Chat now with support
Chat with Support

Change Auditor for Authentication Services 7.1.1 - User Guide

Deployment requirements

* 
NOTE: After an agent upgrade from version 7.0.4 or earlier, you will need to update your configuration setup to enable Authentication Services auditing where required.

o capture activity performed with Authentication Services you need to:

•
Ensure that Authentication Services 4.0 (or later) is properly installed and configured.
•
Enable Authentication Services auditing through the agent configuration setup.
•
Deploy agents on all Active Directory domain controllers in the forest to capture modifications to the Authentication Services configuration container.
•
Enable and disable the required events.

Enable Authentication Services auditing

Authentication Services auditing is enabled and disabled on a configuration basis from through the configuration setup.

To enable Authentication Services auditing:
1
Open the Administration Tasks tab and click Configuration.
2
Select Agent in the Configuration task list.
3
From the Agent Configuration page, click Configurations to see the available configuration definitions. From here you can edit a configuration to include Authentication Services or create a new configuration.
4
Select the required agent configuration, select the Authentication Services tab, and click the option to enabled auditing.

Enable and disable events as required

You can enable or disable events to best suit your organization. To view or modify the current event auditing settings, use the Audit Events page, which is accessible through the Administration Tasks tab.

To disable/enable individual events:
1
Open the Administration Tasks tab.
2
Click Auditing.
3
Select Audit Events (under the Configuration heading in the Auditing task list) to display the Audit Events page.
4
To disable an event, use one of the following methods:
•
Select one or more enabled events and click Disable. (Use the Shift or Ctrl keys to select multiple events.)
•
Select an enabled event, place your cursor in the corresponding Status cell, click the arrow control and select Disabled from the drop-down menu.
•
Right-click an enabled event and select Disable.
5
To enable an event, use one of the following methods:
•
Select one or more disabled events and click Enable. (Use the Shift or Ctrl keys to select multiple events.)
•
Select a disabled event, place your cursor in the corresponding Status cell, click the arrow control and select Enabled from the drop-down menu.
•
Right-click a disabled event and select Enable.
* 
NOTE: You can also disable or enable an event using the Disable/Enable tool bar button at the top of the Event Details pane on a Search Results page.

Make changes and run a report

1
To test Authentication Services auditing, make some changes to the host being monitored.
For example:
•
change the Unix name of a Unix-enabled Active Directory group
•
rename an NIS object within Active Directory
•
move an Authentication Services computer object in an Active Directory domain
2
Select Start | All Programs | Quest | Change Auditor | Change Auditor Client to review the events generated.
3
Open the Searches tab.
4
Expand the Shared | Built-in | Authentication Services folder in the left pane.
5
Locate and double-click All Authentication Services events in last 30 days.
A new Search Results tab is added to the client displaying the events that were captured.
6
Double-click an event from the Search Results grid to display the event details for the selected event.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating