Change Auditor for Active Directory Queries 7.1.1

In addition to the All AD Query Events report, Change Auditor for Active Directory Queries ships with some additional Active Directory Query reports, which are located in the AD Query folder in the explorer view.

To run a more specific AD Query report:

Open the Searches tab.

In the explorer view, expand the Shared | Built-in | AD Query folder.

Locate and double-click one of the AD Query searches in the right-hand pane.

This will display a new Search Results page displaying the AD Query events that meet the search criteria defined in the selected search.


	NOTE: By default, the AD Query reports display additional LDAP details (such as, LDAP Occurrences, LDAP Results, etc.) in the Search Results page.

Create custom AD Query search

The following scenario explains how to use the What tab to create custom AD query searches.

NOTE: If you wanted to, you can use the other search properties tabs to define additional criteria:

•

Who - allows you to search for events generated by a specific user, computer or group

•

Where - allows you to search for events captured by a specific agent or within a specific domain or site

•

When - allows you to search for events that occurred within a specific date/time range

•

Origin - allows you to search for events that originated from a specific workstation or server

To search Active Directory containers for AD queries:

Open the Searches page.

In the explorer view, expand and select the folder where you want to save your search.

Selecting the Private folder will create a search that only you can run and view, whereas selecting the Shared folder will create a search which can be run and viewed by all Change Auditor users.

Click New.

On the Info tab, enter a name and description for the search.

Open the What tab, expand Add and select Subsystem | AD Query. This opens the Add Active Directory Container dialog.

On the Add Active Directory Container dialog, select one of the following options to define the scope of coverage:

•

All Active Directory Objects - select to search all objects.

•

This Object - select to search the selected objects only.

•

This Object and Child Objects Only - select to search the selected object) and its direct child objects.

•

This Object and All Child Objects - select to search the selected objects and all subordinate objects (in all levels).

•

Members of this group - select this option to show changes made to users in a specified group. Nested groups are not supported.


	NOTE: You cannot exclude selections or use the *Like wildcard option when the scope is specified as Members of this group.

When a scope other than All Active Directory Objects is selected, the directory object picker will be activated allowing you to select the objects to include in the search definition.

Use the Browse or Search page to search your environment to locate and select the Active Directory containers to include.

If required, use the Forest drop-down box to select in which forest the objects reside. Foreign agent forests may require foreign forests credentials which can be entered on the Credentials Required dialog.

Use the Options page to view or modify the search options to be used to retrieve directory objects.

In addition, you can optionally enter one or more AD query parameters to be included in the search definition:

•

Filter - allows you to search for a filter string used in a query. This field uses the Like operator; therefore, you can enter a partial string of characters to have Change Auditor return any queries that use a filter string that contains the characters entered.

•

Attributes - allows you to search for attributes that are being queried. This field uses the Like operator; therefore, you can enter a partial string of characters to have Change Auditor return any queries that query attributes that contain the characters entered.

•

Results >= - allows you to search for queries that have returned a specific number of results. Enter (or use the arrow controls to specify) the number of results to be included in the search definition and Change Auditor will display the queries that have returned results equal to or greater than the number entered.

•

Elapsed (ms) >= - allows you to search for queries that take a certain amount of time to complete. Enter (or use the arrow controls to specify) the number of milliseconds to be included in the search definition and Change Auditor will display the queries that took the specified number of milliseconds or longer to run.

•

Transports - allows you to specify the type of transport protocols used to secure LDAP operation or LDAP queries. To include a specific transport, clear the All Transports check box.

•

All Transports - select to include LDAP operation or LDAP queries regardless of the transport protocol used (Default)

•

SSL/TLS - select to include LDAP operation or LDAP queries that are secured using SSL or TLS technology

•

Kerberos- select to include LDAP operation or LDAP queries that are signed using Kerberos-based encryption

•

Simple Bind - select to include LDAP operation or LDAP queries that are secured using simple bind authentication (neither SSL\TLS or Kerberos used)

•

Port - select to identify a specific port used for communication


	NOTE: When you clear the All Transports check box and select both the SSL/TLS and Kerberos check boxes, only AD queries using both of these transport protocols will be included in the search results.


	NOTE: For pre-5.5 LDAP Query events, this field is NULL in the database; therefore, ‘All Transports’ will be included regardless of this setting.

When you specify more than one AD query parameter, Change Auditor uses the ‘OR’ operator and will return AD Query events that meet any of the AD query parameters specified for the selected Active Directory container.

Once you have selected an Active Directory container (and any AD query parameters) to be included, click the Add button to add it to the Selection list at the bottom of the dialog.


	NOTE: Select the Exclude the Above Selection(s) check box if you want to search for changes to all Active Directory containers EXCEPT those listed in the ‘what’ list.


	NOTE: Select the Runtime Prompt check box on this dialog to prompt for an Active Directory container every time the search is run.

Once you have selected the Active Directory container(s) to be included in the search, click the OK button to save your selection and close the dialog.

Once you have defined the search criteria, you can either save the search definition or run the search.

•

To save the search definition without running it, click Save.

•

To save and run the search, click Run.

When this search is run, Change Auditor will search for AD Query events based on the search criteria specified on the What tab and display the results in a new search results page.

To search for an object that already has an audited AD Query event in the database:

Open the Searches page.

In the explorer view, expand and select the folder where you want to save your search.

Selecting the Private folder will create a search that only you can run and view, whereas selecting the Shared folder will create a search which can be run and viewed by all Change Auditor users.

Click the New tool bar button at the top of the Searches page (or right-click a folder and select the New | New Search menu command).

On the Info tab, enter a name and description for the search.

Open the What tab, expand Add with Events and select Subsystem | AD Query.

On the Add Active Directory Container dialog, select an object from the list.

Click the Add button to add it to the selection list at the bottom of the page.

Click OK to save your selection and close the dialog.

Once you have defined your search, you can either save the search definition or run the search.

•

To save the search definition without running it, click Save.

•

To save and run the search, click Run.

When this search runs, Change Auditor searches for the AD Query events based on the search criteria specified on the What tab and display the results in a new search results page.