Change Auditor 7.2 - Web Client User Guide

File System protection

To use File System protection, you must first complete the following steps to define the files and folders to protect:

Create a File System Protection template which specifies the files and folders to protect.

Add this template to an agent configuration. (See Define agent configurations.)

Assign the agent configuration to agents. (See Assign agent configurations to agents.)

The following sections go over the File System Protection page and how to create a File System Protection template.

The File System Protection page opens when File System is selected from the Protection task list in the navigation pane of the Administration Tasks page, and contains an expandable view of all the File System Protection templates that have been previously defined. From this page, you can open the File System Protection wizard to specify a file or folder to protect from unauthorized access. You can also edit existing templates, disable and enable templates, and remove templates that are no longer being used.


	NOTE: If you are planning to use multiple File System Protection templates, see the Quest Change Auditor Technical Insight Guide for more information about how multiple protection templates are evaluated.

To create a File System Protection template:

Open the Administration Tasks page.

Click Protection.

Select File System in the Protection task list to open the File System Protection page.

Click Add to open the File System Protection wizard which steps you through the process of defining the files and folders to protect.

Table 50. File System Protection wizard

Enter a name for the template.

Click Next.

File Path Selection

Specify the file system paths to protect.

By default:

•

Protection is for the selected file system path.

•

Includes all subfolders.

•

Applies to both files and folders.

•

All types of protection (Read, Delete, Owner Change, and so on.) is applied.

NOTE: This must be a local path. Auditing and protecting network shares is not supported. To audit or protect those files and folders, deploy an agent on the share's hosting server.

In the Path field, enter the file system path to protect and click Add.

To change the default protection to exclude the subfolders in the selected file system path, click the entry in the Subfolders cell and select No.

To change the default protection to exclude the selected file system from protection, click the entry in the Protect cell and select No.

To change the default protection of files and folders, click the entry in the Applies To cell and select a different option.

To change the default protection of all changes, click the entry in the Protection Type cell and select or clear protection types.

Use the File Mask field to optionally specify a file mask to protect a group of files in the selected file system path. Once you have specified a file mask, click Add to add it to the list at the bottom of the page.

Click Next.

NOTE: Clicking Finish saves the template and closes the wizard.

Schedule when protection is enabled

(Optional) Schedule when the protection is enforced. You can either select to have the protection always run or have it run only during specific times. The times selected are the local agent time where the template is applied.

NOTE: If you have denied specific users or groups the ability to change the protected objects and you have enabled a protection schedule, those users or groups are denied access only during this time. Anytime outside of when the schedule is set to enabled, these denied accounts can access the protected object.

When the schedule is disabled, all options are disabled with it, including any denied access to the specified users.

The scheduling options override all other protection settings.

To enable the protection only during specific times, select the Protection is scheduled option, and define when it should be enabled (hour blocks on a weekly basis).

Click Next.

Enable or disable protection for specific location

(Optional) Control when the protection is enabled based on the location.

Location refers to the computer that is attempting to access the resource that is protected.

NOTE: If you have denied specific users or groups access to protected objects, but you have specified locations that can access the protected object, the denied user or group can access the protected objects from these locations.

The location options override all other protection settings.

Select from the following options:

•

Protect access from all locations: Protection is always enabled regardless of the location.

•

Protect access only from select locations: Protection is only enabled for the locations specified in the list box.

•

Allow access only from select locations: Protection is disabled for the select locations. Enabled everywhere else.

•

Protect access from all unknown locations: All file system requests from locations that cannot be determined by the Change Auditor agent are protected.

Click Next.

Account Access

(Optional) Specify the user or group accounts which are allowed to change the protected objects selected on the previous page.

By default, all users and groups are prevented from changing to the objects selected for protection.

Select to either Allow or Deny access for the selected users or groups. Keep in mind that by selecting Deny, you are allowing all users to change the protected objects except for those selected on this page.

From the Browse or Search page, select a user or group account and click Add to add it to the selection list at the bottom of the page.

Click Finish to save the template and close the wizard.

Change Auditor Client Comparison

The following table shows what Change Auditor features are available in the Change Auditor Windows client and Change Auditor web client.

Table 51. Change Auditor client comparison
Page/Feature	Available in Windows client?	Available in web client?
Overview Page	Yes	Yes
My Favorite Search	Yes	No
Overview Pane: Accounts Overview	No	Yes
Overview Pane: Agent Status: Enterprise	Yes	Yes
Overview Pane: Agent Status: Other	Yes	Yes
Overview Pane: Agent Status: Workstation	Yes	Yes
Overview Pane: Agent Status: <Domain>	Yes	Yes
Overview Pane: Alert History Counts	Yes: Alert History Counts	Yes: Alert History
Overview Pane: Alert History Counts by Query	Yes	Yes
Overview Pane: Coordinator Status: Enterprise	Yes	Yes
Overview Pane: Coordinator Status: <Domain>	Yes	Yes
Overview Pane: Count of Events by Event Class	Yes	Yes
Overview Pane: Count of Events by Facility	Yes	Yes
Overview Pane: Count of Events by Location	Yes	Yes
Overview Pane: Count of Events by Result	Yes	Yes
Overview Pane: Count of Events by Severity	Yes	Yes
Overview Panes: Count of Events by Subsystem	Yes	Yes
Overview Pane: File Access Rights	No	Yes
Overview Pane: File Ownership	No	Yes
Overview Pane: Recent Event Activity	Yes	Yes
Overview Pane: Top Agent Activity	Yes: Top Agent Activity	Yes: Agent Activity
Overview Pane: [Custom View]	No	Yes
Print page	Yes	No
Searches Page	Yes	Yes
Create New Folder	Yes	Yes
Create New Search	Yes	Yes
Run Search Query	Yes	Yes
Print page	Yes	No
Explorer/Folder View	Yes	Yes
Cut \| Paste \| Delete \| Move \| Copy Folder	Yes	Delete only
Rename Folder	Yes	Yes
Export Folder	Yes	No
Import Search	Yes	No
Import Folder	Yes	No
Publish to Quest Knowledge Portal	Yes	No
Expand All \| Collapse All	Yes	No
Searches List	Yes	Yes
Cut \| Paste \| Delete \| Move \| Copy Search	Yes	Delete only
Print	Yes	No
Export Search Query	Yes	No
Run Local Report	Yes	No
Publish to Quest Knowledge Portal	Yes	No
Enable \| Disable Alerts	Yes	Alert tab only
Alert History \| Delete History	Yes	No
Enable \| Disable Report	Yes	Report tab only
Set As My Favorite	Yes	No
Search Properties Tabs	Yes	Yes
Save \| Save As \| Run Search	Yes	Yes
Info Tab: Search Limit	Yes	Yes
Info Tab: Refresh Interval	Yes	No
Info Tab: Show as Widget	No	Yes
Who Tab: Add \| Delete criteria	Yes	Yes
Who Tab: Add Wildcard Expression	Yes: Add button on tab	Yes: Tab on dialog
Who Tab: Add With Events	Yes: Button on tab	Yes: Tab on dialog
Who Tab: Include Event Source Initiator	Yes	Yes
What Tab: Add	Yes	Yes NOTE: Registry, Service, Local Account searches are only available using Add With Events.
What Tab: Add With Events	Yes: Button on tab	Yes: Button on dialogs
What Tab: Delete \| Edit criteria	Yes	Yes
Where Tab: Add \| Delete criteria	Yes	Yes
Where Tab: Add Wildcard Expression	Yes: Add button on tab	Yes: Tab on dialog
Where Tab: Add With Events	Yes: Button on tab	Yes: Tab on dialog
When Tab: Date Interval settings	Yes	Yes
When Tab: Time Interval settings	Yes	Yes
When Tab: Ability to reset settings	Yes	No
Origin Tab: Add \| Delete criteria	Yes	Yes
Origin Tab: Add With Events	Yes: Button on tab	Yes: Tab on dialog
Alert Tab: Enable Alert	Yes	Yes
Alert Tab: Enable Smart Alert	Yes	Yes
Alert Tab: History Search Limit	Yes	Yes
Alert Tab: Configure Email	Yes	Yes
Alert Tab: Events per email setting	Yes: Setting on tab	Yes: Setting on dialog
Alert Tab: Time Zone setting	Yes: Setting on tab	Yes: Setting on dialog
Report Tab: Enable reporting	Yes	Yes
Report Tab: Preview report	Yes	Yes
Report Tab: Launch Report Designer	Yes	Yes
Report Tab: Define report schedule	Yes	Yes
Report Tab: Define report configuration	Yes	Yes
Layout Tab: Select columns	Yes	Yes
Layout Tab: Define sort criteria	Yes	Yes
Layout Tab: Define display results format (grid, bar graph or pie chart)	Yes	No
SQL Tab: Copy	Yes	No
XML Tab: Copy	Yes	No
Search Results Page	Yes	Yes
Data grid view	Yes	Yes
Grid controls to sort, group and filter data	Yes	Yes
Timeline view	No	Yes
Event Details Pane	Yes	Yes
Copy event details	Yes	No
Email event details	Yes	Yes
View knowledge base	Yes	Yes
Add/view comments	Yes	Yes
View user context	Yes	Yes
Run related searches	Yes	Yes
View resource properties	Yes	Yes
Restore value on Active Directory object events	Yes	Yes
Print page	Yes	No
Deployment Page	Yes	No
Agent Statistics Page	Yes	Yes
Access by:	View menu command Agent Status Overview hot spot link	Agent Status Overview hot spot link
Start \| Stop \| Restart agent	Yes	No
Set Agent Uninstalled	Yes	No
Hide \| Show Uninstalled agents	Yes	No
View agent logs	Yes	No
Print page	Yes	No
View resource properties	Yes	No
Coordinator Statistics Page	Yes	Yes
Accessed by:	View menu command Coordinator Status Overview hot spot link	Coordinator Status Overview hot spot link
Set Coordinator Uninstalled	Yes	No
Hide \| Show Uninstalled coordinators	Yes	No
Print page	Yes	No
View coordinator logs	Yes	No
Administration Tasks Page	Yes	Yes
Export/Import setting/templates	Yes	No
Print pages	Yes	No
Configuration Tasks	Yes	Yes
Agent configuration page	Yes	Yes
Coordinator configuration page	Yes	Yes
Purge Jobs page	Yes	Yes
Report Layouts page	Yes	Yes
Private Alerts and Reports page	Yes	No
Application User Interface page	Yes	Yes
Auditing Tasks	Yes	Yes
Audit Events page	Yes	Yes
Excluded Accounts page	Yes	Yes
Active Directory Auditing page	Yes	Yes
Active Directory Attribute Auditing page	Yes	Yes
Member of Group Auditing page	Yes	Yes
Excluded AD Query page	Yes	Yes
ADAM (AD LDS) Auditing page	Yes	Yes
ADAM (AD LDS) Attribute Auditing page	Yes	Yes
Exchange Mailbox page	Yes	Yes
Office 365 page	Yes	No
SQL Auditing page	Yes	Yes
SQL Data Level Auditing page	Yes	No
SharePoint Auditing page	Yes	Yes
File System Auditing page	Yes	Yes
Registry Auditing page	Yes	Yes
Services Auditing page	Yes	Yes
EMC Auditing page	Yes	Yes
NetApp Auditing page	Yes	Yes
FluidFS Auditing page	Yes	Yes
Web Site Auditing page	Yes	Yes
Protection Tasks	Yes	Yes
Active Directory Protection page	Yes	Yes
ADAM (AD LDS) Protection page	Yes	Yes
Group Policy Protection page	Yes	Yes
Exchange Mailbox Protection page	Yes	Yes
File System Protection page	Yes	Yes
Shared Overviews Page	No	Yes
About Change Auditor dialog	Yes	Yes

Please select your product:

To serve you better, please complete the Purpose of your Chat:

Recommended Solutions for Your Problem

Change Auditor 7.2 - Web Client User Guide

File System protection

Change Auditor Client Comparison