Change Auditor 7.5 - User Guide

Getting Started

Getting Started

•	Deployment requirements

•	Run reports

Deployment requirements

Deployment requirements

Before you can begin to capture logon activity events, you must:

•	Ensure you meet the minimum system requirements.

•	Apply the Change Auditor for Logon Activity User license to monitor servers. (All DCs and Member Servers with an agent installed will be included.)

•	Apply the Change Auditor for Logon Activity Workstation license and deploy workstation agents to the workstations to be monitored. See the Change Auditor Installation Guide for more information on deploying workstation agents.

•	Deploy agents. Depending on your implementation, you can deploy server and/or workstation agents.

NOTE: See Appendix: Agent Comparison for more information.

The recommended installation for domain workstations is through the Deployment tab. However, for non-domain workstations you must manually install the Change Auditor workstation agent. See Appendix: Workstation Agent Deployment for recommendations on deploying agents necessary for auditing both domain workstations and non-domain workstations.

•	Enable the following policies through the Group Policy Management Console to allow Change Auditor to capture Authentication Activity events. (See the Change Auditor for Logon Activity Event Reference Guide for details about authentication activity events).

When Local Policies\Audit Policy is used:

1	Enable the ‘Audit Logon events’ audit policy for all servers and workstations. (Set to audit Success and Failure)

▪	Domain - Group Policy:

▫	Default Domain Policy\Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Audit Policy\Audit logon events

▪	Default Domain Controller Policy:

▫	Default Domain Controllers Policy\Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Audit Policy\Audit logon events

▫	Default Domain Controllers Policy\Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Logon/Logoff\Audit Logon

▪	Workgroup - Local Group Policy:

▫	Local Computer Policy\Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Audit Policy\Audit logon events

2	Wait 30-90 minutes for the policy to refresh.

When Security Settings\Advanced Audit Policy Configuration is used:

1	Enable the ‘Audit Logon’ advanced audit policy for all servers and workstations. (Set to audit Success and Failure)

▪	Domain - Group Policy:

▫	Default Domain Policy\Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Logon/Logoff\Audit Logon

▪	Default Domain Controller Policy:

▫	Default Domain Controllers Policy\Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Audit Policy\Audit logon events

▫	Default Domain Controllers Policy\Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Logon/Logoff\Audit Logon

▪	Workgroup - Local Group Policy:

▫	Local Computer Policy\Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\System Audit Policies - Local Group Policy Object\Logon/Logoff\Audit Logon

2	Wait 30-90 minutes for the policy to refresh.

NOTE: The following Domain Controller Authentication events do not require Windows system provided auditing enabled and are recorded in Change Auditor even if they are not recorded in the Windows Event log: • User authenticated through Kerberos • User failed to authenticate through Kerberos

Additional notes

•	Quest recommends that you deploy a server agent to all servers (domain controllers and member servers) to track configuration changes in real-time.

•	For workstation events, the agent is stored locally to capture logon, logoff, and calculated session activity.

•	If a computer is disconnected from the network, the agent continues to work and store the information locally. Once the computer connects to the network again, the events are sent to the database and integrated at the time they were captured.

NOTE: Logon activity is only available if you have applied the Change Auditor for Logon Activity User license to monitor servers and the Change Auditor for Logon Activity Workstation license to monitor workstations. To verify that it is licensed, right-click the coordinator icon in the system tray and select Licensing.

Run reports

Run reports

Using reports, you can obtain valuable information. For example, you can:

•	Group, sort, and filter the information to help answer key questions for security, HR, and auditors. You can run reports to see who is logging into your servers, gather remote user session information, and access related search information to see what activities specific users have been performing.

•	Create simplified reports by user, computers, logon type, etc.

•	Create private searches and alerts for specific events that need urgent attention. For example, “all server logons in the last 24 hours”.

•	Create dashboards, viewable in the web client, to help facilitate user management. You can then, enable shared overviews to be used by the Helpdesk to see information such as account logons, session activity, and account lockouts.

To test that events are being captured:

1	Select Start | All Programs | Quest | Change Auditor | Change Auditor Client to review the events generated.

2	Open the Searches tab.

3	Expand the Shared | Built-in | Logon Activity folder in the left pane.

4	Locate and double-click All User Sessions in the past 24 hours in the right pane.

A new Search Results tab is added to the client displaying the events captured over the last 24 hours.

5	Select an event from the Search Results grid to display the event details for the selected event.

NOTE: If the Search Properties tabs are displayed across the bottom of the Search Results page, double-click an event to display the event details for the selected event.

 

User Logon Activity Searches/Reports

User Logon Activity Searches/Reports

•	Introduction

•	Built-in logon activity searches

•	Create custom user logon activity searches

•	Search Results