Change Auditor for Active Directory 7.0.4

Custom Active Directory object auditing


	NOTE: The cells directly under the main heading rows are used for filtering data. That is, as you enter characters into these cells, the client will redisplay the templates that meet the search criteria (i.e., comparison operator and characters entered). For more details about using the data filtering function provided throughout the client, see the Change Auditor User Guide.

Custom auditing allows you to specify custom Active Directory object classes and attributes to audit. A new event will be added for each object selected for auditing. Once set, these events are identified with “Custom” in the facility name.

By default, Change Auditor audits user, group and computer custom object classes. If you remove the custom objects from the Active Directory Auditing wizard you will no longer receive audit events for them. This will not affect ‘non-custom’ events and those will still be audited by Change Auditor.

To add an Active Directory object to the auditing list:

Open the Administration Tasks tab.

Click Auditing.

Select Active Directory in the Auditing task list.

Click Add to open the Active Directory Auditing wizard, which steps you through the process of defining the objects and object classes to audit.

Select where to conduct the audit:

•

Enterprise (Default)

•

This object only

•

This object and child objects only

•

This object and all child objects

If you selected the This Object, This Object and Child Objects Only, or This Object and All Child Objects option, use the Browse or Search pages to locate the directory object or container to audit.

If you selected either the This Object and Child Objects Only or This Object and All Child Objects option, select Next to define the object classes to audit.

Use one of the following methods to move an object class to the Audited Object Class list (right-hand pane):

•

Select one or more object classes in the UnAudited Object Class list and click Add.

•

Select one or more object classes in the UnAudited Object Class list and ‘drag and drop’ the selected object classes into the Audited Object Class list.

•

Double-click an object class in the UnAudited Object Class list.

You must select at least one object class for auditing.

After selecting the Active Directory objects (and object classes) to audit, click Finish to save your selection, close the wizard and return to the Active Directory Auditing page.

To add multiple Active Directory objects to the auditing list:

Open the Active Directory Auditing page.

Expand Add and select Select Multiple Objects.

Select where to conduct the audit:

•

Enterprise (Default)

•

This object only

•

This object and child objects only

•

This object and all child objects

If you selected the This Object, This Object and Child Objects Only, or This Object and All Child Objects option, use the Browse or Search pages to locate the directory object or container to audit.

After selecting a directory object or container, click Add to add the selected object to the list box at the bottom of the page.

Repeat this step to add multiple Active Directory objects.

If you selected either the This Object and Child Objects Only or This Object and All Child Objects option, select Next to define the object classes to be audited.

Use one of the following methods to move an object class to the Audited Object Class list (right-hand pane):

•

Select one or more object classes in the UnAudited Object Class list and then click Add.

•

Select one or more object classes in the UnAudited Object Class list and ‘drag and drop’ the selected object classes into the Audited Object Class list.

•

Double-click an object class in the UnAudited Object Class list.

You must select at least one object class for auditing.


	NOTE: If you have selected multiple objects on the first page of the wizard, the object classes selected on this second page will apply to all of these objects.

After selecting the Active Directory objects (and object classes) to audit, click Finish to save your selection, close the wizard and return to the Active Directory Auditing page.

To modify an object in the auditing list:

On the Active Directory Auditing page, select the object to modify, and click Edit.

This opens the Active Directory Auditing wizard, where you can select a different Active Directory object or object classes for auditing.

Click Finish to save your selection, close the wizard and return to the Active Directory Auditing page.

To disable the auditing of an object in the auditing list:

Disabling a template allows you to temporarily disable the auditing of a directory object without having to remove it from the Active Directory auditing list.

On the Active Directory Auditing page, place your cursor in the Status cell for the required object, click the arrow control, and select Disabled.

The entry in the Status column for the object will change to ‘Disabled’.

To re-enable the auditing of an object, use the Enable option in either the Status cell.

To delete an object from the auditing list:

On the Active Directory Auditing page, select the required object and click Delete.

Click Yes to confirm the deletion.

To delete an object class from the auditing list:

On the Active Directory Auditing page, select the required object class and click Delete | Delete Object Class.

Click Yes to confirm the deletion.


	NOTE: You cannot delete the last object class in an object entry in the auditing list. In order to delete this last object class, you must delete the entire object from the auditing list.

Active Directory Auditing wizard

The Active Directory Auditing wizard opens when you select Add or Add | Select Multiple Objects on the Active Directory auditing page. This wizard steps you through the process of defining the custom Active Directory objects to audit.

The following table provides a description of the available fields and controls:

Table 2. Active Directory Auditing wizard

Create or modify Active Directory Auditing page: On the first page of the wizard, select the Active Directory object to audit.

Scope

Select the appropriate option to specify the scope of coverage (Enterprise is selected by default):

•

Enterprise - to audit the entire enterprise

•

This Object - to audit an individual object

•

This Object and Child Objects Only - to audit an object and its direct child objects

•

This Object and All Child Objects - to audit an object and all of its subordinate objects (all levels)

When an option other than Enterprise is selected, the Browse and Search pages allow you to locate and select the Active Directory objects to audit.

Browse page

Displays a hierarchical view of the containers in your environment allowing you to locate and select the Active Directory objects to audit.

If you used the Add | Select Multiple Objects option, once you have selected an object, click Add to add it to the list.

Search page

Use the controls at the top of the Search page to locate an Active Directory object.

If you used the Add | Select Multiple Object option, once you have selected an account, click Add to add it to the list.

Options page

Use the Options page to modify the search options used to retrieve directory objects.

Select Object Classes Page: From here you can select at least one object class for auditing.

NOTE: This page is only displayed if the This Object and Child Objects Only or This Object and All Child Objects scope option is selected on the first page of the wizard.

UnAudited Object Class list

The list box located in the left displays the object classes that are currently not being selected to audit by this template.

Audited Object Class list

The list box located in the right contains the object classes that are currently selected for auditing.

Add

Select one or more object classes from the UnAudited Object Class list and click Add to select them for auditing. The selected object classes will be moved to the Audited Object Class list.

NOTE: You can also double-click an object class to move it into the Audited Object Class list or ‘drag and drop’ it into the Audited Object Class list.

Remove

Select one or more object classes from the Audited Object Class list and click Remove to remove them from auditing. The selected object classes will then be moved back to the UnAudited Object Class list.

NOTE: You can also double-click an object class to move it back into the UnAudited Object Class list or ‘drag and drop’ it into the UnAudited Object Class list.