Chat now with support
Chat with Support

Change Auditor 7.1.1 - User Guide

Change Auditor Overview Agent Deployment Change Auditor Client Overview Overview Page Searches Search Results and Event Details Custom Searches and Search Properties Enable Alert Notifications Administration Tasks Agent Configurations Coordinator Configuration Purging and Archiving your Change Auditor Database Disable Private Alerts and Reports Generate and Schedule Reports SQL Reporting Services Configuration Change Auditor User Interface Authorization Client Authentication Certificate authentication for client coordinator communication Integrating with On Demand Audit Enable/Disable Event Auditing Account Exclusion Registry Auditing Service Auditing Agent Statistics and Logs Coordinator Statistics and Logs Change Auditor Commands Change Auditor Email Tags

Account Exclusion

•
Introduction
•
Excluded Accounts Auditing page
•
Excluded Accounts templates
•
Excluded Accounts wizard

Introduction

Account exclusion allows you to define a list of trusted accounts to exclude from auditing. This enables you to exclude events generated by accounts that make a large number of changes or by accounts which are trusted.

To use account exclusion, you must first define the user/computer accounts that can make changes without triggering an event in Change Auditor:

1
Create an Excluded Accounts template which specifies the user and/or computer accounts that are to be excluded from the auditing process. For more information on creating a template, refer to Excluded Accounts templates.
2
Add this template to an agent configuration. For more information on how to add a template to an agent configuration, refer to Define agent configurations.
3
Assign the agent configuration to Change Auditor agents. For more information on how to assign an agent configuration to an agent, refer to Assign agent configurations to server agents.

Excluded Accounts Auditing page

The Excluded Accounts Auditing page is displayed when Excluded Accounts is selected from the Auditing task in the navigation pane of the Administration Tasks tab. From this page you can launch the Excluded Accounts wizard to create a new template. You can also edit existing templates, disable/enable templates, and remove templates that are no longer being used.

The Excluded Accounts Auditing page contains an expandable view of all the Excluded Accounts templates that have been defined. To add a new template to this list, use the Add tool bar button. Once added, the following information is provided for each Excluded Accounts template:

Template
Displays the name assigned to the template when it was created.
Status
Indicates whether the template is enabled or disabled. To enable/disable the template, place your cursor in this Status cell, click the arrow control and select the appropriate option from the drop-down menu.
Account
This field is used for filtering data.
Operations
If specified, displays the event classes and/or facilities specified on the first page of the wizard that are to be excluded for the account.
 

Click the expansion box to the left of the Template Name to expand this view and display the following details about the template:

Type
Displays the type of account (i.e., user, computer or group) selected for exclusion as specified on the second page of the wizard.
Account
Displays the name of the account selected for exclusion.
Display Name
If available, displays the display name assigned to the excluded accounts listed.

Excluded Accounts templates

* 
NOTE: The cells directly under the main heading rows are used for filtering data. That is, as you enter characters into these cells, the client will redisplay the templates that meet the search criteria (i.e., comparison operator and characters entered). For more details about using the data filtering function provided throughout the client, see Filter data.

To exclude accounts from auditing, you must first create an Excluded Accounts template which specifies the user or computer accounts that are to be excluded. You can then add this template to an agent configuration, which then needs to be assigned to the appropriate agents.

To create an Excluded Accounts template:
1
Open the Administration Tasks tab and click Auditing.
2
Select Excluded Accounts (under the Configuration heading in the Auditing task list) to open the Excluded Accounts Auditing page.
3
Click Add to start the Excluded Accounts wizard which will step you through the process of creating an Excluded Accounts template.
4
On the first page of the wizard, enter the following information:
•
Template Name - Enter a name for the template.
•
Optionally select the facilities/event classes to be excluded.
•
To add individual event classes, select one or more events from the displayed list and click Add | Add This Event.
•
To add all the events in a facility, select an event from the facility and click Add | Add All Events in Facility.
After providing a name and optionally selecting the facilities/event classes to be excluded, click Next.
5
On the second page of the wizard, select the accounts that are to be excluded from auditing.
Use the Browse or Search pages to locate and select the account to be excluded. Click Add to add the selected account to the list box at the bottom of the page.
If required, use the Forest drop-down box to select in which forest the objects reside. Foreign agent forests may require foreign forests credentials which can be entered on the Credentials Required dialog.
Repeat this step to add additional accounts to the exclusion list.
6
(Optional) To specify a wildcard search expression to dynamically exclude additional user accounts from auditing, click Next.
On the Select Accounts to Exclude using Wildcards page, add the accounts to be excluded from auditing. In the text box, enter the wildcard expression (string of characters and/or wildcard character) to be used to search the Domain(NetBIOS)\NT 4 account name for matching users:
•
Use an asterisk (*) to substitute zero or more alphanumeric characters.
•
Use a question mark (?) to substitute a single alphanumeric character.
Click Add to add the string to the Account list.
* 
NOTE: This page should be used to exclude multiple users that match the wildcard search expression. Explicitly named user accounts must be specified on the previous page of the wizard.
7
After specifying the accounts to be excluded, click Finish to create the template without assigning it to an agent configuration.
Clicking Finish creates the template, closes the wizard and returns to the Excluded Accounts Auditing page, where the newly created template will now be listed.
8
To create the template and assign it to an agent configuration, expand the Finish button and click Finish and Assign to Agent Configuration.
This displays the Configuration Setup dialog, allowing you to select the agent configuration to which the template is to be assigned.
 
* 
NOTE: Back on the Excluded Accounts Auditing page, you can also use the Assign tool bar button to assign the selected template to an agent configuration. Clicking this button will display the Configuration Setup dialog allowing you to select the agent configuration to which this template is to be assigned.
9
On the Agent Configuration page, select the agents assigned to use the modified agent configuration and click Refresh Configuration to ensure the agents are using the latest configuration.
To modify an Excluded Accounts template:
* 
NOTE: If you do not refresh the agent’s configuration, the agent will automatically check for a new agent configuration based on the polling interval setting (located on the System Settings tab of the Configuration Setup dialog). The default is every 15 minutes.
1
On the Excluded Accounts Auditing page, select the template to be modified and click Edit.
2
This displays the Excluded Accounts wizard, where you can modify the current list of accounts included in the template.
3
Click Finish or expand the Finish button and click Finish and Assign to Agent Configuration.
To disable an Excluded Accounts template:

Disabling allows you to temporarily stop excluding the specified accounts without having to remove the auditing template.

1
On the Auditing page, use one of the following methods to disable an auditing template:
•
Place your cursor in the Status cell for the template to be disabled, click the arrow control and select Disabled.
•
Right-click the template to be disabled and select Disable.
The entry in the Status column for the template will change to ‘Disabled’.
2
To re-enable the auditing template, use the Enable option in either the Status cell or right-click menu.
To delete an Excluded Accounts template:
1
On the Auditing page, select the template to be deleted and click Delete | Delete Template.
2
A dialog will be displayed confirming that you want to delete the selected template. Click Yes.
To delete an account from an Excluded Accounts template:
1
On the Excluded Accounts Auditing page, select the account to be deleted and click Delete | Delete Excluded Account,
2
A dialog will be displayed confirming that you want to delete the account from the template. Click Yes.
* 
NOTE: If the account is the last one in the template, deleting this account will also delete the template.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating