading button.
* 
NOTE: Selecting the F5 key to refresh your screen resets the data grid back to the grouping defined in the search’s Layout tab, removing any groupings that have been applied.

Event Details pane

The Event Details pane provides additional details about the event selected in the grid at the top of the Search Results page. The contents of this pane depends on the type of event selected. However, all events display the following details:

 
Table 15. Event Details pane
Field
Description

Severity

Displays the severity level assigned to the event.

Who

Specifies the name of the user who initiated the change. If available, the display name of the user account is also displayed in parenthesis.

When

Specifies the date and time when the change occurred.

Where

Displays the name of the server where the change occurred.

Source

Displays the source of the event:

•
Change Auditor
•
ActiveRoles Server
•
GPOADmin
NOTE: When the event is generated from Active Roles Server or GPOADmin, the name of the user account that initiated the event is displayed in parenthesis.

Origin

If available, displays the NetBIOS name and IP address of the workstation or server from which the event was generated.

NOTE: When the browser is running on the IIS server and a change is made on the Administration Tasks page of the web client, the Origin is reported as ::1 (::1). This is expected because the IIS server variable value is ::1.

What

Displays a brief description of the change that occurred. There are three basic types of events generated that determine the ‘what’ information displayed:

•
Occurrence events (e.g., an object is created or deleted)
•
Change events
•
Delta events (e.g. DACL/SACL changes)

Depending on the type of event, additional details may be displayed on this pane. See the Quest Change Auditor User Guide for a description of the additional fields that may be displayed.

Result

Indicates whether the operation mentioned in the event was successfully completed. Valid states are:

•
Success (Green): Indicates that the operation occurred as stated in the event.
•
Protected (Yellow): Indicates that the operation did not occur because the object is being protected by the Change Auditor object locking feature.
•
Failed (Red): Indicates that the operation did not occur due to a factor/setting outside of Change Auditor’s control.
•
None (Gray): Indicates that the operation occurred as stated, but no results were captured for the event. Note that this state is used for most of the internal Change Auditor events.

Subsystem

Defines the subsystem, or area of monitoring, where the event occurred (e.g., Active Directory, Service, Group Policy, etc.)

Action

Defines the action associated with the selected event.

Facility

Displays the event class facility to which the event belongs.

Coordinator ID

The coordinator that processed the event.

To view the event details for an event:
1
Select an event from the Search Results grid to display the Event Details pane across the bottom of the page.
* 
NOTE: Using a mobile browser, the Event Details pane is opened in a new window.
2
To email the selected event’s details, click Email.
This will create a new email containing a link to the Event Details pane. Enter the recipient’s email address and edit the subject line if desired. Click Send.
3
To view the event reference guide associated with the selected event, click Knowledge Base.
4
To view or add comments to the selected event, click Comments.
In the New Comments text box at the bottom of the dialog, enter the comments to be associated with the selected event then click Save. All previously saved comments appear listed in the comments text box at the top of the dialog.
5
To disable an event, click Disable.
6
To run a related search, expand the Related Search button and select the appropriate option:
•
Who: Select this option to run a query for all events generated by this user during the same date interval as that specified in the When tab of the selected event.
•
View Contact Card: For events with a user object, select this option to view the contact card for the user, which includes contact information as well as a list of the groups to which this user belongs.
•
Where: Select this option to run a query for all events captured by this agent during the same date interval as that specified in the When tab of the selected event.
•
View Resources: Select this option to display the Resources Details pane for this server, which includes: Machine Info, Processors, Drives, Shares, Services and Exchange Mailboxes.
See the Quest Change Auditor User Guide for more information about the information displayed on this pane.
•
What: Select this option to run a query for events captured for this event class during the same date interval as that specified in the When tab of the selected event.
•
When: Select this option to run a query for events that occurred on this date.
•
Origin: Select this option to run a query for events that originated from this workstation or server during the same date interval as that specified in the When tab of the selected event.
•
Object: Select this option to run a query for events generated against this object during the same date interval as that specified in the When tab of the selected event.
* 
NOTE: This last option is the ‘object’ from the original event, such as a file or folder, a directory object, registry key, etc..
7
To restore a changed value to the previous value on a simple Active Directory object event, click the Restore Value button. If prompted for credentials, enter the credentials for a user with domain rights to access the selected object. (This button only appears for simple Active Directory object events, such as Add Attribute, Modify Attribute, Delete Attribute.)
* 
NOTE: To collapse and hide the Event Details pane, click the down arrow in the divider bar between the Search Results grid and Event Details pane. To expand a collapsed Event Details pane, click the up arrow in the divider bar at the bottom of the screen.

Timeline view

The Timeline view contains event markers within an interactive timeline. The top band of the timeline contains event markers that correspond to the events returned as a result of a search. The bottom bands provide a zoomed out overview of the event markers displayed on the top band. The distribution and display of these event markers are predefined; however, these settings can be modified to meet your needs.

The Timeline view consists of the following main controls:

•
Event markers
•
Navigation Control panel

Use the tool bar buttons at the top of the page to return to the Data Grid view or close the Search Results page.

 
Table 16. Timeline view: Tool bar buttons
Tool bar button
Description

Grid

Click to display the search results in a Data Grid view instead of the Timeline view.

Close

Click to close the Search Results page.

Event markers

Event markers representing an individual event or a group of events are plotted on the timeline based on when the event actually occurred. The events associated with an event marker are controlled by the settings in the Timeline Display Settings dialog.

Each event marker contains the following components:

•
Severity icon: For individual events, the colored icon represents the severity assigned to the event: red (high), yellow (medium) or green (low). For a group of events, this icon is gray.
•
Event Marker label: The label attached to each event marker is determined by the group settings and date/time of an event. For an individual event, the label is the actual event class; whereas, the label for a group of events is the name of the agent where the events occurred followed by the number of events included in the group.
Event maker labels are displayed by default; however, you can clear the Show event label check box on the Timeline Display Settings dialog to hide all labels.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating