Change Auditor 7.1 - PowerShell Command User Guide

Adding the PowerShell module Viewing available commands and help Installing Change Auditor coordinators and web clients Setting the master time zone Finding Change Auditor installations and coordinators Connecting to and disconnecting from Change Auditor installations and coordinators Managing client authentication options Gathering Change Auditor system information Deploying Change Auditor agents Managing auditing templates Working with searches

Copy-CASearch

Managing Windows File System auditing Managing Fluid File System auditing Managing Azure Active Directory auditing Managing Office 365 auditing Managing Skype for Business auditing Configuring a Quest On Demand Audit integration Working with protection templates

Copy-CASearch

Use this command to copy a search in the installation.

Table 33. Available parameters
Parameter	Description
-Connection	A connection obtained by using the Connect-CAClient command.
-Search	The search info object obtained from the Get-CASearches command.
-IsPublic (Optional)	An optional switch that specifies if the search is public. The default is private.
-UserSid	An optional parameter that is used (when –IsPublic is not used) to specify the SID of the user that owns the directory where the copy of the search is placed.
-Path	A parameter that specifies a path where the copy is to be placed. The default is the root folder of the user/public folder specified with –UserSid /-IsPublic.
-Name (Optional)	An optional parameter that specifies a new name for the copy of the search.
-PassThru (Optional)	A switch that specifies to return the updated search after the command runs.

Example: Copying a search named “New Search for Employee” to a user’s private folder Searches\New and giving it a new name “All My Events”

$connection = Connect-CAClient –InstallationName ‘DEFAULT’

$search = Get-CASearches $connection | ? {$_.Name –eq “New Search for Employee”}

Copy-CASearch –Connection $connection –Search $search –UserSid S-1-5-21-3623811015-3361044348-30300820-1013 –Path Private\Searches\New –Name “All My Events” -PassThru

Add-CASearch

Use this command to create a search in the installation.

Table 34. Available parameters
Parameter	Description
-Connection	A connection obtained by using the Connect-CAClient command.
-XmlSearchDefinition	An XML string or object that represents a search definition.
-IsPublic	A switch that specifies if the search is public. The default is private.
-UserSid	A parameter that is used (when –IsPublic is not used) to specify the SID of the user who owns the new search.
-Path	A parameter that specifies a path where the new search will be placed. The default is the root folder of the user/public folder specified with –UserSid /-IsPublic.
-Name	A parameter that specifies a new name for the search.
-PassThru (Optional)	A switch that specifies to return the new search after the command runs.

Example: Adding a public search to the installation

$connection = Connect-CAClient –InstallationName ‘DEFAULT’

$searchDefinition = Get-Content C:\Users\Admin\Documents\MySearchDefinition.xml

Add-CASearch –Connection $connection –XmlSearchDefinition $searchDefinition
–IsPublic –Path Shared\AllSearches\New –Name “All events in the past 23 hours”
-PassThru

Move-CASearch

Use this command to move a search from one folder path to another in the installation.

Table 35. Available parameters
Parameter	Description
-Connection	A connection obtained by using the Connect-CAClient command.
-IsPublic	A switch that specifies if the search is public. The default is private.
-UserSid	A parameter that is used (when –IsPublic is not used) to specify the SID of the user who owns the new search.
-Path	A parameter that specifies the path where the search will be placed. The default is the root folder of the user/public folder specified with –UserSid /-IsPublic.
-Search	The search info object obtained from the Get-CASearches command.
-PassThru (Optional)	A switch that specifies to return the updated search after the command runs.

Example: Moving the search named “All AD Queries in the last 30 days” to the private folder “Shared\Skype\” of the user with the SID “S-1-5-21-3623811015-3361044348-30300820-1013”

$connection = Connect-CAClient –InstallationName ‘DEFAULT’

$search = Get-CASearches $connection | ? {$_.Name –eq “All AD Queries in the last 30 days”}

Move-CASearch $connection –Search $search –UserSid S-1-5-21-3623811015-3361044348-30300820-1013 –Path “Shared\Skype”

Remove-CASearch

Use this command to remove a public or private search from the installation.

Table 36. Available parameters
Parameter	Description
-Connection	A connection obtained by using the Connect-CAClient command.
-Search	The search info object obtained from the Get-CASearches command.
-Force (Optional)	A parameter that removes the prompt before a search is removed.

Example 1: removing any search with the name “All Exchange Admin Events” from the installation

$connection = Connect-CAClient –InstallationName ‘DEFAULT’

$search = Get-CASearches $connection | ? {$_.Name –eq “All Exchange Admin Events”}

Remove-CASearch $connection –Search $search

Example 2: Removing the search with the name “All Search Events”, owned by the user with the SID “S-1-5-21-3623811015-3361044348-30300820-1013”, which exists in that user’s folder “Security\Internal\Searches” from the installation

$connection = Connect-CAClient –InstallationName ‘DEFAULT’

$search = Get-CASearches $connection | ? {$_.OwnerSid –eq “S-1-5-21-3623811015-3361044348-30300820-1013”} | ? {$_.FolderPath –eq “Security\Internal\Searches”} | ? {$_.Name –eq “All Search Events”}

Remove-CASearch $connection –Search $search

Add-CASearchFolder

Use this command to create a search folder in the installation.

Table 37. Available parameters
Parameter	Description
-Connection	A connection obtained by using the Connect-CAClient command.
-IsPublic	A switch that specifies if the search is public. The default is private.
-UserSid	A parameter that is used (when –IsPublic is not used) to specify the SID of the user who owns the new folder.
-Path	A parameter that specifies the path to create. The default is the root folder of the user/public folder specified with –UserSid /-IsPublic.

Example: Adding the public folder Searches\New to the installation

$connection = Connect-CAClient –InstallationName ‘DEFAULT’

Add-CASearchFolder –Connection $connection –IsPublic –Path Shared\Searches\New

Remove-CASearchFolder

Use this command to remove a public or private folder from the installation.

Table 38. Available parameters
Parameter	Description
-Connection	A connection obtained by using the Connect-CAClient command.
-IsPublic	A switch that specifies the folder being removed is public.
-UserSid	A parameter that is used if –IsPublic is not specified to speci-fy the SID of the user that owns the private folder being removed.
-Path	A parameter that specifies the path to the folder to remove. The default is the root folder of the user/public folder specified with –UserSid /-IsPublic.
-Force (Optional)	An optional parameter that removes the prompt before a search is removed.

Example: Removing the public folder in the installation Miscellaneous\OldSearches

$connection = Connect-CAClient –InstallationName ‘DEFAULT’

Remove-CASearchFolder $connection –IsPublic –Path Shared\Miscellaneous\OldSearches

Managing Windows File System auditing

Managing Fluid File System auditing

Change Auditor for Fluid File System tracks, audits, reports, and alerts on file and folder changes in real time, translating events into simple text and eliminating the time and complexity required by native auditing. The auditing scope can be set on an individual file or folder or an entire file system recursive or non-recursive. Change Auditor also allows you to include or exclude certain files or folders from the audit scope to ensure a fast and efficient audit process.

Change Auditor captures events and provides detailed information relating to the following activities:

•

File and folder access

•

File and folder creation, deletion, and renames

•

File and folder permission changes

•

Content changes, such as file opens and writes


	NOTE: Change Auditor for Fluid File System audits only SMB operations on FluidFS clusters.

The following commands are available to manage Fluid File System auditing:

•

Get-CAFluidFSClusters

•

Get-CAFluidFSEncryptionStatus

•

Get-CAFluidFSEventClassInfo

•

Get-CAFluidFSTemplates

•

Get-CAFluidFSVolumes

•

New-CAFluidFSAuditVolume

•

New-CAFluidFSTemplate

•

Clear-CAFluidFSTemplate

•

Set-CAFluidFSTemplate

•

Set-CAFluidFSEncryptionCredential

Get-CAFluidFSClusters

Use this command to see a list of all Fluid File Service clusters available to audit.

Table 45. Parameter description


Parameter	Description
-Connection	A connection obtained by using the Connect-CAClient command.

Example: See a list of FluidFS cluster names

Get-CAFluidFSClusters -Connection $connection

Get-CAFluidFSEncryptionStatus

Use this command to see if encryption has been set. Encryption protects the data as it passes between the FluidFS cluster and the Change Auditor agents.

Table 46. Parameter description


Parameter	Description
-Connection	A connection obtained by using the Connect-CAClient command.
-ClusterName	The name of the FluidFS cluster to audit.
-ClusterConfigurationCredential	Administrator credentials to access Enterprise Manager.

Example: Determine if FluidFS encryption has been set (True if the encryption status is set; false otherwise)

Get-CAFluidFSEncryptionStatus -Connection $connection -ClusterName $clustername -ClusterConfigurationCredential $credential

Get-CAFluidFSEventClassInfo

Use this command to get a list of all available FluidFS event classes.

Table 47. Parameter description


Parameter	Description
-Connection	A connection obtained by using the Connect-CAClient command.

Example: Get a list of all FluidFS event classes.

Get-CAFluidFSEventClassInfo -Connection $connection

Get-CAFluidFSTemplates

Use this command to see all the Fluid File System templates available within your installation.

Table 48. Parameter description


Parameter	Description
-Connection	A connection obtained by using the Connect-CAClient command.

Example: Get a list of all FluidFS templates

Get-CAFluidFSTemplates -Connection $connection

Get-CAFluidFSVolumes

Use this command to get a list of all volumes on a specified cluster.

Table 49. Parameter description


Parameter	Description
-Connection	A connection obtained by using the Connect-CAClient command.
-ClusterName	The name of the cluster from which to retrieve volume names.
-ClusterConfigurationCredential	Administrator credentials to access Enterprise Manager. This allows the Coordinator to connect with the Enterprise Manager Data Collector service and populate the list of available volumes to audit.

Example: See a list of all available volumes on a cluster

Get-CAFluidFSVolumes -Connection $connection -ClusterName $clustername -ClusterConfigurationCredential $credential

New-CAFluidFSAuditVolume

Use this command to define which volumes to audit.

•

Inclusions allows you to specify what in the selected volume to be audit.

•

Exclusions allow you to refine the settings defined on the Inclusions tab. That is, you can optionally specify the names and paths of any subfolders and files in the selected volume to exclude from auditing.


	NOTE: When specifying exclusions with PowerShell, you must specify the volume. This is not required for inclusion masks. For example: $includePaths = "?folder\*" $excludeFilePaths = "\vol1\.tmp"

Table 50. Parameter description


Parameter	Description
-Volume	The name of the volume to audit.
-IncludePaths	The folders\files to include. NOTE: You can also enter the name of an individual subfolder or file to include. However, if you enter the name of a subfolder, you will only receive events for operations performed against the specified subfolder. You will not receive events for operations performed against any child objects under the specified subfolder.
-EventClasses	The events to audit.
-ExcludeFilePaths (Optional)	The name and path of files to exclude from auditing.
-ExcludeFolderPaths (Optional)	The name and path of subfolders to exclude from auditing.
-Disabled (Optional)	Specifies whether auditing is enabled or disabled on the volume. The disable feature allows you to temporarily stop auditing the specified volume without having to remove the auditing template or individual volume from a template.

Example: Define the volumes to audit

$auditVolume = New-CAFluidFSAuditVolume -Volume $volumes[0] -IncludePaths $includePaths -EventClasses $fluidFSEventClasses -ExcludeFilePaths $excludeFilePaths -ExcludeFolderPaths $excludeFolderPaths -Disabled $False

New-CAFluidFSTemplate

To enable FluidFS auditing in Change Auditor, you must first create an auditing template for each file server to audit. Each auditing template defines the location of the file server, the auditing scope, and the Change Auditor agents that are to receive the events.


	NOTE: There can be only 1 FluidFS auditing template per file server. If you want to audit multiple audit paths, use the same template to specify all the paths to audit on the selected file server.

Use this command to create a Fluid File System auditing template.

Returns: A FluidFS template object.

Table 51. Parameter description


Parameter	Description
-Connection	A connection obtained by using the Connect-CAClient command.
-ClusterName	The name of the cluster to audit.
-Agents	The Change Auditor agents that are to receive the FluidFS events. NOTE: Specifying multiple agents may provide better performance because the file server will load balance audit events and send each assigned agent events round-robin style. However, the downside is that the ‘where’ field for FluidFS events may contain any one of these agents. Also, if FluidFS event logging is enabled, events are written on multiple agent servers.
-AuditItems	The volumes and their list of exclusions and inclusions.
-ClusterConfigurationCredential	Administrator credentials to access Enterprise Manager. This allows the Coordinator to connect with the Enterprise Manager Data Collector service and populate the list of available volumes to audit.
-Disabled (Optional)	Specifies whether the template is enabled or disabled.

Example: Create a FluidFS template

New-CAFluidFSTemplate -Connection $connection -ClusterName $clustername -Agents $agents -AuditItems $auditItems -ClusterConfigurationCredential $credential
-Disabled $False

Clear-CAFluidFSTemplate

Use this command to delete a FluidFS to delete a template when a connection cannot be made with the FluidFS cluster.


	NOTE: Auditing settings must then be removed from the cluster using Enterprise Manager.

Table 52. Parameter description


Parameter	Description
-Connection	A connection obtained by using the Connect-CAClient command.
-Template	The template to delete.

Example: Delete a template when the Fluid FS cluster cannot be reached

Clear-FluidFSTemplate -Connection $connection -Template $template

Set-CAFluidFSTemplate

Use this command to edit an existing Fluid File System template.


	NOTE: You can also use the Enable-CAAgentTemplate and Disable-CAAgentTemplate to enable or disable the template.

Table 53. Available parameters


Parameter	Description
-Connection	A connection obtained by using the Connect-CAClient command.
-Template	The template to edit.
-ClusterConfigurationCredential	Administrator credentials to access Enterprise Manager. This allows the Coordinator to connect with the Enterprise Manager Data Collector service and populate the list of available volumes to audit.
-Agents (Optional)	The Change Auditor agents that are to receive the FluidFS events.
-AuditItems (Optional)	The volumes and their list of exclusions and inclusions.
-Enable (Optional)	Set to true or false to enable and disable the template.

Example: Modify a FluidFS template

Set-CAFluidFSTemplate -Connection $connection -Template $template -ClusterConfigurationCredential $credential -Enable True -Agents $agents -AuditItems $auditItems

Set-CAFluidFSEncryptionCredential

Use this command to enable or disable encryption for auditing on the Fluid File System cluster. Encryption allows you to protect the event traffic as it passes between the FluidFS cluster and the Change Auditor agents.

Table 54. Available parameters


Parameter	Description
-Connection	A connection obtained by using the Connect-CAClient command.
-ClusterName	The name of the cluster to audit.
-ClusterConfigurationCredential	Administrator credentials to access Enterprise Manager.
-EncryptionCredential	The service account credentials for the cluster to use when encrypting events.

Example: Modify the encryption (required or not) for auditing on the Fluid FS cluster

Set-CAFluidFSEncryptionCredential -Connection $connection -ClusterName $clustername -ClusterConfigurationCredential $credential -EncryptionCredential $EncryptionCredential

Managing Azure Active Directory auditing

Change Auditor audits activity in the Azure portal that corresponds to the events in the Azure Active Directory auditing logs and sign-in activity. Managing Azure Active Directory auditing is available through the following PowerShell commands:

•

New-CAAzureADTemplate

•

Get-CAAzureADTemplates

•

Set-CAAzureADTemplate


	NOTE: When you delete a template (see Remove-CAAgentTemplate), the web application created in Azure Active Directory remains. You can delete the web application using the Azure management portal. If you do not have the portal, see https://technet.microsoft.com/en-us/library/dn832618.aspx for instructions.


	NOTE: If your organization uses a proxy server to connect to the internet, you must configure the agent settings to audit Azure Active Directory and Office 365 targets. (See Set-CAConfiguration)

The following sample scripts are available in the Change Auditor client folder. By default they are located here: C:\Program Files\Quest\ChangeAuditor\Client\PowerShell Sample Scripts:

•

CreateAzureADTemplate

•

CreateAzureADTemplateUsingWebAppKey

•

RemoveAzureADTemplate

•

DisableAzureADTemplate

•

ModifyAzureADTemplate-ChangeAgent

•