Change Auditor 7.5 - User Guide

Troubleshooting tips

Troubleshooting tips

If GPO events initiated by GPOADmin do not appear in the Change Auditor for Active Directory client as expected, check the following:

•

GPOADmin/Change Auditor for Active Directory integration is through the SDK. Once configured, Change Auditor for Active Directory agents receive the configured settings in the next configuration polling interval (default every 15 minutes). Before the configuration is received by a Change Auditor for Active Directory agent, GPOADmin initiator and comment information will not be available for GPO events.

To make sure Change Auditor for Active Directory has the latest GPOADmin configuration, manually refresh the agent configuration (Refresh Configuration on Agent Configuration Page on the Administration Tasks tab).

NOTE: This delay is only applicable when you first install GPOADmin/Change Auditor for Active Directory or when the service account in GPOADmin has changed.

•	Verify that the GPO is not being protected by Change Auditor for Active Directory’s Group Policy Object Protection feature. When configured, Change Auditor for Active Directory prevents all changes to GPOs, regardless of the tool that is used to make the change (including GPOADmin).

•	GPOADmin only sends initiator and comment information to Change Auditor for Active Directory for GPO deployment, working copy check in, and working copy check out operations.

•

It may be necessary to restart the GPOADmin service before correct initiator information can be retrieve by Change Auditor for Active Directory. Before restarting the GPOADmin service, check the Change Auditor for Active Directory coordinator’s status to ensure that the coordinator has been initialized and is running.

Active Directory Protection

Active Directory Protection

•	Introduction

•	Active Directory object protection

•	Group Policy Object protection

•	ADAM (AD LDS) object protection

•	Active Directory Database protection

•	Setting extra security on protected objects

Introduction

Introduction

Enabling Active Directory protection allows you to lock down critical objects and attributes to prevent accidental or unauthorized creations, modifications, or deletions. This allows you to protect the environment from harmful changes that could open security holes or cause resources to become unavailable. Once enabled, if an unauthorized user attempts to modify or delete a protected object, Change Auditor prevents the operation and captures an event.

Protection can be defined for any Active Directory, Group Policy, or ADAM (AD LDS) object that you consider critical such as Organizational Units, Group Policy Object, and service accounts.

 

 

NOTE: Protection Notes and Recommendations: 1 Reserve protection for locking only critical objects. 2 Do not protect regular user accounts as it could prevent users from actions such as changing their passwords. 3 Certain applications and services need to make harmless changes to the Configuration and Schema NCs through the LocalSystem account. Therefore, Quest recommends that you do not protect the following applications and services: ▪ Active Directory Knowledge Consistency Checker (KCC) ▪ Quest Directory Analyzer ▪ Microsoft Operations Manager (MOM) ▪ Microsoft Licensing Computer ▪ Microsoft Message Queuing Service (MSMQ) ▪ Terminal Services Licensing Computer ▪ HP OpenView’s Active Directory SPI ▪ Microsoft Exchange If you protect a User object and prevent it from being deleted or modified, you are protecting all the user attributes and the forward links. You are not protecting any back linked attributes as back links are maintained by the system to ensure referential integrity only. If you modify the user’s memberOf attribute and add the user to a group, although you get an error or warning message, the user gets added to any group that is not protected. To prevent anyone from being added to a Group, you would protect the Group object and prevent it from being modified. By locking the Group object, you are locking its member attribute. Hence its membership cannot be modified. 4 Before you can set up ADAM auditing or protection, you must enable the File and Printer Sharing feature under the Windows Firewall. 5 If you have Quest GPOADmin integrated with your Change Auditor deployment, the GPOADmin service account is exempt from protection. 6 A protected GPO can only be changed by override accounts that are excluded from protection.

Active Directory object protection

Active Directory object protection

When configured, Change Auditor prevents changes from occurring to a protected object regardless of who attempts to change the object and the tool or method used. Attempts to change or delete a protected object fail and an event is generated. These ‘failed’ events are identified in the client by displaying ‘Protected’ in the Result column on the Search Results page and Result field in an event’s detail pane.

NOTE: By default, Change Auditor captures events regardless of the result of the operation mentioned in the event. However, you can specify which events to capture based on an event’s result: • All Results (default) • Success Only • Success and Failed Only • Success and Protected Only See the Change Auditor User Guide for more information about defining the events to be captured based on result.