Change Auditor 7.1.1 - Web Client User Guide

Chat now with support

Excluded Accounts auditing

Account exclusion allows you to define a list of trusted accounts to exclude are from auditing. This enables you to exclude events generated by accounts that make many changes or by accounts which are trusted.

To use the account exclusion feature, you must first complete the following steps to define the user and computer accounts that can make changes without triggering an event in Change Auditor:

Create an Excluded Accounts template which specifies the user and/or computer accounts to exclude from auditing.

Add this template to an agent configuration. (See Define agent configurations.)

Assign the agent configuration to Change Auditor agents. (See Assign agent configurations to agents.)

Excluded Accounts Auditing page

The Excluded Accounts Auditing page is displayed when Excluded Accounts is selected from the Auditing task list in the navigation pane of the Administration Tasks page. It contains an expandable view of all the Excluded Accounts templates that have been defined. From this page, you can launch the Excluded Accounts wizard to create a template. You can also edit existing templates, disable and enable templates, or remove templates that are no longer being used.


	NOTE: For more information, including a full description of the page, refer to the Change Auditor User Guide.

To create an Excluded Accounts template:

Open the Administration Tasks page.

Click Auditing.

Select Excluded Accounts (under the Configuration heading in the Auditing task list) to open the Excluded Accounts Auditing page.

Click Add to open the Excluded Accounts wizard which steps you through the process of creating an Excluded Accounts template.

Table 32. Excluded Accounts Wizard

Enter a name for the template.

Click Next.

Account Selection

Select the accounts to exclude.

See Directory object picker for a detailed description of this wizard page.

From the Browse or Search page, select an account and click Add to add it to the selection list.

(Optional) To specify a wildcard search expression to dynamically exclude additional user accounts from auditing, use the (Optional) Enter an account name wildcard field.

In the text box, enter the wildcard expression (string of characters and/or wildcard character) to be used to search the Domain (NetBIOS)\NT 4 account name for matching users:

•

Use an asterisk (*) to substitute zero or more alphanumeric characters.

•

Use a question mark (?) to substitute a single alphanumeric character.

Click Add Wildcard to add it to the selection list.

Click Next.

Event/Facility Selection

Select the event classes and facilities to exclude.

Select one of the following options to add it to the selection list:

•

Add | Add This Event to add individual events.

•

Add | Add All Events In Facility to add all events in the selected facility.

Click Finish to save the template and close the wizard.

Forest

The tasks under this heading are used to define custom auditing definitions for your Active Directory forest.

See the following administration task descriptions for more information:

•

Active Directory auditing

•

ADAM (AD LDS) auditing

•

Applications

Active Directory auditing

By default, Change Auditor for Active Directory audits the Enterprise for changes made to the user, group, and computer objects. However, using the Active Directory auditing tasks you can specify where to conduct the audit (Enterprise, an individual object, and so on) and what to audit, such as the object classes, individual attributes, and even users based on group membership.

In addition, if you have Change Auditor for Active Directory Queries licensed, you can specify Active Directory containers to exclude from AD query auditing.

See the following Administration Tasks page descriptions for more information:

•

Active Directory Auditing page

•

AD Attribute Auditing page

•

Member of Group Auditing page

•

AD Query Auditing page

Active Directory Auditing page

The Active Directory Auditing page opens when Active Directory is selected from the Auditing task list in the navigation pane of the Administration Tasks page, and contains an expandable view of the Active Directory objects selected for auditing. Initially, the list box contains an entry for auditing all user, computer, and group object classes in the entire enterprise.


	NOTE: For more information, including a full description of the page, refer to the Quest Change Auditor for Active Directory User Guide.

To add an Active Directory object to the auditing list:

Open the Administration Tasks page.

Click Auditing.

Select Active Directory in the Auditing task list to display the Active Directory Auditing page.

Click Add to open the Active Directory Auditing wizard, which steps you through the process of defining the objects and object classes to audit.

Table 33. Active Directory Auditing Wizard

Select the Active Directory objects to audit.

See Directory object picker for a detailed description of this wizard page.

Select where to conduct the audit:

•

Enterprise

•

This Object

•

This Object and Child Object Only

•

This Object and All Child Objects

If you selected the This Object, This Object and Child Objects Only or This Object and All Child Objects option, use the Browse or Search pages to locate the directory object or container to be audited.

If required, use the Forest drop-down box to select in which forest the objects reside. Foreign agent forests may require foreign forests credentials which can be entered on the Credentials Required dialog.

Click Next.

Object Classes

Select object classes to audit under the selected container.

NOTE: At least 1 object class must be selected for auditing.

Select one or more object classes in the Unaudited Object Class list (left pane)

Click Add to move it to the Audited Object Class list (right pane).

Click Finish to save your selection and close the wizard.