Chat now with support
Chat with Support

Change Auditor 7.2 - User Guide

Change Auditor Overview Agent Deployment Change Auditor Client Overview Overview Page Searches Search Results and Event Details Custom Searches and Search Properties Enable Alert Notifications Administration Tasks Agent Configurations Coordinator Configuration Purging and Archiving your Change Auditor Database Disable Private Alerts and Reports Generate and Schedule Reports SQL Reporting Services Configuration Change Auditor User Interface Authorization Client Authentication Certificate authentication for client coordinator communication Integrating with On Demand Audit Enable/Disable Event Auditing Account Exclusion Registry Auditing Service Auditing Agent Statistics and Logs Coordinator Statistics and Logs Change Auditor Commands Change Auditor Email Tags

Explorer view

The left pane of the Searches page displays a hierarchical view of the folders used to manage your search definitions and the built-in reports. This view initially displays the following folders:

Quick Search

Allows you to define a search that is to run as soon as the definition is finished. Unlike other custom searches, this search definition will not be saved unless you click Save As on one of the Search Properties tabs.

Private

Used to store your personal custom searches. Only you can see these searches.

* 
NOTE: A foreign security principal in foreign forests is required for some private searches to function properly.

To store foreign user created searches in Change Auditor:
1. Create a trust between the foreign domain and the domain where Change Auditor is installed.
2. Add the foreign user to any group in the Change Auditor domain. This will cause Windows to create a foreign security principal object in the Change Auditor domain.
Shared

Contains the predefined search definitions provided with Change Auditor and can also be used to store public custom searches. All users can see these searches.

Built-In

Contains all predefined reports.

Searches list

The right pane of the Searches page displays a list of the search definitions or built-in reports contained in the folder selected in the explorer view.

The following information is displayed for each search definition:

 
Table 1. Searches list: Field descriptions
Field
Description

Type

Displays the type of entry: Private Search, Shared Search, Private Alert, Shared Alert or Report.

Alert

Indicates whether an alert has been enabled for the search query. Valid entries for this field are:

•
Enabled: Alerting is enabled for the search query and that at least one transport method is enabled.
•
Disabled: Alerting is disabled for the search query; however at least one transport method is still enabled.

Report

Indicates whether reporting had been enabled for the search query. Valid entries for this field are:

•
Enabled: Reporting is enabled for the search query and a report will be sent to the specified recipients as defined on the Report tab.
•
Disabled: Previously enabled reporting has now been disabled for the search query.

Name

Displays the name assigned to the search definition.

Alert To

Displays the email address of any recipients specified to receive an alert email notification (SMTP).

In addition to an email address or distribution list address, you will see the following parameterized values when the corresponding option has been selected on the Alert Custom Email dialog:

•
%WHO% - Indicates that an alert is to be sent to the user who initiated the change that triggered the alert.
•
%OWNER% - Indicates that an alert is to be sent to the changed user account, the Exchange Mailbox owner or whose mailbox was accessed by another user and their action triggered an alert.
•
%MANAGEDBY% - For events associated with users or groups that are being managed by another account, indicates that an alert is to be sent to the managing user’s email.

Alert Cc

Displays the email address of any ‘carbon copy’ recipients specified to receive an alert email notification.

Alert Bcc

Displays the email address of any ‘blind carbon copy’ recipients specified to receive an alert email notification.

Report To

Displays the email address of any recipients and shared folder specified to receive a report as defined on the Report tab.

Report Cc

Displays the email address of any ‘carbon copy’ recipients specified to receive a report email.

Report Bcc

Displays the email address of any ‘blind carbon copy’ recipients specified to receive a report email.

Double-clicking a search definition will run the selected search and display the results in a new Search Results page.

Search Properties tabs

Located across the bottom of the page, the Search Properties tabbed pages define the criteria or properties which make up the selected search.

* 
NOTE: If the Search Properties tabs are not displayed across the bottom of the Search page, click Show Properties at the top of the page.

The Search Properties tabs displayed are:

•
Info: Allows you to enter a name and description for the search
•
Who: Allows you to search for events generated by a specific user, computer, or group.
•
What: Allows you to search for events based on subsystem, event class, object class, severity, or results.
•
Where: Allows you to search for events captured by a specific agent, domain, site, or server type.
•
When: Allows you to search for events that occurred within a specific date/time range.
•
Origin: Allows you to search for events that originated from a specific workstation or server.
•
Alert: Allows you to enable alerts and define how and where to dispatch alerts.
•
Report: Allows you to enable reporting, specify the report layout template to be used or choose to design your own report layout, and define when and where to send the report.
•
Layout: Allows you to define the data (columns) to be retrieved from the database and the sort order for displaying the retrieved data. The layout defined on this tab applies to both the search results displayed in the client and in the report, if reporting is enabled on the Report tab.
•
SQL: Displays the SQL script used to create the selected search definition.
* 
NOTE: This tab is hidden by default. Use Action | Show SQL Tab to display this tab.
•
XML: Displays the XML representation of the search criteria.
* 
NOTE: This tab is hidden by default. Use Action | Show XML Tab to display this tab.

For a detailed description of the Info, Who, What, Where, Origin and Layout tabs and how to use them to create a custom search, see Custom Searches and Search Properties. For more information about the Alert tab, see Enable Alert Notifications. For more information about the Report tab, see Generate and Schedule Reports.

View a list of available searches

All search definitions, private or shared, custom or built-in, are listed on the Searches page.

To view the search definitions available to all Change Auditor users:
1
Open the Searches page.
2
In the explorer view (left pane), double-click the Shared folder to expand the folder and display a hierarchy of folders.
3
Select a subordinate folder under the Shared folder.
The right pane displays a list of the search definitions that are stored in the selected folder.
4
Double-clicking a search in the right-hand pane runs the search and opens a new Search Results page.
5
Right-clicking a search displays a context menu containing actions that can be taken against the selected search.
To view the search definitions that are only available to you:
1
Open the Searches page.
2
Select the Private folder (or a subordinate folder created under the Private folder) in the explorer view.
The right pane displays a list of the search definitions that are stored in the selected folder.
To view the list of built-in reports (those provided with Change Auditor):
1
Open the Searches page.
2
Expand the Built-in folder in the explorer view.
3
Select a folder under the Built-in folder to view the list of search definitions that are stored in the selected folder.
The right pane displays a list of the search definitions that are stored in the selected folder.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating