Change Auditor for Windows File Servers 7.1.1


	NOTE: Windows File Server auditing is only available if you have licensed Change Auditor for Windows Files Servers. If you do not have a valid license you can use the features, however, associated events are not captured. To verify that it is licensed, right-click the coordinator icon in the system tray and select Licensing.

Create a new folder on the C: drive of an agented server and then add a new .txt file in this folder. This folder will be used in the following scenarios as an auditing target.

To capture events, you must define the files and folders to audit and the operations to capture:

•

Create a File System Auditing template which specifies the files/folders and operations to be audited.

•

Add this template to an agent configuration.

•

Assign the agent configuration to agents.

Create File System Auditing template

For this scenario, we will create a template to audit all changes made to the folder you just created.

Select Start | All Programs | Quest | Change Auditor | Change Auditor Client.

Select View | Administration.

Click Auditing.

Select File System in the Auditing task list to open the File System Auditing page.

Click Add to start the File System Auditing wizard which steps you through the process of creating a File System Auditing template.

On the first page of the wizard, enter the following information:

•

Template Name - Enter a name for the template.

•

Audit Path - Select the Folder option. Enter the name of the folder previously created (i.e., Drive:\Folder\) or click the browse button to select the folder.

•

By default, the scope of coverage for the selected folder will be This Object and All Child Objects. Leave this setting for this scenario; however, if you wanted to change this setting, use the drop-down arrow in the scope cell.

•

Events tab - Select both the File Events and Folder Events check boxes (in the header) to track all changes made to the selected folder.

•

Inclusions tab - Click on the Inclusions tab, enter * and click Add to add it to the Included Names list. Entering * will audit all files and folders in the selected folder.

Use the following characters to specify a file mask on the Inclusions tab:

•

Fixed characters such as letters, numbers and other characters that are allowed in file names

•

An asterisk (*) wildcard character to substitute zero or more characters

•

Question Mark (?) wildcard character to substitute a single character


	NOTE: For file system auditing, the slash characters (\) and double asterisks (*) are not allowed in file masks; therefore to include a specific folder (or share), use the Audit Path field at the top of the page to specify the folder (or share) to audit and enter an on the Inclusions tab.

•

Exclusions tab - Skip the Exclusions tab. (In this scenario, we will not be excluding any subfolders or files from auditing. For more information on using the Exclusions tab, see File System Auditing.)

To define any processes that can change audited objects without generating an event, click Next.

On the second page of the wizard, optionally select one or more processes from the list at the top of the page and click Add to add them to the list box at the bottom of the page.

To create the template and assign it to an agent configuration, expand Finish and select Finish and Assign to Agent Configuration.

On the Configuration Setup dialog select the agent configuration (right pane) to which the template is to be assigned and ‘drag and drop’ it onto the newly created template.

The Assigned cell for the template will change to ‘Yes’.

Click OK to save your selection, close the dialog and display the Agents Configuration page.

If this configuration is not assigned to any agents, you will need to assign it to one or more installed agents at this time.

•

On the Agent Configuration page, select one or more agents from the agent list and click Assign.

•

On the Agent Assignment dialog, select the configuration definition to be assigned to the selected agents and click OK.

On the Agents Configuration page, select the agents assigned to use the modified agent configuration and click Refresh Configuration to ensure the agents are using the latest configuration.