Chat now with support
Chat with Support

Change Auditor for Active Directory 7.2 - User Guide

Change Auditor for Active Directory Overview Custom Active Directory Searches and Reports Custom Active Directory Object Auditing Custom Active Directory Attribute Auditing Member of Group Auditing Active Directory Federation Services Auditing ADAM (AD LDS) Auditing Active Directory Database Auditing Active Roles Integration Quest GPOADmin Integration Active Directory Protection Event Details Pane

GPOADmin and Change Auditor integration process

Some GPOADmin events recorded by Change Auditor have the initiator name in the event. The initiator is the name of the account logged in to the GPOADmin client performing actions in GPOADmin. However, the initiator name is not always populated due to how the GPO is processed in Active Directory.

The following is a high-level overview of typical Change Auditor events recorded when modifying a GPO using GPOADmin:

1
A user logged in to GPOADmin to modify a GPO setting.
Change Auditor records the following events:
An event for the creation of a new GPO (the working copy GPO). The “who” in the event shows the GPOADmin service account and the initiator and the name of the user who was logged in to GPOADmin.
A rename event for the new GPO.
A permission change for the new GPO, granting the user logged in to GPOADmin rights to the working copy GPO.
Modification events performed on the working copy GPO. The who of these events show the user logged in to GPOADmin and the initiator blank as the initiator and the who are the same.
2
Once the GPO is checked in, there are number of events recorded with the “who” being the GPOADmin service account and the initiator blank. This is because importing the settings from the working copy to the live copy is performed in Sysvol, outside of GPOADmin. It is the same processes that are performed if the GPO was edited in GPMC. GPOADmin has no knowledge of what is being performed with these Active Directory operations and cannot communicate to Change Auditor who the initiator is as they happened outside of all the GPOADmin processes.
3
Approval is requested in GPOADmin. The approver approves and deploys the GPO.
This generates Change Auditor events where the “who” is the GPOADmin service account and the initiator is the name of the approver.
Events where the initiator is the name of the approver and the action logged was that the version of the GPO attribute was changed, are the events that show when the GPO was deployed and who performed the deployment.
4
GPOADmin provides the initiator name to Change Auditor using Change Auditor APIs.
You will see a considerable amount Change Auditor GPO events generated when performing actions in GPOADmin. This is due to how GPOADmin processes GPOs and how they are deployed to the live environment.

Client components added to Change Auditor

You can view initiator information retrieved from GPOADmin on the Search Results page in the Change Auditor client. You can use the following to display this additional information:

•
A field on the Event Details pane that displays the additional information retrieved from GPOADmin.
•
A built-in report that retrieves all Active Directory changes, including those initiated by GPOADmin. Running this report also displays the Initiator UserName and EventSource columns in the search results.
•
Columns on the Layout tab that allow you to add the event source and initiator information to other search definitions.
•
Option on the Who tab that allows you to create a custom search to search for events initiated by a specific user, including those initiated by GPOADmin.
•
Email tags to include the additional information in alert email notifications.
Event Details pane

A Source field is available in the Event Details pane that displays the name of the application from which the change event was generated (such as, Change Auditor, Active Roles, or GPOADmin). In addition, for change events generated by GPOADmin or Active Roles, the name of the user account that initiated the change is displayed in parenthesis.

All Active Directory events including Active Roles/GPOADmin initiator built-in report

A built-in report is available that retrieves events for all Active Directory changes, including those initiated by GPOADmin and Active Roles. The search definition for this report also includes the initiator information (Initiator UserName and EventSource columns) in the search results.

To execute the built-in GPOADmin search:
1
Open the Searches page.
2
Expand and select the Shared | Built-in | All Events folder to display the built-in searches available.
3
Locate the All Active Directory Events Including ActiveRoles/GPOADmin Initiator search and use one of the following methods to run the selected search:
•
Double-click a search definition
•
Right-click a search definition and select Run
•
Select the search definition and click Run
A new Search Results page appears populated with the audited events that met the search criteria, including the Initiator UserName and EventSource information.
Layout tab

Columns are added to the database to record the information retrieved from GPOADmin or Active Roles. These columns are not displayed by default on a Search Results page for most searches. However, using the Layout tab you can add the following information to all searches:

•
EventSource - for all events, the name of the application from which the event was generated (i.e., Change Auditor, Active Roles, or GPOADmin).
•
Initiator Mail - for events generated by GPOADmin or Active Roles, the email address of the user that initiated the change.
•
Initiator SID - for events generated by GPOADmin or Active Roles, the SID of the user that initiated the change.
•
Initiator UserName - for events generated by GPOADmin or Active Roles, the name of the user that initiated the change.
To add new columns to the search results:
1
Open the Layout tab.
2
Locate the new columns (EventSource, Initiator Mail, Initiator SID, and/or Initiator UserName) in the Unselected Columns table.
3
Select the columns to add and use the right arrow button to move them to the Selected Columns table.
The column will be added to the bottom of the list or beneath the highlighted column in the Selected Columns table.
You can also drag a column to the Selected Columns table.
4
The Selected Columns table also displays the order the columns will be presented. To rearrange the columns, use the up and down arrow buttons located to the right of the Selected Columns table.
You can also drag columns within this table to define the order.
Who tab

When using the Who tab to retrieve change events initiated by a specific user, changes initiated by GPOADmin will not automatically be included in the search. A check is available in the Who tab which instructs Change Auditor to retrieve all change events initiated by the specified user, including those made through GPOADmin.

To include GPOADmin initiated events:
1
Open the Searches page.
2
In the explorer view (left pane), expand and select the folder where you want to save your search (e.g., Shared or Private).
3
Click New to enable the Search Properties tabs.
4
On the Who tab, click Add to add an active user, computer or group to the ‘who’ list.
5
On the Select one or more Directory Objects dialog, use either the Browse or Search page to search your environment to locate the user, computer or group to be included.
Once you have located the directory object to be included, select it and click Add.
Repeat this step to include each additional directory object.
6
After selecting one or more directory objects, click Select to save your selection and close the dialog.
7
Back on the Who tab, select the Include Event Source Initiator check box.
* 
NOTE: Including the event source initiator, may have a noticeable effect on the search performance, depending on the size of the database and the number of results returned in the search.
When this search is run, Change Auditor retrieves all events made by the specified user account, including those initiated by GPOADmin.
In addition, when this check box is selected the Initiator UserName column is added to the Search Results grid for this search. For events initiated by GPOADmin, this column contains the user account that was logged into the GPOADmin console.
Email tags

The following email tags are available which can be added to the event details of alert email notifications:

•
%EVENTSOURCE% - indicates the application where the change event came from: Change Auditor, Active Roles, or GPOADmin.
•
%INITIATORMAIL% - for events generated by GPOADmin or Active Roles, the email address of the user that initiated the event.
•
%INITIATORSID% - for events generated by GPOADmin or Active Roles, the SID of the user that initiated the event.
•
%INITIATORUSERNAME% - for events generated by GPOADmin or Active Roles, the name of the user that initiated the event.

See the Change Auditor User Guide for more information on how to configure and enable email notifications and customize email content.

Troubleshooting tips

If GPO events initiated by GPOADmin do not appear in the Change Auditor client as expected, check the following:

•
GPOADmin/Change Auditor integration is through the SDK. Once configured, Change Auditor agents receive the configured settings in the next configuration polling interval (default every 15 minutes). Before the configuration is received by a Change Auditor agent, GPOADmin initiator and comment information will not be available for GPO events.
To make sure Change Auditor has the latest GPOADmin configuration, manually refresh the agent configuration (Refresh Configuration on Agent Configuration Page on the Administration Tasks tab).
* 
NOTE: This delay is only applicable when you first install GPOADmin/Change Auditor or when the service account in GPOADmin has changed.
•
Verify that the GPO is not being protected by Change Auditor’s Group Policy Object Protection feature. When configured, Change Auditor prevents all changes to GPOs, regardless of the tool that is used to make the change (including GPOADmin).
•
GPOADmin only sends initiator and comment information to Change Auditor for GPO deployment, working copy check in, and working copy check out operations.
•
It may be necessary to restart the GPOADmin service before correct initiator information can be retrieve by Change Auditor. Before restarting the GPOADmin service, check the Change Auditor coordinator’s status to ensure that the coordinator has been initialized and is running.

Active Directory Protection

•
Introduction
•
Active Directory object protection
•
Group Policy Object protection
•
ADAM (AD LDS) object protection
•
Active Directory Database protection
•
Setting extra security on protected objects
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating