Chat now with support
Chat with Support

Quest has tools and processes in place to identify, protect, detect, and remediate vulnerabilities and incidents when they occur, including external security partners. As part of our standard security operations, Quest does not use CrowdStrike in any of our operations. We are reviewing our third parties, and so far, there is minimal affect. It is Quest's policy not to provide further technical details unless they directly impact customer data.

Change Auditor for Windows File Servers 7.4 - User Guide

Make File System changes and run a report

* 
NOTE: If you do not refresh the agent’s configuration, the agent will automatically check for a new agent configuration based on the polling interval setting (located on the System Settings tab of the Configuration Setup dialog). The default is every 15 minutes.
1
To test file system auditing, make some changes to the Windows® file server being monitored.
For example:
•
add a .docx or .txt file
•
change the security permissions on a file (right-click file, open the Security tab and add another user with full control)
•
delete the .txt file
•
add a subfolder
•
change the security permission of the new folder
•
rename the subfolder
2
Select Start | All Programs | Quest | Change Auditor | Change Auditor Client) to review the events generated.
3
Open the Searches tab.
4
Expand the Shared | Built-in | All Events folder in the left pane.
5
Locate and double-click All File System Events in the right pane.
A new Search Results tab is added to the client displaying the Custom File System Monitoring events captured over the last seven days.
6
Select an event from the Search Results grid to display the event details for the selected event.

Troubleshooting steps

* 
NOTE: If the Search Properties tabs are displayed across the bottom of the Search Results page, double-click an event to display the event details for the selected event.

If the Windows file server events do not appear as expected, check the following:

•
Verify that the File System Auditing template is assigned to the agent configuration for your agents.
•
Refresh the specified agent configurations on the Agent Configuration page to ensure the latest File System Auditing template is being used.
•
Verify that you have selected those types of events in the File System Auditing template. (Events tab in the wizard.)
•
Verify that you have included the correct subfolders and files in the File System Auditing template. (Inclusions tab in the wizard.)
* 
NOTE: Entering * will include all subfolders and paths.
•
Verify that you have not excluded the specified subfolders or files in the File System Auditing template. (Exclusions tab in the wizard.)
•
Verify that you have not excluded the process making the file changes in the File System Auditing template. (Last page in the wizard.)

File System Auditing

•
Introduction
•
File System Auditing page
•
File System Auditing templates
•
File System Auditing wizard
•
File System Event settings
•
File System event logging

Introduction

To capture Windows file server events, you must define the files/folders to be audited and the events to be captured:

1
Create a File System Auditing template which specifies the files/folders and events to be audited.
2
Add this template to an agent configuration.
3
Assign the agent configuration to agents.
* 
TIP: Quest recommends a phased approach to setting up file/folder auditing for all servers. A phased approach will allow file/folder auditing to be deployed in stages so that the coordinator performance is not degraded.
* 
NOTE: Windows File System auditing is supported in a Windows failover cluster configuration. However, the agent is not aware of the cluster and will only audit the active nodes in the cluster where agents are deployed.

 

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating