Chat now with support
Chat with Support

Change Auditor for Logon Activity 7.1.1 - User Guide

User Logon Activity Searches/Reports

•
Introduction
•
Built-in logon activity searches
•
Create custom user logon activity searches
•
Search Results

Introduction

You can run built-in searches to retrieve user logon activity captured by deployed Change Auditor server and workstation agents. In addition, you can create custom queries to search for specific user logon activities that need to be tracked in your environment.

 

Built-in logon activity searches

To see a complete list of built-in reports, see the Change Auditor Built-in Reports Reference Guide.

To run the All Logons in Past 24 hours search:

Running the All Logons in the Past 24 hours search will retrieve the all user logon activities for monitored servers and workstations.

1
Open the Searches page.
2
Expand and select the Shared | Built-in | Logon Activity folder to display the built-in searches available.
3
In the right-hand pane, locate the All Logons in the Past 24 hours search and use one of the following methods to run the selected search:
•
Double-click a search definition
•
Right-click a search definition and click the Run menu command
•
Select the search definition and click the Run tool bar button at the top of the Searches page
4
A new Search Results page appears populated with the events that met the search criteria.

Create custom user logon activity searches

The following procedures explain how to user the What tab to create custom user logon activity event queries.
 
* 
NOTE: If you wanted to, you can use the other search properties tabs to define additional criteria:
•
Who - allows you to search for events generated by a specific user, computer or group
•
Where - allows you to search for events captured by a specific agent or within a specific domain or site
•
When - allows you to search for events that occurred within a specific date/time range
•
Origin - allows you to search for events that originated from a specific workstation or server
To search for all network logon events captured this week:

This search captures both successful and failed logon attempts from a remote computer on the network.

* 
NOTE: The network logon events are disabled by default and must first be enabled in the client before they will be captured. Use the Audit Events page on the Administration Tasks tab to enable these events.
1
Open the Searches page.
2
In the explorer view (left pane), expand and select the folder where you want to save your search.
Select the Private folder to create a search that only you can run and view. Select the Shared folder to create a search which can be run and viewed by all Change Auditor users.
3
Click New.
4
On the Info tab, enter a name and description for the search.
5
Open the What tab, expand Add and select Subsystem | Logons.
6
On the Add Logons dialog, select Network, click Add to add it to the selection list, and click OK.
7
Click Run to save and run the newly created search.
A new Search Results page is populated with the results of your search.
To search for a specific logon event by failure reason or status code:

This search captures logon events that contain the specified failure reason or status code.

1
Open the Searches page.
2
In the explorer view (left pane), expand and select the folder where you want to save your search.
Select the Private folder to create a search that only you can run and view. Select the Shared folder to create a search which can be run and viewed by all Change Auditor users.
3
Click New.
4
On the Info tab, enter a name and description for the search.
5
Open the What tab, expand Add and select Subsystem | Logons.
* 
NOTE: Alternatively, you can use Add with Events | Subsystem | Logons to select an entry that already has an event in the database.
6
On the Add Logons dialog, select the logon type.
7
Click to enable the Logon Failure Reason filter, select the comparison operator to use (Like or Not Like) and enter the description. You can also use the wildcard character * for a partial search.
- or -
Click to enable the Logon Status Code filter, select the comparison operator to use (Equals or Does not equal) and enter the code.
8
Click Add to add the filter, Remove to remove a filter, or Update to apply a change to the filter, then click OK.
9
Click Run to save and run the newly created search.
A new Search Results page is populated with the results of your search.
To search a specific user’s logon activity over a specific time period:

This scenario uses the Runtime Prompt options to create a generic search definition where you can then specify the user and time interval each time you run the search.

1
Open the Searches page.
2
In the explorer view (left pane), expand and select the folder where you want to save your search.
Select the Private folder to create a search that only you can run and view. Select the Shared folder to create a search which can be run and viewed by all Change Auditor users.
3
Click New.
4
Open the Info tab, enter a name and description for the search.
5
Open the Who tab and select Runtime Prompt to specify the user to be audited each time you run this search.
6
Open the What tab, expand Add and select Subsystem | Logons.
7
On the Add Logons dialog, select each logon type and click Add. (You will need to add each logon type individually). Click OK to save your selections and close the dialog.
8
Open the When tab and select Runtime Prompt to specify the time interval each time you run this search.
9
Select Run to save and run the search.
10
Since you selected the Runtime Prompt options on both the Who tab and When tab, you will be prompted to specify the user who’s logon activity you want to audit and the time interval to be searched:
•
On the Select Active Directory Objects dialog, use the Browse or Search pages to locate one or more users. Click Add to add the selected user to the list at the bottom of the page. Click Select to save your selection and close the dialog.
•
On the When dialog enter the date range and/or time of day to be searched. Click OK to save your selection and close the dialog.
A new Search Results page will be displayed populated with the results of your search.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating