Chat now with support
Chat with Support

Change Auditor 7.6 - Built-in Reports Reference Guide

Introduction Built-in reports
Active Directory Federation Services AD Query All Events Authentication Services Microsoft Entra Defender Microsoft 365 Logon Activity Recommended Best Practices Regulatory Compliance
FISMA (Federal Information Security Management Act)
NIST SP 800-53 | Technical Controls | Accountability (Including Audit Trails) | A01 – User Association NIST SP 800-53 | Technical Controls | Accountability (Including Audit Trails) | A02 – Content of Audit Records NIST SP 800-53 | Technical Controls | Accountability (Including Audit Trails) | A03 – Auditable Events NIST SP 800-53 | Technical Controls | Accountability (Including Audit Trails) | A04 – Audit Processing NIST SP 800-53 | Technical Controls | Identification and Authentication | IA02 – Remote, Privileged Access Authentication NIST SP 800-53 | Technical Controls | Identification and Authentication | IA03 – Password Protection Mechanisms NIST SP 800-53 | Technical Controls | Identification and Authentication | IA04 – Password Life NIST SP 800-53 | Technical Controls | Identification and Authentication | IA05 – Password Content NIST SP 800-53 | Technical Controls | Identification and Authentication | IA12 – Remote Access Identification Authentication NIST SP 800-53 | Technical Controls | Identification and Authentication | IA16 – Password Management NIST SP 800-53 | Technical Controls | Logical Access Control | AC01 - Remote Access Restrictions NIST SP 800-53 | Technical Controls | Logical Access Control | AC02 - Logon Notification Message NIST SP 800-53 | Technical Controls | Logical Access Control | AC05 - Session Inactivity NIST SP 800-53 | Technical Controls | Logical Access Control | AC06 - Limited Connection Time NIST SP 800-53 | Technical Controls | Logical Access Control | AC09 - Enforcement Mechanisms NIST SP 800-53 | Technical Controls | Logical Access Control | AC10 - Automated Account Controls NIST SP 800-53 | Technical Controls | Logical Access Control | AC12 - Supervision and Review NIST SP 800-53 | Technical Controls | Logical Access Control | AC14 - Authorization Procedures NIST SP 800-53 | Technical Controls | System and Communications Protection | SP02 - Information System Partitioning NIST SP 800-53 | Technical Controls | System and Communications Protection | SP04 - Denial of Service Protection NIST SP 800-53 | Technical Controls | System and Communications Protection | SP05 - Resource Priority NIST SP 800-53 | Technical Controls | System and Communications Protection | SP06 - Boundary Protection NIST SP 800-53 | Technical Controls | System and Communications Protection | SP07 - Network Segregation NIST SP 800-53 | Technical Controls | System and Communications Protection | SP09 - Network Disconnect NIST SP 800-53 | Technical Controls | System and Communications Protection | SP11 - Trust Path NIST SP 800-53 | Technical Controls | System and Communications Protection | SP16 - Use of Encryption
GLBA (Gramm-Leach-Bliley Act) GDPR HIPAA (Health Insurance Portability and Accountability Act) Payment Card Industry SAS 70 (Statement on Auditing Standards, Service Organizations) SOX (Sarbanes-Oxley General IT Controls Evidence based on the COBIT Framework)
Security SharePoint SQL Data Level SQL Extended Events

Integrity and Confidentiality

•
Active Directory
•
Active Directory\Users and Groups
•
Active Directory\Organizational Units
•
Messaging\Exchange
•
Microsoft SQL\Configuration
•
Microsoft SQL\Security
•
Storage\Windows File System
•
SharePoint
•
Security of Processing
Active Directory
24.2 - All AD Queries grouped by AD Search Filter
Who = All Users
What = AD Query Performed
Where = All sources
When = N/A
Origin = All workstations/servers
Layout tab - Order By: Time Detected (Not Grouped); LDAP Filter (Grouped)
24.2 - All AD Queries grouped by AD starting point
Who = All Users
What = AD Query Performed
Where = All sources
When = N/A
Origin = All workstations/servers
Layout Tab - Order By: Time Detected (Not Grouped); Object Canonical (Grouped)
Active Directory\Users and Groups
5.6 - Changes in the membership of critical built-in Enterprise groups
Who = All Users
What = Member Added to Critical Enterprise Group; Member Removed from Critical Enterprise Group
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Active Directory\Organizational Units
5.6 - Organizational Units set to block GPO inheritance in last 30 days
Who = All Users
What = Group Policy Block Inheritance Setting Changed on OU
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Messaging\Exchange
5.6 - Deleted Items Retention Period Changed for a user
Who = All Users
What = Deleted Item Retention Period Changed; Deleted Item Retention Use Defaults Storage Option Changed; Mailbox - End Date Retention Hold; Mailbox - Retention Hold Enabled; Mailbox - Retention Policy; Mailbox - Start Date for Retention Hold; Mailbox - Use Database Retention Defaults
Where = All sources
When = Last 7 days
Origin = All workstations/servers
5.6 - Mail Enabled for Group
Who = All Users
What = Mail Enabled for Group (Exchange 2003); Distribution List - Created; Distribution List - Enabled
Where = All sources
When = Last 7 days
Origin = All workstations/servers
5.6 - Mailbox Store Mounted
Who = All Users
What = Mailbox Store Mounted
Where = All sources
When = Last 7 days
Origin = All workstations/servers
5.6 - Outlook Anywhere Enabled or Disabled for a Server
Who = All Users
What = Outlook Anywhere Disabled for Server; Outlook Anywhere Enabled for Server
Where = All sources
When = Last 7 days
Origin = All workstations/servers
5.6 - Public Folder Created
Who = All Users
What = Public Folder Store Created in Server Storage Group
Where = All sources
When = Last 7 days
Origin = All workstations/servers
5.6 - Public Store Mounted
Who = All Users
What = Public Store Mounted
Where = All sources
When = Last 7 days
Origin = All workstations/servers
5.6 - Storage Group Removed from Exchange Server
Who = All Users
What = Storage Group Removed from Exchange Server
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Microsoft SQL\Configuration
5.6 - Audit Add Role
Who = All Users
What = Audit Add Role
Where = All sources
When = Last 7 days
Origin = All workstations/servers
5.6 - Audit Alter Database
Who = All Users
What = Audit Alter Database
Where = All sources
When = Last 7 days
Origin = All workstations/servers
5.6 - Audit Alter Database Object
Who = All Users
What = Audit Alter Database Object
Where = All sources
When = Last 7 days
Origin = All workstations/servers
5.6 - Audit Alter Database Principal
Who = All Users
What = Audit Alter Database Principal
Where = All sources
When = Last 7 days
Origin = All workstations/servers
5.6 - Audit Alter Schema Object
Who = All Users
What = Audit Alter Schema Object
Where = All sources
When = Last 7 days
Origin = All workstations/servers
5.6 - Audit Alter Server Object
Who = All Users
What = Audit Alter Server Object
Where = All sources
When = Last 7 days
Origin = All workstations/servers
5.6 - Audit Alter Server Principal
Who = All Users
What = Audit Alter Server Principal
Where = All sources
When = Last 7 days
Origin = All workstations/servers
5.6 - Audit Drop DB User
Who = All Users
What = Audit Drop DB User
Where = All sources
When = Last 7 days
Origin = All workstations/servers

Microsoft SQL\Data

5.6 - SQL Data Level Events in the last 24 hours
Who = All Users
What = Check Constraint Added to a Table; Check Constraint Removed from a Table; Default Constraint Added to a Table; Default Constraint Removed from a Table; Default Object Added; Default Object Removed; Foreign Key Added to a Table; Foreign Key Removed from a Table; Function Added; Function Altered; Function Removed; Index Added to a Table; Index Removed from a Table; Object Renamed; Primary Key Added to a Table; Primary Key Removed from a Table; Procedure Added; Procedure Altered; Procedure Removed; Row Added to a Table; Row Removed from a Table; Row Updated in a Table; Rule Added; Rule Removed; Statistics Added to a Table; Statistics Removed from a Table; Table Added; Table Altered; Table Removed; Table Truncated; Trigger Added; Trigger Altered; Trigger Removed; Type Added; Type Removed; User Added; User Removed; View Added; View Altered; View Removed
Where = All sources
When = Last 24 hours
Origin = All workstations/servers
5.6 - SQL Data Level Row Change Events in the last 24 hours
Who = All Users
What = Row Added to a Table; Row Removed from a Table; Row Updated in a Table
Where = All sources
When = Last 24 hours
Origin = All workstations/servers
5.6 - SQL Data Level Structure Change Events in the last 7 days
Who = All Users
What = Check Constraint Added to a Table; Check Constraint Removed from a Table; Default Constraint Added to a Table; Default Constraint Removed from a Table; Default Object Added; Default Object Removed; Foreign Key Added to a Table; Foreign Key Removed from a Table; Function Added; Function Altered; Function Removed; Index Added to a Table; Index Removed from a Table; Object Renamed; Primary Key Added to a Table; Primary Key Removed from a Table; Procedure Added; Procedure Altered; Procedure Removed; Rule Added; Rule Removed; Statistics Added to a Table; Statistics Removed from a Table; Table Added; Table Altered; Table Removed; Table Truncated; Trigger Added; Trigger Altered; Trigger Removed; Type Added; Type Removed; User Added; User Removed; View Added; View Altered; View Removed
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Microsoft SQL\Security
5.6 - Audit Alter Object Derived Permission
Who = All Users
What = Audit Alter Object Derived Permission
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Storage\Windows File System
5.6 - Directory share added in last 30 days
Who = All Users
What = Active Directory Share Added
Where = All sources
When = Last 30 days
Origin = All workstations/servers
5.6 - Directory share removed in last 30 days
Who = All Users
What = Active Directory Share Removed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
5.6 - File/Folder added in last 30 days
Who = All Users
What = File Created; Folder Created
Where = All sources
When = Last 30 days
Origin = All workstations/servers
5.6 - File/Folder moved in last 30 days
Who = All Users
What = File Moved; Folder Moved
Where = All sources
When = Last 30 days
Origin = All workstations/servers
5.6 - File/Folder ownership changed in last 30 days
Who = All Users
What = File Ownership Changed; Folder Ownership Changed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
5.6 - File/Folder permission changed in last 30 days
Who = All Users
What = File Access Rights Changed; Folder Access Rights Changed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
5.6 - File/Folder removed in last 30 days
Who = All Users
What = File Deleted; Folder Deleted
Where = All sources
When = Last 30 days
Origin = All workstations/servers
5.6 - Local share added in last 30 days
Who = All Users
What = Local Share Added
Where = All sources
When = Last 30 days
Origin = All workstations/servers
5.6 - Local share permission changed in last 30 days
Who = All Users
What = Local Share Permissions Changed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
5.6 - Local share removed in last 30 days
Who = All Users
What = Local Share Removed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
5.6 - Shares added in last 30 days
Who = All Users
What = Active Directory Share Added
Where = All sources
When = Last 30 days
Origin = All workstations/servers
5.6 - Shares removed in last 30 days
Who = All Users
What = Active Directory Share Removed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
SharePoint
5.6 - Site Collection Groups created and deleted in the last 7 days
Who = All Users
What = Security group created; Security group deleted
Where = All sources
When = Last 7 days
Origin = All workstations/servers
5.6 - Site Collection Groups Membership changes in the last 7 days
Who = All Users
What = Member added to security group; Member removed from security group
Where = All sources
When = Last 7 days
Origin = All workstations/servers
5.6 - Site Collection Ownership changes in the last 7 days
Who = All Users
What = Site collection ownership granted; Site collection ownership revoked
Where = All sources
When = Last 7 days
Origin = All workstations/servers
5.6 - Site Collections created and deleted in the last 7
Who = All Users
What = Site collection created; Site collection deleted
Where = All sources
When = Last 7 days
Origin = All workstations/servers
5.6 - Sites created and deleted in the last 7 days
Who = All Users
What = Site created; Site deleted
Where = All sources
When = Last 7 days
Origin = All workstations/servers
5.6 - Sites moved in the last 7 days
Who = All Users
What = Site moved
Where = All sources
When = Last 7 days
Origin = All workstations/servers

Security of Processing

•
32 - Detailed List of security log modifications
•
Active Directory
•
Authentication Services
•
Active Directory\Configuration
•
Authentication Services
•
Microsoft SQL\Security
•
SharePoint
•
Storage\Windows File System
32 - Detailed List of security log modifications
Who = All Users
What = Audit Account Logon Events Policy Changed; Audit Account Management Policy Changed; Audit Directory Service Access Policy Changed; Audit Logon Events Policy Changed; Audit Object Access Policy Changed; Audit Privilege Use Policy Changed; Audit Process Tracking Policy Changed; Audit System Events Policy Changed; Audit: Audit The Access of Global System Objects Policy Changed; Audit: Audit The Use of Backup and Restore Privilege Policy Changed; Audit: Shut Down System Immediately if Unable to Log Security Audits Policy Changed; Security Audit Log Rolled Over; Crash on Audit Fail Policy Changed; Shut Down the Computer When the Security Audit Log is Full Policy Changed
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Active Directory
32 - Active Directory Database Events in last 30 days
Who = All Users
What = Active Directory Database facility
Where = All sources
When = Last 30 days
Origin = All workstations/servers
32 - Changes to SYSVOL on all Domain Controllers in last 30 days
Who = All Users
What = SYSVOL facility; SYSVOL Location Changed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
32 - Default domain audit policy changes last 30 days

Report generated for each domain

Who = All Users
What = Audit Account Logon Events Policy Changed; Audit Account Management Policy Changed; Audit Directory Service Access Policy Changed; Audit Logon Events Policy Changed; Audit Object Access Policy Changed; Audit Policy Change Policy Changed; Audit Privilege Use Policy Changed; Audit Process Tracking Policy Changed; Audit System Event Policy Changed
Group Policy subsystem – Default Domain Policy container
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Authentication Services
32 - Authentication Services computers added in last 30 days
Who = All Users
What = Authentication Services Computer object added
Where = All sources
When = Last 30 days
Origin = All workstations/servers
32 - Authentication Services computers deleted in last 30 days
Who = All Users
What = Authentication Services Computer object deleted
Where = All sources
When = Last 30 days
Origin = All workstations/servers
32 - Default domain Kerberos policy changes last 30 days

Report generated for each domain

Who = All Users
What = Enforce User Logon Restrictions Policy Changed; Maximum Lifetime for Service Ticket Policy Changed; Maximum Lifetime for User Ticket Policy Changed; Maximum Lifetime for User Ticket Renewal Policy Changed; Maximum Tolerance for Computer Clock Synchronization Policy Changed
Group Policy subsystem – Default Domain Policy container
Where = All sources
When = Last 30 days
Origin = All workstations/servers
32 - Default domain password policy changes last 30 days

Report generated for each domain

Who = All Users
What = Enforce Password History Policy Changed; Maximum Password Age Policy Changed; Minimum Password Age Policy Changed; Minimum Password Length Policy Changed; Password Must Meet Complexity Requirements Policy Changed; Store Passwords Using Reversible Encryption Policy Changed
Group Policy subsystem – Default Domain Policy container
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Active Directory\Configuration
32 - All Schema Configuration Events
Who = All Users
What = Schema Configuration facility
Schema FSMO Role Owner Moved; Schema Modifications Allowed Flag Changed
Where = All sources
When = Last 7 days
Origin = All workstations/servers
32 - Authentication Services GPO settings changes in last 30 days
Who = All Users
What = Authentication Services GPO Settings Computer Object Added
Where = All sources
When = Last 30 days
Origin = All workstations/servers
32 - Changes in trust
Who = All Users
What = Cross-forest Trust Added; Cross-forest Trust Removed; Trust Added; Trust Removed
Where = All sources
When = Last 7 days
Origin = All workstations/servers
32 - Changes to Domain account policies (GPO filter) in last 30 days
Who = All Users
What = Account Lockout Duration Policy Changed; Account Lockout Threshold Policy Changed; Enforce Password History Policy Changed; Enforce User Logon Restrictions Policy Changed; Maximum Lifetime for Service Ticket Policy Changed; Maximum Lifetime for User Ticket Policy Changed; Maximum Lifetime for User Ticket Renewal Policy Changed; Maximum Password Age Policy Changed; Maximum Tolerance for Computer Clock Synchronization Policy Changed; Minimum Password Age Policy Changed; Minimum Password Length Policy Changed; Password Must Meet Complexity Requirements Policy Changed; Store Passwords Using Reversible Encryption Policy Changed; Reset Account Lockout Counter After Change Policy Changed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
32 - Changes to Domain Audit Policies (GPO filter) in the last 30 days
Who = All Users
What = Audit Account Logon Events Policy Changed; Audit Account Management Policy Changed; Audit Directory Service Access Policy Changed; Audit Logon Events Policy Changed; Audit Object Access Policy Changed; Audit Policy Change Policy Changed; Audit Privilege Use Policy Changed; Audit Process Tracking Policy Changed; Audit System Event Policy Changed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
32 - Changes to Domain Kerberos policies (GPO filter) in the last 30 days
Who = All Users
What = Enforce User Logon Restrictions Policy Changed; Maximum Lifetime for Service Ticket Policy Changed; Maximum Lifetime for User Ticket Policy Changed; Maximum Lifetime for User Ticket Renewal Policy Changed; Maximum Tolerance for Computer Clock Synchronization Policy Changed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
32 - Changes to IP deny filter changes in last 30 days
Who = All Users
What = IP Deny List Entry Added; IP Deny List Entry Removed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
32 - Cross Forest level trusts added in last 30 days
Who = All Users
What = Cross-forest Trust Added
Where = All sources
When = Last 30 days
Origin = All workstations/servers
32 - Cross Forest level trusts deleted in last 30 days
Who = All Users
What = Cross-forest Trust Removed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
32 - DNS server list changes in last 30 days
Who = All Users
What = Contents of DNS Server List Changed
Where = Domain Controller
When = Last 30 days
Origin = All domain controllers
32 - Domain policy changes in last 30 days

Report generated for each domain

Who = All Users
What = Linked Group Policy or Domain Changed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
32 - High Severity changes in the last 30 days
Who = All Users
What = Severity | High
Where = All sources
When = Last 30 days
Origin = All workstations/servers
32 - Permission changes on domains in the last 30 days
Who = All Users
What = DACL Changed on Domain Object
Where = All sources
When = Last 30 days
Origin = All workstations/servers
32 - Trusts added in last 30 days
Who = All Users
What = Trust Added
Where = All sources
When = Last 30 days
Origin = All workstations/servers
32 - Trusts deleted in last 30 days
Who = All Users
What = Trust Removed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
32 - Use of dynamic DNS changed in last 30 days
Who = All Users
What = Use of Dynamic DNS Changed
Where = Domain Controller
When = Last 30 days
Origin = All domain controllers
Active Directory\GPO Configuration
32 - GPO Link changes on Domain objects in the last 30 days
Who = All Users
What = DACL Changed on Group Policy Object; Group Policy Linked; Group Policy Unlinked; Group Policy Block Inheritance Setting Changed on Domain; Group Policy No Override Setting Changed on Domain; Group Policy Disabled Setting on Domain Changed; Owner Changed on Group Policy Object
Where = All sources
When = Last 30 days
Origin = All workstations/servers

