Change Auditor 7.5 - User Guide

Getting started

Getting started

NOTE: Windows File Server auditing is only available if you have licensed Change Auditor for Windows File Servers. If you do not have a valid license you can use the features, however, associated events are not captured. To verify that it is licensed, right-click the coordinator icon in the system tray and select Licensing.

1	Create a new folder on the C: drive of an agented server and then add a new .txt file in this folder. This folder will be used in the following scenarios as an auditing target.

2	To capture events, you must define the files and folders to audit and the operations to capture:

▪	Create a File System Auditing template which specifies the files/folders and operations to be audited.

▪	Add this template to an agent configuration.

▪	Assign the agent configuration to agents.

Create File System Auditing template

Create File System Auditing template

For this scenario, we will create a template to audit all changes made to the folder you just created.

1	Select Start | All Programs | Quest | Change Auditor | Change Auditor Client.

2	Select View | Administration.

3	Click Auditing.

4	Select File System in the Auditing task list to open the File System Auditing page.

5	Click Add to start the File System Auditing wizard which steps you through the process of creating a File System Auditing template.

6	On the first page of the wizard, enter the following information:

▪	Template Name - Enter a name for the template.

▪	Audit Path - Select the Folder option. Enter the name of the folder previously created (i.e., Drive:\Folder\) or click the browse button to select the folder.

▪	By default, the scope of coverage for the selected folder will be This Object and All Child Objects. Leave this setting for this scenario; however, if you wanted to change this setting, use the drop-down arrow in the scope cell.

▪	Events tab - Select both the File Events and Folder Events check boxes (in the header) to track all changes made to the selected folder.

▪	Inclusions tab - Click on the Inclusions tab, enter * and click Add to add it to the Included Names list. Entering * will audit all files and folders in the selected folder.

Use the following characters to specify a file mask on the Inclusions tab:

▫	Fixed characters such as letters, numbers and other characters that are allowed in file names

▫	An asterisk (*) wildcard character to substitute zero or more characters

▫	Question Mark (?) wildcard character to substitute a single character

NOTE: For file system auditing, the slash characters (\) and double asterisks (**) are not allowed in file masks; therefore to include a specific folder (or share), use the Audit Path field at the top of the page to specify the folder (or share) to audit and enter an * on the Inclusions tab.

▪	Exclusions tab - Skip the Exclusions tab. (In this scenario, we will not be excluding any subfolders or files from auditing. For more information on using the Exclusions tab, see File System Auditing.)

7	To define any processes that can change audited objects without generating an event, click Next.

On the second page of the wizard, optionally select one or more processes from the list at the top of the page and click Add to add them to the list box at the bottom of the page.

8	To create the template and assign it to an agent configuration, expand Finish and select Finish and Assign to Agent Configuration.

9	On the Configuration Setup dialog select the agent configuration (right pane) to which the template is to be assigned and ‘drag and drop’ it onto the newly created template.

The Assigned cell for the template will change to ‘Yes’.

10	Click OK to save your selection, close the dialog and display the Agents Configuration page.

11	If this configuration is not assigned to any agents, you will need to assign it to one or more installed agents at this time.

▪	On the Agent Configuration page, select one or more agents from the agent list and click Assign.

▪	On the Agent Assignment dialog, select the configuration definition to be assigned to the selected agents and click OK.

12	On the Agents Configuration page, select the agents assigned to use the modified agent configuration and click Refresh Configuration to ensure the agents are using the latest configuration.

Make File System changes and run a report

Make File System changes and run a report

NOTE: If you do not refresh the agent’s configuration, the agent will automatically check for a new agent configuration based on the polling interval setting (located on the System Settings tab of the Configuration Setup dialog). The default is every 15 minutes.

1	To test file system auditing, make some changes to the Windows® file server being monitored.

For example:

▪	add a .docx or .txt file

▪	change the security permissions on a file (right-click file, open the Security tab and add another user with full control)

▪	delete the .txt file

▪	add a subfolder

▪	change the security permission of the new folder

▪	rename the subfolder

2	Select Start | All Programs | Quest | Change Auditor | Change Auditor Client) to review the events generated.

3	Open the Searches tab.

4	Expand the Shared | Built-in | All Events folder in the left pane.

5	Locate and double-click All File System Events in the right pane.

A new Search Results tab is added to the client displaying the Custom File System Monitoring events captured over the last seven days.

6	Select an event from the Search Results grid to display the event details for the selected event.

Troubleshooting steps

Troubleshooting steps

NOTE: If the Search Properties tabs are displayed across the bottom of the Search Results page, double-click an event to display the event details for the selected event.

If the Windows file server events do not appear as expected, check the following:

•	Verify that the File System Auditing template is assigned to the agent configuration for your agents.

•	Refresh the specified agent configurations on the Agent Configuration page to ensure the latest File System Auditing template is being used.

•	Verify that you have selected those types of events in the File System Auditing template. (Events tab in the wizard.)

•	Verify that you have included the correct subfolders and files in the File System Auditing template. (Inclusions tab in the wizard.)

NOTE: Entering * will include all subfolders and paths.

•	Verify that you have not excluded the specified subfolders or files in the File System Auditing template. (Exclusions tab in the wizard.)

•	Verify that you have not excluded the process making the file changes in the File System Auditing template. (Last page in the wizard.)