Change Auditor 7.1.1 - Event Reference Guide

Change Auditor Internal Auditing Custom Registry Monitoring Fault Tolerance Local Group Monitoring Local User Monitoring Service Monitoring System Events Threat Detection Events

Log Events

Change Auditor Coordinator Service event log Change Auditor Service event log

Registry events Local Groups events Service events

Fault Tolerance

Table 3. Fault Tolerance events
Event	Description	Severity
Change Auditor Agent Connected	Created when a Change Auditor agent connects to the Change Auditor coordinator service.	Low
Change Auditor Agent Disconnected	Created when a Change Auditor agent disconnects from the Change Auditor coordinator service.	Medium
Change Auditor Agent Lost Heartbeat	Created when a Change Auditor agent has lost heartbeat and is considered inactive.	Low
Change Auditor Agent Restarted	Created when a Change Auditor agent is restarted.	Low
Change Auditor Agent Uninstalled	Created when a Change Auditor agent is uninstalled.	Low
Topology Server Added	Created when a Change Auditor coordinator is notified that a new server has been added to the topology.	Low
Topology Server Removed	Created when a Change Auditor coordinator is notified that a server has been removed from the topology.	Low
Topology Workstation Added	Created when a Change Auditor coordinator is notified that a workstation has been added to the topology.	Low

Local Group Monitoring

Table 4. Local Group Monitoring events
Event	Description	Severity
Local Group Added	Created when a local group is added to a member server using the MMC Local Users and Groups snap-in or the NET LOCALGROUP command line.	Medium
Local Group Removed	Created when a local group is removed from a member server using the MMC Local Users and Groups snap-in or the NET LOCALGROUP command line.	Medium
Local Group Renamed	Created when a local group is renamed on a member server using the MMC Local Users and Groups snap-in.	Medium
Member Added to Local Group	Created when group or user members are added to a local group on a member server using the MMC Local Users and Groups snap-in or the NET LOCALGROUP command line.	Medium
Member Removed from Local Group	Created when group or user members are removed from a local group on a member server using the MMC Local Users and Groups snap-in or the NET LOCALGROUP command line.	Medium

Local User Monitoring

Table 5. Local User Monitoring events
Event	Description	Severity
Account Disabled for Local User	Created when a local user account is disabled using the MMC Local Users and Computers snap-in or the NET USER/ACTIVE command line.	Medium
Account Enabled for Local User	Created when a local user account is enabled using the MMC Local Users and Computers snap-in or the NET USER/ACTIVE command line.	Medium
Account Expiration Changed for Local User	Created when the expiration date/time is changed for a local user account.	Medium
Active Session Limit Changed for Local User	Created when the Active session limit timeout value is changed in the Terminal Services Session settings for a user account.	Medium
Allow Reconnection Option Changed for Local User	Created when the Allow reconnection option is changed in the Terminal Services Environment for a user account.	Medium
Can't Change Password Changed for Local User	Created when the User can’t change password option is enabled or disabled for a local user account.	Medium
Connect Client Drives at Logon Changed for Local User	Created when the Connect client drives at logon option is changed in the Terminal Services Environment for a user account.	Medium
Connect Client Printers at Logon Changed for Local User	Created when the Connect client printers at logon option is changed in the Terminal Services Environment for a user account.	Medium
Default to Main Client Printer Changed for Local User	Created when the Default to main client printer option is changed in the Terminal Services Environment for a user account.	Medium
Deny This User Terminal Services Permission Changed for Local User	Created when the Deny this user permission to log on to any Terminal Server option is changed in the Terminal Services Profile settings for a local user account on a member server.	Medium
Dial-in Callback Number Changed for Local User	Created when the Callback number is changed in the Remote Access Dial-in and VPN settings for a local user account on a member server.	Medium
Dial-in Callback Options Changed for Local User	Created when the Callback options setting is changed in the Remote Access Dial-in and VPN settings for a local user account on a member server.	Medium
Dial-in Static IP Address Changed for Local User	Created when the Assign a Static IP Address setting is changed in the Remote Access Dial-in and VPN settings for a local user account on a member server.	Medium
Dial-in Static Routes Changed for Local User	Created when the Apply Static Routes setting is changed in the Remote Access Dial-in and VPN settings for a local user account on a member server.	Medium
Dial-in Verify Caller-ID Changed for Local User	Created when the caller-ID setting is changed in the Remote Access Dial-in and VPN settings for a local user account on a member server.	Medium
Disconnected Session Timeout Changed for Local User	Created when the End a disconnected session timeout value is changed in the Terminal Services Session settings for a user account.	Medium
Enable Remote Control Changed for Local User	Created when the Enable remote control option is changed in the Terminal Services Remote Control settings for a user account.	Medium
Home Folder Mapped Drive Changed for Local User	Created when the home folder remote mapped drive for a user account is changed using the MMC Local Users and Groups snap-in.	Medium
Home Folder Path Changed for Local User	Created when the home folder local or remote path for a user account is changed using the MMC Local Users and Groups snap-in or NET USER/HOMEDIR command line.	Medium
Idle Session Limit Changed for Local Users	Created when the Idle session limit timeout value is changed in the Terminal Services Environment for a user account.	Medium
Local User Account Locked	Created when the number of successive failed logon attempts using a local user account on a member server exceeds the threshold set for the account lockout policy on that server.	Medium
Local User Account Unlocked	Created when a local user account is unlocked by an administrator. The account can be unlocked using the MMC Local Users and Computers snap-in.	Medium
Local User Added	Created when a local user is added to a member server using the MMC Local Users and Groups snap-in or the NET USER command line.	Medium
Local User badPwdCount Changed	Created when a logon attempt using a local user account on a member server fails due to an incorrect password.	Medium
Local User Logged On	Created when a user logs on using a local user account on a member server.	Medium
Local User Removed	Created when a local user is removed from a member server using the MMC Local Users and Groups snap-in or the NET USER command line.	Medium
Local User Renamed	Created when a local user is renamed on a member server using the MMC Local Users and Groups snap-in.	Medium
Logon Program Filename Changed for Local User	Created when the starting program filename is changed in the Terminal Services Environment for a user account.	Medium
Logon Program Folder Changed for Local User	Created when the logon program folder is changed in the Terminal Services Environment for a user account.	Medium
Logon Script Changed for Local User	Created when the logon script for a local user account is changed using the MMC Local Users and Groups snap-in or NET USER/SCRIPTPATH command line.	Medium
Must Change Password At Next Logon Changed for Local User	Created when the User must change password at next logon option is enabled or disabled for a local user account.	Medium
Password Changed for Local User	Created when the password for a local user account is changed.	Medium
Password Never Expires Changed for Local User	Created when the Password Never Expires option is enabled or disabled for a local user account.	Medium
Password Required Changed for Local User	Created when the Password Required option is enabled or disabled for a local user account.	Medium
Profile Path Changed for Local User	Created when the path profile for a local user account is changed using the MMC Local Users and Groups snap-in or NET USER/PROFILEPATH command line.	Medium
Remote Access Permission Changed for Local User	Created when the Remote access permission (Dial-in or VPN) option is changed in the Remote Access Dial-in and VPN settings for a local user account on a member server.	Medium
Remote Control Level of Control Changed for Local User	Created when the Level of control option is changed in the Terminal Services Remote Control settings for a user account.	Medium
Remote Control Require User's Permission Changed for Local User	Created when the Require User’s Permission option is changed in the Terminal Services Remote Control settings for a user account.	Medium
Session Limit Action Changed for Local User	Created when the When session limit is reached or connection is broken option is changed in the Terminal Services Environment for a user account.	Medium
Start the Following Program at Logon Changed for Local User	Created when the Start following programs at logon option is changed in the Terminal Services Environment for a user account.	Medium
Terminal Services Home Folder Mapped Drive Changed for Local User	Created when the Terminal Services home folder remote mapped drive is changed in the Terminal Services Profile settings for a local user account on a member server.	Medium
Terminal Services Home Folder Path Changed for Local User	Created when the Terminal Services home folder local or remote path is changed in the Terminal Services Profile settings for a local user account on a member server.	Medium
Terminal Services Profile Path Changed for Local User	Created when the profile path is changed in the Terminal Services Profile settings for a local user account on a member server.	Medium

Service Monitoring

Table 6. Service Monitoring events
Event	Description	Severity
Service Account Changed	Created when a service account is changed.	High
Service Dependencies Changed	Created when a dependency for a service is changed.	Medium
Service Paused	Created when a service is paused.	Medium
Service Recovery Actions Changed	Created when the recovery actions for a service is changed.	Medium
Service Resumed	Created when a service is resumed after it has been paused.	Medium
Service Start Type Changed	Created when the start type of a service is changed.	Medium
Service Started	Created when a service is started.	Medium
Service Stopped	Created when a service is stopped.	Medium

Please select your product:

To serve you better, please complete the Purpose of your Chat:

Recommended Solutions for Your Problem

Change Auditor 7.1.1 - Event Reference Guide

Fault Tolerance

Local Group Monitoring

Local User Monitoring

Service Monitoring