Active Directory\Users and Groups

32 - Critical Group Membership changes in last 30 days
Who = All Users
What = Member Added to Critical Enterprise Group; Member Removed from Critical Enterprise Group; Nested Member Added to Critical Enterprise Group; Nested Member Removed from Critical Enterprise Group
Where = All sources
When = Last 30 days
Origin = All workstations/servers
32 - Group added in last 30 days
Who = All Users
What = Group Object Added
Where = All sources
When = Last 30 days
Origin = All workstations/servers
32 - Group deleted in last 30 days
Who = All Users
What = Group Object Removed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
32 - Group member added changes in last 30 days
Who = All Users
What = Member Added to Group
Where = All sources
When = Last 30 days
Origin = All workstations/servers
32 - Group member removed changes in last 30 days
Who = All Users
What = Member Removed from Group
Where = All sources
When = Last 30 days
Origin = All workstations/servers
32 - Group Membership changes in last 30 days
Who = All Users
What = Member Added to Group, Member Removed from Group; Nested Member Added to Group; Nested Member Removed from Group
Where = All sources
When = Last 30 days
Origin = All workstations/servers
32 - Group moved in last 30 days
Who = All Users
What = Group Object Moved
Where = All sources
When = Last 30 days
Origin = All workstations/servers
32 - Group nested member added changes in last 30 days
Who = All Users
What = Nested Member Added to Group
Where = All sources
When = Last 30 days
Origin = All workstations/servers
32 - Group nested member removed changes in last 30 days
Who = All Users
What = Nested Member Removed from Group
Where = All sources
When = Last 30 days
Origin = All workstations/servers
32 - Membership changed in critical groups in last 7 days
Who = All Users
What = Member Added to Critical Enterprise Group; Member Removed from Critical Enterprise Group
Where = All sources
When = Last 7 days
Origin = All workstations/servers
32 - Permissions on group changes last 30 days
Who = All Users
What = DACL Changed on Group Object; Active Directory subsystem
Where = All sources
When = Last 30 days
Origin = All workstations/servers
32 - Permissions on user accounts changed in last 30 days
Who = All Users
What = DACL Changed on User Object; Required User’s Permissions Changed for User Object
Where = All sources
When = Last 30 days
Origin = All workstations/servers
32 - Permissions to AdminSDHolder in last 30 days
Who = All Users
What = DACL Changed on AdminSDHolder Object
Where = All sources
When = Last 30 days
Origin = All workstations/servers
32 - User account restrictions changed in the last 30 days
Who = All Users
What = User Account Enabled; User Account Disabled; DACL Change on User Object; User Member-of Added; User Member-of Removed; User accountExpires Changed; User Password Changed; User logonHours Changed; User Account Locked; User Account Unlocked; Active Session Limit Changed for User Object
Where = All sources
When = Last 30 days
Origin = All workstations/servers
32 - User logon hours changed in last 30 days
Who = All Users
What = User logonHours Changed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
32 - Users added in last 30 days
Who = All Users
What = User Object Added
Where = All sources
When = Last 30 days
Origin = All workstations/servers
32 - Users added to group in last 30 days
Who = All Users
What = User Member-of Added
Where = All sources
When = Last 30 days
Origin = All workstations/servers
32 - Users deleted in last 30 days
Who = All Users
What = User Object Removed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
32 - Users disabled in last 30 days
Who = All Users
What = User Account Disabled
Where = All sources
When = Last 30 days
Origin = All workstations/servers
32 - Users enabled in last 30 days
Who = All Users
What = User Account Enabled; User Account Re-enabled
Where = All sources
When = Last 30 days
Origin = All workstations/servers
32 - Users expiration date changed in last 30 days
Who = All Users
What = User Account Expires changed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
32 - Users locked in last 30 days
Who = All Users
What = User Account Locked
Where = All sources
When = Last 30 days
Origin = All workstations/servers
32 - Users locked out in last 30 days
Who = All Users
What = User Account Locked
Where = All sources
When = Last 30 days
Origin = All workstations/servers
32 - Users logon hours changed in last 30 days
Who = All Users
What = User logonHours Changed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
32 - Users moved in last 30 days
Who = All Users
What = User Object Moved
Where = All sources
When = Last 30 days
Origin = All workstations/servers
32 - Users removed from group in last 30 days
Who = All Users
What = User Member-of Removed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
32 - Users renamed in last 30 days
Who = All Users
What = Domain User Renamed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
32 - Users SAM account name changed in last 30 days
Who = All Users
What = User samAccountName Changed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
32 - Users unlocked in last 30 days
Who = All Users
What = User Account Unlocked
Where = All sources
When = Last 30 days
Origin = All workstations/servers
32 - Users workstation access restrictions changed in last 30 days
Who = All Users
What = User userWorkstations Added; User userWorkstations Removed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Authentication Services
32 - Detailed list of password age policy modifications
Who = All Users
What = Maximum Password Age Policy Changed
Where = All sources
When = Last 7 days
Origin = All workstations/servers
32 - Detailed list of password complexity policy modifications
Who = All Users
What = Password Must Meet Complexity Requirements Policy Changed
Where = All sources
When = Last 7 days
Origin = All workstations/servers
32 - Detailed list of password history policy modifications
Who = All Users
What = Enforce Password History Policy Changed
Where = All sources
When = Last 7 days
Origin = All workstations/servers
32 - Detailed list of storing password policy modifications
Who = All Users
What = Store Passwords Using Reversible Encryption Policy Changed
Where = All sources
When = Last 7 days
Origin = All workstations/servers
- IPSec changes in last 30 days
Who = All Users
What = IPSEC Settings Changed
Where = All sources
When = Last 30 days
Origin = All domain controllers

Messaging\Exchange

32 - All Exchange Administrative Group events in last 30 days
Who = All Users
What = Exchange Administrative Group facility
Where = All sources
When = Last 30 days
Origin = All workstations/servers
32 - All Send Connector Change Events
Who = All Users
What = Mutual Auth TLS Option Changed on Send Connector; Send Connector Added to Organization Configuration; Send Connector Protocol Logging Changed; Send Connector Removed from Organization Configuration; Send Connector Renamed; Send Connector Response FQDN Changed; Send Connector Status Changed; Address Space Added to Send Connector; Address Space Removed from Send Connection; External DNS Lookup Option Changed on Send Connector; Send Connector Maximum Message Size Changed; Smart Host Added to Send Connector; Smart Host Authentication Settings Changed on Send Connector; Smart Host Removed from Send Connector; Source Server Added to Send Connector; Source Server Removed from Send Connector
Where = All sources
When = Last 7 days
Origin = All workstations/servers
32 - All Unified Messaging (UM) Policy Change Events
Who = All Users
What = Allow Calls to Extensions Option Changed in UM Mailbox Policy; Allow Calls to Same-Plan Users Option Changed in UM Mailbox Policy; Allow Common PIN Pattern Option Changed in UM Mailbox Policy; Fax Identity Changed in UM Mailbox Policy; Fax Message Text Changed in UM Mailbox Policy; Incorrect PIN Mailbox Lockout Setting Changed in UM Mailbox Policy; Incorrect PIN Reset Setting Changed in UM Mailbox Policy; In-Country Rule Group Added to UM Mailbox Policy; In-Country Rule Group Removed From UM Mailbox Policy; International Rule Group Added to UM Mailbox Policy; International Rule Group Removed from UM Mailbox Policy; Mailbox Enabled Text Changed in UM Mailbox Policy; Maximum Greeting Duration Changed in UM Mailbox Policy; Maximum Greeting Duration Enabled Option Changed in UM Mailbox Policy; Minimum PIN Length Changed in UM Mailbox Policy; PIN History Length Changed in UM Mailbox Policy; PIN Lifetime Changed in UM Mailbox Policy; PIN Reset Text Changed in UM Mailbox Policy; UM Mailbox Policy Added to Organization Configuration; UM Mailbox Policy Removed from Organization Configuration; UM Mailbox Policy Renamed; Voice Message Text Changed in UM Mailbox Policy
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Microsoft SQL\Security
32 - All SQL Add Roles, User, and Login Events in the last 24 hours
Who = All Users
What = Audit Add DB User; Audit Add Login; Audit Add Login to Server Role; Audit Add Member to DB Role; Audit Add Role
Where = All sources
When = Last 24 hours
Origin = All workstations/servers
32 - All SQL Security Audit Events in the last 24 hours
Who = All Users
What = SQL Security Audit Event facility
Where = All sources
When = Last 24 hours
Origin = All workstations/servers
5.6 - Audit Add DB User
Who = All Users
What = Audit Add DB User
Where = All sources
When = Last 7 days
Origin = All workstations/servers
5.6 - Audit Add Login
Who = All Users
What = Audit Add Login
Where = All sources
When = Last 7 days
Origin = All workstations/servers
5.6 - Audit Add Login to Server Role
Who = All Users
What = Audit Add Login to Server Role
Where = All sources
When = Last 7 days
Origin = All workstations/servers
5.6 - Audit Add Member to DB Role
Who = All Users
What = Audit Add Member to DB Role
Where = All sources
When = Last 7 days
Origin = All workstations/servers
SharePoint
32 - Permission changes in the last 7 days
Who = All Users
What = All permission levels revoked; Permission level created; Permission level deleted; Permission level granted; Permission level permissions modified; Permission level revoked
Where = All sources
When = Last 7 days
Origin = All workstations/servers
32 - Permission Inheritance changes in the last 7 days
Who = All Users
What = Permission inheritance broken; Permission inheritance restored; Permission level inheritance broken; Permission level permissions modified
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Storage\Windows File System
32 - File/Folder auditing changed in last 30 days
Who = All Users
What = File Auditing Changed; Folder Auditing Changed
Where = All sources
When = Last 30 days
Origin = All workstations/servers

HIPAA (Health Insurance Portability and Accountability Act)

The HIPAA reports are available in the following folders:

•
164.308 – Administrative Safeguards | Information Access Management
•
164.308 – Administrative Safeguards | Security Awareness and Training
•
164.308 – Administrative Safeguards | Security Management
•
164.308 – Administrative Safeguards | Workforce Security
•
164.310 – Physical Safeguards | Standard Workstation Security
•
164.310 – Physical Safeguards | Standard Workstation Use
•
164.312 – Technical Safeguards | Standard Person or entity authentication
•
164.312 – Technical Safeguards | Standard Access Control
•
164.312 – Technical Safeguards | Standard Audit Control

164.308 – Administrative Safeguards | Security Management

| Security Management
Information System Activity Review
(Executive Summary) - Formal Mechanism for Processing Records

A summary report containing events from all of the following reports.

Detailed list of Change Auditor agent modifications
Who = All Users
What = Agent Service Has More Than 100 Events Waiting; Agent Service Has Reached a Critical Load; Agent Service Has Returned to Normal Operations; Change Auditor Agent Connected; Change Auditor Agent Disconnected; Change Auditor Agent Uninstalled
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Detailed list of security log modifications
Who = All Users
What = Audit Account Logon Events Policy Changed; Audit Account Management Policy Changed; Audit Directory Service Access Policy Changed; Audit Logon Events Policy Changed; Audit Object Access Policy Changed; Audit Policy Change Policy Changed; Audit Privilege Use Policy Changed; Audit Process Tracking Policy Changed; Audit System Events Policy Changed; Audit: Audit the Access of Global System Object Policy Changed; Audit: Audit the use of Backup and Restore Privilege Policy Changed; Crash on Audit Fail Policy Changed; Security Audit Log Rolled Over; Shut Down the Computer When the Security Audit Log is Full Policy Changed
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Access Control - File Access
Directory shares added in last 30 days
Who = All Users
What = Active Directory Share Added
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Directory shares removed in last 30 days
Who = All Users
What = Active Directory Share Removed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
File/Folder added in last 30 days
Who = All Users
What = File Created; Folder Created
Where = All sources
When = Last 30 days
Origin = All workstations/servers
File/Folder attribute changed in last 30 days
Who = All Users
What = File Attribute Changed; Folder Attribute Changed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
File/Folder auditing changed in last 30 days
Who = All Users
What = File Auditing Changed; Folder Auditing Changed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
File/Folder modified date changed in last 30 days
Who = All Users
What = File Last Write Changed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
File/Folder moved in last 30 days
Who = All Users
What = File Moved; Folder Moved
Where = All sources
When = Last 30 days
Origin = All workstations/servers
File/Folder ownership changed in last 30 days
Who = All Users
What = File Ownership Changed; Folder Ownership Changed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
File/Folder permission changed in last 30 days
Who = All Users
What = File Access Rights Changed; Folder Access Rights Changed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
File/Folder removed in last 30 days
Who = All Users
What = File Deleted; Folder Deleted
Where = All sources
When = Last 30 days
Origin = All workstations/servers
File/Folder renamed in last 30 days
Who = All Users
What = File Renamed; Folder Renamed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Local share added in last 30 days
Who = All Users
What = Local Share Added
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Local share auditing changed in last 30 days
Who = All Users
What = Local Share Auditing changed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Local share permission changed in last 30 days
Who = All Users
What = Local Share Permissions Changed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Local share removed in last 30 days
Who = All Users
What = Local Share Removed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Shares added in last 30 days
Who = All Users
What = Active Directory Share Added
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Shares removed in last 30 days
Who = All Users
What = Active Directory Share Removed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
EMC
EMC file access rights changed
Who = All Users
What = EMC file access rights changed
Where = All sources
When = This Week
Origin = All workstations/servers
EMC file contents written
Who = All Users
What = EMC file contents written
Where = All sources
When = This Week
Origin = All workstations/servers
EMC file contents created
Who = All Users
What = EMC file contents created
Where = All sources
When = This Week
Origin = All workstations/servers
EMC file contents deleted
Who = All Users
What = EMC file contents deleted
Where = All sources
When = This Week
Origin = All workstations/servers
EMC file contents moved
Who = All Users
What = EMC file contents moved
Where = All sources
When = This Week
Origin = All workstations/servers
EMC file contents opened
Who = All Users
What = EMC file contents opened
Where = All sources
When = This Week
Origin = All workstations/servers
EMC file ownership changed
Who = All Users
What = EMC file ownership changed
Where = All sources
When = This Week
Origin = All workstations/servers
EMC file renamed
Who = All Users
What = EMC file renamed
Where = All sources
When = This Week
Origin = All workstations/servers
EMC folder access rights changed
Who = All Users
What = EMC folder access rights changed
Where = All sources
When = This Week
Origin = All workstations/servers
EMC folder created
Who = All Users
What = EMC folder created
Where = All sources
When = This Week
Origin = All workstations/servers
EMC folder deleted
Who = All Users
What = EMC folder deleted
Where = All sources
When = This Week
Origin = All workstations/servers
EMC folder moved
Who = All Users
What = EMC folder moved
Where = All sources
When = This Week
Origin = All workstations/servers
EMC folder ownership changed
Who = All Users
What = EMC folder ownership changed
Where = All sources
When = This Week
Origin = All workstations/servers
EMC folder renamed
Who = All Users
What = EMC folder renamed
Where = All sources
When = This Week
Origin = All workstations/servers
Exchange
All Exchange Permission Tracking Events
Who = All Users
What = Exchange Permission Tracking facility
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All Journaling Rule Change Events
Who = All Users
What = Journaling Rule Added to Organization Configuration; Journaling Rule Changed; Journaling Rule Removed from Organization Configuration; Journaling Rule Renamed
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Deleted Items Retention Period Changed for a user
Who = All Users
What = Deleted Item Retention Period Changed; Deleted Item Retention Use Defaults Storage Option Changed; Mailbox - End Date Retention Hold; Mailbox - Retention Hold Enabled; Mailbox - Retention Policy; Mailbox - Start Date for Retention Hold; Mailbox - Use Database Retention Defaults
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Logon Activity
All Interactive Logons in the past 24 hours
Who = All Users
What = User failed to log on interactively; User logged on interactively
Where = All sources
When = Last 24 hours
Origin = All workstations/servers
Info Tab = Fetch Every 10 Seconds
All Logons in the past 24 hours
Who = All Users
What = Authentication Activity; Domain Controller Authentication; Logon Session
Where = All sources
When = Last 24 hours
Origin = All workstations/servers
Info Tab = Fetch Every 10 Seconds
All Remote Interactive Logons in the past 24 hours
Who = All Users
What = User failed to log on interactively from a remote computer; User failed to perform a network logon from a remote computer; User logged on interactively from a remote computer; User performed a successful network logon from a remote computer
Where = All sources
When = Last 24 hours
Origin = All workstations/servers
Info Tab = Fetch Every 10 Seconds
All User Sessions in the past 24 hours
Who = All Users
What = Logon Session facility
Where = All sources
When = Last 24 hours
Origin = All workstations/servers
Info Tab = Fetch Every 10 Seconds
NetApp
NetApp file access rights changed (no from-value)
Who = All Users
What = NetApp file access rights changed (no from-value)
Where = All sources
When = This Week
Origin = All workstations/servers
NetApp file access rights changed
Who = All Users
What = NetApp file access rights changed
Where = All sources
When = This Week
Origin = All workstations/servers
NetApp file contents written
Who = All Users
What = NetApp file contents written
Where = All sources
When = This Week
Origin = All workstations/servers
NetApp file created
Who = All Users
What = NetApp file created
Where = All sources
When = This Week
Origin = All workstations/servers
NetApp file deleted
Who = All Users
What = NetApp file deleted
Where = All sources
When = This Week
Origin = All workstations/servers
NetApp file moved
Who = All Users
What = NetApp file moved
Where = All sources
When = This Week
Origin = All workstations/servers
NetApp file opened
Who = All Users
What = NetApp file opened
Where = All sources
When = This Week
Origin = All workstations/servers
NetApp file ownership changed
Who = All Users
What = NetApp file access rights changed
Where = All sources
When = This Week
Origin = All workstations/servers
NetApp file ownership changed (no from-value)
Who = All Users
What = NetApp file access rights changed (no from-value)
Where = All sources
When = This Week
Origin = All workstations/servers
NetApp file renamed
Who = All Users
What = NetApp file renamed
Where = All sources
When = This Week
Origin = All workstations/servers
NetApp folder access rights changed (no from-value)
Who = All Users
What = NetApp folder access rights changed (no from-value)
Where = All sources
When = This Week
Origin = All workstations/servers
NetApp folder access rights changed
Who = All Users
What = NetApp folder access rights changed
Where = All sources
When = This Week
Origin = All workstations/servers
NetApp folder created
Who = All Users
What = NetApp folder created
Where = All sources
When = This Week
Origin = All workstations/servers
NetApp folder deleted
Who = All Users
What = NetApp folder deleted
Where = All sources
When = This Week
Origin = All workstations/servers
NetApp folder moved
Who = All Users
What = NetApp folder moved
Where = All sources
When = This Week
Origin = All workstations/servers
NetApp folder ownership changed
Who = All Users
What = NetApp folder access rights changed
Where = All sources
When = This Week
Origin = All workstations/servers
NetApp folder ownership changed (no from-value)
Who = All Users
What = NetApp folder access rights changed (no from-value)
Where = All sources
When = This Week
Origin = All workstations/servers
NetApp folder renamed
Who = All Users
What = NetApp folder renamed
Where = All sources
When = This Week
Origin = All workstations/servers
SharePoint
Permission changes in the last 7 days
Who = All Users
What = All permission levels revoked; Permission level created; Permission level deleted; Permission level granted; Permission level permissions modified; Permission level revoked
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Permission inheritance changes in the last 7 days
Who = All Users
What = Permission inheritance broken; Permission inheritance restored; Permission level inheritance broken; Permission level permissions modified
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Site Collection Groups created and deleted in the last 7 days
Who = All Users
What = Security group created; Security group deleted
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Site Collection Groups membership changes in the last 7 days
Who = All Users
What = Member added to security group; Member removed from security group
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Site Collection ownership changes in the last 7 days
Who = All Users
What = Site collection ownership granted; Site collection ownership revoked
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Site Collections created and deleted in the last 7 days
Who = All Users
What = Site collection created; Site collection deleted
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Sites created and deleted in the last 7 days
Who = All Users
What = Site created; Site deleted
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Sites moved in the last 7 days
Who = All Users
What = Site moved
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating