Change Auditor 7.5 - User Guide

Add Logons dialog (Add With Events)

Add Logons dialog (Add With Events)

The Add Logons dialog appears when Add With Events | Subsystem | Logons is selected on the What search properties tab (Searches page or the Purge Options page in the Purge Job wizard). This dialog allows you to search for logon activity events based on the logon types that have an event associated with it in the Change Auditor database and by the failure reason or status code.

Use the Add, Remove, and Update buttons to adjust the filter parameters as required. Once you have made your selections, use the OK button to save your selection and close the dialog.

The following information and controls are included in this dialog:

Logon Failure Reason

Select this option and the comparison operator to use (Like or Not Like) to filter based on the failure reason. Use the wildcard character * for a partial search.

Logon Status Code

Select this option and the comparison operator to use (Equals or Does not equal) to filter based on the status code.

Parameter list

The list at the bottom of the dialog displays the filters selected for inclusion (or exclusion when the Exclude the Above Selection(s) check box is checked) in the search definition. Use the buttons located above this list box to add, remove, or update the filters:

▪	Add: Use to add filter parameters.

▪	Remove: Use to remove filter parameters.

▪	Update: Use to change filter parameters.

Exclude the Above Selection(s)

Select this check box to exclude the filter listed in the Parameter list from the search query. That is, Change Auditor will search for all logon activity events except for those associated with the filter listed.

Runtime Prompt

Select the Runtime Prompt option to prompt for the logon type whenever the search is run. That is, when the Run tool bar button is clicked, the Add Logons dialog appears allowing you to select the logon type(s) to be included in the search. This option is not available when this dialog is launched from the Purge Job wizard.

Add Object Classes dialog

Add Object Classes dialog

The Add Object Classes dialog is displayed when Add | Object Class is selected on the What search properties tab (Searches page or the Purge Options page in the Purge Job wizard). This dialog allows you to search for changes made to a specific object class (a.k.a. classSchema object).

From this dialog, select an object class and click the Add button to add it to the list box located across the bottom of the dialog. Once you have made your selections, click the OK button to save your selection and close the dialog.

The following information/controls are included on this dialog:

Data grid

The data grid displays a list of all the object classes defined and available for inclusion in the search. For each object class listed, the following information is displayed:

▪	Object Class - lists the object classes defined and available for auditing.

▪	Parameter Name - if applicable, this column displays the parameter associated with an event class. That is, parameters are retrieved from Active Directory for DNS and the different group objects (for example, Distribution and Security groups).

Object classes list

The list box at the bottom of the dialog displays the object classes to be included in the search definition (or excluded if the Exclude the Above Selection(s) check box is checked). Use the buttons located above this list box as described below:

▪	Add - click the Add button to add the selected item to the Object Classes list.

▪	Remove - select the entry to be removed in the Object Classes list and then click the Remove button.

Exclude the Above Selection(s)

Select this check box to exclude the object classes listed in the Object Classes list. That is, Change Auditor will search for change events to all object classes except those associated with the object classes listed.

Runtime Prompt

Select the Runtime Prompt option to prompt for the object class whenever the search is run. That is, when the Run tool bar button is clicked, the Add Object Classes dialog is displayed allowing you to select the object class to be included in the search.This option is not available when this dialog is started from the Purge Job wizard.

NOTE: When Runtime Prompt is selected, the Object Class option will be disabled on the Add tool bar buttons on the What tab.

Add Object Classes dialog (Add With Events)

Add Object Classes dialog (Add With Events)

The Add Object Classes dialog is displayed when Add With Events | Object Class is selected on the What search properties tab (Searches page or the Purge Options page in the Purge Job wizard). This dialog allows you to search for changes made to an object class (a.k.a. classSchema object) that has an event associated with it in the Change Auditor database.

From this dialog, select an object class and click the Add button to add it to the list box located across the bottom of the dialog. Once you have made your selections, click the OK button to save your selection and close the dialog.

The following information/controls are included on this dialog:

Data grid

The data grid displays a list of all the object classes that have an event associated with it in the Change Auditor database.

Object classes list

The list box at the bottom of the dialog displays the object classes to be included in the search definition (or excluded if the Exclude the Above Selection(s) check box is checked). Use the buttons located above this list box as described below:

▪	Add - click the Add button to add the selected item to the Object Classes list.

▪	Remove - select the entry to be removed in the Object Classes list and then click the Remove button.

Exclude the Above Selection(s)

Select this check box to exclude the object classes listed in the Object Classes list. That is, Change Auditor will search for change events to all object classes except those associated with the object classes listed.

Runtime Prompt

Select the Runtime Prompt option to prompt for the object class whenever the search is run. That is, when the Run tool bar button is clicked, the Add Object Classes dialog is displayed allowing you to select the object class to be included in the search. This option is not available when this dialog is started from the Purge Job wizard.

NOTE: When Runtime Prompt is selected, the Object Class option will be disabled on the Add tool bar buttons on the What tab.

Add Origin dialog

Add Origin dialog

The Add Origin dialog is displayed when the Add tool bar button is clicked on the Origin search properties tab (Searches page or the Purge Options page in the Purge Job wizard). This dialog allows you to search for changes originating from a specific workstation or server.

Use the controls on this dialog to specify a wildcard expression to locate a workstation or server. Once you have entered the wildcard expression to be used, click OK to save your selection and close the dialog.

The following information/controls are included on this dialog:

Comparison operator

In the left-hand field, use the drop-down control to select the comparison operator to be used:

▪

Like

▪

Not Like

Pattern

In the field to the right of the comparison operator field, enter the pattern (character string and * wildcard character) to be used to search for a match. This pattern will be used to search the NetBIOS name and IP address of workstations and servers.

Use the * wildcard character to match any string of zero or more characters.