Change Auditor 7.5 - User Guide

ADAM (AD LDS) event logging

ADAM (AD LDS) event logging

In addition to real-time event auditing, you can enable event logging to capture ADAM (AD LDS) events locally in a Windows event log. This event log can then be collected using InTrust to satisfy long-term storage requirements.

For ADAM (AD LDS) events, event logging is disabled by default. When enabled, all ADAM activity is sent to the InTrust for ADAM event log. See the Change Auditor for Active Directory Event Reference Guide for a list of the events that can be sent to this event log.

To enable ADAM (AD LDS) event logging:

1	Open the Administration Tasks tab.

2	Click Configuration.

3	Select Agent in the Configuration task list to display the Agent Configuration page.

4	Click Event Logging.

5	On the Event Logging dialog, select ADAM (AD LDS).

6	Click OK to save your selection and close the dialog.

 

Active Directory Database Auditing

Active Directory Database Auditing

•	Introduction

•	Active Directory Database Auditing page

•	Active Directory Database auditing templates

•	Active Directory Database Auditing Wizard

Introduction

Introduction

Change Auditor allows you to monitor the Active Directory database (NTDS.dit) file for possible unauthorized access attempts.

Extraction of this file could lead to parsing of usernames and passwords resulting in a security breach. The ability to audit changes to this file reduces the risk of the user account information from being accessed and tampered with by unwanted processes or users.

To capture Active Directory database events, you must:

•	Create an Active Directory Database template.

•	Add this template to an agent configuration.

•	Assign the agent configuration to agents.

This chapter includes a description of the Active Directory Database auditing pages in the Administration Tasks tab, the procedure for creating and working with Active Directory Database auditing templates.

 

 

Active Directory Database Auditing page

Active Directory Database Auditing page

The Active Directory Database Auditing page is displayed when Active Directory Database is selected from the Auditing task list in the navigation pane of the Administration Tasks page. From this page you can start the Active Directory Auditing wizard to monitor your Active Directory database for unauthorized access. You can also edit existing templates, disable/enable templates and remove templates that are no longer being used.

NOTE: By default, Change Auditor captures events regardless of the result of the operation mentioned in the event. However, you can specify which events to capture based on an event’s result: • All Results (default) • Success Only • Success and Failed Only • Success and Protected Only See the Change Auditor User Guide for more information about defining the events to be captured based on result.

The Active Directory Database Auditing page contains an expandable view of all the templates that have been previously defined. To add a new template to the list, use the Add tool bar button.

NOTE: Authorization to use the administration tasks on the Administrations Tasks tab is defined using the Application User Interface page under the Configuration task list. If you are denied access to the tasks on this page, see the Change Auditor User Guide for more information about how to gain access.

Once added, the following information is provided for the template:

Template

Displays the name assigned to the template when it was created.

Status

Indicates whether the template is enabled or disabled. To enable/disable the template, place your cursor in this Status cell, click the arrow control and select the appropriate option from the drop-down menu.

Exempt Process Filter

Displays a list of processes which bypass Active Directory database auditing.