立即与支持人员聊天
与支持团队交流

Change Auditor 7.3 - User Guide

Change Auditor Overview Agent Deployment Change Auditor Client Overview Overview Page Searches Search Results and Event Details Custom Searches and Search Properties Enable Alert Notifications Administration Tasks Agent Configurations Coordinator Configuration Purging and Archiving your Change Auditor Database Disable Private Alerts and Reports Generate and Schedule Reports SQL Reporting Services Configuration Change Auditor User Interface Authorization Client Authentication Certificate authentication for client coordinator communication Integrating with On Demand Audit Enable/Disable Event Auditing Account Exclusion Registry Auditing Service Auditing Agent Statistics and Logs Coordinator Statistics and Logs Change Auditor Commands Change Auditor Email Tags

Using custom filters

The following procedures walk you through a few scenarios using custom filters.

To find events generated when a member is added to a group:
1
Run the All Events search.
2
On the Search Results page, place your cursor in the data filtering cell of the Event column, click the arrow control and select (Custom).
3
Select All.
4
Specify the following criteria:
•
Contains | group
•
Contains | added
•
Does not contain | group policy
5
Click OK.
To find delete object operations related to a forest container:
1
Run the All Events search.
2
On the Search Results page, place your cursor in the data filtering cell of the Action column, click the arrow control and select (Custom).
3
Select All.
4
Specify the following criteria:
•
Contains | delete
•
Contains | object
5
Click OK.
6
On the Search Results page, place your cursor in the data filtering cell of the Facility column and enter: forest.

Directory object picker

Throughout the client, the directory object picker is used to locate and select Active Directory objects from the environment. This object picker is displayed in either a stand-alone dialog (such as the Select Active Directory Objects dialog) or as a page in a wizard. The client needs to be able to connect to a Global Catalog (GC) to display the object picker and query objects. The client contacts the coordinator to get the Global Catalog that should be used. The coordinator attempts to choose a GC in its local domain and site. If none is found, it chooses one in its domain, then in the local site, and lastly the entire forest. It is recommended to have the coordinator and the client reside in the same site and/or domain so that the directory object picker performs more efficiently.

The object picker consists of the following pages:

•
Browse - use the Browse page to select a directory object from a hierarchical view of your environment
* 
NOTE: If Active Directory integrated DNS is deployed, you can access the ForestDNSZones or DomainDNSZones partitions by right-clicking on the top-level domain object.
•
Search - use the Search page to search your environment to locate and select a directory object
* 
NOTE: Disabled objects on these two pages are represented by a red X icon.
•
Options - use the Options page to view or modify search options used to retrieve directory objects
Browsing for a directory object
To browse for a directory object:
1
Open the Browse page.
2
In the Forest field, select the forest that contains the required directory objects.
* 
NOTE: The Forest field is available in directory object picker in the following areas:
•
Group membership expansion, SMTP configuration and shared folder configuration
•
Purge and archive jobs
•
Active Directory, AD Query, ADAM (AD LDS), Exchange, Group Policy, Local accounts, Registry, Service, and SQL Server searches
•
Report and alert email configuration
•
Windows File System and AD Query auditing wizard
•
Active Directory auditing and protection wizard
•
File System protection wizard
3
In the Find field, either enter or use the drop-down menu to select the type of directory object.
You can enter multiple classes, separated by either a comma or semi-colon. Note that when you type in an entry, you must use the Enter key or the Apply Filter button to display the objects.
 
* 
NOTE: Most of the time, this field will be automatically filled in with the appropriate entry. Thus, when this field is grayed out, this is a read-only field which cannot be changed.
4
In the explorer view (left pane), single-click on the expansion state box to the left of a container or double-click a container to expand the view to display subordinate objects.
Select a container in this pane to populate the object list (right pane) with the objects that belong to the selected container.
* 
NOTE: Right-clicking the root domain in the explorer view displays a drop-down menu listing any peer domains. To view a different domain’s objects, select the desired domain from those listed.
Use the F5 button to force a refresh of the contents of this pane.
5
In the object list, click the object to select it and use the Add button to add it to the Selected Objects list at the bottom of the dialog.
 
* 
NOTE: The Selected Objects list is used for both the Browse and Search pages and will contain the objects selected from either of these pages.
6
Once you have added objects to this list, use the Select button to save your selection and close the dialog. Or if the directory object picker is part of a wizard, click Next to save your selection and continue.
Searching for a directory object
To search your environment for a directory object:
1
Open the Search page and use the controls at the top of the page to search your environment to locate the desired objects.
2
In the Find field, either enter or use the drop-down menu to select the type of directory object to be located.
You can enter multiple classes, separated by either a comma or semi-colon. Note that when you type in an entry, either click the Enter key or use the Search button to display the objects.
3
In the Name field, specify a search expression to be used to search Active Directory to locate a particular object. In most cases, this field will contain an asterisk (*) indicating to search for all objects of the type specified in the Find field.
* 
NOTE: Most of the time, this field will be automatically filled in with the appropriate entry. Thus, when this field is grayed out, this is a read-only field which cannot be changed.
Select the ANR check box to use Ambiguous Name Resolution (ANR) as the search algorithm, which allows you to enter limited input (partial data) to find multiple objects in your network.
When the ANR check box is checked, use one of the following methods to enter your search expression:
•
Enter a partial string to return exact matches or a list of possible matches. For example, entering ‘Admin’ will return objects that contain the names ‘Admin’, ‘Admins’, ‘Administrator’, Administrators’, etc.
•
Enter a string preceded by the equal sign (=Admins) to return only exact matches. For example, entering ‘=Admin’ will return only those objects containing the name ‘Admin’.
By default, ANR will search the following attribute fields in Active Directory:
•
First Name (GivenName)
•
Last Name (Surname)
•
Display Name (displayName)
•
LegacyExchangeDN
•
msExchMailNickname
•
Relative Discontinued Name of the object (RDN)
•
Office (physicalDeliveryOfficeName)
•
Email address (proxyAddress)
•
Security Account Manager account (sAMAccountName)
When the ANR check box is not checked, the search expression entered will be used to search only the Display Name of directory objects to locate a particular object.
To use this search mechanism, enter a string of characters and the wildcard (*) character as described below.
•
n* will return objects that start with the letter ‘n’
•
*n will return objects that end in the letter ‘n’
•
*n* will return objects that contain the letter ‘n’ within their Display Name.
4
After entering a search expression, use the Search button to initiate the search and return the results of the search.
5
The object list displays the objects found as a result of your search. To select an object, click on the object to highlight it and use the Add button to add it to the Selected Objects list.
 
* 
NOTE: The Selected Objects list is used for both the Browse and Search pages and will contain the objects selected from either of these pages.
6
Once you have added objects to this list, use the Select button to save your selection and close the dialog. Or if the directory object picker is part of a wizard, click Next to save your selection and continue.
To view or modify the search options to use to retrieve directory objects:
1
Open the Options page and modify the options as required.
* 
NOTE: The settings on the Options page only apply to the current user and do not impact other users using a Change Auditor client.
2
The Search Limit field specifies the maximum number of records to return for an Active Directory object search. The default is 2000 records.
To change this limit, enter a value between 100 and 9999.
Or to allow an unlimited number of records to be returned, select the No Search Limit check box.
3
The Page Size field displays the maximum number of records to return per LDAP polling cycle.
* 
TIP: Care should be taken when modifying this value, because it could impact the performance of your searches.
4
Once you have made changes on the Options page, use the Select button to save your selection and close the dialog. If the directory object picker is part of a wizard, click Next to save your selection and continue.

Overview Page

•
Overview
•
My Favorite Search
•
Define a favorite search
•
Overview panes
•
Event Details pane

Overview

Overview

Once agents are deployed, the Overview page initially displays when the client successfully connects to a coordinator. This page highlights application details based on your preference. For example, you can display Agent Status, Top Agent Activity, Recent Event Activity, Coordinator Status, Event Counts, or Alert History Counts.

You can view a real-time stream of events based on a ‘favorite’ search definition. By default, the top pane uses the Change Auditor Real-Time search definition and display all events (up to 10,000 records) generated in the last 20 minutes. You can, however, define a different ‘favorite’ search and the events captured from that search will then be displayed across the top of the Overview page.

The information on this page is captured when the client starts. To refresh all of the information displayed on the Overview page, select Refresh. Also, when you select a different pane for display, the latest information for the 'new' pane will be displayed.

相关文档

The document was helpful.

选择评级

I easily found the information I needed.

选择评级