Chat now with support
Chat with Support

Change Auditor 7.4 - Web Client User Guide

Install Change Auditor Web Client Web Client Overview Overview Page Shared Overviews Administration Page Searches Page Search Results Page Administration Tasks Page Configuration Tasks (Administration Tasks Page) Auditing Tasks (Administration Tasks Page) Protection Tasks (Administration Tasks Page) Change Auditor Client Comparison

Introduction

Protection enables administrators to lock down critical objects and attributes to prevent accidental or unauthorized creations, modifications, deletions, and access. This allows you to protect the environment from harmful changes that could open security holes or cause resources to become unavailable.

The protection task list is divided into the following separate task lists:

•
Forest
•
Active Directory object protection
•
ADAM (AD LDS) object protection
•
Group Policy object protection
•
Application
•
Exchange Mailbox protection
•
Server
•
File System protection
* 
NOTE: Authorization to use the administration tasks on the Administrations Tasks tab is defined using the Application User Interface page under the Configuration task list. If you are denied access to the tasks on any of these pages, see Application User Interface Authorization page for information.

Forest

With Change Auditor for Active Directory, you can protect any Active Directory, Group Policy, or ADAM (AD LDS) objects that you consider critical. Examples of such objects may include Organizational Units, Group Policy Objects, and service accounts.

* 
NOTE: For more information, including recommendations and full descriptions of the following protection pages, see the Quest Change Auditor for Active Directory User Guide.

See the following administration task descriptions for more information:

•
Active Directory object protection
•
ADAM (AD LDS) object protection
•
Group Policy object protection

Active Directory object protection

When configured, Change Auditor prevents changes from occurring to a protected object regardless of who attempts to change the object and the tool or method used. Attempts to change or delete a protected object fail and an event is generated. These ‘failed’ events are identified by displaying ‘Protected’ in the Result column on the Search Results page and Result field in an event’s detail pane.

* 
NOTE: See the Quest Change Auditor User Guide for information about defining the events to capture based on result.
Active Directory Protection page

The Active Directory Protection page is displayed when Active Directory is selected from the Protection task list in the navigation pane of the Administration Tasks page, and contains an expandable view of all the Active Directory Protection templates that have been previously defined. From this page, you can open the Active Directory Protection wizard to define critical Active Directory objects to protect from unauthorized modifications. You can also edit existing templates, disable and enable templates, and remove templates that are no longer required.

The Active Directory protection templates defined on the Active Directory Protection page are global settings and apply to all agents.

* 
NOTE: If you are planning to use multiple Active Directory Protection templates, see the Quest Change Auditor Technical Insight Guide for more information about how multiple protection templates are evaluated.
To create an Active Directory Protection template:
1
Open the Administration Tasks page.
2
Click Protection.
3
Select Active Directory in the Protection task list to open the Active Directory Protection page.
4
Click Add to open the Active Directory Protection wizard which allows you to specify the Active Directory objects to be protected.
 
Table 45. Active Directory Protection wizard
Page
Description
Procedure

Welcome

Name your template.
1
Enter a name for the template.
2
Click Next.

Object Selection

Use the Browse or Search page to locate and select the directory objects to protect.

See Directory object picker for a detailed description of this wizard page.
1
From the Browse or Search page, select an object and click Add to add it to the selection list at the bottom of the page.
2
To change the default operations, click the entry in the Operations cell and select or clear operations.
3
To change the default scope, click the entry in the Scope cell and select a different scope.
4
Click Next.
NOTE: Clicking Finish saves the template and closes the wizard.

Attribute Protection

(Optional) Specify the attributes to include and exclude.

By default, all attributes for the selected objects are protected.
1
To protect individual attributes instead of all attributes, select one of the following options:
•
Only Selected
•
All EXCEPT Selected
2
From the attribute list on the left, select the individual attributes to included and click Add to move them to the Selected Attributes list on the right.
3
Click Next.
NOTE: Clicking Finish saves the template and closes the wizard.

Schedule when protection is enabled

(Optional) Schedule when the protection is enforced. You can either select to have the protection always run or have it run only during specific times. The times selected are the local agent time where the template is applied.

NOTE: If you have denied specific users or groups the ability to change the protected objects and you have enabled a protection schedule, those users or groups are denied access only during this time. Anytime outside of when the schedule is set to enabled, these denied accounts can access the protected object.

When the schedule is disabled, all options are disabled with it, including any denied access to the specified users.

The scheduling options override all other protection settings.
1
To enable the protection only during specific times, select the Protection is scheduled option, and define when it should be enabled (hour blocks on a weekly basis).
2
Click Next.

Enable or disable protection for specific location

(Optional) Control when the protection is enabled based on the location.

Location refers to the computer that is attempting to access the resource that is protected.

NOTE: If you have denied specific users or groups access to protected objects, but you have specified locations that an access the protected object, the denied user or group can access the protected objects from these locations.

The location options override all other protection settings.
1
Select from the following options:
•
Protect access from all locations: Protection is always enabled regardless of the location.
•
Protect access only from select locations: Protection is only enabled for the locations specified in the list box.
•
Allow access only from select locations: Protection is disabled for the select locations. Enabled everywhere else.
•
Protect access from all unknown locations: All file system requests from locations that cannot be determined by the agent will be protected.
2
Click Next.

Account Access

(Optional) Specify the accounts that are allowed to change the protected objects.

By default all users and groups are prevented from changing the Active Directory objects selected for protection.
1
Select whether to Allow or Deny access for the selected users or groups. Keep in mind that by selecting Deny, you are allowing all users to change the protected object EXCEPT for those selected on this page.
2
From the Browse or Search page, select an object and click Add to add it to the selection list at the bottom of the page.
3
Click Next.
NOTE: Clicking Finish saves the template and closes the wizard.

Template Management

(Optional) Specify individual users or groups who are authorized to manage this protection template.

NOTE: This page only appears when your Active Directory and Group Policy protection templates are stored in SQL, which is the default location for storing these templates.
IMPORTANT: Edits made on this page impact template access rights. For more information about this protection feature, see the Quest Change Auditor User Guide.
1
From the Browse or Search page, select an account and click Add to add it to the selection list at the bottom of the page.
2
Click Finish to save the protection template and close the wizard.
IMPORTANT: If the current user who is creating the protection template is not in the authorized accounts list, a warning message is displayed prompting the user to continue or stop with the creation of the protection template.

If you are in the authorized accounts list at template creation time, you may be locked out later if someone else in the authorized accounts list edits the template and removes you.

ADAM (AD LDS) object protection

When configured, Change Auditor for Active Directory prevents changes to objects in specified ADAM (AD LDS) instances.

ADAM (AD LDS) Protection page

The ADAM (AD LDS) Protection page is displayed when ADAM (AD LDS) is selected from the Protection task list in the navigation pane of the Administration Tasks page, and contains an expandable view of all the ADAM (AD LDS) Protection templates that have been previously defined. From this page, you can open the ADAM (AD LDS) Protection wizard to define critical objects to protect from unauthorized modifications. You can also edit existing templates, disable and enable templates, and remove templates that are no longer required.

The ADAM (AD LDS) protection templates defined on this page are global settings and apply to all ADAM instances associated with a Change Auditor agent.

* 
NOTE: If you are planning to use multiple ADAM (AD LDS) Protection templates, see the Quest Change Auditor Technical Insight Guide for more information about how multiple protection templates are evaluated.
To create an ADAM (AD LDS) Protection template:
1
Open the Administration Tasks page.
2
Click Protection.
3
Select ADAM (AD LDS) in the Protection task list to open the ADAM (AD LDS) Protection page.
4
Click Add to open the ADAM (AD LDS) Protection wizard which allows you to specify the objects to be protected.
 
Table 46. ADAM (AD LDS) Protection wizard
Page
Description
Procedure

ADAM (AD LDS) Instance

Select the ADAM (AD LDS) instance from which to choose protected objects.

The list displays the ADAM (AD LDS) instances discovered in your environment. Only instances running on computers with a Change Auditor agent installed are available.
1
Select the ADAM (AD LDS) instance from which to choose protected objects.
2
Enter the credentials for a Windows or ADAM/AD LDS account that can access the instance.
3
Click Test to verify the credentials and enable the Next button. If the credentials were incorrect, an error message is displayed.
4
Click Next.
NOTE: If you have multiple ADAM (AD LDS) instances with replicating application partitions, there is no need to configure an auditing template for each instance. Change Auditor sends the auditing configuration to each computer that is hosting an instance. You must have an agent installed on each instance host

Welcome

Name your template.
1
Enter a name for the template.
2
Click Next.

Object Selection

Use the Browse or Search page to locate and select the objects to protect.

See Directory object picker for a detailed description of this wizard page.
1
From the Browse or Search page, select an object to protect and click Add.
2
To change the default operations, click the entry in the Operations cell and select or clear operations.
3
To change the default scope, click the entry in the Scope cell and select a different scope.
4
Click Next.
NOTE: Clicking Finish saves the template and closes the wizard.

Attribute Protection

(Optional) Specify the attributes to include and exclude.

By default, all attributes for the selected objects are protected.
1
To protect individual attributes, select one of the following options:
•
Only Selected
•
All EXCEPT Selected
2
From the attribute list on the left, select the individual attributes to include and click Add to move them to the Selected Attributes list on the right.
3
Click Next.
NOTE: Clicking Finish saves the template and closes the wizard.

Account Access

(Optional) Specify the accounts that are allowed to change the protected objects.

By default, all users and groups are prevented from changing the objects selected for protection.
1
Select whether to Allow or Deny access for the selected users or groups. Keep in mind that by selecting Deny, you are allowing all users to change the protected object except for those selected on this page.
2
From the Browse or Search page, select an object and click Add to add it to the selection list at the bottom of the page.
3
Click Finish to save the template and close the wizard.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating