From 4443e980abb996da77b8f812a370d8e025d8e729 Mon Sep 17 00:00:00 2001 From: thobed <10742470+thobed@users.noreply.github.com> Date: Wed, 9 Sep 2026 09:52:39 -0400 Subject: [PATCH 01/15] Document TLS certificate rotation for the installer Add update-cert and rollback-cert to the installer reference (flags, exit codes) and a new task page walking through rotating an expiring or untrusted certificate without reinstalling. --- docs/accessanalyzer/26.1/install/index.md | 2 +- .../26.1/install/installer-reference.md | 55 +++++ .../install/rotate-the-tls-certificate.md | 193 ++++++++++++++++++ 3 files changed, 249 insertions(+), 1 deletion(-) create mode 100644 docs/accessanalyzer/26.1/install/rotate-the-tls-certificate.md diff --git a/docs/accessanalyzer/26.1/install/index.md b/docs/accessanalyzer/26.1/install/index.md index b45f667958..325287cb34 100644 --- a/docs/accessanalyzer/26.1/install/index.md +++ b/docs/accessanalyzer/26.1/install/index.md @@ -13,7 +13,7 @@ An installation takes three steps, each on its own page. After the first sign-in, the [Guides](../guides/index.md) show you how to scan your first source. -After you're running, see [Upgrade to a new version](upgrade-to-a-new-version.md) for how new releases roll out and when you need to act. +After you're running, see [Upgrade to a new version](upgrade-to-a-new-version.md) for how new releases roll out and when you need to act, and [Rotate the TLS certificate](rotate-the-tls-certificate.md) to replace the certificate without reinstalling. ## People You Need diff --git a/docs/accessanalyzer/26.1/install/installer-reference.md b/docs/accessanalyzer/26.1/install/installer-reference.md index 38437cecd8..3c2c4512de 100644 --- a/docs/accessanalyzer/26.1/install/installer-reference.md +++ b/docs/accessanalyzer/26.1/install/installer-reference.md @@ -9,6 +9,8 @@ sidebar_position: 4 ```bash dspm-installer [flags] dspm-installer wait-for-apps [flags] +dspm-installer update-cert [flags] +dspm-installer rollback-cert [flags] dspm-installer --help dspm-installer --version ``` @@ -157,6 +159,59 @@ It prints `Waiting for applications to become Synced and Healthy…` and exits w Exit codes: 0 when everything is healthy, 70 when the timeout passes, 71 when a service stays in a failed state for 5 minutes, and 1 for any other error. Ctrl-C exits 1. +## The `update-cert` Command + +`update-cert` installs a new TLS certificate on a running Access Analyzer installation, without re-running the full installer. Use it to replace a certificate that's expiring or expired, to replace one pods don't trust, or to swap a self-signed certificate for a CA-issued one. + +```bash +sudo dspm-installer update-cert \ + --tls-cert /etc/dspm/tls.crt \ + --tls-key /etc/dspm/tls.key \ + --ca-bundle /etc/dspm/internal-root-ca.pem +``` + +`update-cert` validates the certificate and key pair, confirms the certificate's Subject Alternative Names cover the installed hostname, snapshots the certificate the cluster serves, applies the new certificate and CA bundle, restarts every workload that mounts the CA bundle, and verifies the result before it exits. See [Rotate the TLS certificate](rotate-the-tls-certificate.md) for the full procedure, including how to roll back with `rollback-cert`. + +| Flag | Default | Description | +|---|---|---| +| `--tls-cert` | (required) | PEM certificate file, full chain with the leaf certificate first. | +| `--tls-key` | (required) | PEM private key file matching `--tls-cert`. | +| `--ca-bundle` | none | PEM CA bundle the certificate chains to. Required unless the certificate is self-signed. | +| `--hostname` | from `/etc/dspm/installer.yaml` | Hostname the certificate must cover. | +| `--port` | `443` | External HTTPS port used to probe the certificate the cluster serves. | +| `--timeout` | `30m` | Time budget for the whole rotation. A rollback, if needed, gets its own budget of the same size. | +| `--dry-run` | off | Validate the certificate and print the plan without changing the cluster. Doesn't need cluster access. | +| `--no-rollback` | off | Leave the new certificate in place if verification fails, instead of restoring the previous one automatically. | +| `--kubeconfig` | `/etc/rancher/k3s/k3s.yaml` | Path to the kubeconfig file. | +| `--argocd-namespace` | `argocd` | Kubernetes namespace for ArgoCD. | + +If verification fails, `update-cert` restores the previous certificate from its snapshot and exits with a code that tells you what state the cluster is in: + +| Code | Meaning | +|---|---| +| 0 | `update-cert` applied and verified the new certificate. | +| 1 | A check failed before `update-cert` wrote anything. The cluster is unchanged. | +| 72 | Verification failed; `update-cert` restored and verified the previous certificate. | +| 73 | Verification failed; `update-cert` restored the previous certificate but couldn't verify it. | +| 74 | Verification failed and `update-cert` couldn't apply the rollback. | +| 75 | `update-cert` couldn't reach the ingress, so it verified nothing and rolled nothing back. The new certificate is still in place. | + +## The `rollback-cert` Command + +`rollback-cert` restores a certificate from a snapshot `update-cert` saved during an earlier rotation. Snapshots live under `/etc/dspm/cert-snapshots/` and are never pruned automatically. + +```bash +sudo dspm-installer rollback-cert --latest +``` + +| Flag | Default | Description | +|---|---|---| +| `--list` | off | List available snapshots: timestamp, hostname, leaf certificate fingerprint, and expiry. Doesn't need cluster access. | +| `--latest` | off | Restore the most recent snapshot. | +| `--snapshot` | none | Restore the snapshot at the given path, such as `/etc/dspm/cert-snapshots/2026-09-08T14-02-11Z`. | + +`--list`, `--latest`, and `--snapshot` are mutually exclusive. `rollback-cert` exits `0` when it applies and verifies the restore, `72` when it applies the restore but verification fails, and `73` when it can't apply the restore. + ## Logs | File | Contents | diff --git a/docs/accessanalyzer/26.1/install/rotate-the-tls-certificate.md b/docs/accessanalyzer/26.1/install/rotate-the-tls-certificate.md new file mode 100644 index 0000000000..6a8d68033e --- /dev/null +++ b/docs/accessanalyzer/26.1/install/rotate-the-tls-certificate.md @@ -0,0 +1,193 @@ +--- +title: Rotate the TLS Certificate +description: Replace the TLS certificate on a running Access Analyzer installation with dspm-installer update-cert, and roll back to a previous certificate if needed. +sidebar_position: 5 +--- + +Rotate the TLS certificate with `update-cert`, a subcommand of the same `dspm-installer` binary you used to install Access Analyzer. `update-cert` and its counterpart, `rollback-cert`, talk to the cluster directly with `kubectl` instead of through the product API, so they work even when `platform-service` is failing because it doesn't trust the current certificate. + +Run both commands with `sudo`. The default kubeconfig at `/etc/rancher/k3s/k3s.yaml` is readable only by root, so without `sudo`, `kubectl` falls back to `localhost:8080` and fails with "connection refused." + +## When to Rotate the Certificate + +Use `update-cert` when: + +- The current certificate is expiring or has expired. +- An internal certificate authority (CA) issued the current certificate and pods are failing because they don't trust it, even though the install itself completed. +- You want to replace a self-signed demo certificate with a CA-issued one. + +:::warning +Don't re-run the installer to change the certificate. The installer only writes the certificate and key Secret—it doesn't update the CA bundle every pod trusts, and ArgoCD reverts a manual edit on its next sync. `update-cert` updates both and waits for the cluster to pick them up. +::: + +## Before You Start + +1. Stage the new certificate and key on the install host. The conventional paths are: + + ```bash + /etc/dspm/tls.crt # PEM, full chain, leaf certificate first + /etc/dspm/tls.key # PEM private key matching the certificate + ``` + + Both files must be PEM. If you received a PFX or P12 file, convert it first: + + ```bash + openssl pkcs12 -in cert.pfx -clcerts -nokeys -out /etc/dspm/tls.crt + openssl pkcs12 -in cert.pfx -nocerts -nodes -out /etc/dspm/tls.key + ``` + +2. If a private CA issued the certificate, get the issuing root CA in PEM form too, for example `/etc/dspm/internal-root-ca.pem`. This is required for a certificate from a private CA: a full-chain PEM omits the root by convention, so the certificate file alone gives the installer nothing to derive a trust anchor from. Only a self-signed certificate can skip this. + +3. Confirm the certificate covers the installed hostname. `update-cert` reads the hostname from `/etc/dspm/installer.yaml` and stops if the certificate's Subject Alternative Names don't cover it. + +## Rotate the Certificate + +1. Run a dry run first. It validates the files and prints what would change without touching the cluster, so you can run it without cluster access. + + ```bash + sudo dspm-installer update-cert \ + --tls-cert /etc/dspm/tls.crt \ + --tls-key /etc/dspm/tls.key \ + --ca-bundle /etc/dspm/internal-root-ca.pem \ + --dry-run + ``` + + Leave out `--ca-bundle` for a self-signed certificate. The output shows the hostname, the fingerprint of the replacement certificate, where the CA bundle comes from, and, if the cluster is reachable, the fingerprint being served. Fix the certificate or key files if validation fails here—`update-cert` hasn't written anything yet. + +2. Run the rotation. + + ```bash + sudo dspm-installer update-cert \ + --tls-cert /etc/dspm/tls.crt \ + --tls-key /etc/dspm/tls.key \ + --ca-bundle /etc/dspm/internal-root-ca.pem + ``` + + `update-cert` validates the certificate and key pair, confirms the certificate covers the hostname, and (with `--ca-bundle`) confirms the certificate chains to the bundle. It then snapshots the certificate the cluster serves to `/etc/dspm/cert-snapshots//`, applies the new certificate and CA bundle, restarts every workload that mounts the CA bundle, and verifies the ingress serves the new certificate before it exits. On success, it prints `New certificate applied and verified (leaf )`. + +3. Confirm the certificate from a client machine. + + ```bash + openssl s_client -connect dspm.corp.example.com:443 -servername dspm.corp.example.com /dev/null \ + | openssl x509 -noout -subject -issuer -dates -fingerprint -sha256 + ``` + + The fingerprint should match the `leaf` value `update-cert` printed. + +If verification fails, `update-cert` automatically restores the previous certificate from its snapshot and exits with a non-zero code. See [Exit codes](installer-reference.md#exit-codes) in the installer reference for what each code means and what to do next. + +## If the Probe Fails Behind a Reverse Proxy + +`update-cert` verifies the certificate by connecting to `:` from the install host. If a load balancer, reverse proxy, or split-horizon DNS sits in front of the cluster's ingress, that verification connects to the intermediary's certificate instead of the one you just installed, and `update-cert` rolls back a certificate that actually installed correctly. The error message names the expected fingerprint and points you to `--no-rollback`. + +In that topology, run with `--no-rollback`, then verify the certificate yourself from a client that reaches the ingress directly, or read it from the Secret: + +```bash +sudo dspm-installer update-cert \ + --tls-cert /etc/dspm/tls.crt \ + --tls-key /etc/dspm/tls.key \ + --ca-bundle /etc/dspm/internal-root-ca.pem \ + --no-rollback + +sudo kubectl get secret dspm-tls -n kube-system -o jsonpath='{.data.tls\.crt}' \ + | base64 -d | openssl x509 -noout -fingerprint -sha256 +``` + +If the new certificate turns out to be wrong, roll it back with `rollback-cert`. + +## Roll Back a Certificate + +Every rotation leaves a snapshot under `/etc/dspm/cert-snapshots/`. To restore a previous certificate: + +1. List the available snapshots. This doesn't need cluster access. + + ```bash + sudo dspm-installer rollback-cert --list + ``` + + The output shows the timestamp, hostname, leaf certificate fingerprint, and expiry of each snapshot. + +2. Restore one. + + ```bash + # the most recent snapshot + sudo dspm-installer rollback-cert --latest + + # or a specific one + sudo dspm-installer rollback-cert --snapshot /etc/dspm/cert-snapshots/2026-09-08T14-02-11Z + ``` + + `rollback-cert` restores the CA bundle along with the certificate and key, restarts the workloads that consume them, and verifies the result. On success, it prints `Restored and verified certificate from `. + +:::note +Snapshots contain private key material. Access Analyzer writes them with restricted file permissions and never prunes them automatically. Remove ones you no longer need: + +```bash +sudo ls -l /etc/dspm/cert-snapshots/ +sudo rm -rf /etc/dspm/cert-snapshots/ +``` +::: + +## Checking the Result + +Confirm the cluster's state directly if an exit code left you unsure what happened: + +```bash +# the certificate and key the ingress serves +sudo kubectl get secret dspm-tls -n kube-system -o jsonpath='{.data.tls\.crt}' \ + | base64 -d | openssl x509 -noout -subject -dates -fingerprint -sha256 + +# the CA bundle pods trust +sudo kubectl get configmap ca-bundle -n access-analyzer -o jsonpath='{.data}' | head -c 400 + +# ArgoCD application health +sudo kubectl get applications -n argocd + +# platform-service came up after the restart +sudo kubectl rollout status deploy/platform-service -n access-analyzer +sudo kubectl logs deploy/platform-service -n access-analyzer --tail=50 +``` + +Every application should show `Synced` and `Healthy`, and the `platform-service` log should show OpenID Connect (OIDC) discovery completing rather than exiting on a certificate error. + +
+Troubleshooting: recovering when rollback-cert can't restore a snapshot + +If `rollback-cert` itself can't apply a snapshot, the snapshot directory still holds everything needed to recover by hand. Each snapshot contains: + +| File | Contents | +|---|---| +| `tls.crt` | The previous certificate chain. | +| `tls.key` | The previous private key. | +| `params.json` | The previous `customCaBundle` and `caBundle` Helm parameter values (`caBundle` is already base64-encoded). | +| `meta.yaml` | Timestamp, hostname, leaf certificate fingerprint, and expiry. | + +Apply them directly: + +```bash +SNAP=/etc/dspm/cert-snapshots/ +sudo ls "$SNAP" + +# 1. Restore the certificate and key Secret. +sudo kubectl create secret tls dspm-tls -n kube-system \ + --cert="$SNAP/tls.crt" --key="$SNAP/tls.key" \ + --dry-run=client -o yaml | sudo kubectl apply -f - + +# 2. Restore the CA bundle parameters on the netwrix application. +# List the parameters, find the 0-based positions of ingress.customCaBundle +# and ingress.caBundle, and use them as N and M. +sudo kubectl get application netwrix -n argocd \ + -o jsonpath='{range .spec.source.helm.parameters[*]}{.name}{"\n"}{end}' +CUSTOM=$(sudo jq -r .customCaBundle "$SNAP/params.json") +BUNDLE=$(sudo jq -r .caBundle "$SNAP/params.json") +sudo kubectl patch application netwrix -n argocd --type json \ + -p "[{\"op\":\"replace\",\"path\":\"/spec/source/helm/parameters/N/value\",\"value\":\"$CUSTOM\"}, + {\"op\":\"replace\",\"path\":\"/spec/source/helm/parameters/M/value\",\"value\":\"$BUNDLE\"}]" + +# 3. Force a refresh and restart the consumers. +sudo kubectl annotate application netwrix -n argocd argocd.argoproj.io/refresh=hard --overwrite +sudo kubectl rollout restart deploy/platform-service -n access-analyzer +sudo kubectl get applications -n argocd -w +``` + +
From ff519da4be3a3c3620ffa27b300a72f7ef4331ed Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Wed, 9 Sep 2026 13:59:59 +0000 Subject: [PATCH 02/15] fix(vale): auto-fix style issues (Vale + Dale) --- docs/accessanalyzer/26.1/install/installer-reference.md | 4 ++-- .../26.1/install/rotate-the-tls-certificate.md | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/accessanalyzer/26.1/install/installer-reference.md b/docs/accessanalyzer/26.1/install/installer-reference.md index 3c2c4512de..a654effb2a 100644 --- a/docs/accessanalyzer/26.1/install/installer-reference.md +++ b/docs/accessanalyzer/26.1/install/installer-reference.md @@ -178,7 +178,7 @@ sudo dspm-installer update-cert \ | `--tls-key` | (required) | PEM private key file matching `--tls-cert`. | | `--ca-bundle` | none | PEM CA bundle the certificate chains to. Required unless the certificate is self-signed. | | `--hostname` | from `/etc/dspm/installer.yaml` | Hostname the certificate must cover. | -| `--port` | `443` | External HTTPS port used to probe the certificate the cluster serves. | +| `--port` | `443` | External HTTPS port for probing the certificate the cluster serves. | | `--timeout` | `30m` | Time budget for the whole rotation. A rollback, if needed, gets its own budget of the same size. | | `--dry-run` | off | Validate the certificate and print the plan without changing the cluster. Doesn't need cluster access. | | `--no-rollback` | off | Leave the new certificate in place if verification fails, instead of restoring the previous one automatically. | @@ -198,7 +198,7 @@ If verification fails, `update-cert` restores the previous certificate from its ## The `rollback-cert` Command -`rollback-cert` restores a certificate from a snapshot `update-cert` saved during an earlier rotation. Snapshots live under `/etc/dspm/cert-snapshots/` and are never pruned automatically. +`rollback-cert` restores a certificate from a snapshot `update-cert` saved during an earlier rotation. Snapshots live under `/etc/dspm/cert-snapshots/`, and Access Analyzer never prunes them automatically. ```bash sudo dspm-installer rollback-cert --latest diff --git a/docs/accessanalyzer/26.1/install/rotate-the-tls-certificate.md b/docs/accessanalyzer/26.1/install/rotate-the-tls-certificate.md index 6a8d68033e..464858dfba 100644 --- a/docs/accessanalyzer/26.1/install/rotate-the-tls-certificate.md +++ b/docs/accessanalyzer/26.1/install/rotate-the-tls-certificate.md @@ -36,7 +36,7 @@ Don't re-run the installer to change the certificate. The installer only writes openssl pkcs12 -in cert.pfx -nocerts -nodes -out /etc/dspm/tls.key ``` -2. If a private CA issued the certificate, get the issuing root CA in PEM form too, for example `/etc/dspm/internal-root-ca.pem`. This is required for a certificate from a private CA: a full-chain PEM omits the root by convention, so the certificate file alone gives the installer nothing to derive a trust anchor from. Only a self-signed certificate can skip this. +2. If a private CA issued the certificate, get the issuing root CA in PEM form too, for example `/etc/dspm/internal-root-ca.pem`. A certificate from a private CA requires this: a full-chain PEM omits the root by convention, so the certificate file alone gives the installer nothing to derive a trust anchor from. Only a self-signed certificate can skip this. 3. Confirm the certificate covers the installed hostname. `update-cert` reads the hostname from `/etc/dspm/installer.yaml` and stops if the certificate's Subject Alternative Names don't cover it. @@ -52,7 +52,7 @@ Don't re-run the installer to change the certificate. The installer only writes --dry-run ``` - Leave out `--ca-bundle` for a self-signed certificate. The output shows the hostname, the fingerprint of the replacement certificate, where the CA bundle comes from, and, if the cluster is reachable, the fingerprint being served. Fix the certificate or key files if validation fails here—`update-cert` hasn't written anything yet. + Leave out `--ca-bundle` for a self-signed certificate. The output shows the hostname, the fingerprint of the replacement certificate, where the CA bundle comes from, and, if the cluster is reachable, the fingerprint the cluster serves. Fix the certificate or key files if validation fails here—`update-cert` hasn't written anything yet. 2. Run the rotation. @@ -153,7 +153,7 @@ Every application should show `Synced` and `Healthy`, and the `platform-service`
Troubleshooting: recovering when rollback-cert can't restore a snapshot -If `rollback-cert` itself can't apply a snapshot, the snapshot directory still holds everything needed to recover by hand. Each snapshot contains: +If `rollback-cert` itself can't apply a snapshot, the snapshot directory still holds everything you need to recover by hand. Each snapshot contains: | File | Contents | |---|---| From 8f0b5cb8a29192e0cd5285c50ded1c3a2cefd2c3 Mon Sep 17 00:00:00 2001 From: thobed <10742470+thobed@users.noreply.github.com> Date: Wed, 9 Sep 2026 10:02:36 -0400 Subject: [PATCH 03/15] Address editorial review on TLS rotation docs Fix the exit-code cross-reference and its accuracy around --no-rollback and unreachable ingresses, add a maintenance-window note and a reverse-proxy pointer before the procedure, name the dspm-tls Secret, document the --hostname override, use placeholder hostnames in the verification command, align exit-code and heading style with the rest of the reference, and fix sidebar ordering between the post-install task pages and the installer reference. --- docs/accessanalyzer/26.1/install/index.md | 2 +- .../26.1/install/installer-reference.md | 8 +++++--- .../install/rotate-the-tls-certificate.md | 20 ++++++++++++------- 3 files changed, 19 insertions(+), 11 deletions(-) diff --git a/docs/accessanalyzer/26.1/install/index.md b/docs/accessanalyzer/26.1/install/index.md index 325287cb34..88f63c1f0e 100644 --- a/docs/accessanalyzer/26.1/install/index.md +++ b/docs/accessanalyzer/26.1/install/index.md @@ -13,7 +13,7 @@ An installation takes three steps, each on its own page. After the first sign-in, the [Guides](../guides/index.md) show you how to scan your first source. -After you're running, see [Upgrade to a new version](upgrade-to-a-new-version.md) for how new releases roll out and when you need to act, and [Rotate the TLS certificate](rotate-the-tls-certificate.md) to replace the certificate without reinstalling. +After you're running, see [Upgrade to a new version](upgrade-to-a-new-version.md) for how new releases roll out and when you need to act. To replace the TLS certificate without reinstalling, see [Rotate the TLS certificate](rotate-the-tls-certificate.md). ## People You Need diff --git a/docs/accessanalyzer/26.1/install/installer-reference.md b/docs/accessanalyzer/26.1/install/installer-reference.md index a654effb2a..028f017089 100644 --- a/docs/accessanalyzer/26.1/install/installer-reference.md +++ b/docs/accessanalyzer/26.1/install/installer-reference.md @@ -1,7 +1,7 @@ --- title: Installer Reference description: The dspm-installer flags, environment variables, configuration file keys, exit codes, preflight checks, and log locations. -sidebar_position: 4 +sidebar_position: 6 --- `dspm-installer` takes its settings from four places. A flag wins over an environment variable, an environment variable wins over the configuration file, and the configuration file wins over the built-in default. When the installer runs in a terminal, it prompts for any required value still missing; without a terminal, a missing required value is an error. @@ -118,6 +118,8 @@ When the file supplies every required value and the installer runs in a terminal | 71 | A service stayed in a failed state for 5 minutes. Only `wait-for-apps` returns this code; during an install the same condition exits 70. | | 80 | Preflight checks failed (`preflight checks failed`), or you didn't accept warnings (`preflight warnings detected; use --accept-warnings to continue` or `installation stopped at preflight warnings`). | +The `update-cert` and `rollback-cert` commands return their own codes. See [The `update-cert` command](#the-update-cert-command) and [The `rollback-cert` command](#the-rollback-cert-command). + ## Preflight Checks Eleven checks run before the installer changes anything on the server, in the order the following table lists them. Each ends as PASS, WARN, or FAIL. The installer prints only WARN and FAIL results, as ` [FAIL] ` or ` [WARN] `. Any FAIL stops the install; `--accept-warnings` doesn't override it. Any WARN stops it too unless you answer **Yes** to **Continue despite these warnings?** or pass `--accept-warnings`. @@ -179,7 +181,7 @@ sudo dspm-installer update-cert \ | `--ca-bundle` | none | PEM CA bundle the certificate chains to. Required unless the certificate is self-signed. | | `--hostname` | from `/etc/dspm/installer.yaml` | Hostname the certificate must cover. | | `--port` | `443` | External HTTPS port for probing the certificate the cluster serves. | -| `--timeout` | `30m` | Time budget for the whole rotation. A rollback, if needed, gets its own budget of the same size. | +| `--timeout` | `30m0s` | Time budget for the whole rotation. A rollback, if needed, gets its own budget of the same size. | | `--dry-run` | off | Validate the certificate and print the plan without changing the cluster. Doesn't need cluster access. | | `--no-rollback` | off | Leave the new certificate in place if verification fails, instead of restoring the previous one automatically. | | `--kubeconfig` | `/etc/rancher/k3s/k3s.yaml` | Path to the kubeconfig file. | @@ -210,7 +212,7 @@ sudo dspm-installer rollback-cert --latest | `--latest` | off | Restore the most recent snapshot. | | `--snapshot` | none | Restore the snapshot at the given path, such as `/etc/dspm/cert-snapshots/2026-09-08T14-02-11Z`. | -`--list`, `--latest`, and `--snapshot` are mutually exclusive. `rollback-cert` exits `0` when it applies and verifies the restore, `72` when it applies the restore but verification fails, and `73` when it can't apply the restore. +`--list`, `--latest`, and `--snapshot` are mutually exclusive. `rollback-cert` exits `1` when a check fails before it writes anything, such as combining these flags or naming a snapshot that doesn't exist, `0` when it applies and verifies the restore, `72` when it applies the restore but verification fails, and `73` when it can't apply the restore. ## Logs diff --git a/docs/accessanalyzer/26.1/install/rotate-the-tls-certificate.md b/docs/accessanalyzer/26.1/install/rotate-the-tls-certificate.md index 464858dfba..894003f018 100644 --- a/docs/accessanalyzer/26.1/install/rotate-the-tls-certificate.md +++ b/docs/accessanalyzer/26.1/install/rotate-the-tls-certificate.md @@ -17,7 +17,7 @@ Use `update-cert` when: - You want to replace a self-signed demo certificate with a CA-issued one. :::warning -Don't re-run the installer to change the certificate. The installer only writes the certificate and key Secret—it doesn't update the CA bundle every pod trusts, and ArgoCD reverts a manual edit on its next sync. `update-cert` updates both and waits for the cluster to pick them up. +Don't re-run the installer to change the certificate. The installer only writes the Kubernetes Secret that holds the certificate and key (`dspm-tls`)—it doesn't update the CA bundle every pod trusts, and ArgoCD reverts a manual edit on its next sync. `update-cert` updates both and waits for the cluster to pick them up. ::: ## Before You Start @@ -36,9 +36,11 @@ Don't re-run the installer to change the certificate. The installer only writes openssl pkcs12 -in cert.pfx -nocerts -nodes -out /etc/dspm/tls.key ``` -2. If a private CA issued the certificate, get the issuing root CA in PEM form too, for example `/etc/dspm/internal-root-ca.pem`. A certificate from a private CA requires this: a full-chain PEM omits the root by convention, so the certificate file alone gives the installer nothing to derive a trust anchor from. Only a self-signed certificate can skip this. +2. If a private CA issued the certificate, get the issuing root CA in PEM form too, for example `/etc/dspm/internal-root-ca.pem`. A certificate from a private CA requires this: a full-chain PEM omits the root by convention, so the certificate file alone gives `update-cert` nothing to derive a trust anchor from. Only a self-signed certificate can skip this. -3. Confirm the certificate covers the installed hostname. `update-cert` reads the hostname from `/etc/dspm/installer.yaml` and stops if the certificate's Subject Alternative Names don't cover it. +3. Confirm the certificate covers the installed hostname. `update-cert` reads the hostname from `/etc/dspm/installer.yaml` and stops if the certificate's Subject Alternative Names don't cover it. Pass `--hostname` to override the value in that file, or to supply it when the file is missing. + +If a load balancer, reverse proxy, or split-horizon DNS sits in front of the cluster's ingress, read [If the probe fails behind a reverse proxy](#if-the-probe-fails-behind-a-reverse-proxy) before you start. ## Rotate the Certificate @@ -56,6 +58,10 @@ Don't re-run the installer to change the certificate. The installer only writes 2. Run the rotation. + :::note + Restarting the workloads that mount the CA bundle briefly interrupts the web application. A rotation typically finishes in a few minutes; `--timeout` allows up to 30 minutes. Run it during a maintenance window. + ::: + ```bash sudo dspm-installer update-cert \ --tls-cert /etc/dspm/tls.crt \ @@ -65,16 +71,16 @@ Don't re-run the installer to change the certificate. The installer only writes `update-cert` validates the certificate and key pair, confirms the certificate covers the hostname, and (with `--ca-bundle`) confirms the certificate chains to the bundle. It then snapshots the certificate the cluster serves to `/etc/dspm/cert-snapshots//`, applies the new certificate and CA bundle, restarts every workload that mounts the CA bundle, and verifies the ingress serves the new certificate before it exits. On success, it prints `New certificate applied and verified (leaf )`. -3. Confirm the certificate from a client machine. +3. Confirm the certificate from a client machine. Substitute your installed hostname for ``. ```bash - openssl s_client -connect dspm.corp.example.com:443 -servername dspm.corp.example.com /dev/null \ + openssl s_client -connect :443 -servername /dev/null \ | openssl x509 -noout -subject -issuer -dates -fingerprint -sha256 ``` The fingerprint should match the `leaf` value `update-cert` printed. -If verification fails, `update-cert` automatically restores the previous certificate from its snapshot and exits with a non-zero code. See [Exit codes](installer-reference.md#exit-codes) in the installer reference for what each code means and what to do next. +If verification fails, `update-cert` restores the previous certificate from its snapshot and exits with a non-zero code—unless you passed `--no-rollback`, or it couldn't reach the ingress at all, in which case the new certificate stays in place. See [The `update-cert` command](installer-reference.md#the-update-cert-command) in the installer reference for what each code means and what to do next. ## If the Probe Fails Behind a Reverse Proxy @@ -128,7 +134,7 @@ sudo rm -rf /etc/dspm/cert-snapshots/ ``` ::: -## Checking the Result +## Check the Result Confirm the cluster's state directly if an exit code left you unsure what happened: From 4c40c4001a15fc95c328855d54105dbb89952072 Mon Sep 17 00:00:00 2001 From: thobed <10742470+thobed@users.noreply.github.com> Date: Wed, 9 Sep 2026 10:08:24 -0400 Subject: [PATCH 04/15] Address second round of editorial review on TLS rotation docs Fix a dropped relative pronoun, qualify the rollback claim against --no-rollback and unreachable-ingress cases, align boolean flag defaults and the rollback-cert exit codes with the rest of the reference, cross-link the two docs for exit codes and cleanup steps, define platform-service and trust anchor on first use, clarify that the rotation timeout is a configurable default, and spell out what a healthy CA bundle check looks like. --- .../26.1/install/installer-reference.md | 23 ++++++++++++------- .../install/rotate-the-tls-certificate.md | 14 +++++------ 2 files changed, 22 insertions(+), 15 deletions(-) diff --git a/docs/accessanalyzer/26.1/install/installer-reference.md b/docs/accessanalyzer/26.1/install/installer-reference.md index 028f017089..9ee600b056 100644 --- a/docs/accessanalyzer/26.1/install/installer-reference.md +++ b/docs/accessanalyzer/26.1/install/installer-reference.md @@ -163,7 +163,7 @@ Exit codes: 0 when everything is healthy, 70 when the timeout passes, 71 when a ## The `update-cert` Command -`update-cert` installs a new TLS certificate on a running Access Analyzer installation, without re-running the full installer. Use it to replace a certificate that's expiring or expired, to replace one pods don't trust, or to swap a self-signed certificate for a CA-issued one. +`update-cert` installs a new TLS certificate on a running Access Analyzer installation, without re-running the full installer. Use it to replace a certificate that's expiring or expired, to replace one that pods don't trust, or to swap a self-signed certificate for a CA-issued one. ```bash sudo dspm-installer update-cert \ @@ -182,12 +182,12 @@ sudo dspm-installer update-cert \ | `--hostname` | from `/etc/dspm/installer.yaml` | Hostname the certificate must cover. | | `--port` | `443` | External HTTPS port for probing the certificate the cluster serves. | | `--timeout` | `30m0s` | Time budget for the whole rotation. A rollback, if needed, gets its own budget of the same size. | -| `--dry-run` | off | Validate the certificate and print the plan without changing the cluster. Doesn't need cluster access. | -| `--no-rollback` | off | Leave the new certificate in place if verification fails, instead of restoring the previous one automatically. | +| `--dry-run` | `false` | Validate the certificate and print the plan without changing the cluster. Doesn't need cluster access. | +| `--no-rollback` | `false` | Leave the new certificate in place if verification fails, instead of restoring the previous one automatically. | | `--kubeconfig` | `/etc/rancher/k3s/k3s.yaml` | Path to the kubeconfig file. | | `--argocd-namespace` | `argocd` | Kubernetes namespace for ArgoCD. | -If verification fails, `update-cert` restores the previous certificate from its snapshot and exits with a code that tells you what state the cluster is in: +If verification fails, `update-cert` restores the previous certificate from its snapshot—unless you passed `--no-rollback`, or it couldn't reach the ingress at all. It exits with a code that tells you what state the cluster is in: | Code | Meaning | |---|---| @@ -200,7 +200,7 @@ If verification fails, `update-cert` restores the previous certificate from its ## The `rollback-cert` Command -`rollback-cert` restores a certificate from a snapshot `update-cert` saved during an earlier rotation. Snapshots live under `/etc/dspm/cert-snapshots/`, and Access Analyzer never prunes them automatically. +`rollback-cert` restores a certificate from a snapshot `update-cert` saved during an earlier rotation. Snapshots live under `/etc/dspm/cert-snapshots/`, and Access Analyzer never prunes them automatically. Snapshots contain private key material. See [Roll back a certificate](rotate-the-tls-certificate.md#roll-back-a-certificate) for how to remove ones you no longer need. ```bash sudo dspm-installer rollback-cert --latest @@ -208,11 +208,18 @@ sudo dspm-installer rollback-cert --latest | Flag | Default | Description | |---|---|---| -| `--list` | off | List available snapshots: timestamp, hostname, leaf certificate fingerprint, and expiry. Doesn't need cluster access. | -| `--latest` | off | Restore the most recent snapshot. | +| `--list` | `false` | List available snapshots: timestamp, hostname, leaf certificate fingerprint, and expiry. Doesn't need cluster access. | +| `--latest` | `false` | Restore the most recent snapshot. | | `--snapshot` | none | Restore the snapshot at the given path, such as `/etc/dspm/cert-snapshots/2026-09-08T14-02-11Z`. | -`--list`, `--latest`, and `--snapshot` are mutually exclusive. `rollback-cert` exits `1` when a check fails before it writes anything, such as combining these flags or naming a snapshot that doesn't exist, `0` when it applies and verifies the restore, `72` when it applies the restore but verification fails, and `73` when it can't apply the restore. +`--list`, `--latest`, and `--snapshot` are mutually exclusive. + +| Code | Meaning | +|---|---| +| 0 | `rollback-cert` applied and verified the restore. | +| 1 | A check failed before `rollback-cert` wrote anything, such as combining mutually exclusive flags or naming a snapshot that doesn't exist. | +| 72 | `rollback-cert` applied the restore, but verification failed. | +| 73 | `rollback-cert` couldn't apply the restore. | ## Logs diff --git a/docs/accessanalyzer/26.1/install/rotate-the-tls-certificate.md b/docs/accessanalyzer/26.1/install/rotate-the-tls-certificate.md index 894003f018..24787eb742 100644 --- a/docs/accessanalyzer/26.1/install/rotate-the-tls-certificate.md +++ b/docs/accessanalyzer/26.1/install/rotate-the-tls-certificate.md @@ -4,7 +4,7 @@ description: Replace the TLS certificate on a running Access Analyzer installati sidebar_position: 5 --- -Rotate the TLS certificate with `update-cert`, a subcommand of the same `dspm-installer` binary you used to install Access Analyzer. `update-cert` and its counterpart, `rollback-cert`, talk to the cluster directly with `kubectl` instead of through the product API, so they work even when `platform-service` is failing because it doesn't trust the current certificate. +Rotate the TLS certificate with `update-cert`, a subcommand of the same `dspm-installer` binary you used to install Access Analyzer. `update-cert` and its counterpart, `rollback-cert`, talk to the cluster directly with `kubectl` instead of through the product API, so they work even when the `platform-service` workload is failing because it doesn't trust the current certificate. Run both commands with `sudo`. The default kubeconfig at `/etc/rancher/k3s/k3s.yaml` is readable only by root, so without `sudo`, `kubectl` falls back to `localhost:8080` and fails with "connection refused." @@ -17,7 +17,7 @@ Use `update-cert` when: - You want to replace a self-signed demo certificate with a CA-issued one. :::warning -Don't re-run the installer to change the certificate. The installer only writes the Kubernetes Secret that holds the certificate and key (`dspm-tls`)—it doesn't update the CA bundle every pod trusts, and ArgoCD reverts a manual edit on its next sync. `update-cert` updates both and waits for the cluster to pick them up. +Don't re-run the installer to change the certificate. The installer only writes the Kubernetes Secret that holds the certificate and key (`dspm-tls`)—it doesn't update the CA bundle every pod trusts, and ArgoCD reverts a hand-edited Secret on its next sync. `update-cert` updates both and waits for the cluster to pick them up. ::: ## Before You Start @@ -36,7 +36,7 @@ Don't re-run the installer to change the certificate. The installer only writes openssl pkcs12 -in cert.pfx -nocerts -nodes -out /etc/dspm/tls.key ``` -2. If a private CA issued the certificate, get the issuing root CA in PEM form too, for example `/etc/dspm/internal-root-ca.pem`. A certificate from a private CA requires this: a full-chain PEM omits the root by convention, so the certificate file alone gives `update-cert` nothing to derive a trust anchor from. Only a self-signed certificate can skip this. +2. If a private CA issued the certificate, get the issuing root CA in PEM form too, for example `/etc/dspm/internal-root-ca.pem`. A certificate from a private CA requires this: a full-chain PEM omits the root by convention, so the certificate file alone doesn't tell `update-cert` which CA to trust. Only a self-signed certificate can skip this. 3. Confirm the certificate covers the installed hostname. `update-cert` reads the hostname from `/etc/dspm/installer.yaml` and stops if the certificate's Subject Alternative Names don't cover it. Pass `--hostname` to override the value in that file, or to supply it when the file is missing. @@ -59,7 +59,7 @@ If a load balancer, reverse proxy, or split-horizon DNS sits in front of the clu 2. Run the rotation. :::note - Restarting the workloads that mount the CA bundle briefly interrupts the web application. A rotation typically finishes in a few minutes; `--timeout` allows up to 30 minutes. Run it during a maintenance window. + Restarting the workloads that mount the CA bundle briefly interrupts the web application. A rotation typically finishes in a few minutes; the default `--timeout` gives it up to 30 minutes. Run it during a maintenance window. ::: ```bash @@ -80,7 +80,7 @@ If a load balancer, reverse proxy, or split-horizon DNS sits in front of the clu The fingerprint should match the `leaf` value `update-cert` printed. -If verification fails, `update-cert` restores the previous certificate from its snapshot and exits with a non-zero code—unless you passed `--no-rollback`, or it couldn't reach the ingress at all, in which case the new certificate stays in place. See [The `update-cert` command](installer-reference.md#the-update-cert-command) in the installer reference for what each code means and what to do next. +If verification fails, `update-cert` restores the previous certificate from its snapshot and exits with a non-zero code—unless you passed `--no-rollback`, or it couldn't reach the ingress at all, in which case the new certificate stays in place. See [The `update-cert` command](installer-reference.md#the-update-cert-command) in the installer reference for what each code means. If it exits `74`, see the "Recovering when rollback-cert can't restore a snapshot" troubleshooting section under [Check the Result](#check-the-result). ## If the Probe Fails Behind a Reverse Proxy @@ -123,7 +123,7 @@ Every rotation leaves a snapshot under `/etc/dspm/cert-snapshots/`. To restore a sudo dspm-installer rollback-cert --snapshot /etc/dspm/cert-snapshots/2026-09-08T14-02-11Z ``` - `rollback-cert` restores the CA bundle along with the certificate and key, restarts the workloads that consume them, and verifies the result. On success, it prints `Restored and verified certificate from `. + `rollback-cert` restores the CA bundle along with the certificate and key, restarts the workloads that consume them, and verifies the result. On success, it prints `Restored and verified certificate from `. See [The `rollback-cert` command](installer-reference.md#the-rollback-cert-command) in the installer reference for its flags and exit codes. :::note Snapshots contain private key material. Access Analyzer writes them with restricted file permissions and never prunes them automatically. Remove ones you no longer need: @@ -154,7 +154,7 @@ sudo kubectl rollout status deploy/platform-service -n access-analyzer sudo kubectl logs deploy/platform-service -n access-analyzer --tail=50 ``` -Every application should show `Synced` and `Healthy`, and the `platform-service` log should show OpenID Connect (OIDC) discovery completing rather than exiting on a certificate error. +The CA bundle should start with `-----BEGIN CERTIFICATE-----`, every application should show `Synced` and `Healthy`, and the `platform-service` log should show OpenID Connect (OIDC) discovery completing rather than exiting on a certificate error.
Troubleshooting: recovering when rollback-cert can't restore a snapshot From b833e0072057cbb05904d37bd0705be9d12bde9b Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Wed, 9 Sep 2026 14:13:41 +0000 Subject: [PATCH 05/15] fix(vale): auto-fix style issues (Vale + Dale) --- docs/accessanalyzer/26.1/install/installer-reference.md | 2 +- docs/accessanalyzer/26.1/install/rotate-the-tls-certificate.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/accessanalyzer/26.1/install/installer-reference.md b/docs/accessanalyzer/26.1/install/installer-reference.md index 9ee600b056..b89006657a 100644 --- a/docs/accessanalyzer/26.1/install/installer-reference.md +++ b/docs/accessanalyzer/26.1/install/installer-reference.md @@ -136,7 +136,7 @@ The installer compares RAM and disk against their thresholds with a 5% tolerance | `kernel-modules` | The kernel has the `br_netfilter` and `overlay` modules loaded or built in. The install loads missing modules itself, so this check warns only when it can't inspect a module, or during a dry run when a module isn't loaded. | WARN | `kernel module issues: : could not check module: ` or `kernel module issues: : not loaded (dry run; will not be modprobed)` | | `os` | The Linux distribution belongs to a recognized family. | WARN | `unrecognised Linux distribution; installation may not be supported` | | `selinux` | SELinux isn't in enforcing mode. | WARN | The message says SELinux is enforcing and asks you to allow the platform's container policy or set SELinux to permissive. | -| `antivirus` | No known antivirus product is installed or running: `mdatp`, CrowdStrike, ClamAV, Sophos, Carbon Black, or Trend Micro. | WARN | `antivirus software detected: (exclusion hint: )` | +| `antivirus` | The server has no known antivirus product installed or running: `mdatp`, CrowdStrike, ClamAV, Sophos, Carbon Black, or Trend Micro. | WARN | `antivirus software detected: (exclusion hint: )` | | `network` | Each of the 18 required hosts resolves in DNS and accepts a connection on port 443 within 5 seconds. | FAIL when a name doesn't resolve; WARN when a connection times out or the host refuses it | `DNS resolution failed for: ` or `connection failed (timeout/refused) for: ` | | `domain-join` | Whether the server belongs to an Active Directory domain. Informational only. | — | `no AD domain detected`, or a message naming the detected domain | | `clock-sync` | A time-sync service (`chronyd`, `ntpd`, or `systemd-timesyncd`) is running. | WARN | `no clock sync daemon detected; Kerberos authentication requires clocks within 5 minutes of the AD domain controller — install chronyd, ntpd, or systemd-timesyncd to eliminate clock-skew risk` | diff --git a/docs/accessanalyzer/26.1/install/rotate-the-tls-certificate.md b/docs/accessanalyzer/26.1/install/rotate-the-tls-certificate.md index 24787eb742..4fbbe842db 100644 --- a/docs/accessanalyzer/26.1/install/rotate-the-tls-certificate.md +++ b/docs/accessanalyzer/26.1/install/rotate-the-tls-certificate.md @@ -159,7 +159,7 @@ The CA bundle should start with `-----BEGIN CERTIFICATE-----`, every application
Troubleshooting: recovering when rollback-cert can't restore a snapshot -If `rollback-cert` itself can't apply a snapshot, the snapshot directory still holds everything you need to recover by hand. Each snapshot contains: +If `rollback-cert` itself can't apply a snapshot, the snapshot directory still holds everything you need to recover manually. Each snapshot contains: | File | Contents | |---|---| From bea65179980d095be38b3fdf9a5ae07bf5664d0f Mon Sep 17 00:00:00 2001 From: thobed <10742470+thobed@users.noreply.github.com> Date: Wed, 9 Sep 2026 10:17:48 -0400 Subject: [PATCH 06/15] Fix rollback-cert exit codes and missing flags against source MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Verified against the actual implementation (netwrix-corp/access-analyzer commit d2ef453). rollback-cert has no exit code 72 — its real codes are 0, 1, 73, and 74. It also accepts --hostname, --port, --timeout, --kubeconfig, and --argocd-namespace like update-cert does; only --list, --latest, and --snapshot were documented. Also note that update-cert's exit code 72 is reused for --no-rollback runs and for a snapshot that couldn't be loaded, not only a successful rollback. --- .../26.1/install/installer-reference.md | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/docs/accessanalyzer/26.1/install/installer-reference.md b/docs/accessanalyzer/26.1/install/installer-reference.md index b89006657a..11192cc9c6 100644 --- a/docs/accessanalyzer/26.1/install/installer-reference.md +++ b/docs/accessanalyzer/26.1/install/installer-reference.md @@ -193,7 +193,7 @@ If verification fails, `update-cert` restores the previous certificate from its |---|---| | 0 | `update-cert` applied and verified the new certificate. | | 1 | A check failed before `update-cert` wrote anything. The cluster is unchanged. | -| 72 | Verification failed; `update-cert` restored and verified the previous certificate. | +| 72 | Verification failed; `update-cert` restored and verified the previous certificate. Also returned when `--no-rollback` was set (nothing restored) or the saved snapshot couldn't be loaded. | | 73 | Verification failed; `update-cert` restored the previous certificate but couldn't verify it. | | 74 | Verification failed and `update-cert` couldn't apply the rollback. | | 75 | `update-cert` couldn't reach the ingress, so it verified nothing and rolled nothing back. The new certificate is still in place. | @@ -211,6 +211,11 @@ sudo dspm-installer rollback-cert --latest | `--list` | `false` | List available snapshots: timestamp, hostname, leaf certificate fingerprint, and expiry. Doesn't need cluster access. | | `--latest` | `false` | Restore the most recent snapshot. | | `--snapshot` | none | Restore the snapshot at the given path, such as `/etc/dspm/cert-snapshots/2026-09-08T14-02-11Z`. | +| `--hostname` | from `/etc/dspm/installer.yaml` | Hostname the restored certificate must cover. | +| `--port` | `443` | External HTTPS port used to verify the restore. | +| `--timeout` | `30m0s` | Time budget for the restore. | +| `--kubeconfig` | `/etc/rancher/k3s/k3s.yaml` | Path to the kubeconfig file. | +| `--argocd-namespace` | `argocd` | Kubernetes namespace for ArgoCD. | `--list`, `--latest`, and `--snapshot` are mutually exclusive. @@ -218,8 +223,8 @@ sudo dspm-installer rollback-cert --latest |---|---| | 0 | `rollback-cert` applied and verified the restore. | | 1 | A check failed before `rollback-cert` wrote anything, such as combining mutually exclusive flags or naming a snapshot that doesn't exist. | -| 72 | `rollback-cert` applied the restore, but verification failed. | -| 73 | `rollback-cert` couldn't apply the restore. | +| 73 | `rollback-cert` applied the restore, but verification failed. | +| 74 | `rollback-cert` couldn't apply the restore. | ## Logs From 444500e082b4b6731ecff4269d162107ba8cb842 Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Wed, 9 Sep 2026 14:21:24 +0000 Subject: [PATCH 07/15] fix(vale): auto-fix style issues (Vale + Dale) --- docs/accessanalyzer/26.1/install/installer-reference.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/accessanalyzer/26.1/install/installer-reference.md b/docs/accessanalyzer/26.1/install/installer-reference.md index 11192cc9c6..2d5736bc06 100644 --- a/docs/accessanalyzer/26.1/install/installer-reference.md +++ b/docs/accessanalyzer/26.1/install/installer-reference.md @@ -109,7 +109,7 @@ When the file supplies every required value and the installer runs in a terminal | Code | Meaning | |---|---| | 0 | Success. | -| 1 | General failure: an invalid flag value, a hostname or TLS validation error, a required value missing in a non-interactive run, or prompts canceled with Esc or Ctrl-C (`installation cancelled`). | +| 1 | General failure: an invalid flag value, a hostname or TLS validation error, a required value missing in a non-interactive run, or you canceled the prompts with Esc or Ctrl-C (`installation cancelled`). | | 10 | License key error. The key is expired, suspended, not found, or invalid. | | 20 | The release version you requested with `--target-revision` isn't available for this license key. | | 50 | The installer couldn't install the platform, or the platform didn't become ready within 5 minutes. | @@ -193,7 +193,7 @@ If verification fails, `update-cert` restores the previous certificate from its |---|---| | 0 | `update-cert` applied and verified the new certificate. | | 1 | A check failed before `update-cert` wrote anything. The cluster is unchanged. | -| 72 | Verification failed; `update-cert` restored and verified the previous certificate. Also returned when `--no-rollback` was set (nothing restored) or the saved snapshot couldn't be loaded. | +| 72 | Verification failed; `update-cert` restored and verified the previous certificate. `update-cert` also returns 72 when you pass `--no-rollback` (nothing restored) or when it can't load the saved snapshot. | | 73 | Verification failed; `update-cert` restored the previous certificate but couldn't verify it. | | 74 | Verification failed and `update-cert` couldn't apply the rollback. | | 75 | `update-cert` couldn't reach the ingress, so it verified nothing and rolled nothing back. The new certificate is still in place. | @@ -212,7 +212,7 @@ sudo dspm-installer rollback-cert --latest | `--latest` | `false` | Restore the most recent snapshot. | | `--snapshot` | none | Restore the snapshot at the given path, such as `/etc/dspm/cert-snapshots/2026-09-08T14-02-11Z`. | | `--hostname` | from `/etc/dspm/installer.yaml` | Hostname the restored certificate must cover. | -| `--port` | `443` | External HTTPS port used to verify the restore. | +| `--port` | `443` | External HTTPS port for verifying the restore. | | `--timeout` | `30m0s` | Time budget for the restore. | | `--kubeconfig` | `/etc/rancher/k3s/k3s.yaml` | Path to the kubeconfig file. | | `--argocd-namespace` | `argocd` | Kubernetes namespace for ArgoCD. | From 567479729d13d883ed0e68d55c20643f946449e2 Mon Sep 17 00:00:00 2001 From: thobed <10742470+thobed@users.noreply.github.com> Date: Wed, 9 Sep 2026 10:55:23 -0400 Subject: [PATCH 08/15] Document the --log-path installer flag Add --log-path (env LOG_PATH, default /var/log/dspm-installer.log) to the flags table and update the Logs section to describe its fatal-vs- fallback write-failure behavior: unwritable at the default path falls back to stderr, but the same failure on an explicitly set path stops the installer. --- docs/accessanalyzer/26.1/install/installer-reference.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/accessanalyzer/26.1/install/installer-reference.md b/docs/accessanalyzer/26.1/install/installer-reference.md index 2d5736bc06..e0ad611598 100644 --- a/docs/accessanalyzer/26.1/install/installer-reference.md +++ b/docs/accessanalyzer/26.1/install/installer-reference.md @@ -36,6 +36,7 @@ Two environment variable names need care: `--hostname` reads `DSPM_HOSTNAME`, no | `--assume-yes` | `DSPM_ASSUME_YES` | `false` | Skip the review screen that appears when the configuration file already supplies every required value. | | `--dry-run` | `DRY_RUN` | `false` | Print the planned actions and exit without installing. Needs no TLS files and writes no configuration file. | | `--log-level` | `LOG_LEVEL` | `info` | Detail written to the log file: `debug`, `info`, `warn`, or `error`. | +| `--log-path` | `LOG_PATH` | `/var/log/dspm-installer.log` | Path to the installer's log file. If you set this explicitly (flag, environment variable, or configuration file) and the path isn't writable or is a symlink, the installer stops with an error instead of falling back to the terminal. | | `--postgres-data-dir` | `POSTGRES_DATA_DIR` | none | Custom directory for the application database's data. | | `--clickhouse-data-dir` | `CLICKHOUSE_DATA_DIR` | none | Custom directory for the analytics store's data. | | `--log-exports-storage` | `LOG_EXPORTS_STORAGE` | none | Persistent volume claim (PVC) size for log exports, such as `10Gi`. | @@ -230,5 +231,5 @@ sudo dspm-installer rollback-cert --latest | File | Contents | |---|---| -| `/var/log/dspm-installer.log` | Everything the installer does, as one JavaScript Object Notation (JSON) object per line, at the detail `--log-level` sets. The installer appends to the file on every run, with mode `0640`. If the installer can't write the file, it sends the same output to the terminal's standard error as text. | +| The `--log-path` file (default `/var/log/dspm-installer.log`) | Everything the installer does, as one JavaScript Object Notation (JSON) object per line, at the detail `--log-level` sets. The installer appends to the file on every run, with mode `0640`, and rejects a symlink at that path. At the default path, a write failure is non-fatal and the installer sends the same output to the terminal's standard error as text instead; with `--log-path` set explicitly, the same failure stops the installer with an error. | | `/var/log/dspm-preflight.json` | The full result of the most recent preflight run: `timestamp`, `overallStatus`, and a `checks` list with `name`, `status`, and `message` for every check, including the ones that passed. `--dry-run` doesn't write it. | From 2ec4f04ddb75fb20c550e0eedec6a6ec9a8b3dcd Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Wed, 9 Sep 2026 15:03:30 +0000 Subject: [PATCH 09/15] fix(vale): auto-fix style issues (Vale + Dale) --- docs/accessanalyzer/26.1/install/installer-reference.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/accessanalyzer/26.1/install/installer-reference.md b/docs/accessanalyzer/26.1/install/installer-reference.md index e0ad611598..342aadd3b7 100644 --- a/docs/accessanalyzer/26.1/install/installer-reference.md +++ b/docs/accessanalyzer/26.1/install/installer-reference.md @@ -40,7 +40,7 @@ Two environment variable names need care: `--hostname` reads `DSPM_HOSTNAME`, no | `--postgres-data-dir` | `POSTGRES_DATA_DIR` | none | Custom directory for the application database's data. | | `--clickhouse-data-dir` | `CLICKHOUSE_DATA_DIR` | none | Custom directory for the analytics store's data. | | `--log-exports-storage` | `LOG_EXPORTS_STORAGE` | none | Persistent volume claim (PVC) size for log exports, such as `10Gi`. | -| `--skip-preflight` | `SKIP_PREFLIGHT` | `false` | Skip the preflight checks. Intended for testing only. | +| `--skip-preflight` | `SKIP_PREFLIGHT` | `false` | Skip the preflight checks. For testing only. | | `--version` | — | — | Print the installer version and exit. | | `--help` | — | — | Print flag help and exit. | From 04553ff0b5318ac27bdbadd23758d5be4d72c563 Mon Sep 17 00:00:00 2001 From: thobed <10742470+thobed@users.noreply.github.com> Date: Wed, 9 Sep 2026 12:45:59 -0400 Subject: [PATCH 10/15] Replace hardcoded snapshot date with a placeholder Per PR feedback, --snapshot examples used a literal timestamp from when the doc was written. Use , matching the placeholder already used for this path elsewhere on the page. --- docs/accessanalyzer/26.1/install/installer-reference.md | 2 +- docs/accessanalyzer/26.1/install/rotate-the-tls-certificate.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/accessanalyzer/26.1/install/installer-reference.md b/docs/accessanalyzer/26.1/install/installer-reference.md index 342aadd3b7..9ab3c38c76 100644 --- a/docs/accessanalyzer/26.1/install/installer-reference.md +++ b/docs/accessanalyzer/26.1/install/installer-reference.md @@ -211,7 +211,7 @@ sudo dspm-installer rollback-cert --latest |---|---|---| | `--list` | `false` | List available snapshots: timestamp, hostname, leaf certificate fingerprint, and expiry. Doesn't need cluster access. | | `--latest` | `false` | Restore the most recent snapshot. | -| `--snapshot` | none | Restore the snapshot at the given path, such as `/etc/dspm/cert-snapshots/2026-09-08T14-02-11Z`. | +| `--snapshot` | none | Restore the snapshot at the given path, such as `/etc/dspm/cert-snapshots/`. | | `--hostname` | from `/etc/dspm/installer.yaml` | Hostname the restored certificate must cover. | | `--port` | `443` | External HTTPS port for verifying the restore. | | `--timeout` | `30m0s` | Time budget for the restore. | diff --git a/docs/accessanalyzer/26.1/install/rotate-the-tls-certificate.md b/docs/accessanalyzer/26.1/install/rotate-the-tls-certificate.md index 4fbbe842db..0f531ac65c 100644 --- a/docs/accessanalyzer/26.1/install/rotate-the-tls-certificate.md +++ b/docs/accessanalyzer/26.1/install/rotate-the-tls-certificate.md @@ -120,7 +120,7 @@ Every rotation leaves a snapshot under `/etc/dspm/cert-snapshots/`. To restore a sudo dspm-installer rollback-cert --latest # or a specific one - sudo dspm-installer rollback-cert --snapshot /etc/dspm/cert-snapshots/2026-09-08T14-02-11Z + sudo dspm-installer rollback-cert --snapshot /etc/dspm/cert-snapshots/ ``` `rollback-cert` restores the CA bundle along with the certificate and key, restarts the workloads that consume them, and verifies the result. On success, it prints `Restored and verified certificate from `. See [The `rollback-cert` command](installer-reference.md#the-rollback-cert-command) in the installer reference for its flags and exit codes. From 0edbd8c8c3117586b52dab53ee6bc866dd61792b Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Wed, 9 Sep 2026 16:52:16 +0000 Subject: [PATCH 11/15] fix(vale): auto-fix style issues (Vale + Dale) --- docs/accessanalyzer/26.1/install/rotate-the-tls-certificate.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/accessanalyzer/26.1/install/rotate-the-tls-certificate.md b/docs/accessanalyzer/26.1/install/rotate-the-tls-certificate.md index 0f531ac65c..43bd678a77 100644 --- a/docs/accessanalyzer/26.1/install/rotate-the-tls-certificate.md +++ b/docs/accessanalyzer/26.1/install/rotate-the-tls-certificate.md @@ -17,7 +17,7 @@ Use `update-cert` when: - You want to replace a self-signed demo certificate with a CA-issued one. :::warning -Don't re-run the installer to change the certificate. The installer only writes the Kubernetes Secret that holds the certificate and key (`dspm-tls`)—it doesn't update the CA bundle every pod trusts, and ArgoCD reverts a hand-edited Secret on its next sync. `update-cert` updates both and waits for the cluster to pick them up. +Don't re-run the installer to change the certificate. The installer only writes the Kubernetes Secret that holds the certificate and key (`dspm-tls`)—it doesn't update the CA bundle every pod trusts, and ArgoCD reverts a hand-edited Secret on its next sync. `update-cert` updates both and waits for the cluster to load them. ::: ## Before You Start From 4f21e67db14090a516fd8c2a35418cdd15d248f9 Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Thu, 10 Sep 2026 12:13:40 +0000 Subject: [PATCH 12/15] fix(vale): auto-fix style issues (Vale + Dale) --- docs/accessanalyzer/26.1/install/installer-reference.md | 4 ++-- .../accessanalyzer/26.1/install/rotate-the-tls-certificate.md | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/accessanalyzer/26.1/install/installer-reference.md b/docs/accessanalyzer/26.1/install/installer-reference.md index 9ab3c38c76..b023e7acf7 100644 --- a/docs/accessanalyzer/26.1/install/installer-reference.md +++ b/docs/accessanalyzer/26.1/install/installer-reference.md @@ -4,7 +4,7 @@ description: The dspm-installer flags, environment variables, configuration file sidebar_position: 6 --- -`dspm-installer` takes its settings from four places. A flag wins over an environment variable, an environment variable wins over the configuration file, and the configuration file wins over the built-in default. When the installer runs in a terminal, it prompts for any required value still missing; without a terminal, a missing required value is an error. +`dspm-installer` takes its settings from four places. A flag overrides an environment variable, an environment variable overrides the configuration file, and the configuration file overrides the built-in default. When the installer runs in a terminal, it prompts for any required value still missing; without a terminal, a missing required value is an error. ```bash dspm-installer [flags] @@ -111,7 +111,7 @@ When the file supplies every required value and the installer runs in a terminal |---|---| | 0 | Success. | | 1 | General failure: an invalid flag value, a hostname or TLS validation error, a required value missing in a non-interactive run, or you canceled the prompts with Esc or Ctrl-C (`installation cancelled`). | -| 10 | License key error. The key is expired, suspended, not found, or invalid. | +| 10 | License key error. The key is expired, suspended, unknown, or invalid. | | 20 | The release version you requested with `--target-revision` isn't available for this license key. | | 50 | The installer couldn't install the platform, or the platform didn't become ready within 5 minutes. | | 60 | The installer couldn't install a platform component. | diff --git a/docs/accessanalyzer/26.1/install/rotate-the-tls-certificate.md b/docs/accessanalyzer/26.1/install/rotate-the-tls-certificate.md index 43bd678a77..425b5f21d9 100644 --- a/docs/accessanalyzer/26.1/install/rotate-the-tls-certificate.md +++ b/docs/accessanalyzer/26.1/install/rotate-the-tls-certificate.md @@ -17,7 +17,7 @@ Use `update-cert` when: - You want to replace a self-signed demo certificate with a CA-issued one. :::warning -Don't re-run the installer to change the certificate. The installer only writes the Kubernetes Secret that holds the certificate and key (`dspm-tls`)—it doesn't update the CA bundle every pod trusts, and ArgoCD reverts a hand-edited Secret on its next sync. `update-cert` updates both and waits for the cluster to load them. +Don't re-run the installer to change the certificate. The installer writes only the Kubernetes Secret that holds the certificate and key (`dspm-tls`)—it doesn't update the CA bundle every pod trusts, and ArgoCD reverts a hand-edited Secret on its next sync. `update-cert` updates both and waits for the cluster to load them. ::: ## Before You Start From 6adbe9e24e65a63260b1b78370b92643fe8972bc Mon Sep 17 00:00:00 2001 From: Jordan Violet <8886650+jtviolet@users.noreply.github.com> Date: Thu, 10 Sep 2026 08:48:55 -0400 Subject: [PATCH 13/15] docs(accessanalyzer): remove the 26.1 Knowledge Base section and migration docs The 26.1 KB section held a StealthAUDIT/Access Analyzer 12 migration guide written against a pre-release product model (scanner nodes, source groups) that the shipping-product rewrite no longer matches, plus an article template and an upgrade how-to. Delete the version-pinned KB source folder outright and give 26.1 no KB section at all: add a `kb: false` opt-out on the version entry so the copy script skips it (and removes any stale copied folder) instead of falling back to the 12.0/11.6 knowledge base. Fold the upgrade article's unique steps, checking the installed version with `dspmctl version` before and after the upgrade, into the existing Installation > Upgrade to a New Version page rather than keeping a second page on the same procedure. No redirects: the docs are not yet in use. Generated with AI Co-Authored-By: Claude Code --- .../26.1/install/upgrade-to-a-new-version.md | 20 +- docs/kb/accessanalyzer-26.1/_category_.json | 10 - docs/kb/accessanalyzer-26.1/index.md | 18 -- .../kb-article-template.md | 186 ------------------ .../migration/_category_.json | 10 - .../migration/audit-data-strategy.md | 85 -------- .../kb/accessanalyzer-26.1/migration/index.md | 73 ------- .../migration/migrate-credentials.md | 92 --------- .../migration/migrate-job-configurations.md | 173 ---------------- .../migration/migrate-proxy-servers.md | 147 -------------- .../migration/migrate-schedules.md | 121 ------------ .../migration/migrate-target-servers.md | 149 -------------- .../migration/migration-checklist.md | 165 ---------------- .../updating-to-the-latest-version.md | 78 -------- scripts/copy-kb-to-versions.mjs | 27 +++ src/config/products.js | 3 +- src/theme/searchUtils.js | 4 +- 17 files changed, 50 insertions(+), 1311 deletions(-) delete mode 100644 docs/kb/accessanalyzer-26.1/_category_.json delete mode 100644 docs/kb/accessanalyzer-26.1/index.md delete mode 100644 docs/kb/accessanalyzer-26.1/kb-article-template.md delete mode 100644 docs/kb/accessanalyzer-26.1/migration/_category_.json delete mode 100644 docs/kb/accessanalyzer-26.1/migration/audit-data-strategy.md delete mode 100644 docs/kb/accessanalyzer-26.1/migration/index.md delete mode 100644 docs/kb/accessanalyzer-26.1/migration/migrate-credentials.md delete mode 100644 docs/kb/accessanalyzer-26.1/migration/migrate-job-configurations.md delete mode 100644 docs/kb/accessanalyzer-26.1/migration/migrate-proxy-servers.md delete mode 100644 docs/kb/accessanalyzer-26.1/migration/migrate-schedules.md delete mode 100644 docs/kb/accessanalyzer-26.1/migration/migrate-target-servers.md delete mode 100644 docs/kb/accessanalyzer-26.1/migration/migration-checklist.md delete mode 100644 docs/kb/accessanalyzer-26.1/updating-to-the-latest-version.md diff --git a/docs/accessanalyzer/26.1/install/upgrade-to-a-new-version.md b/docs/accessanalyzer/26.1/install/upgrade-to-a-new-version.md index d0e105d409..3465b1f8f8 100644 --- a/docs/accessanalyzer/26.1/install/upgrade-to-a-new-version.md +++ b/docs/accessanalyzer/26.1/install/upgrade-to-a-new-version.md @@ -10,7 +10,15 @@ Run it with `sudo`. The default kubeconfig at `/etc/rancher/k3s/k3s.yaml` is rea ## Check Whether You Need to Act -Check how you installed the app. The installer's default `--target-revision` is `1.*`, a wildcard. If nobody pinned a specific version at install time, ArgoCD already tracks the newest stable 1.x tag and picks up new releases on its next sync. You don't need any `dspmctl` steps. +Start by checking which version is running: + +```bash +sudo dspmctl version +``` + +Compare the output with the latest release Netwrix has announced. If they match, Access Analyzer is already up to date. + +If they don't match, check how you installed the app. The installer's default `--target-revision` is `1.*`, a wildcard. If nobody pinned a specific version at install time, ArgoCD already tracks the newest stable 1.x tag and picks up new releases on its next sync. You don't need any `dspmctl` steps. If you pinned a specific version at install time, or want to pin one now, follow these steps. @@ -40,6 +48,16 @@ If you pinned a specific version at install time, or want to pin one now, follow ## Checking the Result +Wait one to five minutes for the pods to restart, then check the version again: + +```bash +sudo dspmctl version +``` + +The output should show the version you set. Pod restarts take longer on a busy server, so if the version hasn't changed after five minutes, wait another two or three minutes and run the command again. + +For a detailed view of the sync, ask ArgoCD directly: + ```bash sudo kubectl exec -n argocd -ti deploy/dspmctl -- argocd app get argocd/netwrix ``` diff --git a/docs/kb/accessanalyzer-26.1/_category_.json b/docs/kb/accessanalyzer-26.1/_category_.json deleted file mode 100644 index 7ad393fb13..0000000000 --- a/docs/kb/accessanalyzer-26.1/_category_.json +++ /dev/null @@ -1,10 +0,0 @@ -{ - "label": "Knowledge Base", - "position": 999, - "collapsed": true, - "collapsible": true, - "link": { - "type": "doc", - "id": "index" - } -} diff --git a/docs/kb/accessanalyzer-26.1/index.md b/docs/kb/accessanalyzer-26.1/index.md deleted file mode 100644 index ec7eebed34..0000000000 --- a/docs/kb/accessanalyzer-26.1/index.md +++ /dev/null @@ -1,18 +0,0 @@ ---- -title: "Access Analyzer Knowledge Base" -description: "Access Analyzer v26.1 knowledge base articles and troubleshooting guides" -slug: accessanalyzer-26.1 ---- - -# Access Analyzer Knowledge Base - -Welcome to the Access Analyzer knowledge base. Browse troubleshooting guides, configuration instructions, and best practices for Access Analyzer v26.1. - -Use the search function above to find specific articles or browse through all Access Analyzer KB articles in this section. - -## Need Help? - -If you cannot find what you are looking for: -1. Use the search function above -2. Check the main Access Analyzer documentation -3. Contact [Netwrix support](https://www.netwrix.com/support.html) diff --git a/docs/kb/accessanalyzer-26.1/kb-article-template.md b/docs/kb/accessanalyzer-26.1/kb-article-template.md deleted file mode 100644 index 44f5731e30..0000000000 --- a/docs/kb/accessanalyzer-26.1/kb-article-template.md +++ /dev/null @@ -1,186 +0,0 @@ ---- -unlisted: true -description: >- - [One sentence. Keyword-rich, SEO-friendly summary of what problem this - article solves or what task it covers. Example: "When the Access Analyzer - scan job fails with error X, the host is unreachable. This article describes - the cause and provides steps to resolve the connectivity issue."] -keywords: - - access analyzer - - "[keyword 2 — use exact phrasing a customer would search for]" - - "[keyword 3 — include error codes or unique identifiers when relevant]" - - "[keyword 4]" - - "[keyword 5]" - - "[keyword 6]" - - "[keyword 7]" - - "[keyword 8 — aim for 8–12 total keywords]" -products: - - access-analyzer -sidebar_label: "KB Article Template" -tags: [] -title: "KB Article Template and Style Guide" -knowledge_article_id: kA0Qk000000XXXXKAA ---- - -# KB Article Template and Style Guide - -This file is a placeholder and authoring guide for Access Analyzer v26.1 knowledge base articles. Copy this file, rename it, and replace the placeholder content with the actual article. Remove this introduction paragraph before publishing. - ---- - - - - - - - -## Symptom - - - -When running [specific job or action] in Netwrix Access Analyzer, the following error appears: - -```text -[Paste the exact error message here, as it appears in the UI or log.] -``` - -[Optional: one additional sentence describing secondary symptoms, e.g., "The job fails immediately and no scan results are produced."] - -## Cause - - - -This error occurs when [plain-language explanation of the root cause]. - -## Resolution - - - -1. Navigate to **[Menu] > [Submenu]** in the Netwrix Access Analyzer console. -2. Select **[Option]** and click **[Button]**. -3. In the **[Field Name]** field, enter [description of required value]. -4. Click **Save** to apply the changes. -5. Re-run the [job or scan] to confirm the issue is resolved. - -> **NOTE:** [Use for important context that does not fit inline. Use **IMPORTANT:** instead for warnings about irreversible actions or data loss.] - -## Related Links - -- [Netwrix Access Analyzer Documentation — System Requirements](/docs/accessanalyzer/26_1/install/requirements) -- [Link text describing destination — add a line for each relevant resource](#) - ---- - - - - - ---- - -## Style Quick Reference - -Remove this section before publishing. - -| Element | Format | Example | -|---|---|---| -| UI button / menu / tab / field | **Bold** | Click **Save** | -| Command-line input | `` `backtick` `` | Run `npm start` | -| Error message (full block) | ` ```text ``` ` fenced block | See Symptom section above | -| File path (inline) | `` `backtick` `` | Open `` `C:\Program Files\Netwrix` `` | -| Important callout | `> **IMPORTANT:** ...` | Warns of irreversible actions | -| Note callout | `> **NOTE:** ...` | Non-critical supplemental info | -| External link | `[Name ⸱ Company 🡥](URL)` | [SMB Security ⸱ Microsoft 🡥](https://example.com) | -| Image alt text | [Action shown] + [key UI elements] | "Dialog box for scan settings with Schedule tab active" | -| Product — first mention | Full name | Netwrix Access Analyzer | -| Product — subsequent mentions | Short name | Access Analyzer | - -### Title Rules by Article Type - -| Type | Format | Good Example | Bad Example | -|---|---|---|---| -| How-To | [Action Gerund] [Specific Task] | Configuring LDAP Authentication | How to Configure LDAP? | -| Error Resolution | Error: [Unique Code or Message] | Error: Host Unreachable 0x80070005 | Error: Something Went Wrong | -| Symptom Resolution | [Component] [Symptom] [Context] | Scan Jobs Failing After Upgrade | Scans Not Working | - -### Voice and Tone - -- Use "you" (second person) when addressing the reader. -- Write in active voice: "Click **Save**" not "**Save** should be clicked." -- Avoid: "simply," "just," "easy," "obviously," "leverage," "utilize." -- Write out contractions: "do not" not "don't," "cannot" not "can't." -- No exclamation marks, including in callouts. -- One idea per paragraph; paragraphs to 3–4 sentences maximum. diff --git a/docs/kb/accessanalyzer-26.1/migration/_category_.json b/docs/kb/accessanalyzer-26.1/migration/_category_.json deleted file mode 100644 index 5e5042c29e..0000000000 --- a/docs/kb/accessanalyzer-26.1/migration/_category_.json +++ /dev/null @@ -1,10 +0,0 @@ -{ - "label": "Migration from StealthAUDIT / Access Analyzer", - "position": 10, - "collapsed": false, - "collapsible": true, - "link": { - "type": "doc", - "id": "index" - } -} diff --git a/docs/kb/accessanalyzer-26.1/migration/audit-data-strategy.md b/docs/kb/accessanalyzer-26.1/migration/audit-data-strategy.md deleted file mode 100644 index 4682654cb6..0000000000 --- a/docs/kb/accessanalyzer-26.1/migration/audit-data-strategy.md +++ /dev/null @@ -1,85 +0,0 @@ ---- -title: "Historical Audit Data" -description: "How historical audit records in the legacy SQL Server database are preserved and accessed alongside Access Analyzer 26" -keywords: - - audit data migration - - sql server audit records - - historical data - - fsactivity migration - - adactivity migration - - compliance continuity - - stealthaudit database -products: - - access-analyzer -sidebar_label: "Historical Audit Data" -tags: - - migration - - audit-data ---- - -# Historical Audit Data - -## Overview - -Access Analyzer 26 uses a separate database stack (ClickHouse and PostgreSQL) and does not connect to or read from the legacy SQL Server database. Historical audit records collected by the previous version remain in the original SQL Server database and are not affected by the migration. - -The sections below cover what data remains in the SQL Server database, how to maintain access to it, and what data AA26 collects going forward. - ---- - -## Historical data retention - -Any data you need to maintain for audit and compliance purposes remains in the SQL Server database. This includes activity records from monitored sources and state-in-time collections such as sensitive data discovery findings. - -:::note -State-in-time collections — such as sensitive data findings and permissions snapshots — are stale as soon as they are collected. The priority after migrating to AA26 is to get the equivalent scans running in AA26 so that current data is available there. -::: - -## Maintaining access to historical records - -No data is deleted or modified by the migration. The legacy SQL Server database remains intact and queryable at all times. - -To maintain access to historical records: - -1. **Retain the NAA SQL Server instance** and its database. Do not decommission or drop the database while historical records are needed for audit or compliance. - -2. **Grant read-only SQL access** to security analysts, compliance officers, and legal teams who need to query historical records. - -3. **Document the coverage start date for each source.** Record the date AA26 began collecting data for each migrated source. This date determines which system to query for audit requests that span the migration. - ---- - -## What Access Analyzer 26 collects - -For sources added to AA26, the product collects the following data: - -| Data Type | Source | Stored In | -| --- | --- | --- | -| Permissions, group memberships, and access rights | Access scan | ClickHouse | -| Files and objects containing sensitive content | Sensitive data scan | ClickHouse | -| Active Directory and Entra ID users, groups, and memberships | IAM sync | ClickHouse | -| Real-time file system activity events | Netwrix Activity Monitor (NAM) integration | ClickHouse | - -Real-time file system activity events require Netwrix Activity Monitor to be installed and monitoring the target hosts. See the **Activity Monitor Integration** page under Configuration for setup steps. - ---- - -## Compliance continuity - -Historical audit records in the SQL Server database remain intact throughout and after the migration. There is no gap in the audit record for any period covered by the legacy system. - -Notify your compliance and legal teams of the coverage start date for each migrated source so that audit requests spanning the migration can be directed to the correct system. - -| Period / Source | System of Record | -| --- | --- | -| Data collected before migration | Legacy NAA SQL Server database | -| Data collected after migration | Access Analyzer 26 (ClickHouse) | -| Sources not yet migrated to AA26 | Legacy NAA SQL Server database | - ---- - -## Related links - -- [Migration Overview](./index.md) -- [Migration Checklist](./migration-checklist.md) -- [Migrating Target Servers and Host Lists](./migrate-target-servers.md) diff --git a/docs/kb/accessanalyzer-26.1/migration/index.md b/docs/kb/accessanalyzer-26.1/migration/index.md deleted file mode 100644 index b247ea4ae1..0000000000 --- a/docs/kb/accessanalyzer-26.1/migration/index.md +++ /dev/null @@ -1,73 +0,0 @@ ---- -title: "Migrating to Access Analyzer 26" -description: "Concept mapping and step-by-step procedures for migrating credentials, target servers, and schedules from Netwrix Access Analyzer 12.0 and earlier to Access Analyzer 26" -keywords: - - access analyzer migration - - stealthaudit migration - - migrate to AA26 - - host list migration - - connection profile migration - - schedule migration - - sql server audit data - - migration guide -products: - - access-analyzer -sidebar_label: "Migration Overview" -tags: - - migration ---- - -# Migrating to Access Analyzer 26 - -This section covers migrating credentials, target servers, and job schedules from Netwrix Access Analyzer 12.0 and earlier (formerly StealthAUDIT) to Access Analyzer 26 (AA26). These procedures apply whether you are replacing the previous version or running both products in parallel. Historical audit data collected by the previous version remains in the SQL Server database and is not affected. - ---- - -## In this section - -| Article | Description | -| --- | --- | -| [Migrating Connection Profiles to Service Accounts](./migrate-credentials.md) | Inventory legacy connection profiles and recreate them as service accounts in AA26. | -| [Migrating Proxy Servers to Scanners](./migrate-proxy-servers.md) | Replace legacy Windows proxy servers with Linux-based AA26 scanner nodes for File Server and Active Directory scanning. | -| [Migrating Target Servers and Host Lists to Source Groups](./migrate-target-servers.md) | Inventory legacy host lists and recreate them as source groups and sources in AA26. | -| [Migrating Job Configurations to Scan Parameters](./migrate-job-configurations.md) | Map legacy data collector settings to AA26 scan parameters by connector type. | -| [Migrating Job Schedules to Scan Schedules](./migrate-schedules.md) | Translate Windows Task Scheduler triggers to cron expressions and configure scan schedules in AA26. | -| [Historical Audit Data](./audit-data-strategy.md) | Understand what audit data stays in the SQL Server database and how to maintain access to it. | -| [Migration Checklist](./migration-checklist.md) | Track and validate progress through each migration phase. | - ---- - -## Concept mapping - -Each legacy concept maps directly to an AA26 equivalent. Refer to this table throughout the migration. - -| Legacy Concept | AA26 Equivalent | Key Difference | -| --- | --- | --- | -| **Host** | **Source** | A single target system in both products. In AA26, sources belong to a source group. | -| **Host List** | **Source Group** | A source group contains sources of a single connector type. Legacy host lists can contain mixed types and must be split before migrating. | -| **Connection Profile** | **Service Account** | Passwords cannot be exported from the legacy system and must be re-entered when creating service accounts in AA26. | -| **Job / Data Collector** | **Scan** | Scans replace the job/query model. Each source has one scan per scan type (access scan or sensitive data scan). | -| **Schedule / Trigger** | **Scan Schedule (cron)** | AA26 uses standard five-field cron expressions. Windows Task Scheduler triggers must be translated to cron format. | -| **Proxy Server / Applet** | **Scanner** | AA26 scanners are Linux-based K3s nodes deployed via SSH from the AA26 UI. No manual Windows service installation is required. Only File Server and Active Directory connectors use scanners — Entra ID and SharePoint Online connect directly. | -| **Storage Profile (SQL Server)** | **ClickHouse + PostgreSQL** | AA26 uses a different database stack. Historical data collected by the legacy product remains in the SQL Server database and is not migrated. | -| **FSActivity / ADActivity tables** | **Activity Monitor integration** | Real-time file system and AD activity events are surfaced in AA26 through Netwrix Activity Monitor (NAM). Customers running NAM can add an AA26 output to route events directly into AA26. | - ---- - -## Migration sequence - -Complete the steps in this order. Each step is a prerequisite for the next. - -1. **[Migrate credentials](./migrate-credentials.md)** — Create service accounts in AA26. The source group creation wizard requires a service account before you can create a group. -2. **[Migrate proxy servers](./migrate-proxy-servers.md)** — Deploy Linux scanner nodes for File Server and Active Directory source groups. Skip this step if you plan to use the Default Scanner (local scanning only). -3. **[Migrate target servers and host lists](./migrate-target-servers.md)** — Create source groups and add sources. Assign scanner labels to connect each source group to the scanner nodes you deployed. -4. **[Migrate job configurations](./migrate-job-configurations.md)** — Configure scan parameters for each source: scan type, scope, workers, differential scanning, and data classification settings. -5. **[Migrate schedules](./migrate-schedules.md)** — Configure scan schedules on each source. -6. **Validate** — Run an initial scan on each source group and compare results against legacy job output. - ---- - -## Related links - -- [Migration Checklist](./migration-checklist.md) -- [Historical Audit Data](./audit-data-strategy.md) diff --git a/docs/kb/accessanalyzer-26.1/migration/migrate-credentials.md b/docs/kb/accessanalyzer-26.1/migration/migrate-credentials.md deleted file mode 100644 index 0b4dfbd0a4..0000000000 --- a/docs/kb/accessanalyzer-26.1/migration/migrate-credentials.md +++ /dev/null @@ -1,92 +0,0 @@ ---- -title: "Migrating Connection Profiles to Service Accounts" -description: "How to inventory legacy Netwrix Access Analyzer connection profiles and recreate them as service accounts in Access Analyzer 26" -keywords: - - connection profile migration - - service account migration - - stealthaudit credentials - - access analyzer credentials - - username password service account - - client id secret - - client certificate -products: - - access-analyzer -sidebar_label: "Migrating Connection Profiles" -tags: - - migration - - service-accounts ---- - -# Migrating Connection Profiles to Service Accounts - -## Overview - -Service accounts in AA26 replace legacy connection profiles and serve the same purpose: storing the credentials that scanners use to connect to data sources. Complete this inventory and recreation process before creating source groups. - -Complete this procedure before creating source groups. The source group creation wizard requires a service account to be present before you can create a group. - -:::warning -Passwords and client secrets cannot be exported from the legacy system. You must re-enter all credentials when creating service accounts in AA26. Prepare the necessary credentials before starting this procedure. -::: - ---- - -## Credential type mapping - -Each legacy connection profile credential type maps to an AA26 service account type as follows: - -| Legacy Credential Type | AA26 Service Account Type | Used For | -| --- | --- | --- | -| Local machine account (Windows) | Username/Password | File Server sources | -| Active Directory domain account | Username/Password | Active Directory and File Server sources | -| Microsoft Entra ID key | Client ID/Secret | Entra ID sources | -| Web service (certificate) | Client ID/Certificate | SharePoint Online sources | -| Unix account | *(not applicable)* | Not supported in AA26 connectors | -| SQL account | *(not applicable)* | Not supported in AA26 connectors | - -Only the four credential types listed as applicable are needed for the connectors supported in AA26. If your legacy environment uses connection profiles for other purposes (SQL Server inventory, Unix auditing), those do not require migration. - ---- - -## Before you begin - -- Identify all connection profiles used by Active Directory, file server, SharePoint, and Entra ID jobs in the legacy system. -- Obtain the credentials for each profile: username and password for domain accounts, client ID and secret for Entra ID registrations, and client ID and certificate for SharePoint. -- Confirm that each account has the required permissions for its connector type in AA26. See the connector-specific prerequisites in the Access Analyzer documentation. - ---- - -## Step 1 — Inventory legacy connection profiles - -Before creating service accounts in AA26, document every connection profile that needs to be migrated. - -1. Open the Netwrix Access Analyzer console. -2. Navigate to **Settings** > **Connection**. -3. Review each connection profile listed. Record the profile name, credential type, username, and domain. -4. Note which jobs reference each profile (visible in the Job Properties panel for each job). - ---- - -## Step 2 — Create service accounts in Access Analyzer - -Create one service account in AA26 for each legacy connection profile that needs to be migrated. Use the credential type mapping table above to determine which account type to create for each profile. - -For the full creation procedure, navigate to **Configuration** > **Service Accounts** in the Access Analyzer console. See the Service Accounts documentation for steps specific to each credential type. - ---- - -## Step 3 — Verify - -After creating all service accounts, verify each one before using it in a source group: - -1. In the service accounts list, locate a newly created account. -2. Click the actions menu and select **Edit**. -3. Confirm the credential type and username display correctly. -4. You'll verify connectivity through the source group's **Test Connection** function in the [next migration step](./migrate-target-servers.md). - ---- - -## Related links - -- [Migrating Target Servers and Host Lists](./migrate-target-servers.md) -- [Migration Checklist](./migration-checklist.md) diff --git a/docs/kb/accessanalyzer-26.1/migration/migrate-job-configurations.md b/docs/kb/accessanalyzer-26.1/migration/migrate-job-configurations.md deleted file mode 100644 index a800c44989..0000000000 --- a/docs/kb/accessanalyzer-26.1/migration/migrate-job-configurations.md +++ /dev/null @@ -1,173 +0,0 @@ ---- -title: "Migrating Job Configurations to Scan Parameters" -description: "How to map legacy Netwrix Access Analyzer job and data collector settings to scan parameters in Access Analyzer 26" -keywords: - - job migration - - data collector migration - - scan configuration migration - - fsaa migration - - adinventory migration - - stealthaudit job settings - - access analyzer scan parameters -products: - - access-analyzer -sidebar_label: "Migrating Job Configurations" -tags: - - migration - - scans ---- - -# Migrating Job Configurations to Scan Parameters - -## Overview - -Scans in AA26 replace the legacy job/data collector model. Each source has one scan per scan type, and scan parameters are configured directly on the scan rather than in a job wizard. The tables and procedures below map each legacy data collector setting to its AA26 equivalent by connector type. - -Before starting this procedure, complete [Migrating Target Servers and Host Lists to Source Groups](./migrate-target-servers.md). Scans exist within source groups and are associated with specific sources. - ---- - -## Data collector to scan type mapping - -Each legacy data collector maps to a specific AA26 scan type: - -| Legacy Data Collector | AA26 Scan Type | Notes | -| --- | --- | --- | -| FSAA — File System Access/Permission Auditing | File Server — **Access Scan** | Scans permissions and file metadata | -| FSAA — Sensitive Data Discovery | File Server — **Sensitive Data Scan** | Requires Access Scan to have run first | -| ADInventory | Active Directory — **Identity Sync** | Collects users, groups, and membership | -| AzureAD Inventory | Entra ID — **Identity Sync** | Collects users, groups, and roles | -| SPAA — SharePoint Access Auditing | SharePoint Online — **Access Scan** | Scans permissions and content metadata | -| FSAA — File System Activity | *Not applicable* | Activity data is surfaced through Netwrix Activity Monitor (NAM) integration. See [Historical Audit Data](./audit-data-strategy.md). | - ---- - -## Key differences from legacy jobs - -**One scan per source, not per job.** In the legacy product, multiple jobs could target the same host with different data collector settings. In AA26, each source has one Access Scan and one Sensitive Data Scan. If you had multiple FSAA jobs targeting the same file server with different scope or depth settings, consolidate those settings into a single scan configuration per source. - -**Scan type is fixed per scan.** Unlike a legacy FSAA job that could include both permission auditing and sensitive data queries, AA26 uses separate scans for each type. The Access Scan runs first; the Sensitive Data Scan uses the discovered share list from the Access Scan as its scope. - -**Proxy assignment is replaced by scanner labels.** Legacy jobs had a Scan Server Selection step where you assigned a specific proxy server or proxy host list. In AA26, scanner assignment is configured at the source group level using scanner labels — not per scan. See [Migrating Proxy Servers to Scanners](./migrate-proxy-servers.md). - ---- - -## Managing scans - -Navigate to **Configuration** > **Scans** to view and configure all scans across your sources. - -![Scans list showing existing scans with columns for Name, Scan Type, Source, Source Group, Source Type, Schedule, Scanner, and Actions](/images/accessanalyzer/26.1/migration/scans-list.png) - -Each row shows a scan's type, source, schedule, and assigned scanner. Click the scan name to open the edit panel for that scan. - ---- - -## File Server — Access Scan parameters - -The Access Scan collects file permissions, share structure, and file metadata from file servers. - -![Edit Scan panel for a File Server access scan showing Basic Information, Scan Configuration, and Schedule sections](/images/accessanalyzer/26.1/migration/scan-edit-file-server-access.png) - -| AA26 Parameter | Description | Legacy Equivalent | -| --- | --- | --- | -| **Name** | Display name for this scan. | Job name | -| **Description** | Optional notes. | Job description | -| **Scan Type** | Set to **Access Scan**. | FSAA — Access/Permission Auditing query | -| **Schedule** | Enable and configure a recurring schedule. | Windows Task Scheduler trigger on the job | - -The Access Scan has no additional scoping parameters. It scans all accessible shares on the source server. Use the Sensitive Data Scan's Share Selection parameter to scope sensitive data collection to specific shares. - ---- - -## File Server — Sensitive Data Scan parameters - -The Sensitive Data Scan classifies file contents against configured data type patterns. It must be run after the Access Scan — the scan uses the share list discovered by the Access Scan to determine scope. - -![Edit Scan panel for a File Server sensitive data scan showing Scan Type, Configuration Source, and Processing Options sections](/images/accessanalyzer/26.1/migration/scan-edit-file-server-sdd.png) - -| AA26 Parameter | Description | Legacy Equivalent | -| --- | --- | --- | -| **Scan Type** | Set to **Sensitive Data Scan**. | FSAA — Sensitive Data Discovery query | -| **Configuration Source** | **Inherit from global configuration** uses the globally configured sensitive data types. Select a custom configuration to override for this scan. | Global sensitive data policy | -| **Run OCR** | Enable to extract text from image files during classification. | FSAA OCR option | -| **Sensitive Data Types to Classify** | Select which data type categories to classify against: CCPA, CMMC, Credentials, Financial Records, GDPR, GDPR Restricted, GLBA, HIPAA, PCI DSS, PHI, PII. | Sensitive data criteria selection in FSAA wizard | -| **Batch Size** | Number of files to process per batch. Default: 100. | No direct equivalent | -| **Workers** | Number of concurrent workers for scanning. Default: 3. | FSAA thread count or concurrent scan settings | -| **Differential Scan** | When enabled, only files modified since the last scan are classified. The first run scans all files. | FSAA incremental scan option | -| **Share Selection** | Restrict the scan to specific shares discovered by the Access Scan. If empty, all discovered shares are scanned. | FSAA include/exclude share lists | -| **Maximum Scan Depth** | Folder depth limit. Leave empty for unlimited depth. | FSAA scan depth setting | -| **Schedule** | Enable and configure a recurring schedule. | Windows Task Scheduler trigger | - -:::note -The Share Selection list is populated from the results of the Access Scan. If no shares appear, run the Access Scan for that source first. -::: - ---- - -## Active Directory — Identity Sync parameters - -The Identity Sync collects users, groups, group membership, and custom attributes from Active Directory domain controllers. - -![Edit Scan panel for an Active Directory identity sync showing Identity Source, connection override settings, and Schedule](/images/accessanalyzer/26.1/migration/scan-edit-ad.png) - -| AA26 Parameter | Description | Legacy Equivalent | -| --- | --- | --- | -| **Scan Name** | Display name for this sync. | Job name | -| **Identity Source** | The Active Directory source to sync. Selects the domain controller configured on the source. | Job host target / connection profile | -| **Host / Port / Domain** | Override the connection settings inherited from the source. Leave as inherited unless you need to target a specific domain controller. | ADInventory domain and DC settings | -| **Ignore SSL Errors** | Ignore certificate errors on the LDAP/LDAPS connection. | ADInventory SSL options | -| **Differential Scan** | When enabled, only changes since the last sync are collected. | ADInventory incremental collection | -| **Schedule** | Frequency: One-time, Hourly, Daily, Weekly, or Monthly. Set a specific time and optional start/end date. | Windows Task Scheduler trigger | - -:::note -AA26 collects standard Active Directory attributes: users, groups, group membership, and user custom attributes. Custom attribute collection beyond this set is not configurable in the current release. -::: - ---- - -## Entra ID — Identity Sync parameters - -The Identity Sync collects users, groups, and roles from Entra ID via the Microsoft Graph API. - -![Edit Scan panel for an Entra ID identity sync showing Identity Source, connection override settings, and Schedule](/images/accessanalyzer/26.1/migration/scan-edit-entra-id.png) - -| AA26 Parameter | Description | Legacy Equivalent | -| --- | --- | --- | -| **Scan Name** | Display name for this sync. | Job name | -| **Identity Source** | The Entra ID source to sync. | Job host target | -| **Client ID / Tenant ID** | Override the credentials inherited from the source's service account. Leave as inherited in most cases. | AzureAD Inventory connection profile | -| **Schedule** | Enable and configure a recurring schedule. | Windows Task Scheduler trigger | - ---- - -## SharePoint Online — Access Scan parameters - -The SharePoint Online Access Scan collects site, library, and item permissions from SharePoint Online, OneDrive, and Teams. - -When you create a SharePoint Online source group, the wizard includes a **SharePoint Domain** field. This is equivalent to the legacy SPAA site URL configuration. Within a source group, the scan targets all sites within that domain by default. - ---- - -## Settings that do not migrate - -Some legacy job settings have no equivalent in AA26: - -| Legacy Setting | Status in AA26 | -| --- | --- | -| Applet launch mechanism (MSTask / Windows Service / pre-installed service) | Not applicable — scanner deployment is automated via K3s | -| Per-proxy communication timeout | Not applicable — managed by Kubernetes infrastructure | -| Strong proxy affinity (pin host to specific proxy) | No direct equivalent — scanner labels route at source group level | -| Applet port and certificate exchange | Not applicable — managed by K3s infrastructure | -| Custom AD attribute collection beyond standard set | Not supported in current release | -| Multiple jobs targeting same host with different scoping | Consolidate to one scan configuration per source | -| FSAA File System Activity scanning | Not a scan type — route activity data through NAM integration | -| SQL Server, Exchange, Unix data collectors | No equivalent connector in current release | - ---- - -## Related links - -- [Migrating Proxy Servers to Scanners](./migrate-proxy-servers.md) -- [Migrating Target Servers and Host Lists](./migrate-target-servers.md) -- [Historical Audit Data](./audit-data-strategy.md) -- [Migration Checklist](./migration-checklist.md) diff --git a/docs/kb/accessanalyzer-26.1/migration/migrate-proxy-servers.md b/docs/kb/accessanalyzer-26.1/migration/migrate-proxy-servers.md deleted file mode 100644 index 52302cf9f6..0000000000 --- a/docs/kb/accessanalyzer-26.1/migration/migrate-proxy-servers.md +++ /dev/null @@ -1,147 +0,0 @@ ---- -title: "Migrating Proxy Servers to Scanners" -description: "How to replace legacy Netwrix Access Analyzer proxy servers with Access Analyzer 26 scanner nodes" -keywords: - - proxy server migration - - scanner migration - - aa26 scanner node - - deploy scanner - - stealthaudit proxy - - access analyzer scanner - - fsaa proxy -products: - - access-analyzer -sidebar_label: "Migrating Proxy Servers" -tags: - - migration - - scanners ---- - -# Migrating Proxy Servers to Scanners - -## Overview - -Scanner nodes in Access Analyzer 26 replace legacy Windows proxy servers for distributed File Server and Active Directory scanning. If your legacy environment used proxy servers to scan hosts close to their network location, deploy equivalent scanner nodes in AA26 so scans run in the same distributed fashion. - -Without dedicated scanner nodes, File Server and Active Directory source groups use the Default Scanner, which runs scans from the central AA26 server. This works for small or centralized environments but isn't optimized for distributed deployments where proximity to the target matters. - -:::note -Entra ID and SharePoint Online source groups do not use scanners. Those connectors connect directly from the AA26 service. Only File Server and Active Directory source groups require scanner deployment. -::: - ---- - -## Architecture comparison - -In the legacy product, distributed scanning relied on Windows proxy servers running the FSAA Proxy Service (`FSAAAppletServer.exe`). These were persistent Windows agents deployed manually and assigned per-job in the Data Collector wizard. - -AA26 replaces this with **scanner nodes**: Linux virtual machines that AA26 registers via SSH and automatically configures with a lightweight Kubernetes (K3s) runtime. Scans run as on-demand containers — there is no persistent agent process, and no manual service installation. - -| | Legacy Proxy Server | AA26 Scanner Node | -| --- | --- | --- | -| **Operating system** | Windows | Linux | -| **Deployment** | Manual installer on each Windows host | Automated via SSH from AA26 | -| **Runtime** | Persistent Windows service | On-demand containers (per scan) | -| **Assignment** | Per-job (Scan Server Selection wizard page) | Per-source group (via scanner labels) | -| **Connectors supported** | FSAA, ADInventory, and others | File Server, Active Directory | -| **Default option** | Local mode (EA console) | Default Scanner (local, always available) | - -The **Default Scanner** is available immediately without any deployment. It runs scans directly from the AA26 server — equivalent to the legacy "Local Server" option in the Scan Server Selection page. If your legacy environment ran all scans locally, the Default Scanner covers this case without any migration action. - ---- - -## Before you begin - -- [ ] Identify which legacy proxy servers are in use and which jobs reference them. -- [ ] Confirm the replacement Linux VMs are provisioned and accessible via SSH. -- [ ] Obtain an SSH Username/Key service account with access to each Linux VM. This account is used by AA26 during scanner registration. -- [ ] Plan your scanner labeling scheme before deploying. Scanner labels route scans to specific scanner pools. A consistent scheme — for example, `region=us-east` or `environment=production` — makes source group assignment straightforward. - ---- - -## Step 1 — Inventory legacy proxy servers - -Before deploying scanner nodes, document every proxy server in use. - -1. Open the Netwrix Access Analyzer console. -2. Navigate to **Settings** > **Proxy Servers** (or the equivalent node in your version). -3. For each proxy server, record: - - The server hostname or IP address. - - The jobs or host lists assigned to it. - - The geographic location or network segment it serves. - -This inventory determines how many scanner nodes you need and how to label them. - ---- - -## Step 2 — Deploy scanner nodes - -Navigate to **Configuration** > **Scanners** in Access Analyzer 26. - -![Scanners list showing the Default Scanner with columns for Name/IP, Labels, Source Groups, Health Status, and Last Heartbeat](/images/accessanalyzer/26.1/migration/scanners-list.png) - -The list shows all registered scanner nodes. The **Default Scanner** is always present and represents local scanning from the AA26 server. - -Click **Deploy Scanner** to register a new scanner node. - -![Deploy Scanner form showing fields for Name, SSH Host, SSH Host Key, SSH Port, Service Account, and Labels](/images/accessanalyzer/26.1/migration/scanner-deploy-form.png) - -Complete the form for each scanner node you are deploying: - -| Field | Description | -| --- | --- | -| **Name** | A display name that identifies this scanner. Use a name that reflects its location or purpose, for example `us-east-scanner-01`. | -| **SSH Host** | The hostname or IP address of the Linux VM. | -| **SSH Host Key** | The public SSH host key of the target machine. AA26 uses this to verify the identity of the remote host before connecting. Retrieve it by running `ssh-keyscan ` on the target machine or your management workstation. | -| **SSH Port** | The SSH port. Defaults to 22 if not specified. | -| **Service Account** | An SSH Username/Key service account that has SSH access to the Linux VM. AA26 uses these credentials to connect and install the K3s runtime. | -| **Labels** | Key-value pairs used to route scans to this scanner. Add at least one label that matches your labeling scheme, for example `region=us-east`. | - -Click **Test connection** before clicking **Deploy** to verify that AA26 can reach the Linux VM with the provided credentials. Deployment installs the K3s runtime on the target machine automatically. - -Repeat for each scanner node you are deploying. - ---- - -## Step 3 — Assign scanner labels to source groups - -After deploying scanner nodes, configure each source group to use them. - -1. Navigate to **Configuration** > **Source Groups**. -2. For each File Server or Active Directory source group, open the actions menu and select **Edit**. -3. In the **Scanner Labels** field, enter the key-value labels that match the scanner nodes responsible for that group. For example, if your file servers are in the US East region and you labeled your scanner `region=us-east`, add `region=us-east` to the source group. -4. Click **Save**. - -Scans in that source group will route to any scanner node matching all specified labels. If no labels are set on a source group, scans use the Default Scanner. - -:::note -A source group can match multiple scanner nodes if more than one node carries the specified labels. AA26 distributes scans across matching nodes. -::: - ---- - -## Step 4 — Verify scanner health - -After deploying and assigning scanner nodes: - -1. Navigate to **Configuration** > **Scanners**. -2. Confirm each deployed scanner shows **Healthy** in the Health Status column. -3. Run a test scan on one source group that uses each new scanner. Verify the scan completes successfully before proceeding. - ---- - -## Step 5 — Decommission legacy proxy servers - -After validating that scanner nodes are handling scans successfully: - -1. Stop the FSAA Proxy Service on each legacy Windows proxy server. -2. Uninstall the proxy service using **Add/Remove Programs** or your organization's standard software removal process. -3. Retire the Windows VMs if they are no longer needed for other purposes. - ---- - -## Related links - -- [Migrating Target Servers and Host Lists](./migrate-target-servers.md) -- [Migrating Job Configurations to Scan Parameters](./migrate-job-configurations.md) -- [Migration Checklist](./migration-checklist.md) diff --git a/docs/kb/accessanalyzer-26.1/migration/migrate-schedules.md b/docs/kb/accessanalyzer-26.1/migration/migrate-schedules.md deleted file mode 100644 index d19d603658..0000000000 --- a/docs/kb/accessanalyzer-26.1/migration/migrate-schedules.md +++ /dev/null @@ -1,121 +0,0 @@ ---- -title: "Migrating Job Schedules to Scan Schedules" -description: "How to translate legacy Netwrix Access Analyzer job schedules to cron expressions and configure scan schedules in Access Analyzer 26" -keywords: - - schedule migration - - job schedule migration - - cron expression - - windows task scheduler migration - - scan schedule AA26 - - stealthaudit schedule -products: - - access-analyzer -sidebar_label: "Migrating Job Schedules" -tags: - - migration - - schedules ---- - -# Migrating Job Schedules to Scan Schedules - -## Overview - -The legacy product schedules data collection using Windows Task Scheduler triggers. AA26 schedules scans using cron expressions — a standard five-field format. The steps below cover how to export legacy schedule data, translate trigger settings to cron format, and apply the resulting schedules to source groups in AA26. - ---- - -## Concept comparison - -| Legacy Concept | AA26 Equivalent | -| --- | --- | -| Schedule / Trigger on a job or job group | Cron expression on a scan configuration | -| Schedule Service Account (Windows Task Scheduler) | Scanner service account (runs the scan) | -| Multiple jobs with individual schedules | One scan schedule per source group (shared across all sources in the group) | -| Daily / Weekly / Monthly trigger | Equivalent cron expression | -| Run As — specific domain account | Service account assigned to the source group | - -In AA26, the scan schedule is set at the source group level and applies to all sources in the group. If you need different schedules for individual sources, override the schedule at the source level after creating the group. - ---- - -## Cron expression reference - -AA26 uses standard five-field cron expressions in UTC by default. Each field controls a time component: - -``` -┌───────── minute (0–59) -│ ┌─────── hour (0–23, UTC) -│ │ ┌───── day of month (1–31) -│ │ │ ┌─── month (1–12) -│ │ │ │ ┌─ day of week (0=Sunday, 6=Saturday) -│ │ │ │ │ -* * * * * -``` - -### Common schedule translations - -| Legacy Trigger | Cron Expression | Description | -| --- | --- | --- | -| Daily at 11:00 PM (local) | `0 23 * * *` | Runs at 23:00 UTC daily. Adjust hour for your timezone. | -| Daily at 2:00 AM | `0 2 * * *` | Runs at 02:00 UTC daily. | -| Daily at 6:00 AM | `0 6 * * *` | Runs at 06:00 UTC daily. | -| Weekly — Sunday at midnight | `0 0 * * 0` | Runs at 00:00 UTC every Sunday. | -| Weekly — Monday at 6:00 AM | `0 6 * * 1` | Runs at 06:00 UTC every Monday. | -| Weekly — Saturday at 11:00 PM | `0 23 * * 6` | Runs at 23:00 UTC every Saturday. | -| Monthly — 1st of month at midnight | `0 0 1 * *` | Runs at 00:00 UTC on the 1st. | -| Monthly — 15th of month at 3:00 AM | `0 3 15 * *` | Runs at 03:00 UTC on the 15th. | -| Every 6 hours | `0 */6 * * *` | Runs at 00:00, 06:00, 12:00, 18:00 UTC. | -| Every 12 hours | `0 */12 * * *` | Runs at 00:00 and 12:00 UTC daily. | - -:::note -AA26 stores cron schedules in UTC. If your legacy jobs used local time triggers, convert them to UTC when creating the cron expression. Set the **Time Zone** field on the scan configuration if you want to define the schedule in local time. -::: - ---- - -## Before you begin - -- [ ] Source groups and sources have been created in AA26 ([Migrating Target Servers and Host Lists](./migrate-target-servers.md)). -- [ ] You have a documented list of legacy job schedules (from Step 1 below). -- [ ] You have determined which cron expressions to use for each source group. - ---- - -## Step 1 — Inventory legacy job schedules - -1. In the NAA console, navigate to the **Schedule** node in the left panel. -2. Review each scheduled task listed. For each task, record: - - The job or job group it runs. - - The trigger type (daily, weekly, monthly). - - The start time and recurrence settings. -3. Use the cron expression table above to determine the equivalent for each. - ---- - -## Step 2 — Configure scan schedules in Access Analyzer - -Scan schedules are configured on source groups. Navigate to **Configuration** > **Source Groups**, then edit the group or configure schedules during source group creation. - -![Source group creation wizard step 3 showing scan type selection and cron schedule configuration fields](/images/accessanalyzer/26.1/migration/create-source-group-scan-config.png) - -For each source group: - -1. In the source groups list, click the actions menu for the group and select **Edit**. -2. Navigate to the **Scan Configuration** section. -3. Enter the cron expression for the schedule you determined in Step 1. -4. Set the **Time Zone** if you want to express the schedule in local time rather than UTC. -5. Enable the schedule by setting **Schedule Enabled** to active. -6. Click **Save**. - -:::note -If different legacy jobs targeting the same set of hosts had different schedules, you might need to split those hosts across separate source groups in AA26 so each group can have its own schedule. -::: - -Repeat the steps in [Step 2](#step-2--configure-scan-schedules-in-access-analyzer) for each source group until all schedules are configured. - ---- - -## Related links - -- [Migrating Target Servers and Host Lists](./migrate-target-servers.md) -- [Migration Checklist](./migration-checklist.md) diff --git a/docs/kb/accessanalyzer-26.1/migration/migrate-target-servers.md b/docs/kb/accessanalyzer-26.1/migration/migrate-target-servers.md deleted file mode 100644 index 7020a118d6..0000000000 --- a/docs/kb/accessanalyzer-26.1/migration/migrate-target-servers.md +++ /dev/null @@ -1,149 +0,0 @@ ---- -title: "Migrating Target Servers and Host Lists to Source Groups" -description: "How to inventory legacy Netwrix Access Analyzer host lists and recreate them as source groups and sources in Access Analyzer 26" -keywords: - - host list migration - - source group migration - - migrate hosts to AA26 - - stealthaudit host list - - access analyzer source groups - - target server migration -products: - - access-analyzer -sidebar_label: "Migrating Target Servers and Host Lists" -tags: - - migration - - source-groups ---- - -# Migrating Target Servers and Host Lists to Source Groups - -## Overview - -This procedure covers inventorying the host lists in your legacy Netwrix Access Analyzer installation and recreating them as source groups and sources in Access Analyzer 26. - -Before starting this procedure, complete [Migrating Connection Profiles to Service Accounts](./migrate-credentials.md). The source group creation wizard requires a service account to be present before you can create a group. - ---- - -## Key difference: host lists vs. source groups - -In the legacy product, a single host list can contain any mix of target system types. A list named "East Coast Servers" might include file servers, Active Directory domain controllers, and SharePoint sites. - -**AA26 source groups are single-type.** Each group is created for one connector type, and that type is permanent — it can't be changed after creation. You must split mixed-type host lists into separate source groups before you begin. - -**Planning example:** - -| Legacy Host List | Hosts | AA26 Source Groups | -| --- | --- | --- | -| East Coast Servers | 12 file servers, 2 AD domains | East Coast — File Servers (12 sources)
East Coast — Active Directory (2 sources) | -| Cloud Resources | Entra ID tenant, SharePoint site | Cloud — Entra ID (1 source)
Cloud — SharePoint Online (1 source) | - -Plan your source group structure on paper before creating anything in AA26. - ---- - -## Supported connector types - -AA26 currently supports the following connector types. Only hosts of these types need to be migrated: - -| Legacy Collector / Target Type | AA26 Connector | -| --- | --- | -| File System (FSAA) — Windows file servers | File Server | -| File System (FSAA) — NetApp ONTAP | File Server | -| File System (FSAA) — Isilon/PowerScale | File Server | -| File System (FSAA) — Dell VNX, Celerra, Unity | File Server | -| AD Inventory / ADActivity — Active Directory | Active Directory | -| Azure AD / Entra ID | Entra ID | -| SPAA — SharePoint Online | SharePoint Online | - -Legacy jobs targeting SQL Server, Exchange, Unix, or other systems do not have corresponding connectors in AA26 at this time. Document those targets separately for future migration phases. - ---- - -## Before you begin - -- [ ] All service accounts have been created in AA26 ([Migrating Connection Profiles](./migrate-credentials.md)). -- [ ] Scanner nodes have been deployed for Active Directory and File Server source groups, or you have confirmed that the Default Scanner (local) meets your scanning needs ([Migrating Proxy Servers to Scanners](./migrate-proxy-servers.md)). -- [ ] You have a written inventory of host lists and their members (see Step 1). -- [ ] You have planned which legacy host lists map to which AA26 source groups. - ---- - -## Step 1 — Inventory legacy host lists - -Export a complete inventory of your legacy host lists and hosts before making any changes. - -1. Open the Netwrix Access Analyzer console. -2. Navigate to **Host Management** in the left panel. -3. For each host list, right-click and select **Export** to export the host list to CSV. -4. Record the host list name, the number of hosts, and the system types present. - ---- - -## Step 2 — Create source groups in Access Analyzer - -Navigate to **Configuration** > **Source Groups**. - -![Source Groups list showing existing groups with source type, service account, scan type, and status columns](/images/accessanalyzer/26.1/migration/source-groups-list.png) - -Create one source group for each connector type across your legacy host lists. Click **Create Source Group** to open the wizard. - -### Step 1 of 3 — Select the source type - -The wizard first asks you to choose a connector type. - -![Source group creation wizard step 1 showing four source type options: Active Directory, Entra ID, File Server, and SharePoint Online](/images/accessanalyzer/26.1/migration/create-source-group-type-select.png) - -Select the connector type that matches the hosts you are migrating. If you have hosts of multiple types from the same legacy host list, you'll repeat this process for each type. - -### Step 2 of 3 — Configure the group - -![Source group creation wizard step 2 showing name field, service account selection, and max concurrent scans setting for a File Server group](/images/accessanalyzer/26.1/migration/create-source-group-file-server.png) - -| Field | What to enter | -| --- | --- | -| **Name** | A descriptive name that identifies the source type and scope. Example: `File Servers — East Coast` | -| **Service Account** | Select the service account you created for this connector type. | -| **Max Concurrent Scans** | Leave at `1` for initial setup. Increase after validating the first scan. | -| **Scanner Labels** | For Active Directory and File Server groups, add the key-value labels that match the scanner nodes you deployed. Leave empty to use the Default Scanner (local scanning from the AA26 server). | - -Add sources to the group: -- For each host in the matching legacy host list, click **Add Source** and enter the hostname or IP address. -- Use the **Test Connection** button to verify connectivity for each source before saving. - -### Step 3 of 3 — Configure scan parameters - -![Source group creation wizard step 3 showing scan type selection and schedule configuration fields](/images/accessanalyzer/26.1/migration/create-source-group-scan-config.png) - -Select the scan types to enable. Configure the scan schedule using a cron expression. See [Migrating Job Schedules](./migrate-schedules.md) for guidance on translating legacy schedule triggers to cron expressions. - -Click **Save** to create the source group. - -:::note -Add sources to the group one at a time using the **Add Source** button in the source group UI, or use the AA26 REST API. See [Step 3 — Test connections](#step-3--test-connections) after all sources have been added. -::: - ---- - -## Step 3 — Test connections - -After adding sources, verify that AA26 can reach each target: - -1. Navigate to **Configuration** > **Source Groups**. -2. Click the actions menu for your new source group and select **View Sources**. -3. For each source, click the actions menu and select **Test Connection**. -4. Confirm that all sources show a successful connection result before proceeding. - -If a connection test fails, verify that: -- The service account has the required permissions on the target system. -- The scanner assigned to the source group can reach the target on the required ports. -- The hostname or IP address in the source matches what the scanner can resolve. - ---- - -## Related links - -- [Migrating Connection Profiles](./migrate-credentials.md) -- [Migrating Job Schedules](./migrate-schedules.md) -- [Migration Checklist](./migration-checklist.md) diff --git a/docs/kb/accessanalyzer-26.1/migration/migration-checklist.md b/docs/kb/accessanalyzer-26.1/migration/migration-checklist.md deleted file mode 100644 index a05fd60327..0000000000 --- a/docs/kb/accessanalyzer-26.1/migration/migration-checklist.md +++ /dev/null @@ -1,165 +0,0 @@ ---- -title: "Migration Checklist" -description: "Pre-migration, in-migration, and post-migration validation checklist for migrating from Netwrix Access Analyzer to Access Analyzer 26" -keywords: - - migration checklist - - access analyzer migration validation - - stealthaudit migration checklist - - pre migration checklist - - post migration validation -products: - - access-analyzer -sidebar_label: "Migration Checklist" -tags: - - migration ---- - -# Migration Checklist - -Complete each section before moving to the next. - -**Customer:** _____________________________    **Migration date:** _____________________________ - -**Engineer:** _____________________________    **AA26 version:** _____________________________ - ---- - -## Pre-migration — Legacy system documentation - -Complete this section before making any changes to either system. - -### Legacy system inventory - -- [ ] Documented all active host lists, including name, description, and member count. -- [ ] Documented the target type of each host in each list (file server, Active Directory, Entra ID, SharePoint Online, other). -- [ ] Exported host list data using `Export-LegacyHostLists.ps1` or manual console export. -- [ ] Identified which host lists contain mixed types and documented the required split into separate source groups. -- [ ] Documented all connection profiles: name, credential type, username/domain. -- [ ] Identified which connection profiles map to which credential type in AA26 (Username/Password, Client ID/Secret, Client ID/Certificate). -- [ ] Noted which legacy jobs are in scope for migration (AD, file server, SharePoint, Entra ID jobs). -- [ ] Noted which legacy jobs are out of scope (SQL Server, Exchange, Unix, and other unsupported connectors). -- [ ] Exported job schedule data using `Export-LegacySchedules.ps1` or manual review. -- [ ] Translated all required schedules to cron expressions. Cron expressions documented: _______________________. - -### Legacy database documentation - -- [ ] Confirmed the SQL Server instance name and database name for the legacy NAA database. -- [ ] Documented the date of the most recent successful job run for each in-scope job. -- [ ] Identified the activity table names for historical data that needs to remain accessible. -- [ ] Confirmed who requires read access to the legacy SQL Server database post-migration. - -### AA26 environment readiness - -- [ ] AA26 instance is deployed and accessible. -- [ ] Administrator account credentials for AA26 are confirmed. -- [ ] Scanners are deployed and online for all required connector types (Active Directory, File Server). -- [ ] Network connectivity is confirmed from scanner to each target system on required ports. -- [ ] Required app registrations in Entra ID / Azure are in place (for Entra ID and SharePoint Online sources). - ---- - -## Migration phase 1 — Credentials - -- [ ] All required Username/Password service accounts created in AA26. - - Count: _____ accounts -- [ ] All required Client ID/Secret service accounts created in AA26. - - Count: _____ accounts -- [ ] All required Client ID/Certificate service accounts created in AA26. - - Count: _____ accounts -- [ ] Each service account verified by visual inspection in the Service Accounts list. - ---- - -## Migration phase 2 — Source groups and sources - -Complete one row per source group. - -| Source Group Name | Connector Type | No. of Sources | Service Account | Test Connection | -| --- | --- | --- | --- | --- | -| | | | | Pass / Fail | -| | | | | Pass / Fail | -| | | | | Pass / Fail | -| | | | | Pass / Fail | -| | | | | Pass / Fail | -| | | | | Pass / Fail | -| | | | | Pass / Fail | -| | | | | Pass / Fail | - -- [ ] All source groups created in AA26. -- [ ] All sources added to their respective groups. -- [ ] Test Connection passed for every source in every group. -- [ ] Scanner labels verified on Active Directory and File Server groups. - ---- - -## Migration phase 3 — Scan schedules - -- [ ] Cron expressions applied to all source groups. -- [ ] Schedule time zones confirmed (UTC or local time as required). -- [ ] Schedules verified as enabled on each source group. - ---- - -## Migration phase 4 — Initial scan validation - -For each source group, run an initial access scan manually before enabling the schedule. - -| Source Group Name | Scan Type | Scan Status | Finding Count | Compared to Legacy | -| --- | --- | --- | --- | --- | -| | Access | | | Match / Difference | -| | Sensitive Data | | | Match / Difference | -| | Access | | | Match / Difference | -| | Sensitive Data | | | Match / Difference | -| | Access | | | Match / Difference | -| | Sensitive Data | | | Match / Difference | - -- [ ] All source groups have completed at least one successful access scan. -- [ ] Scan results reviewed and validated against legacy job output. -- [ ] Significant discrepancies documented and investigated. - -**Discrepancy notes:** _______________________________________________________________________________ - ---- - -## Post-migration - -### Legacy system - -- [ ] Legacy NAA jobs for migrated sources stopped or disabled to prevent duplicate collection. -- [ ] Read-only SQL Server access confirmed for authorized users (compliance, legal, analysts). -- [ ] Coverage start date documented for each migrated source: _________________________. -- [ ] Compliance and legal teams notified of which system holds records for which sources and time periods. - -### AA26 system - -- [ ] AA26 scheduled scans running on configured cron schedule without errors. -- [ ] No scan execution failures in the first 48 hours of scheduled operation. -- [ ] Users and roles configured for all required analysts and administrators. -- [ ] Dashboards and reports accessible to relevant users. - -### Handover - -- [ ] Migration summary document completed and delivered to customer. -- [ ] Customer IT or security team trained on AA26 source group management. -- [ ] Customer IT or security team trained on interpreting scan results. -- [ ] Support escalation path communicated to customer. - ---- - -## Sign-off - -| Role | Name | Signature | Date | -| --- | --- | --- | --- | -| Migration Engineer | | | | -| Customer IT Lead | | | | -| Customer Security Lead | | | | - ---- - -## Related links - -- [Migration Overview](./index.md) -- [Migrating Connection Profiles](./migrate-credentials.md) -- [Migrating Target Servers and Host Lists](./migrate-target-servers.md) -- [Migrating Job Schedules](./migrate-schedules.md) -- [Historical Audit Data Strategy](./audit-data-strategy.md) diff --git a/docs/kb/accessanalyzer-26.1/updating-to-the-latest-version.md b/docs/kb/accessanalyzer-26.1/updating-to-the-latest-version.md deleted file mode 100644 index e0f0dca29c..0000000000 --- a/docs/kb/accessanalyzer-26.1/updating-to-the-latest-version.md +++ /dev/null @@ -1,78 +0,0 @@ ---- -title: "Updating to the Latest Version" -description: >- - How to verify your current version of Netwrix Access Analyzer 26.1 and update to the latest release. Applies to both auto-update and targeted version installations. -sidebar_label: "Updating to the Latest Version" -keywords: - - access analyzer 26.1 - - upgrade access analyzer - - dspmctl version - - dspmctl set-revision - - dspmctl sync - - update access analyzer - - target revision - - auto update - - argocd sync - - check version -products: - - accessanalyzer -tags: - - kb -knowledge_article_id: kA0Qk000000XXXXKAA ---- - -# Updating to the Latest Version - -## Overview - -ArgoCD deploys Netwrix Access Analyzer 26.1, and you update it using the `dspmctl` command-line tool over an SSH connection to the host server. How you update Access Analyzer depends on how it was originally installed: - -- **Auto-update installation** — ArgoCD automatically applies new releases as they become available. You do not need to perform any manual update steps; you only need to verify that ArgoCD applied the update. -- **Targeted version installation** — The original installation pinned a specific version. You must manually set the new target version and trigger a sync. - -If you are not sure which installation type applies to your environment, run `sudo dspmctl version` and compare the output to the latest announced release. If they match, the application is already current. For system requirements, see [System Requirements](/docs/accessanalyzer/26_1/install/requirements). - -## Instructions - -### Auto-Update Installations - -1. Connect to the Access Analyzer host server over SSH. -2. Run the following command to check the currently installed version: - - ```bash - sudo dspmctl version - ``` - -3. Compare the output to the latest announced release version. If the versions match, no further action is required. - -### Targeted Version Installations - -1. Connect to the Access Analyzer host server over SSH. -2. Run the following command to check the currently installed version: - - ```bash - sudo dspmctl version - ``` - -3. Run the following command to set the new target version, replacing `` with the latest release number (for example, `1.0.15`): - - ```bash - sudo dspmctl set-revision netwrix - ``` - -4. Run the following command to force all pods to sync immediately: - - ```bash - sudo dspmctl sync netwrix - ``` - -5. Wait one to five minutes for the pods to restart and stabilize. -6. Run the version command again to confirm the update was applied: - - ```bash - sudo dspmctl version - ``` - - The output should match the version you set in step 3. - -> **NOTE:** If the version does not update after five minutes, wait an additional two to three minutes and run `sudo dspmctl version` again. Pod restarts can take longer depending on system load. diff --git a/scripts/copy-kb-to-versions.mjs b/scripts/copy-kb-to-versions.mjs index 66a3942436..31a5c271bc 100644 --- a/scripts/copy-kb-to-versions.mjs +++ b/scripts/copy-kb-to-versions.mjs @@ -6,6 +6,7 @@ * * Features: * - Copies KB articles from central location to versioned docs folders + * - Skips versions that opt out of the KB (kb: false in products.js) and removes their stale copies * - Rewrites absolute KB links to relative paths during copy * - Removes .md extensions from links (Docusaurus best practice) * - Generates _category_.json files for proper category labeling @@ -68,6 +69,11 @@ function buildConfig() { } }); + // Versions that opt out of the KB entirely (kb: false on the version entry) + const noKbVersions = product.versions + .filter(v => v.kb === false) + .map(v => v.version); + // Special handling: KB folder name mapping (for legacy naming) const kbFolderName = productId === 'recoveryforactivedirectory' ? 'recoveryad' : @@ -84,6 +90,7 @@ function buildConfig() { config[productId] = { versions: versions, versionSources: versionSources, + noKbVersions: noKbVersions, source: `docs/kb/${kbFolderName}`, destinationPattern: destinationPattern }; @@ -650,6 +657,26 @@ function main() { validateDestinationPath(destination); console.log(`\n 📖 Version: ${version}`); + + // A version can opt out of the KB (kb: false in products.js). Skip it + // and remove any copy left behind from before the opt-out, so a stale + // Knowledge Base section doesn't keep showing up in local builds. + if (config.noKbVersions?.includes(version)) { + console.log(` ℹ️ KB disabled for this version (kb: false) — skipping`); + if (fs.existsSync(destination)) { + if (!isDryRun) { + if (!removeDirectorySync(destination)) { + throw new Error('Failed to remove KB folder for a version with kb: false'); + } + console.log(` 🗑️ Removed previously copied KB folder: ${destination}`); + } else { + console.log(` 🔍 [dry-run] Would remove previously copied KB folder: ${destination}`); + } + } + totalSkipped++; + continue; + } + console.log(` Source: ${versionSource}`); console.log(` Dest: ${destination}`); diff --git a/src/config/products.js b/src/config/products.js index c66393c8d6..1f91c1ce45 100644 --- a/src/config/products.js +++ b/src/config/products.js @@ -18,6 +18,7 @@ * @property {boolean} isLatest - Whether this is the latest version * @property {string} [sidebarFile] - Custom sidebar file path (defaults to generated path) * @property {string} [kbSource] - Optional override for the KB source directory for this version (relative to repo root). When set, this version pulls KB articles from this directory instead of the product-level default (docs/kb//). + * @property {boolean} [kb] - Set to false to give this version no Knowledge Base section. The KB copy script skips the version (and removes any previously copied kb/ folder) instead of falling back to the product-level KB source. Defaults to true. */ /** @@ -66,7 +67,7 @@ export const PRODUCTS = [ label: '26.1', isLatest: true, sidebarFile: './sidebars/accessanalyzer/26.1.js', - kbSource: 'docs/kb/accessanalyzer-26.1', + kb: false, // No Knowledge Base section: the docs/kb/accessanalyzer articles apply to 12.0 and 11.6 only }, { version: '12.0', diff --git a/src/theme/searchUtils.js b/src/theme/searchUtils.js index b15fdc60ee..ac2c55610a 100644 --- a/src/theme/searchUtils.js +++ b/src/theme/searchUtils.js @@ -37,8 +37,8 @@ export function versionLabel(version) { // A version-pinned KB source (kbSource override) publishes under its directory // basename instead of the product id — both as the standalone route segment and as -// the copied landing page's slug (docs/kb/accessanalyzer-26.1/index.md pins -// slug: accessanalyzer-26.1 while the default source pins slug: accessanalyzer). +// the copied landing page's slug (a source at docs/kb/-/ pins +// slug: - while the default source pins slug: ). // basename -> product id, so every shape of one article normalizes to one key. const PINNED_KB_SOURCES = new Map(); PRODUCTS.forEach(p => (p.versions || []).forEach(v => { From 2a1096f70c5f4d03257108c2389d29c29db18a4b Mon Sep 17 00:00:00 2001 From: Jordan Violet <8886650+jtviolet@users.noreply.github.com> Date: Thu, 10 Sep 2026 09:27:16 -0400 Subject: [PATCH 14/15] chore: refresh package-lock.json npm normalized the lockfile by dropping the `libc` fields on optional platform packages. Follow-up to #1522, where this change was left out. Generated with AI Co-Authored-By: Claude Code --- package-lock.json | 18 ------------------ 1 file changed, 18 deletions(-) diff --git a/package-lock.json b/package-lock.json index 1fffe42ff9..26cc40d6f8 100644 --- a/package-lock.json +++ b/package-lock.json @@ -6609,9 +6609,6 @@ "cpu": [ "arm64" ], - "libc": [ - "glibc" - ], "license": "Apache-2.0 AND MIT", "optional": true, "os": [ @@ -6628,9 +6625,6 @@ "cpu": [ "arm64" ], - "libc": [ - "musl" - ], "license": "Apache-2.0 AND MIT", "optional": true, "os": [ @@ -6647,9 +6641,6 @@ "cpu": [ "ppc64" ], - "libc": [ - "glibc" - ], "license": "Apache-2.0 AND MIT", "optional": true, "os": [ @@ -6666,9 +6657,6 @@ "cpu": [ "s390x" ], - "libc": [ - "glibc" - ], "license": "Apache-2.0 AND MIT", "optional": true, "os": [ @@ -6685,9 +6673,6 @@ "cpu": [ "x64" ], - "libc": [ - "glibc" - ], "license": "Apache-2.0 AND MIT", "optional": true, "os": [ @@ -6704,9 +6689,6 @@ "cpu": [ "x64" ], - "libc": [ - "musl" - ], "license": "Apache-2.0 AND MIT", "optional": true, "os": [ From 5246814b9d8427193f948e8b9ef8c0ffce928278 Mon Sep 17 00:00:00 2001 From: dsalyamova Date: Thu, 10 Sep 2026 14:55:33 +0100 Subject: [PATCH 15/15] docs(auditor): port WSA/User Activity content-accuracy fixes to 10.7 and 10.8 (AUD-336) (#1521) * docs(auditor): port WSA/User Activity content-accuracy fixes to 10.7 and 10.8 (AUD-336) Apply the same content-accuracy and formatting fixes made to 10.9 in the Windows Server and User Activity docs, adapted for 10.7/10.8: consolidate duplicated content into single canonical topics, fix broken/flattened bullet lists, restore the correct three-level Component/Object type/Attributes table structure (previously collapsed by AI migration), split DNS Who-value notes out of the table into proper admonitions, fix broken links and duplicated rows, and correct Windows Server 2008 references (unsupported in 10.7/10.8). OS-version content that remains supported in 10.7/10.8 (e.g. Windows Server 2012, Windows 7) is intentionally left untouched. Generated with AI Co-Authored-By: Claude Code * fix(vale): auto-fix style issues (Vale + Dale) * docs(auditor): apply editorial review fixes to 10.7/10.8 WSA and User Activity docs (AUD-336) Address findings from the PR editorial review: split the combined Windows Server/User Activity item row in datasources.md into two correctly-linked rows, add missing anchors and
separators for scannability, fix broken NOTE-block scoping and misplaced Video Recording group description, correct "when upon" grammar, rename the Containers and Computers option cell and align "Exclude Monitored Objects" link/heading text with its destination's actual name, remove a duplicated Install Core Service section in favor of a single pointer, align gMSA prerequisite phrasing, fix an undefined triple- asterisk table marker, de-link a heading-less cross reference, disambiguate the Configure Advanced Audit Policy section heading from the page H1, match removablestorage.md link text casing to its target headings, and give the Install Core Service manual procedure its own heading with note formatting. Generated with AI Co-Authored-By: Claude Code * fix(vale): auto-fix style issues (Vale + Dale) --------- Co-authored-by: Claude Code Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> --- .../10.7/admin/monitoringplans/datasources.md | 32 +- .../10.7/admin/monitoringplans/overview_1.md | 51 ++- .../admin/monitoringplans/windows/overview.md | 41 ++- .../useractivity/datacollection.md | 36 +- .../configuration/useractivity/overview.md | 75 ++--- .../10.7/configuration/useractivity/ports.md | 6 +- .../useractivity/videorecordings.md | 61 ++-- .../windowsserver/advancedpolicy.md | 56 +--- .../configuration/windowsserver/eventlog.md | 18 +- .../10.7/configuration/windowsserver/iis.md | 4 +- .../configuration/windowsserver/overview.md | 314 +++++++++-------- .../10.7/configuration/windowsserver/ports.md | 2 +- .../windowsserver/registrykey.md | 14 +- .../windowsserver/remoteregistry.md | 4 +- .../windowsserver/removablestorage.md | 154 +++++---- .../10.7/install/useractivitycoreservice.md | 19 +- .../10.8/admin/monitoringplans/datasources.md | 34 +- .../microsoftentraid/overview.md | 51 +-- .../10.8/admin/monitoringplans/overview_1.md | 51 +-- .../admin/monitoringplans/windows/overview.md | 39 +-- .../useractivity/datacollection.md | 36 +- .../configuration/useractivity/overview.md | 79 ++--- .../10.8/configuration/useractivity/ports.md | 6 +- .../useractivity/videorecordings.md | 63 ++-- .../windowsserver/advancedpolicy.md | 58 +--- .../configuration/windowsserver/eventlog.md | 18 +- .../10.8/configuration/windowsserver/iis.md | 4 +- .../configuration/windowsserver/overview.md | 316 +++++++++--------- .../10.8/configuration/windowsserver/ports.md | 2 +- .../windowsserver/registrykey.md | 14 +- .../windowsserver/remoteregistry.md | 4 +- .../windowsserver/removablestorage.md | 155 +++++---- .../10.8/install/useractivitycoreservice.md | 21 +- 33 files changed, 872 insertions(+), 966 deletions(-) diff --git a/docs/auditor/10.7/admin/monitoringplans/datasources.md b/docs/auditor/10.7/admin/monitoringplans/datasources.md index 8f04f8d796..5e58adf18e 100644 --- a/docs/auditor/10.7/admin/monitoringplans/datasources.md +++ b/docs/auditor/10.7/admin/monitoringplans/datasources.md @@ -6,15 +6,15 @@ sidebar_position: 20 # Manage Data Sources -You can fine-tune data collection for each data source. Settings that you configure for the data -source will be applied to all items belonging to that data source. Using data source settings, you -can, for example: +You can fine-tune data collection for each data source. Netwrix Auditor applies the settings that +you configure for the data source to all items belonging to that data source. Using data source +settings, you can, for example: - Enable state-in-time data collection (supported for several data sources) - Depending on the data source, customize the monitoring scope (e.g., enable read access auditing, monitoring of failed attempts) -To add, modify, and remove data sources, enable or disable monitoring, you must be assigned the +To add, modify, and remove data sources, or to enable or disable monitoring, you must have the Global administrator role in the product or the Configurator role on the plan. See the [Role-Based Access and Delegation](/docs/auditor/10.7/admin/monitoringplans/delegation.md) topic for additional information. @@ -77,19 +77,20 @@ associated with your data source. | Data Source | Item | | ----------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| Active Directory Group Policy Exchange Logon Activity | [Domain](activedirectory/overview.md#domain) | +| Active Directory
Group Policy
Exchange
Logon Activity | [Domain](activedirectory/overview.md#domain) | | Active Directory Federation Services | [Federation Server](adfs.md#federation-server) | -| Microsoft Entra ID Exchange Online SharePoint Online Microsoft Teams | [Microsoft Entra ID](/docs/auditor/10.7/admin/monitoringplans/microsoftentraid/overview.md) | -| File Servers (including Windows file server, Dell, NetApp, Nutanix File server, Synology, and Qumulo) | [AD Container](activedirectory/overview.md#ad-container) [File Servers](/docs/auditor/10.7/admin/monitoringplans/fileservers/overview.md) [Dell Isilon](fileservers/overview.md#dell-isilon) [Dell VNX VNXe](fileservers/overview.md#dell-vnx-vnxe) [File Servers](/docs/auditor/10.7/admin/monitoringplans/fileservers/overview.md) [NetApp](fileservers/overview.md#netapp) [Windows File Share](fileservers/scope.md#windows-file-share) [Nutanix SMB Shares](fileservers/overview.md#nutanix-smb-shares) [Qumulo](fileservers/overview.md#qumulo) [Synology](fileservers/overview.md#synology) By default, Auditor will monitor all shares stored in the specified location, except for hidden shares (both default and user-defined). If you want to monitor user-defined hidden shares, select the related option in the monitored item settings. Remember that administrative hidden shares like default system root or Windows directory (ADMIN$), default drive shares (D$, E$), etc. will not be monitored. See the topics on the monitored items for details. | +| Microsoft Entra ID
Exchange Online
SharePoint Online
Microsoft Teams | [Microsoft 365 tenant](/docs/auditor/10.7/admin/monitoringplans/microsoftentraid/overview.md#configure-office-365-tenant-as-a-monitored-item) | +| File Servers (including Windows file server, Dell, NetApp, Nutanix File server, Synology, and Qumulo) | [AD Container](activedirectory/overview.md#ad-container)
[Computer](fileservers/windowsfileserver.md#computer)
[Dell Isilon](fileservers/overview.md#dell-isilon)
[Dell VNX VNXe](fileservers/overview.md#dell-vnx-vnxe)
[IP Range](fileservers/windowsfileserver.md#ip-range)
[NetApp](fileservers/overview.md#netapp)
[Windows File Share](fileservers/scope.md#windows-file-share)
[Nutanix SMB Shares](fileservers/overview.md#nutanix-smb-shares)
[Qumulo](fileservers/overview.md#qumulo)
[Synology](fileservers/overview.md#synology) By default, Auditor will monitor all shares stored in the specified location, except for hidden shares (both default and user-defined). If you want to monitor user-defined hidden shares, select the related option in the monitored item settings. Remember that Auditor doesn't monitor administrative hidden shares like default system root or Windows directory (ADMIN$), default drive shares (D$, E$), etc. See the topics on the monitored items for details. | | Network Devices | [Syslog Device](networkdevices.md#syslog-device) [Cisco Meraki Dashboard](networkdevices.md#cisco-meraki-dashboard) | | Oracle Database | [Oracle Database Instance](oracle/overview.md#oracle-database-instance) | | SharePoint | [SharePoint Farm](sharepoint/overview.md#sharepoint-farm) | | SQL Server | [SQL Server Instance](sqlserver/items.md#sql-server-instance) [SQL Server Availability Group](sqlserver/items.md#sql-server-availability-group) | | VMware | [VMware ESX/ESXi/vCenter](vmware/overview.md#vmware-esxesxivcenter) | -| Windows Server User Activity | [File Servers](/docs/auditor/10.7/admin/monitoringplans/fileservers/overview.md) [AD Container](activedirectory/overview.md#ad-container) [File Servers](/docs/auditor/10.7/admin/monitoringplans/fileservers/overview.md) | +| Windows Server | [Computer](/docs/auditor/10.7/admin/monitoringplans/windows/overview.md#computer) [AD Container](/docs/auditor/10.7/admin/monitoringplans/windows/overview.md#ad-container) [IP Range](/docs/auditor/10.7/admin/monitoringplans/windows/overview.md#ip-range) | +| User Activity | [Computer](/docs/auditor/10.7/admin/monitoringplans/overview_1.md#computer) [AD Container](/docs/auditor/10.7/admin/monitoringplans/overview_1.md#ad-container) [IP Range](/docs/auditor/10.7/admin/monitoringplans/overview_1.md#ip-range) | | Netwrix API | [Integration API](/docs/auditor/10.7/api/overview.md) | -To add, modify, and remove items, you must be assigned the Global administrator role in the product +To add, modify, and remove items, you must have the Global administrator role in the product or the **Configurator** role on the plan. See the [Role-Based Access and Delegation](/docs/auditor/10.7/admin/monitoringplans/delegation.md) topic for additional information. @@ -107,9 +108,9 @@ monitoring plan and click Edit item. For each item, you can: ## Configure Monitoring Scope -In some environments, it may not be necessary to monitor the entire IT infrastructure. Netwrix -monitoring scope can be configured on the Data Source and/or Item levels. the section below contains -examples on how to use omit functionality in Auditor. +In some environments, you don't need to monitor the entire IT infrastructure. You can configure the +Netwrix monitoring scope at the Data Source and/or Item levels. The following table provides +examples of how to use the omit functionality in Auditor. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. @@ -122,17 +123,16 @@ The new monitoring scope restrictions apply together with previous exclusion set | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Active Directory** | | | You want to omit all activity by a specific service account or service accounts with a specific naming pattern. | [Active Directory](/docs/auditor/10.7/admin/monitoringplans/activedirectory/overview.md) | -| If Netwrix user is responsible just for a limited scope within corporate AD, s/he needs to omit everything else. | [Active Directory](/docs/auditor/10.7/admin/monitoringplans/activedirectory/overview.md) - Always both activity and state in time data are omitted. - In group/Not in group filters don't not process groups from omitted OUs. | +| If Netwrix user is responsible just for a limited scope within corporate AD, s/he needs to omit everything else. | [Active Directory](/docs/auditor/10.7/admin/monitoringplans/activedirectory/overview.md) - The product always omits both activity and state in time data. - In group/Not in group filters don't process groups from omitted OUs. | | **Logon Activity** | | | You want to omit domain logons by a specific service account or service accounts with a specific naming pattern. | [Logon Activity](/docs/auditor/10.7/admin/monitoringplans/logonactivity/overview.md) | | **File Servers** (including Windows file server, Dell, NetApp, Nutanix File server) | | | You have a server named _StationWin16_ where you can't install .Net 4.5 in the OU where you keep all member servers. You want to suppress errors from this server by excluding it from the Netwrix auditing scope. | [AD Container](activedirectory/overview.md#ad-container) | | A Security Officer wants to monitor a file share but s/he doesn't have access to a certain folder on this share. Then, s/he doesn't want the product to monitor this folder at all. | [File Servers](/docs/auditor/10.7/admin/monitoringplans/fileservers/overview.md) [Dell Isilon](fileservers/overview.md#dell-isilon) [Dell VNX VNXe](fileservers/overview.md#dell-vnx-vnxe) [NetApp](fileservers/overview.md#netapp) [Windows File Share](fileservers/scope.md#windows-file-share) [Nutanix SMB Shares](fileservers/overview.md#nutanix-smb-shares) | -| A Security Officer wants to monitor a file share but s/he doesn't have access to a certain folder on this share. Then, s/he doesn't want the product to monitor this folder at all. | [File Servers](/docs/auditor/10.7/admin/monitoringplans/fileservers/overview.md) [Dell Isilon](fileservers/overview.md#dell-isilon) [Dell VNX VNXe](fileservers/overview.md#dell-vnx-vnxe) [NetApp](fileservers/overview.md#netapp) [Windows File Share](fileservers/scope.md#windows-file-share) [Nutanix SMB Shares](fileservers/overview.md#nutanix-smb-shares) | | A Security Officer wants to monitor a file share, but it contains a folder with a huge amount of objects, so s/he doesn't want Netwrix Auditor to collect State-in-Time data for this folder. | [File Servers](/docs/auditor/10.7/admin/monitoringplans/fileservers/overview.md) [Dell Isilon](fileservers/overview.md#dell-isilon) [Dell VNX VNXe](fileservers/overview.md#dell-vnx-vnxe) [NetApp](fileservers/overview.md#netapp) [Windows File Share](fileservers/scope.md#windows-file-share) [Nutanix SMB Shares](fileservers/overview.md#nutanix-smb-shares) | | You want to exclude specific computers within an IP range from the Netwrix auditing scope. | [File Servers](/docs/auditor/10.7/admin/monitoringplans/fileservers/overview.md) | | **SQL Server** | | -| You want to know if the _corp\administrator_ user is messing with SQL data. | [SQL Server Instance](sqlserver/items.md#sql-server-instance) | +| You want to know if the _corp\administrator_ user is changing SQL data. | [SQL Server Instance](sqlserver/items.md#sql-server-instance) | | As an Auditor administrator, you want to exclude the _domain\nwxserviceaccount_ service account activity from SQL server audit so that you get reports without changes made by automatic systems. | [SQL Server Instance](sqlserver/items.md#sql-server-instance) | | As an Auditor administrator, you want to exclude all changes performed by _MyCustomTool_. | [SQL Server Instance](sqlserver/items.md#sql-server-instance) | | **SharePoint** | | @@ -142,4 +142,4 @@ The new monitoring scope restrictions apply together with previous exclusion set | You have a server named StationWin16 where you can't install .Net 4.5 in the OU where you keep all member servers. You want to suppress errors from this server by excluding it from the Netwrix auditing scope. | [AD Container](activedirectory/overview.md#ad-container) | | You want to exclude specific computers within an IP range from the Netwrix auditing scope. | [File Servers](/docs/auditor/10.7/admin/monitoringplans/fileservers/overview.md) | | VMware | | -| You have a virtual machine named "testvm" used for testing purposes, so you want to exclude it from being monitored. | [VMware ESX/ESXi/vCenter](vmware/overview.md#vmware-esxesxivcenter) | +| You have a virtual machine named "testvm" that you use for testing, so you want to exclude it from monitoring. | [VMware ESX/ESXi/vCenter](vmware/overview.md#vmware-esxesxivcenter) | diff --git a/docs/auditor/10.7/admin/monitoringplans/overview_1.md b/docs/auditor/10.7/admin/monitoringplans/overview_1.md index a34e3ad819..78c8af5bae 100644 --- a/docs/auditor/10.7/admin/monitoringplans/overview_1.md +++ b/docs/auditor/10.7/admin/monitoringplans/overview_1.md @@ -7,18 +7,17 @@ sidebar_position: 180 # User Activity :::note -Before configuring your monitoring plan, read and complete the instructions in -the following topics: -::: +Read and complete the instructions in the following topics before configuring your monitoring +plan: - [Protocols and Ports Required](/docs/auditor/10.7/requirements/ports.md) – To ensure successful data collection and activity monitoring configure necessary protocols and ports for inbound and outbound connections - [Data Collecting Account](/docs/auditor/10.7/admin/monitoringplans/dataaccounts.md) – Configure data collecting accounts as required to audit your IT systems - - [User Activity](/docs/auditor/10.7/configuration/useractivity/overview.md) – Configure data source as required to be monitored +::: Complete the following fields: @@ -26,18 +25,17 @@ Complete the following fields: | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | General | | | Monitor this data source and collect activity data | Enable monitoring of the selected data source and configure Auditor to collect and store audit data. | -| Notify users about activity monitoring | You can enable the message that will be displayed when a user logs in and specify the message text. | -| Record video of user activity within sessions | - If disabled, only user session events will be collected (regardless of whether the user is idle or not). - If enabled, the product will both collect user session events and record video of user activity. By default, this option is disabled. | -| Video Recording For these settings to become effective, enable video recording on the General tab. | | -| Adjust video quality | Optimize video file by adjusting the following: - File size and video quality - Save video in grayscale - CPU load and Video smoothness. | -| Adjust video duration | Limit video file length by adjusting the following: - Recording lasts for `<...>` minutes—Video recording will be stopped after the selected time period. - User has been idle for `<...>` minutes—Video recording will be stopped if a user is considered inactive during the selected time period. If the Record video of user activity within sessions option is enabled, the User Sessions report shows active time calculated without including user idle period. Mind that a computer is considered to be idle by Windows if there has not been user interaction via the mouse or keyboard for a given time and if the hard drives and processors have been idle more than 90% of that time. - Free disk space is less than `<...>` MB—Video recording will be stopped when upon reaching selected disk space limit. - Consider user activity — Select one of the following: - Stop if user has been idle for `<...>` minutes. Select if you want video recording for a user to be stopped after the specified time period. - Continue video recording regardless of the user idle state. When selected, Netwrix Auditor continues video recording for idle users. | +| Notify users about activity monitoring | You can enable the message that appears when a user logs in and specify the message text. | +| Record video of user activity within sessions |
  • If disabled, the product collects only user session events (regardless of whether the user is idle or not).
  • If enabled, the product will both collect user session events and record video of user activity.
By default, this option is disabled. | +| Video Recording | | +| Adjust video quality | For these settings to become effective, enable video recording on the General tab. Optimize video file by adjusting the following:
  • File size and video quality
  • Save video in grayscale
  • CPU load and Video smoothness
| +| Adjust video duration | For these settings to become effective, enable video recording on the General tab. Limit video file length by adjusting the following:
  • Recording lasts for `<...>` minutes—Video recording stops after the selected time period.
  • User has been idle for `<...>` minutes—Video recording stops if the product considers a user inactive during the selected time period.
If the Record video of user activity within sessions option is enabled, the User Sessions report shows active time calculated without including user idle period. Mind that Windows considers a computer idle if there has not been user interaction via the mouse or keyboard for a given time and if the hard drives and processors have been idle more than 90% of that time.
  • Free disk space is less than `<...>` MB—Video recording stops when the selected disk space limit is reached.
  • Consider user activity — Select one of the following:
    • Stop if user has been idle for `<...>` minutes. Select if you want the product to stop video recording for a user after the specified time period.
    • Continue video recording regardless of the user idle state. When selected, Netwrix Auditor continues video recording for idle users.
| | Set a retention period to clear stale videos | When the selected retention period is over, Netwrix Auditor deletes your video recordings. | | Users | | -| Specify users to track their activity | Select the users whose activity should be recorded. You can select **All users** or create a list of **Specific users or user groups**. Certain users can also be added to **Exceptions** list. | +| Specify users to track their activity | Select the users whose activity you want to record. You can select **All users** or create a list of **Specific users or user groups**. You can also add certain users to the **Exceptions** list. | | Applications | | -| Specify applications you want to track | Select the applications that you want to monitor. You can select All applications or create a list of Specific applications. Certain applications can also be added to Exceptions list. | -| Monitored Computers | | -| For a newly created monitoring plan for User Activity, the list of monitored computers is empty. Add items to your monitoring plan and wait until Netwrix Auditor retrieves all computers within these items. See [Add Items for Monitoring](/docs/auditor/10.7/admin/monitoringplans/datasources.md#add-items-for-monitoring)for more information. The list contains computer name, its current status and last activity time. | | +| Specify applications you want to track | Select the applications that you want to monitor. You can select All applications or create a list of Specific applications. You can also add certain applications to the Exceptions list. | +| Monitored Computers | For a newly created monitoring plan for User Activity, the list of monitored computers is empty. Add items to your monitoring plan and wait until Netwrix Auditor retrieves all computers within these items. See [Add Items for Monitoring](/docs/auditor/10.7/admin/monitoringplans/datasources.md#add-items-for-monitoring) for more information. The list contains computer name, its current status and last activity time. | Review your data source settings and click **Add** to go back to your plan. The newly created data source will appear in the **Data source** list. As a next step, click **Add item** to specify an @@ -47,19 +45,18 @@ information. ## How to Include/Exclude Applications -To create a list of application to include in / exclude from monitoring, you will need to provide: +To create a list of applications to include in or exclude from monitoring, provide the following: - Title — application title as shown on top of the application window, for example, **MonthlyReport.docx - Word**. - - Title can also be found in the "_What_" column of related Netwrix Auditor reports and search - results, for example, in the **User Sessions** report. + - You can also find the title in the "_What_" column of related Netwrix Auditor reports and + search results, for example, in the **User Sessions** report. -- Description — as shown in the Description column on theDetails tab of Windows Task Manager. +- Description — as shown in the Description column on the Details tab of Windows Task Manager. - Using Description can help to filter out several components of a single application — for - example, all executables having _TeamViewer 14_ description belong to the same app (see the - screenshot above). + example, all executables having _TeamViewer 14_ description belong to the same app. To create a list of inclusions / exclusions for applications: @@ -67,13 +64,15 @@ To create a list of inclusions / exclusions for applications: **Step 2 –** Enter application title and description you have identified. -Wildcards (\*?) are supported and applied as follows: +The product supports wildcards (\*?) and applies them as follows: - _\* - Notepad_ (the "Title" filter) will exclude all Notepad windows. - _colo?r \*_ (the "Title" filter) will exclude all application window titles containing "_color_" or "_colour_". +:::note Same logic applies to the inclusion rules. +::: Example @@ -90,8 +89,8 @@ To exclude the Notepad application window with "_Document1_" open, add the follo ## Computer For evaluation purposes, Netwrix recommends selecting Computer as an item for a monitoring plan. -After the product is configured to collect data from the specified items, audit settings (including -Core and Compression services installation) will be applied to all computers within AD Container or +After you configure the product to collect data from the specified items, it applies audit settings +(including Core and Compression services installation) to all computers within AD Container or IP Range. Complete the following fields: @@ -100,7 +99,7 @@ Complete the following fields: | --------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | General | | | Specify a computer | Provide a server name by entering its FQDN, NETBIOS, or IPv4 address. You can click Browse to select a computer from the list of computers in your network. | -| Specify the account for collecting data | Select the account that will be used to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select account type you want to use and enter credentials. The following choices are available: - User/password. The account must be granted the same permissions and access rights as the default account used for data collection. See the [Data Collecting Account](/docs/auditor/10.7/admin/monitoringplans/dataaccounts.md) topic for additional information. - Group Managed Service Account (gMSA). You should specify only the account name in the domain\account$ format. See the [Use Group Managed Service Account (gMSA)](/docs/auditor/10.7/requirements/gmsa.md) topic for additional information. | +| Specify the account for collecting data | Select the account you want to use to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select account type you want to use and enter credentials. The following choices are available: - User/password. The account must have the same permissions and access rights as the default account used for data collection. See the [Data Collecting Account](/docs/auditor/10.7/admin/monitoringplans/dataaccounts.md) topic for additional information. - Group Managed Service Account (gMSA). You should specify only the account name in the domain\account$ format. See the [Use Group Managed Service Account (gMSA)](/docs/auditor/10.7/requirements/gmsa.md) topic for additional information. | ## IP Range @@ -110,7 +109,7 @@ Complete the following fields: | --------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | General | | | Specify IP range | Specify an IP range for the audited computers. To exclude computers from within the specified range, click **Exclude**. Enter the IP subrange you want to exclude, and click **Add**. | -| Specify the account for collecting data | Select the account that will be used to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select **Custom account** and enter credentials. The credentials are case sensitive. A custom account must be granted the same permissions and access rights as the default account used for data collection. See the [Data Collecting Account](/docs/auditor/10.7/admin/monitoringplans/dataaccounts.md) topic for additional information. | +| Specify the account for collecting data | Select the account the same way as for the [Computer](#computer) item. | ## AD Container @@ -119,5 +118,5 @@ Complete the following fields: | Option | Description | | --------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | General | | -| Specify AD container | Specify a whole AD domain, OU, or container. Click **Browse** to select from the list of containers in your network. You can also: - Select a particular computer type to be audited within the chosen AD container: **Domain controllers, Servers (excluding domain controllers)**, or **Workstations**. - Click **Exclude** to specify AD domains, OUs, and containers you don't want to audit. In the Exclude Containers dialog, click Add and specify an object. The list of containers doesn't include child domains of trusted domains. Use other options **(Computer, IP range** to specify the target computers. | -| Specify the account for collecting data | Select the account that will be used to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select **Custom account** and enter credentials. The credentials are case sensitive. If using a group Managed Service Account (gMSA), you can specify only the account name in the _domain\account$_ format. Password field can be empty. A custom account must be granted the same permissions and access rights as the default account used for data collection. See the[Data Collecting Account](/docs/auditor/10.7/admin/monitoringplans/dataaccounts.md) topic for additional information. | +| Specify AD container | Specify a whole AD domain, OU, or container. Click **Browse** to select from the list of containers in your network. You can also:
  • Select a particular computer type to audit within the chosen AD container: **Domain controllers, Servers (excluding domain controllers)**, or **Workstations**.
  • Click **Exclude** to specify AD domains, OUs, and containers you don't want to audit. In the Exclude Containers dialog, click Add and specify an object. The list of containers doesn't include child domains of trusted domains.
Use other options (**Computer**, **IP range**) to specify the target computers. | +| Specify the account for collecting data | Select the account the same way as for the [Computer](#computer) item. | diff --git a/docs/auditor/10.7/admin/monitoringplans/windows/overview.md b/docs/auditor/10.7/admin/monitoringplans/windows/overview.md index 66adad25ab..f5e0320c02 100644 --- a/docs/auditor/10.7/admin/monitoringplans/windows/overview.md +++ b/docs/auditor/10.7/admin/monitoringplans/windows/overview.md @@ -6,15 +6,14 @@ sidebar_position: 200 # Windows Server -**NOTE:** Before configuring your monitoring plan, read and complete the instructions in -the following topics: +**NOTE:** Read and complete the instructions in the following topics before configuring your +monitoring plan: - [Protocols and Ports Required](/docs/auditor/10.7/requirements/ports.md) – To ensure successful data collection and activity monitoring configure necessary protocols and ports for inbound and outbound connections - [Data Collecting Account](/docs/auditor/10.7/admin/monitoringplans/dataaccounts.md) – Configure data collecting accounts as required to audit your IT systems - - [Windows Server](/docs/auditor/10.7/configuration/windowsserver/overview.md) – Configure data source as required to be monitored @@ -24,12 +23,12 @@ Complete the following fields: | -------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | General | | | Monitor this data source and collect activity data | Enable monitoring of the selected data source and configure Auditor to collect and store audit data. | -| Monitor changes to system components | Select the system components that you want to audit for changes. Review the following for additional information: - General computer settings—Enables auditing of general computer settings. For example, computer name or workgroup changes. - Hardware—Enables auditing of hardware devices configuration. For example, your network adapter configuration changes. - Add/Remove programs—Enables auditing of installed and removed programs. For example, Microsoft Office package has been removed from the audited Windows Server. - Services—Enables auditing of started/stopped services. For example, the Windows Firewall service stopped. - Audit policies—Enables auditing of local advanced audit policies configuration. For example, the Audit User Account Management advanced audit policy is set to "_Failure_". - DHCP configuration—Enables auditing of DHCP configuration changes. - Scheduled tasks—Enables auditing of enabled / disabled / modified scheduled tasks. For example, the GoogleUpdateTaskMachineUA scheduled task trigger changes. - Local users and groups—Enables auditing of local users and groups. For example, an unknown user was added to the Administrators group. - DNS configuration—Enables auditing of your DNS configuration changes. For example, your DNS security parameters' changes. - DNS resource records—Enables auditing of all types of DNS resource records. For example, A-type resource records (Address record) changes. - File shares—Enables auditing of created / removed / modified file shares and their properties. For example, a new file share was created on the audited Windows Server. - Removable media—Enables auditing of USB thumb drives insertion. | -| Specify data collection method | You can enable **network traffic compression.** If enabled, a Compression Service will be automatically launched on the audited computer, collecting and prefiltering data. This significantly improves data transfer and minimizes the impact on the target computer performance. | -| Configure audit settings | You can adjust audit settings automatically. Your current audit settings will be checked on each data collection and adjusted if necessary. This method is recommended for evaluation purposes in test environments. If any conflicts are detected with your current audit settings, automatic audit configuration will not be performed. Don't select the checkbox if you want to configure audit settings manually. See the [Windows Server](/docs/auditor/10.7/configuration/windowsserver/overview.md) configuration topic for additional information about audit settings required to collect comprehensive audit data and the instructions on how to configure them. | -| Collect data for state-in-time reports | Configure Auditor to store daily snapshots of your system configuration required for further state-in-time reports generation. See the [State–In–Time Reports](/docs/auditor/10.7/admin/reports/types/stateintime/overview.md) topic for additional information. When auditing file servers, changes to effective access permissions can be tracked in addition to audit permissions. By default, Combination of file and share permissions is tracked. File permissions define who has access to local files and folders. Share permissions provide or deny access to the same resources over the network. The combination of both determines the final access permissions for a shared folder—the more restrictive permissions are applied. Upon selecting Combination of file and share permissions only the resultant set will be written to the Audit Database. Select File permissions option too if you want to see difference between permissions applied locally and the effective file and share permissions set. To disable auditing of effective access, unselect all checkboxes under Include details on effective permissions. In the Schedule state-in-time data collection section, you can select a custom weekly interval for snapshots collection. Click Modify and select days of week you want your snapshot to be collected. In the Manage historical snapshots section, you can click **Manage** and select the snapshots that you want to import to the Audit Database to generate a report on the data source's state at the specific moment in the past. You must be assigned the Global administrator or the Global reviewer role to import snapshots. Move the selected snapshots to the Snapshots available for reporting list using the arrow button. The product updates the latest snapshot on the regular basis to keep users up to date on actual system state. Users can also configure Only the latest snapshot is available for reporting in Auditor. If you want to generate reports based on different snapshots, you must import snapshots to the Audit Database. | +| Monitor changes to system components | Select the system components that you want to audit for changes. Review the following for additional information:
  • General computer settings—Enables auditing of general computer settings. For example, computer name or workgroup changes.
  • Hardware—Enables auditing of hardware devices configuration. For example, your network adapter configuration changes.
  • Add/Remove programs—Enables auditing of installed and removed programs. For example, Microsoft Office package has been removed from the audited Windows Server.
  • Services—Enables auditing of started/stopped services. For example, the Windows Firewall service stopped.
  • Audit policies—Enables auditing of local advanced audit policies configuration. For example, the Audit User Account Management advanced audit policy is set to "_Failure_".
  • DHCP configuration—Enables auditing of DHCP configuration changes.
  • Scheduled tasks—Enables auditing of enabled / disabled / modified scheduled tasks. For example, the GoogleUpdateTaskMachineUA scheduled task trigger changes.
  • Local users and groups—Enables auditing of local users and groups. For example, an unknown user was added to the Administrators group.
  • DNS configuration—Enables auditing of your DNS configuration changes. For example, your DNS security parameters' changes.
  • DNS resource records—Enables auditing of all types of DNS resource records. For example, A-type resource records (Address record) changes.
  • File shares—Enables auditing of created / removed / modified file shares and their properties. For example, a new file share was created on the audited Windows Server.
  • Removable media—Enables auditing of USB thumb drives insertion.
| +| Specify data collection method | You can enable **network traffic compression.** If enabled, the product automatically launches a Compression Service on the audited computer to collect and prefilter data. This significantly improves data transfer and minimizes the impact on the target computer performance. | +| Configure audit settings | You can adjust audit settings automatically. Auditor checks your current audit settings on each data collection and adjusts them if necessary. Netwrix recommends this method for evaluation purposes in test environments. If Auditor detects conflicts with your current audit settings, it doesn't perform automatic audit configuration. Don't select the checkbox if you want to configure audit settings manually. See the [Windows Server](/docs/auditor/10.7/configuration/windowsserver/overview.md) configuration topic for additional information about audit settings required to collect comprehensive audit data and the instructions on how to configure them. | +| Collect data for state-in-time reports | Configure Auditor to store daily snapshots of your system configuration required for further state-in-time reports generation. See the [State–In–Time Reports](/docs/auditor/10.7/admin/reports/types/stateintime/overview.md) topic for additional information. In the Manage historical snapshots section, you can click **Manage** and select the snapshots that you want to import to the Audit Database to generate a report on the data source's state at the specific moment in the past. You must have the Global administrator or the Global reviewer role to import snapshots. Move the selected snapshots to the Snapshots available for reporting list using the arrow button. The product updates the latest snapshot regularly to keep users up to date on the actual system state. Users can also configure Only the latest snapshot is available for reporting in Auditor. If you want to generate reports based on different snapshots, you must import snapshots to the Audit Database. | | Activity | | -| Specify monitoring restrictions | Specify restriction filters to narrow your Windows Server monitoring scope (search results, reports, and Activity Summaries). For example, you can exclude system activity on a particular objects on all computers. All filters are applied using AND logic. Click Add and complete the following fields: - User who initiated the change: – provide the name of the user whose changes you want to ignore as shown in the "_Who_" column of reports and Activity Summaries. Example: _mydomain\user1_. You can provide the "_System_" value to exclude events containing the “_System_” instead of an account name in the “_Who_” column. - Windows Server which setting was changed: – provide the name of the server in your IT infrastructure whose changes you want to ignore as shown in the "_What_" column of reports and Activity Summaries. Example: _winsrv2016-01.mydomain.local_. - Setting changed: – provide the name for unwanted settings as shown in the "_What_" column in reports and Activity Summaries. Example: _System Properties\*_. You can use a wildcard (\*) to replace any number of characters in filters. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. The new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.7/admin/monitoringplans/overview.md)topic for additional information. | +| Specify monitoring restrictions | Specify restriction filters to narrow your Windows Server monitoring scope (search results, reports, and Activity Summaries). For example, you can exclude system activity on a particular objects on all computers. The product applies all filters using AND logic. Click Add and complete the following fields:
  • User who initiated the change: provide the name of the user whose changes you want to ignore as shown in the "_Who_" column of reports and Activity Summaries. Example: _mydomain\user1_. You can provide the "_System_" value to exclude events containing the “_System_” instead of an account name in the “_Who_” column.
  • Windows Server which setting was changed: provide the name of the server in your IT infrastructure whose changes you want to ignore as shown in the "_What_" column of reports and Activity Summaries. Example: _winsrv2016-01.mydomain.local_.
  • Setting changed: provide the name for unwanted settings as shown in the "_What_" column in reports and Activity Summaries. Example: _System Properties\*_.
You can use a wildcard (\*) to replace any number of characters in filters. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. The new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.7/admin/monitoringplans/overview.md) topic for additional information. | Review your data source settings and click **Add** to go back to your plan. The newly created data source will appear in the **Data source** list. As a next step, click **Add item** to specify an @@ -39,11 +38,11 @@ information. ## Computer -Select the account that will be used to collect data for this item. If you want to use a specific +Select the account you want to use to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select account type you want to use and enter credentials. The following choices are available: -- User/password. The account must be granted the same permissions and access rights as the default +- User/password. The account must have the same permissions and access rights as the default account used for data collection. See the [Data Collecting Account](/docs/auditor/10.7/admin/monitoringplans/dataaccounts.md) topic for additional information. - Group Managed Service Account (gMSA). You should specify only the account name in the @@ -62,7 +61,7 @@ Complete the following fields: | --------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | General | | | Specify IP range | Specify an IP range for the audited computers. To exclude computers from within the specified range, click **Exclude**. Enter the IP subrange you want to exclude, and click **Add**. | -| Specify the account for collecting data | Select the account that will be used to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select **Custom account** and enter credentials. The credentials are case sensitive. A custom account must be granted the same permissions and access rights as the default account used for data collection. See the [Data Collecting Account](/docs/auditor/10.7/admin/monitoringplans/dataaccounts.md) topic for additional information. | +| Specify the account for collecting data | Select the account the same way as for the [Computer](#computer) item. | ## AD Container @@ -71,19 +70,17 @@ Complete the following fields: | Option | Description | | --------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | General | | -| Specify AD container | Specify a whole AD domain, OU, or container. Click **Browse** to select from the list of containers in your network. You can also: - Select a particular computer type to be audited within the chosen AD container: **Domain controllers, Servers (excluding domain controllers)**, or **Workstations**. - Click **Exclude** to specify AD domains, OUs, and containers you don't want to audit. In the Exclude Containers dialog, click Add and specify an object. The list of containers doesn't include child domains of trusted domains. Use other options **(Computer, IP range** to specify the target computers. | -| Specify the account for collecting data | Select the account that will be used to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select **Custom account** and enter credentials. The credentials are case sensitive. If using a group Managed Service Account (gMSA), you can specify only the account name in the _domain\account$_ format. Password field can be empty. Starting with version 10.7, you can implement the integration between Netwrix Auditor and Netwrix Privilege Secure. See the [Netwrix Privilege Secure](/docs/auditor/10.7/admin/settings/privilegesecure.md) topic for additional information. Refer to the [Permissions for Active Directory Auditing](/docs/auditor/10.7/configuration/activedirectory/permissions.md) topic for more information on using Netwrix Privilege Secure as an account for data collection. A custom account must be granted the same permissions and access rights as the default account used for data collection. See the[Data Collecting Account](/docs/auditor/10.7/admin/monitoringplans/dataaccounts.md) topic for additional information. | -| Containers and Computers | | -| Monitor hidden shares | By default, Auditor will monitor all shares stored in the specified location, except for hidden shares (both default and user-defined). Select **Monitor user-defined hidden shares** if necessary. Even when this option is selected, the product will not collect data from administrative hidden shares such as: default system root or Windows directory (ADMIN$), default drive shares (D$, E$, etc.), shares used by printers to enable remote administration (PRINT$), etc. | -| Specify monitoring restrictions | Specify restriction filters to narrow your monitoring scope (search results, reports, and Activity Summaries). All filters are applied using AND logic. Depending on the type of the object you want to exclude, select one of the following: - Add AD Container – Browse for a container to be excluded from being audited. You can select a whole AD domain, OU, or container. - Add Computer – Provide the name of the computer you want to exclude as shown in the "_Where_" column of reports and Activity Summaries. For example, _backupsrv01.mydomain.local_. Wildcards (\*) aren't supported. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. The new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.7/admin/monitoringplans/overview.md)topic for additional information. | +| Specify AD container | Specify a whole AD domain, OU, or container. Click **Browse** to select from the list of containers in your network. You can also:
  • Select a particular computer type to audit within the chosen AD container: **Domain controllers, Servers (excluding domain controllers)**, or **Workstations**.
  • Click **Exclude** to specify AD domains, OUs, and containers you don't want to audit. In the Exclude Containers dialog, click Add and specify an object. The list of containers doesn't include child domains of trusted domains.
Use other options (**Computer**, **IP range**) to specify the target computers. | +| Specify the account for collecting data | Select the account the same way as for the [Computer](#computer) item. | +| Specify monitoring restrictions | Specify restriction filters to narrow your monitoring scope (search results, reports, and Activity Summaries). The product applies all filters using AND logic. Depending on the type of the object you want to exclude, select one of the following:
  • Add AD Container – Browse for a container to exclude from auditing. You can select a whole AD domain, OU, or container.
  • Add Computer – Provide the name of the computer you want to exclude as shown in the "_Where_" column of reports and Activity Summaries. For example, _backupsrv01.mydomain.local_. The product doesn't support wildcards (\*).
In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. The new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Windows Server Monitoring Scope](/docs/auditor/10.7/admin/monitoringplans/windows/scope.md) topic for additional information. | ## Use Netwrix Privilege Secure as a Data Collecting Account Starting with version 10.7, you can use Netwrix Privilege Secure to manage the account for collecting data, after configuring the integration. See the [Netwrix Privilege Secure](/docs/auditor/10.7/admin/settings/privilegesecure.md) topic for additional information about -integration and supported data sources. In this case, the credentials will not be stored by Netwrix -Auditor. Instead, they will be managed by Netwrix Privilege Secure and provided on demand, ensuring +integration and supported data sources. In this case, Netwrix Auditor doesn't store the credentials. +Instead, Netwrix Privilege Secure manages them and provides them on demand, ensuring password rotation or using temporary accounts for data collection. To use Netwrix Privilege Secure as an account for data collection: @@ -100,8 +97,8 @@ Credential-based is the default option. Refer to the [Netwrix Privilege Secure](https://helpcenter.netwrix.com/category/privilegesecure_accessmanagement) documentation for details about Access Policies. -In this case, you need to provide the username of the account managed by Netwrix Privilege Secure, -and to which Netwrix Auditor has the access through a Credential-based access policy. +In this case, provide the username of the account that Netwrix Privilege Secure manages and that +Netwrix Auditor can access through a Credential-based access policy. **NOTE:** Netwrix recommends using different credentials for different monitoring plans and data sources. @@ -112,8 +109,8 @@ The second option is Resource-based. To use this option, you need to provide the Resource names, assigned to Netwrix Auditor in the corresponding Resource-based policy. Ensure that you specified the same names as in Netwrix Privilege Secure. -The Resource name in this case is where the activity will be performed. For example, if you grant +The Resource name in this case is where the activity takes place. For example, if you grant the data collecting account the access to a local Administrators group - the resource is the server -where the permission will be granted. +where you grant the permission. Netwrix Privilege Secure is ready to use as an account for data collection. diff --git a/docs/auditor/10.7/configuration/useractivity/datacollection.md b/docs/auditor/10.7/configuration/useractivity/datacollection.md index bacd23c621..d8142f4485 100644 --- a/docs/auditor/10.7/configuration/useractivity/datacollection.md +++ b/docs/auditor/10.7/configuration/useractivity/datacollection.md @@ -10,18 +10,20 @@ To successfully track user activity, ensure that the following settings are conf audited computers and on the computer where Netwrix Auditor Server is installed: - The **Windows Management Instrumentation** and the **Remote Registry** services are running and - their **Startup Type** is set to _"Automatic"_. See the Check the Windows Services Status topic - for additional information. + their **Startup Type** is set to _"Automatic"_. See the + [Check the Windows Services Status](#check-the-windows-services-status) topic for additional + information. - The **File and Printer Sharing** and the **Windows Management Instrumentation** features are - allowed to communicate through Windows Firewall. See the Windows Features Communication topic for - additional information. + allowed to communicate through Windows Firewall. See the + [Windows Features Communication](#windows-features-communication) topic for additional + information. - Local TCP Port 9004 is opened for inbound connections on the computer where Netwrix Auditor Server - is installed. This is done automatically on the product installation. See the Open Local TCP Port - 9004 topic for additional information. -- Local TCP Port 9003 is opened for inbound connections on the audited computers. See the Open Local - TCP Port 9003 topic for additional information. -- Remote TCP Port 9004 is opened for outbound connections on the audited computers. See the Open - Remote TCP Port 9004 topic for additional information. + is installed. The product does this automatically during installation. See the + [Open Local TCP Port 9004](#open-local-tcp-port-9004) topic for additional information. +- Local TCP Port 9003 is opened for inbound connections on the audited computers. See the + [Open Local TCP Port 9003](#open-local-tcp-port-9003) topic for additional information. +- Remote TCP Port 9004 is opened for outbound connections on the audited computers. See the + [Open Remote TCP Port 9004](#open-remote-tcp-port-9004) topic for additional information. ## Check the Windows Services Status @@ -35,7 +37,7 @@ its status is _"Started"_ (on pre-Windows Server 2012 versions) and _"Running"_ service. In the **Remote Registry Properties** dialog, in the **General** tab, select _"Automatic"_ from the dropdown list. -**Step 4 –** Perform the steps above for the **Windows Management Instrumentation** service. +**Step 4 –** Repeat these steps for the **Windows Management Instrumentation** service. ## Windows Features Communication @@ -61,7 +63,7 @@ settings** on the left. **Step 3 –** In the Windows Firewall with Advanced Security dialog, select Inbound Rules on the left. -**Step 4 –** Click New Rule. In the New Inbound Rule wizard, complete the steps as described below: +**Step 4 –** Click New Rule. In the New Inbound Rule wizard, complete the following steps: - On the Rule Type step, select Program. - On the Program step, specify the path: %Netwrix Auditor installation folder%/Netwrix Auditor/User @@ -72,7 +74,7 @@ left. **Step 5 –** Double-click the newly created rule and open the Protocols and Ports tab. -**Step 6 –** In the Protocols and Ports tab, complete the steps as described below: +**Step 6 –** In the Protocols and Ports tab, complete the following steps: - Set Protocol type to _"TCP"_. - Set Local port to _"Specific Ports"_ and specify to _"9004"_. @@ -88,7 +90,7 @@ settings** on the left. **Step 3 –** In the Windows Firewall with Advanced Security dialog, select Inbound Rules on the left. -**Step 4 –** Click New Rule. In the New Inbound Rule wizard, complete the steps as described below. +**Step 4 –** Click New Rule. In the New Inbound Rule wizard, complete the following steps. | Option | Setting | | --------- | ---------------------------------------------------------------------------------------------------------------------------------- | @@ -100,7 +102,7 @@ left. **Step 5 –** Double-click the newly created rule and open the Protocols and Ports tab. -**Step 6 –** In the Protocols and Ports tab, complete the steps as described below: +**Step 6 –** In the Protocols and Ports tab, complete the following steps: - Set Protocol type to _"TCP"_. - Set Local port to _"Specific Ports"_ and specify to _"9003"_. @@ -116,7 +118,7 @@ settings** on the left. **Step 3 –** In the Windows Firewall with Advanced Security dialog, select Outbound Rules on the left. -**Step 4 –** Click New Rule. In the New Outbound Rule wizard, complete the steps as described below. +**Step 4 –** Click New Rule. In the New Outbound Rule wizard, complete the following steps. | Option | Setting | | --------- | ---------------------------------------------------------------------------------------------------------------------------------- | @@ -128,7 +130,7 @@ left. **Step 5 –** Double-click the newly created rule and open the Protocols and Ports tab. -**Step 6 –** In the Protocols and Ports tab, complete the steps as described below: +**Step 6 –** In the Protocols and Ports tab, complete the following steps: - Set Protocol type to _"TCP"_. - Set Remote port to _"Specific Ports"_ and specify to _"9004"_. diff --git a/docs/auditor/10.7/configuration/useractivity/overview.md b/docs/auditor/10.7/configuration/useractivity/overview.md index ad4b0b0e1a..13f9438104 100644 --- a/docs/auditor/10.7/configuration/useractivity/overview.md +++ b/docs/auditor/10.7/configuration/useractivity/overview.md @@ -9,10 +9,10 @@ sidebar_position: 120 Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and access auditing requires a certain configuration of native audit settings in the audited environment and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data -integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data. +certain built-in Windows services, etc. Proper audit configuration ensures audit data integrity. +Without it, your change reports may contain warnings, errors, or incomplete audit data. -**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See +**CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. @@ -21,10 +21,10 @@ You can use group Managed Service Accounts (gMSA) as data collecting accounts. You can configure your IT Infrastructure for monitoring in one of the following ways: -- Automatically through a monitoring plan – This is a recommended method. If you select to - automatically configure audit in the target environment, your current audit settings will be - checked on each data collection and adjusted if necessary. -- Manually – Native audit settings must be adjusted manually to ensure collecting comprehensive and +- Automatically through a monitoring plan – Netwrix recommends this method. If you select to + automatically configure audit in the target environment, Auditor checks your current audit + settings on each data collection and adjusts them if necessary. +- Manually – You must adjust native audit settings manually to ensure collecting comprehensive and reliable audit data. You can enable Auditor to continually enforce the relevant audit policies or configure them manually: @@ -36,8 +36,9 @@ You can configure your IT Infrastructure for monitoring in one of the following must be allowed to communicate through the Windows Firewall. - Local TCP Port 9003 must be opened for inbound connections. - Remote TCP Port 9004 must be opened for outbound connections. - - The User Activity Core Service is installed on the monitored computers. See the Install - Netwrix Auditor Agent to Audit User Activity topic for additional information. + - The User Activity Core Service must be installed on the monitored computers. See the + [Install for User Activity Core Service](/docs/auditor/10.7/install/useractivitycoreservice.md) + topic for additional information. - .NET 4.8 must be installed. - On the Netwrix Auditor host system/server: @@ -53,28 +54,31 @@ See the following topics for additional information: - [Configure Data Collection Settings](/docs/auditor/10.7/configuration/useractivity/datacollection.md) - [Configure Video Recordings Playback Settings](/docs/auditor/10.7/configuration/useractivity/videorecordings.md) +- [Install for User Activity Core Service](/docs/auditor/10.7/install/useractivitycoreservice.md) ## User Sessions Review a full list of all session actions when auditing user sessions with Netwrix Auditor. -| Object type | Action | What | Description | -| --------------------------- | -------------------------------- | ----------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------- | -| User session | Session start | Monitoring start | - Logon (session creation) - Start of monitoring (after service install or deploy) | -| Session start | Local session start | — | | -| Session end | Sign-out | - User initiated sign-out / logoff | | -| Session end | Shutdown | - Computer shutdown - Service stop / crash (appears after one starts service again) | | -| Session start / Session end | Screensaver off / Screensaver on | — | | -| Session start / Session end | Unlock / Lock | — | | -| Session start | Console connection | - Connect locally to existing session | | -| Session end | Console disconnection | - Switch user - Remote connect to existing session | | -| Session start | Remote connection | - Connect through RDP | | -| Session end | Remote disconnection | - Disconnect in RDP or just close RDP session | | +Netwrix Auditor reports all of these actions under the **User session** object type. + +| Action | What | Description | +| ---------------------------- | --------------------------------- | -------------------------------------------------------------------------------------------------------- | +| Session start | Monitoring start |
  • Logon (session creation)
  • Start of monitoring (after service install or deploy)
| +| Session start | Local session start | — | +| Session end | Sign-out | User initiated sign-out / logoff | +| Session end | Shutdown |
  • Computer shutdown
  • Service stop / crash (appears after one starts service again)
| +| Session start / Session end | Screensaver off / Screensaver on | — | +| Session start / Session end | Unlock / Lock | — | +| Session start | Console connection | Connect locally to existing session | +| Session end | Console disconnection |
  • Switch user
  • Remote connect to existing session
| +| Session start | Remote connection | Connect through RDP | +| Session end | Remote disconnection | Disconnect in RDP or just close RDP session | ### Run As Monitoring Netwrix Auditor for User Activity can monitor programs executed under different user accounts. -Review the table below to discover how different "run as" scenarios are reflected in the product. +Review the following table to discover how the product reflects different "run as" scenarios. | Object type | Details | Description | | --------------- | ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------- | @@ -82,30 +86,3 @@ Review the table below to discover how different "run as" scenarios are reflecte | Window | Application Run As: `` | Standard user runs an application under credentials of another standard user. | | Elevated Window | Application Run As: `` | User runs program through Run As Administrator or Accepts UAC (User Account Control) elevation prompts. | | Elevated Window | None | Administrator needs to run the program with Run as Administrator enabled. Server Manager is one of the main examples for this case. | - -## Install Netwrix Auditor Agent to Audit User Activity - -By default, the agent is installed automatically on the audited computers upon the **New Managed -Object** wizard completion. If, for some reason, installation has failed, you must install the agent -manually on each of the audited computers. - -Before installing Netwrix Auditor agent to audit user activity, ensure that: - -- The audit settings are configured properly. -- The Data Processing Account has access to the administrative shares. - -**Step 1 –** Navigate to _%Netwrix Auditor Installation Folder%\User Activity Video Recording_ and -copy the UACoreSvcSetup.msi file to the audited computer. - -**NOTE:** This is the default location. However, it may be changed because users can move this -folder. - -**Step 2 –** Run the installation package. - -**Step 3 –** Follow the instructions of the setup wizard. When prompted, accept the license -agreement and specify the installation folder. - -**Step 4 –** On the Agent Settings page, specify the host server (i.e., the name of the computer -where Netwrix Auditor is installed) and the server TCP port. - -Netwrix Auditor agent is installed and ready to audit user activity. diff --git a/docs/auditor/10.7/configuration/useractivity/ports.md b/docs/auditor/10.7/configuration/useractivity/ports.md index 8834d40722..d3e2ac93a7 100644 --- a/docs/auditor/10.7/configuration/useractivity/ports.md +++ b/docs/auditor/10.7/configuration/useractivity/ports.md @@ -21,9 +21,9 @@ allow inbound connections to local 9004 TCP port. | -------------------- | -------- | ---------------------- | ---------------------- | ---------------------------------------------------------------------------------------------- | | 9004 | TCP | Monitored computer | Netwrix Auditor Server | Network Traffic Compression Service communications | | 9003 | TCP | Netwrix Auditor Server | Monitored computer | Network Traffic Compression Service communications | -| 139 445 | TCP | Netwrix Auditor Server | Monitored computer | Service Control Manager Remote Protocol (RPC) Remote registry | +| 139, 445 | TCP | Netwrix Auditor Server | Monitored computer | Service Control Manager Remote Protocol (RPC) Remote registry | | Dynamic: 1024 -65535 | TCP | Netwrix Auditor Server | Monitored computer | Windows Management Instrumentation | -| 135 | TCP | Netwrix Auditor Server | Monitored computer | Service Control Manager Remote Protocol (RPC) Network Traffic Compression Service installation | -| 137 through 139 | UDP | Netwrix Auditor Server | Monitored computer | Service Control Manager Remote Protocol (RPC) Network Traffic Compression Service installation | +| 135 | TCP | Netwrix Auditor Server | Monitored computer | Service Control Manager Remote Protocol (RPC) — Network Traffic Compression Service installation | +| 137 through 139 | UDP | Netwrix Auditor Server | Monitored computer | Service Control Manager Remote Protocol (RPC) — Network Traffic Compression Service installation | | 445 | TCP | Netwrix Auditor Server | Monitored computer | SMB 2.0/3.0 Video files copy | | – | ICMP | Netwrix Auditor Server | Monitored computer | Network Traffic Compression Service communications | diff --git a/docs/auditor/10.7/configuration/useractivity/videorecordings.md b/docs/auditor/10.7/configuration/useractivity/videorecordings.md index dd9cbd95b1..45bc13be85 100644 --- a/docs/auditor/10.7/configuration/useractivity/videorecordings.md +++ b/docs/auditor/10.7/configuration/useractivity/videorecordings.md @@ -6,47 +6,48 @@ sidebar_position: 30 # Configure Video Recordings Playback Settings -Video recordings of users' activity can be watched in any Netwrix Auditor client. Also, recordings +You can watch video recordings of users' activity in any Netwrix Auditor client. Also, recordings are available as links in web-based reports and email-based Activity Summaries. You can use group Managed Service Accounts (gMSA) as data collecting accounts. -To be able to watch video files captured by Netwrix Auditor via console, the following settings must -be configured: +To watch video files captured by Netwrix Auditor via console, configure the following settings: - The user must have read permissions (resultant set) to the **Netwrix_UAVR$** shared folder where video files are stored. By default, all members of the **Netwrix Auditor Client Users** group can - access this shared folder. Both the group and the folder are created automatically by Netwrix - Auditor. Ensure to grant sufficient permissions on folder or explicitly add user to the group - (regardless his or her role delegated in the product). See the To Add an Account to Netwrix - Auditor Client Users Group topic for additional information. -- A dedicated codec must be installed. This codec is installed automatically on the computer where - Netwrix Auditor is deployed, and on the monitored computers. To install it on a different + access this shared folder. Netwrix Auditor creates both the group and the folder automatically. + Grant sufficient permissions on the folder or explicitly add the user to the group, regardless of + the role delegated to them in the product. See the + [To Add an Account to Netwrix Auditor Client Users Group](#to-add-an-account-to-netwrix-auditor-client-users-group) + topic for additional information. +- A dedicated codec must be installed. Netwrix Auditor installs this codec automatically on the + computer where you deploy it, and on the monitored computers. To install it on a different computer, download it from [https://www.netwrix.com/download/ScreenPressorNetwrix.zip](https://www.netwrix.com/download/ScreenPressorNetwrix.zip). - The Ink and Handwriting Services, Media Foundation, and Desktop Experience Windows features must be installed on the computer where Netwrix Auditor Server is deployed. These features allow - enabling Windows Media Player and sharing video recordings via DLNA. See the To Enable Windows - Features topic for additional information. + enabling Windows Media Player and sharing video recordings via DLNA. See the + [To Enable Windows Features](#to-enable-windows-features) topic for additional information. -To be able to watch video files captured by Netwrix Auditor via direct links, the following settings -must be configured: +To watch video files captured by Netwrix Auditor via direct links, configure the following settings: - Microsoft Internet Explorer 7.0 and above must be installed and ActiveX must be enabled. -- Internet Explorer security settings must be configured properly. See the To Configure Internet - Explorer Security Settings topic for additional information. -- JavaScript must be enabled. See the To Enable JavaScript topic for additional information. -- Internet Explorer Enhanced Security Configuration (IE ESC) must be disabled. See the To Disable - Internet Explorer Enhanced Security Configuration (IE ESC) topic for additional information. - -All Internet Explorer-related settings are relevant only for those who watch videos not in Netwrix -Auditor console. - -**NOTE:** Microsoft is in the process of deprecating Internet Explorer. However, if you are trying -to access the video recordings from browser via direct links (reports on SSRS portal, subscriptions, -activity summaries, search export results), IE engine should be present on the client machine. IE -might be disabled with GPO, but it shouldn't be removed completely. Recommended option is to use -Edge with "IE mode" option enabled. +- Internet Explorer security settings must be configured properly. See the + [To Configure Internet Explorer Security Settings](#to-configure-internet-explorer-security-settings) + topic for additional information. +- JavaScript must be enabled. See the [To Enable JavaScript](#to-enable-javascript) topic for + additional information. +- Internet Explorer Enhanced Security Configuration (IE ESC) must be disabled. See the + [To Disable Internet Explorer Enhanced Security Configuration (IE ESC)](#to-disable-internet-explorer-enhanced-security-configuration-ie-esc) + topic for additional information. + +All Internet Explorer-related settings are relevant only for those who watch videos outside the +Netwrix Auditor console. + +**NOTE:** Microsoft is deprecating Internet Explorer. However, if you access the video recordings +from a browser via direct links (reports on SSRS portal, subscriptions, activity summaries, search +export results), the IE engine must be present on the client machine. You can disable IE with GPO, +but don't remove it completely. Netwrix recommends using Edge with the "IE mode" option enabled. ## To Configure Internet Explorer Security Settings @@ -82,7 +83,7 @@ disable it. ## To Add an Account to Netwrix Auditor Client Users Group -All members of the Netwrix Auditor Client Users group are granted the Global reviewer role in Netwrix Auditor and have access to all collected data. +Netwrix Auditor grants all members of the Netwrix Auditor Client Users group the Global reviewer role and access to all collected data. **Step 1 –** On the computer where Netwrix Auditor Server is installed, start the Local Users and Computers snap-in. @@ -91,11 +92,11 @@ Computers snap-in. **Step 3 –** In the Netwrix Auditor Client Users Properties dialog, click **Add**. -**Step 4 –** Specify the users you want to be included in this group. +**Step 4 –** Specify the users you want to add to this group. ## To Enable Windows Features -Follow the steps if Netwrix Auditor Server is installed on the Windows Server 2012 and later. +Follow these steps if Netwrix Auditor Server runs on Windows Server 2012 or later. **Step 1 –** Navigate to **Start** > **Server Manager**. diff --git a/docs/auditor/10.7/configuration/windowsserver/advancedpolicy.md b/docs/auditor/10.7/configuration/windowsserver/advancedpolicy.md index 48af74f893..8a070da4e8 100644 --- a/docs/auditor/10.7/configuration/windowsserver/advancedpolicy.md +++ b/docs/auditor/10.7/configuration/windowsserver/advancedpolicy.md @@ -6,7 +6,7 @@ sidebar_position: 50 # Configure Advanced Audit Policies -Advanced audit policies can be configured instead of local policies. Any of them are required if you +You can configure advanced audit policies instead of local policies. Any of them are required if you want to get the "Who" and "When" values for the changes to the following monitored system components: @@ -22,7 +22,7 @@ components: ## Configure Security Options -Setting up both basic and advanced audit policies may lead to incorrect audit reporting. To force basic audit policies to be ignored and prevent conflicts, enable the _Audit: Force audit policy subcategory settings_ policy. +Setting up both basic and advanced audit policies may lead to incorrect audit reporting. To make Windows ignore basic audit policies and prevent conflicts, enable the _Audit: Force audit policy subcategory settings_ policy. **Step 1 –** On the audited server, open the Local Security Policy snap-in and navigate to Start > Windows Administrative Tools > Local Security Policy. @@ -34,55 +34,11 @@ Force audit policy subcategory settings policy. **Step 3 –** Double-click the policy and enable it. -## Configure Advanced Audit Policy on Windows Server 2016 +## Configure Advanced Audit Policy in Local Security Policy -In Windows Server 2016 audit policies aren't integrated with the Group Policies and can only be -deployed using logon scripts generated with the native Windows **auditpol.exe** command line tool. -Therefore, these settings aren't permanent and will be lost after server reboot. - -The procedure below explains how to configure Advanced audit policy for a single server. If you -audit multiple servers, you may want to create logon scripts and distribute them to all target -machines via Group Policy. Refer to the -[Create System Startup / Shutdown and User Logon / Logoff Scripts](https://technet.microsoft.com/en-us/library/dd630947.aspx) -Microsoft article for more information. - -**Step 1 –** On an audited server, navigate to Start > Run and type "cmd". - -**Step 2 –** Disable the Object Access, Account Management, and Policy Change categories by -executing the following command in the command line interface: - -``` -auditpol /set /category:"Object Access" /success:disable /failure:disable -auditpol /set /category:"Account Management" /success:disable /failure:disable -auditpol /set /category:"Policy Change" /success:disable /failure:disable -``` - -**Step 3 –** Enable the following audit subcategories: - -| Audit subcategory | Command | -| -------------------------- | ------------------------------------------------------------------------------------------ | -| Security Group Management | `auditpol /set /subcategory:"Security Group Management" /success:enable /failure:disable` | -| User Account Management | `auditpol /set /subcategory:"User Account Management" /success:enable /failure:disable` | -| Handle Manipulation | `auditpol /set /subcategory:"Handle Manipulation" /success:enable /failure:disable` | -| Other Object Access Events | `auditpol /set /subcategory:"Other Object Access Events" /success:enable /failure:disable` | -| Registry | `auditpol /set /subcategory:"Registry" /success:enable /failure:disable` | -| File Share | `auditpol /set /subcategory:"File Share" /success:enable /failure:disable` | -| Audit Policy Change | `auditpol /set /subcategory:"Audit Policy Change" /success:enable /failure:disable` | - -It is recommended to disable all other subcategories unless you need them for other purposes. You -can check your current effective settings by executing the following commands: - -``` -auditpol /set /category:"Object Access"  -auditpol /set /category:"Account Management"  -auditpol /set /category:"Policy Change"  -``` - -## Configure Advanced Audit Policy on Windows Server 2016 and Above - -In Windows Server 2016 and above, Advanced audit policies are integrated with Group Policies, so -they can be applied via Group Policy Object or Local Security Policies. The procedure below -describes how to apply Advanced policies via Local Security Policy console. +Advanced audit policies integrate with Group Policies, so you can apply them via Group Policy +Object or Local Security Policies. The following procedure describes how to apply Advanced policies +via the Local Security Policy console. **Step 1 –** On the audited server, open the **Local Security Policy** snap-in and navigate to Start > Windows Administrative Tools >Local Security Policy. diff --git a/docs/auditor/10.7/configuration/windowsserver/eventlog.md b/docs/auditor/10.7/configuration/windowsserver/eventlog.md index f9c2734919..1671a925f9 100644 --- a/docs/auditor/10.7/configuration/windowsserver/eventlog.md +++ b/docs/auditor/10.7/configuration/windowsserver/eventlog.md @@ -6,8 +6,8 @@ sidebar_position: 60 # Adjusting Event Log Size and Retention Settings -Consider that if the event log size is insufficient, overwrites may occur before data is written to -the Long-Term Archive and the Audit Database, and some audit data may be lost. +Consider that if the event log size is insufficient, overwrites may occur before the product writes +data to the Long-Term Archive and the Audit Database, and you may lose some audit data. To prevent overwrites, you can increase the maximum size of the event logs and set retention method for these logs to "_Overwrite events as needed_". This refers to the following event logs: @@ -16,16 +16,17 @@ for these logs to "_Overwrite events as needed_". This refers to the following e - Security - Setup - System -- Applications and Services logs > Microsoft>Windows > TaskScheduler > Operational +- Applications and Services logs > Microsoft > Windows > TaskScheduler > Operational - Applications and Services logs > Microsoft > Windows > DNS-Server > Audit (only for DCs running Windows Server 2012 R2 and above) - Applications and Services logs > AD FS > Admin log (for AD FS servers ) See the Microsoft article on [recommended event log settings](https://support.microsoft.com/en-us/help/957662/recommended-settings-for-event-log-sizes-in-windows) for more information. -The procedure below provides a possible way to specify the event log settings manually. However, if -you have multiple target computers, consider configuring these settings via Group Policy as also -described in this section +The following procedure provides a possible way to specify the event log settings manually. However, +if you have multiple target computers, consider configuring these settings via Group Policy as +described in +[Configure the Event Log Size Using Group Policy](#configure-the-event-log-size-using-group-policy). ## Configure the Event Log Size Manually @@ -76,8 +77,7 @@ Configuration > Policies > Administrative Templates > Windows Components > Event **Step 2 –** Select the log you need. -**Step 3 –** Edit Specify the maximum log file size setting; the value is usually set to _4194240 -KB_. +**Step 3 –** Edit Specify the maximum log file size setting; the value is usually _4194240 KB_. **Step 4 –** Specify retention settings for the log; usually it is Overwrite as needed. @@ -92,7 +92,7 @@ HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Directory Service ![gpo_eventlog_regedit_thumb_0_0](/images/auditor/10.7/configuration/windowsserver/gpo_eventlog_regedit_thumb_0_0.webp) You can configure Group Policy Preferences to push registry changes to the target domain computers. -For the example above (Directory Service Log), perform the following steps. +For the preceding example (Directory Service Log), perform the following steps. **Step 1 –** In Group Policy Management Console on the domain controller go to **Computer > Preferences > Windows Settings > Registry**. diff --git a/docs/auditor/10.7/configuration/windowsserver/iis.md b/docs/auditor/10.7/configuration/windowsserver/iis.md index fd0786f0bc..9b51f3fafc 100644 --- a/docs/auditor/10.7/configuration/windowsserver/iis.md +++ b/docs/auditor/10.7/configuration/windowsserver/iis.md @@ -6,8 +6,8 @@ sidebar_position: 100 # Internet Information Services (IIS) -To be able to process Internet Information Services (IIS) events, you must enable the Remote -Registry service on the target computers. [Windows Server](/docs/auditor/10.7/configuration/windowsserver/overview.md) +To process Internet Information Services (IIS) events, you must enable the Remote +Registry service on the target computers. See [Enable Remote Registry](/docs/auditor/10.7/configuration/windowsserver/remoteregistry.md) for more information. To configure the Operational log size and retention method diff --git a/docs/auditor/10.7/configuration/windowsserver/overview.md b/docs/auditor/10.7/configuration/windowsserver/overview.md index 3ca8237750..e4909f8dfa 100644 --- a/docs/auditor/10.7/configuration/windowsserver/overview.md +++ b/docs/auditor/10.7/configuration/windowsserver/overview.md @@ -9,20 +9,20 @@ sidebar_position: 140 Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and access auditing requires a certain configuration of native audit settings in the audited environment and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data -integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data. +certain built-in Windows services, etc. Proper audit configuration ensures audit data integrity. +Without it, your change reports may contain warnings, errors, or incomplete audit data. -**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See +**CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. You can configure your IT Infrastructure for monitoring in one of the following ways: -- Automatically through a monitoring plan – This is a recommended method. If you select to - automatically configure audit in the target environment, your current audit settings will be - checked on each data collection and adjusted if necessary. -- Manually – Native audit settings must be adjusted manually to ensure collecting comprehensive and +- Automatically through a monitoring plan – Netwrix recommends this method. If you select to + automatically configure audit in the target environment, Auditor checks your current audit + settings on each data collection and adjusts them if necessary. +- Manually – You must adjust native audit settings manually to ensure collecting comprehensive and reliable audit data. You can enable Auditor to continually enforce the relevant audit policies or configure them manually: @@ -35,21 +35,16 @@ You can configure your IT Infrastructure for monitoring in one of the following - The Audit: Force audit policy subcategory settings (Windows 7 or later) security option must be enabled. - - For Windows Server 2008—The Object Access, Account Management, and Policy Change - categories must be disabled while the Security Group Management, User Account Management, - Handle Manipulation, Other Object Access Events, Registry, File Share, and Audit Policy - Change subcategories must be enabled for _"Success"_. - - For Windows Server 2008 R2 / Windows 7 and above—Audit Security Group Management, Audit - User Account Management, Audit Handle Manipulation, Audit Other Object Access Events, - Audit Registry, Audit File Share, and Audit Policy Change advanced audit policies - must be set to _"Success"_. + - Audit Security Group Management, Audit User Account Management, Audit Handle + Manipulation, Audit Other Object Access Events, Audit Registry, Audit File Share, and + Audit Policy Change advanced audit policies must be set to _"Success"_. - See the [Configure Local Audit Policies](/docs/auditor/10.7/configuration/windowsserver/localpolicy.md) topic and the [Configure Advanced Audit Policies](/docs/auditor/10.7/configuration/windowsserver/advancedpolicy.md) topic for additional information. - The following legacy audit policies can be configured instead of advanced: Audit object access, Audit policy change, and **Audit account management** must be set to _"Success"_. - - The Enable Persistent Time Stamp local group policy must be enabled. This policy should be - configured manually since Auditor doesn't enable it automatically. See the + - The Enable Persistent Time Stamp local group policy must be enabled. You must configure this + policy manually because Auditor doesn't enable it automatically. See the [Configure Enable Persistent Time Stamp Policy](/docs/auditor/10.7/configuration/windowsserver/persistenttimestamp.md) topic for additional information. - The Application, Security, and System event log maximum size must be set to 4 GB. The @@ -83,7 +78,7 @@ You can configure your IT Infrastructure for monitoring in one of the following - Performance Logs and Alerts (TCP-In) - If the audited servers are behind the Firewall, review the list of protocols and ports - required for Netwrix Auditor and ensure that these ports are opened. See the + required for Netwrix Auditor and ensure that these ports are open. See the [Windows Server Ports](/docs/auditor/10.7/configuration/windowsserver/ports.md) topic for additional information. - For auditing removable storage media, two Event Trace Session objects must be created. See the [Configure Removable Storage Media for Monitoring](/docs/auditor/10.7/configuration/windowsserver/removablestorage.md) topic for additional @@ -106,147 +101,138 @@ remember to do the following: 2. Configure required protocols and ports, as described in the [Windows Server Ports](/docs/auditor/10.7/configuration/windowsserver/ports.md) topic. -## Exclude Monitored Objects +## Windows Server Monitoring Scope -You can fine-tune Netwrix Auditor by specifying data that you want to exclude from the Windows Server monitoring scope. - -**Step 1 –** Navigate to the _%Netwrix Auditor installation folder%\Windows Server Auditing_ folder. - -**Step 2 –** Edit the \*.txt files, based on the following guidelines: - -- Each entry must be a separate line. -- Wildcards (\* and ?) are supported. A backslash (\) must be put in front of (\*), (?), (,), and - (\) if they are a part of an entry value. -- Lines that start with the # sign are treated as comments and are ignored. - -| File | Description | Syntax | -| ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| omitcollectlist.txt | Contains a list of objects and their properties to be excluded from being monitored. If you want to restart monitoring these objects, remove them from the omitcollectlist.txt and run data collection at least twice. | `monitoring plan name,server name,class name,property name,property value` `class name` is a mandatory parameter, it can't be replaced with a wildcard. `property name` and `property value` are optional, but can't be replaced with wildcards either. For example: `#*,server,MicrosoftDNS_Server `````` #*,*,StdServerRegProv` | -| omiterrors.txt | Contains a list of errors/warnings to be omitted from logging to the Netwrix Auditor System Health event log. | `monitoring plan name,server name,error text` For example: `*,productionserver1.corp.local,*Access is denied*` | -| omitreportlist.txt | Contains a list of objects to be excluded from reports and Activity Summary emails. In this case audit data is still being collected. | `monitoring plan name,who,where,object type,what,property name` For example: `*,CORP\\jsmith,*,*,*,*` | -| omitsitcollectlist.txt | Contains a list of objects to be excluded from State-in-time reports. | `monitoring planname,server name,class name,property name,property value` `class name` is a mandatory parameter, it can't be replaced with a wildcard. `property name` and `property value` are optional, but can't be replaced with wildcards either. For example: `*,server,MicrosoftDNS_Server` `*,*,StdServerRegProv` | -| omitstorelist.txt | Contains a list of objects to be excluded from being stored to the Audit Archive and showing up in reports. In this case audit data is still being collected. | `monitoring plan name,who,where,object type,what,property name` For example: `*,*,*,Scheduled task,Scheduled Tasks\\User_Feed_Synchronization*,*` | +You can fine-tune Netwrix Auditor by specifying data that you want to exclude from the Windows Server +monitoring scope. See the +[Windows Server Monitoring Scope](/docs/auditor/10.7/admin/monitoringplans/windows/scope.md) topic for +additional information. ## Monitored Objects This section lists Windows Server components and settings whose changes Netwrix Auditor can monitor. -When monitoring a Windows Server, Netwrix Auditor needs to audit some registry settings. See the -Windows Server Registry Keys section for additional information. If you want Netwrix Auditor to -audit custom registry keys, see the Monitoring Custom Registry KeysMonitoring Custom Registry -Keystopic for additional information. - -In the table below, double asterisks (\*\*) indicates the components and settings for which the Who -value is reported as _“Not Applicable”_. - -| Object type | Attributes | -| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| General Computer Settings | | -| Computer |
  • System state changed to Started
  • System state changed to Stopped. Reason: Reason type
  • System state changed to Stopped. Reason: unexpected shutdown or system failure
| -| Computer Name |
  • Computer Description
  • Name
  • Domain
| -| Environment Variables |
  • Type
  • Value
| -| Event Log |
  • Event Log Cleared
| -| General |
  • Caption
  • Organization
  • Registered User
  • Serial Number
  • Service Pack\*\*
  • Version\*\*
| -| Remote |
  • Enable Remote Desktop on this computer
| -| Startup and Recovery |
  • Automatically Restart
  • Dump File
  • Dump Type
  • Overwrite any existing file
  • Send Alert
  • System Startup Delay
  • Write an Event
| -| System Time |
  • System time changed from ... to ...
  • Time zone changed Not supported on Windows Server 2008 SP2 and Windows Server 2008 R2.
| -| Add / Remove Programs | | -| Add or Remove Programs |
  • Installed For\*\*
  • Version
| -| Services | | -| System Service |
  • Action in case of failed service startup
  • Action in case of service stopping
  • Allow service to interact with desktop
  • Caption
  • Created
  • Deleted
  • Description
  • Name
  • Path to executable
  • Service Account
  • Service Type
  • Start Mode
  • Error Control
| -| Audit Policies | | -| Local Audit Policy |
  • Added Audit settings Only for the Global Object Access Auditing advanced policies.
  • Successful audit enabled/disabled
  • Failure audit enabled/disabled
| -| Per-User Local Audit Policy |
  • Success audit include added
  • Success audit include removed
  • Failure audit include added
  • Failure audit include removed
  • Success audit exclude added
  • Success audit exclude removed
  • Failure audit exclude added
  • Failure audit exclude remove
| -| Hardware | | -| Base Board\*\* |
  • Hosting Board
  • Status
  • Manufacturer
  • Product
  • Version
  • Serial Number
| -| BIOS\*\* |
  • Manufacturer
  • Version
| -| Bus\*\* |
  • Bus Type
  • Status
| -| Cache Memory\*\* |
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Purpose
  • Status
| -| CD-ROM Drive\*\* |
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Media Type
  • Name
  • SCSI Bus
  • SCSI Logical Unit
  • SCSI Port
  • SCSI Target ID
  • Status
| -| Disk Partition\*\* |
  • Primary Partition
  • Size (bytes)
  • Starting offset (bytes)
| -| Display Adapter\*\* |
  • Adapter RAM (bytes)
  • Adapter Type
  • Bits/Pixel
  • Configuration Manager Error Code
  • Driver Version
  • Installed Drivers
  • Last Error Description
  • Last Error Code
  • Refresh Rate
  • Resolution
  • Status
| -| DMA\*\* |
  • Status
| -| Floppy Drive\*\* |
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Status
| -| Hard Drive\*\* |
  • Bytes/Sector
  • Configuration Manager Error Code
  • Interface Type
  • Last Error Description
  • Last Error Code
  • Media Loaded
  • Media Type
  • Model
  • Partitions
  • SCSI Bus
  • SCSI Logical Unit
  • SCSI Port
  • SCSI Target ID
  • Sectors/Track
  • Size (bytes)
  • Status
  • Total Cylinders
  • Total Heads
  • Total Sectors
  • Total Tracks
  • Tracks/Cylinder
| -| IDE\*\* |
  • Configuration Manager Error Code
  • Description
  • Last Error Description
  • Last Error Code
  • Status
| -| Infrared\*\* |
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Status
| -| Keyboard\*\* |
  • Configuration Manager Error Code
  • Description
  • Last Error Description
  • Last Error Code
  • Layout
  • Name
  • Status
| -| Logical Disk\*\* |
  • Description
  • File System
  • Size (bytes)
  • Status
| -| Monitor\*\* |
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Monitor Type
  • Status
| -| Network Adapter |
  • Adapter Type \*
  • Configuration Manager Error Code
  • Default IP Gateway \*
  • DHCP Enabled\*
  • DHCP Server
  • DNS Server Search Order
  • IP Address \*
  • Last Error Description
  • Last Error Code
  • MAC Address
  • Network Connection Name
  • Network Connection Status
  • Service Name
  • Status \* — indicates the properties whose changes may not be reported correctly, displaying "_Who_" (i.e. initiator's account) as _System_.
| -| Network Protocol\*\* |
  • Description
  • Status
| -| Parallel Ports\*\* |
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Status
| -| PCMCIA Controller\*\* |
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Status
| -| Physical Memory\*\* |
  • Capacity (bytes)
  • Status
  • Manufacturer
  • Memory Type
  • Speed
  • Part Number
  • Serial Number
| -| Pointing Device\*\* |
  • Configuration Manager Error Code
  • Double Click Threshold
  • Handedness
  • Hardware Type
  • Last Error Description
  • Last Error Code
  • Number of buttons
  • Status
| -| Printing |
  • Comment\*\*
  • Hidden\*\*
  • Local\*\*
  • Location\*\*
  • Name\*\*
  • Network\*\*
  • Port Name\*\*
  • Printer error information
  • Published\*\*
  • Shared\*\*
  • Share Name\*\*
  • Status
| -| Processor\*\* |
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Max Clock Speed (MHz)
  • Name
  • Status
| -| SCSI\*\* |
  • Configuration Manager Error Code
  • Description
  • Last Error Description
  • Last Error Code
  • Status
| -| Serial Ports\*\* |
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Maximum Bits/Second
  • Name
  • Status
| -| Sound Device\*\* |
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Status
| -| System Slot\*\* |
  • Slot Designation
  • Status
| -| USB Controller\*\* |
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Name
  • Status
| -| USB Hub\*\* |
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Name
  • Status
| -| DHCP configuration | | -| If the DHCP server runs on Windows Server 2008 (or below), then the Who value for DHCP server configuration events is reported as _“Not Applicable”_. | | -| Server role |
  • Added
  • Removed
| -| Server settings |
  • Type:
  • IPv4
  • IPv4 Filters
  • IPv6
  • Action:
  • Modified
| -| DHCP scope |
  • Type:
  • IPv4
  • Multicast IPv4
  • Superscope for IPv4
  • IPv6
  • Action:
  • Added
  • Removed
  • Modified
  • Moved
| -| DHCP Reservation |
  • Type:
  • IPv4
  • IPv6
  • Action:
  • Added
  • Removed
  • Modified
| -| DHCP Policy |
  • Type:
  • IPv4
  • IPv4 server-wide
  • Action:
  • Added
  • Removed
  • Modified
  • Renamed
| -| Removable media | | -| Removable Storage Media\*\* | Netwrix Auditor doesn't report on floppy/optical disk and memory card storage medias. For removable storages, the When value reports actual time when a change was made and/or a target server was started.
  • Device class:
  • CD and DVD
  • Floppy Drives
  • Removable Disk
  • Tape Drives
  • Windows Portable Devices When the Audit Object Access local audit policy and/or the Audit Central Access Policy Staging \ Audit Removable Storage advanced audit policies are enabled on the target server, the `gpupdate /force` command execution issues removable storage restart. These actions are disclosed in Netwrix Auditor reports, search, and activity summaries. These actions are system-generated, not user-initiated.
| -| Scheduled Tasks | | -| Scheduled Task |
  • Account Name
  • Application
  • Comment
  • Creator
  • Enabled
  • Parameters
  • Triggers
| -| Local Users and Groups | | -| Local Group |
  • Description
  • Name
  • Members
| -| Local User |
  • Description
  • Disabled/Enabled
  • Full Name
  • Name
  • User can't change password
  • Password Never Expires
  • User must change password at next logon
| -| DNS Configuration | | -| The Who value will be reported for DNS configuration settings only if the DNS server runs on Windows Server 2012 R2. See the following Microsoft article for additional information: [Update adds query logging and change auditing to Windows DNS servers](https://support.microsoft.com/en-us/kb/2956577). | | -| DNS Server |
  • Address Answer Limit
  • Allow Update
  • Auto Cache Update
  • Auto Config File Zones
  • Bind Secondaries
  • Boot Method
  • Default Aging State
  • Default No Refresh Interval
  • Default Refresh Interval
  • Disable Auto Reverse Zones
  • Disjoint Nets
  • Ds Available
  • Ds Polling Interval
  • Ds Tombstone Interval
  • EDns Cache Timeout
  • Enable Directory Partitions
  • Enable Dns Sec
  • Enable EDns Probes
  • CD-ROM D Enable Netmask Ordering
  • Event Log Level
  • Fail On Load If Bad Zone Data
  • Forward Delegations
  • Forwarders
  • Forwarding Timeout
  • Is Slave
  • Listen Addresses
  • Log File Max Size
  • Log File Path
  • Log Level
  • Loose Wildcarding
  • Max Cache TTL
  • Max Negative Cache TTL
  • Name Check Flag
  • No Recursion
  • Recursion Retry
  • Recursion Timeout
  • Round Robin
  • Rpc Protocol
  • Scavenging Interval
  • Secure Cache Against Pollution
  • Send Port
  • Server Addresses
| -| DNS Zone |
  • Aging State
  • Allow update
  • Auto created
  • Data file name
  • Ds integrated
  • Expires after
  • Forwarder slave
  • Forwarder timeout
  • Master servers
  • Minimum TTL
  • No refresh interval
  • Notify
  • Notify servers
  • Owner name
  • Paused
  • Primary server
  • Refresh interval
  • Responsible person
  • Retry interval
  • Reverse
  • Scavenge servers
  • Secondary servers
  • Secure secondaries
  • Shutdown
  • TTL
  • User NB stat
  • Use WINS
  • Zone type
| -| DNS Resource Records | | -| The Who value will be reported for DNS Resource Records only if the DNS server runs Windows Server 2012 R2. See the following Microsoft article for additional information: [Update adds query logging and change auditing to Windows DNS servers](https://support.microsoft.com/en-us/kb/2956577). | | -| DNS AAAA |
  • Container name
  • IPv6 Address
  • Owner name
  • Record class
  • TTL
  • Zone type
| -| DNS AFSDB |
  • Container name
  • Owner name
  • Server name
  • Server subtype
  • Record class
  • TTL
  • Zone type
| -| DNS ATM A |
  • ATM Address
  • Container name
  • Format
  • Owner name
  • Record class
  • TTL
  • Value
  • Zone type
| -| DNS A |
  • Container name
  • IP Address
  • Owner name
  • Record class
  • TTL
  • Zone type
| -| DNS CNAME |
  • Container name
  • FQDN for target host
  • Owner name
  • Record class
  • TTL
  • Zone type
| -| DNS DHCID |
  • Container name
  • DHCID (base 64)
  • Owner name
  • Record class
  • TTL
  • Zone type
| -| DNS DNAME |
  • Container name
  • FQDN for target domain
  • Owner name
  • Record class
  • TTL
  • Zone type
| -| DNS DNSKEY |
  • Algorithm
  • Container name
  • Key type
  • Key (base 64)
  • Name type
  • Owner name
  • Protocol
  • Record class
  • Signatory field
  • TTL
  • Zone type
| -| DNS DS |
  • Algorithm
  • Container name
  • Data
  • DigestType
  • Key tag
  • Owner name
  • Record class
  • TTL
  • Zone type
| -| DNS HINFO |
  • Container name
  • CPU type
  • Operating system
  • Owner name
  • Record class
  • TTL
  • Zone type
| -| DNS ISDN |
  • Container name
  • ISDN phone number and DDI
  • ISDN subaddress
  • Owner name
  • Record class
  • TTL
  • Zone type
| -| DNS KEY |
  • Algorithm
  • Container name
  • Key type
  • Key (base 64)
  • Name type
  • Owner name
  • Protocol
  • Record class
  • Signatory field
  • TTL
  • Zone type
| -| DNS MB\*\*\* |
  • Container name
  • Mailbox host
  • Owner name
  • Record class
  • TTL
  • Zone type
| -| DNS MD |
  • Container name
  • MD host
  • Owner name
  • Record class
  • TTL
  • Zone type
| -| DNS MF |
  • Container name
  • MF host
  • Owner name
  • Record class
  • TTL
  • Zone type
| -| DNS MG |
  • Container name
  • Member mailbox
  • Owner name
  • Record class
  • TTL
  • Zone type
| -| DNS MINFO |
  • Container name
  • Error mailbox
  • Owner name
  • Responsible mailbox
  • Record class
  • TTL
  • Zone type
| -| DNS MR |
  • Container name
  • Owner name
  • Replacement mailbox
  • Record class
  • TTL
  • Zone type
| -| DNS MX |
  • Container name
  • FQDN of mail server
  • Mail server priority
  • Owner name
  • Record class
  • TTL
  • Zone type
| -| DNS NAPTR |
  • Container name
  • Flag string
  • Order
  • Owner name
  • Preference
  • Record class
  • Regular expression string
  • Replacement domain
  • Service string
  • TTL
  • Zone type
| -| DNS NS |
  • Container name
  • Name servers
  • Owner name
  • TTL
| -| DNS NXT |
  • Container name
  • Next domain name
  • Owner name
  • Record class
  • Record types
  • TTL
  • Zone type
| -| DNS PTR |
  • Container name
  • Owner name
  • PTR domain name
  • Record class
  • TTL
  • Zone type
| -| DNS RP |
  • Container name
  • Mailbox of responsible person
  • Optional associated text (TXT) record
  • Owner name
  • Record class
  • TTL
  • Zone type
| -| DNS RRSIG |
  • Algorithm
  • Container name
  • Key tag
  • Labels
  • Original TTL
  • Owner name
  • Record class
  • Signature expiration (GMT)
  • Signature inception (GMT)
  • Signature (base 64)
  • Signer's name
  • TTL
  • Type covered
  • Zone type
| -| DNS RT |
  • Container name
  • Intermediate host
  • Owner name
  • Preference
  • Record class
  • TTL
  • Zone type
| -| DNS SIG |
  • Algorithm
  • Container name
  • Key tag
  • Labels
  • Original TTL
  • Owner name
  • Record class
  • Signature expiration (GMT)
  • Signature inception (GMT)
  • Signature (base 64)
  • Signer's name
  • TTL
  • Type covered
  • Zone type
| -| DNS SRV |
  • Container name
  • Host offering this service
  • Owner name
  • Port number
  • Priority
  • Record class
  • TTL
  • Weight
  • Zone type
| -| DNS TEXT |
  • Container name
  • Owner name
  • Record class
  • Text
  • TTL
  • Zone type
| -| DNS WINS |
  • Cache time-out
  • Container name
  • Don't replicate this record
  • Lookup time-out
  • Owner name
  • Record class
  • Wins servers
  • Zone type
| -| DNS WKS |
  • Container name
  • IP address
  • Owner name
  • Protocol
  • Record class
  • Services
  • TTL
  • Zone type
| -| DNS X25 |
  • Container name
  • Owner name
  • Record
  • Record class
  • TTL
  • X.121 PSDN address
  • Zone type
| -| File Shares | | -| Share |
  • Access-based enumeration
  • Caching
  • Description
  • Enable BranchCache
  • Encrypt data access
  • Folder path
  • Share permissions
  • User limit
| +When monitoring a Windows Server, Netwrix Auditor needs to audit some registry settings. See +[Windows Server Registry Keys](#windows-server-registry-keys) for additional information. If you +want Netwrix Auditor to audit custom registry keys, see +[Monitoring Custom Registry Keys](#monitoring-custom-registry-keys) for additional information. + +The following table has three levels: a **Component** is a system component you enable for +auditing in the monitoring plan (see the Windows Server monitoring plan topic, Monitor changes to +system components, for a description of each component); each component contains one or more **Object types**, which +are the specific entities Netwrix Auditor tracks; and **Attributes** are the individual properties +of that object type whose changes Netwrix Auditor reports. + +Double asterisks (\*\*) indicate the object types and attributes for which Netwrix Auditor reports +the Who value as _“Not Applicable”_. + +| Component | Object type | Attributes | +| --- | --- | --- | +| General computer settings | Computer |
  • System state changed to Started
  • System state changed to Stopped. Reason: Reason type
  • System state changed to Stopped. Reason: unexpected shutdown or system failure
| +| | Computer Name |
  • Computer Description
  • Name
  • Domain
| +| | Environment Variables |
  • Type
  • Value
| +| | Event Log |
  • Event Log Cleared
| +| | General |
  • Caption
  • Organization
  • Registered User
  • Serial Number
  • Service Pack\*\*
  • Version\*\*
| +| | Remote |
  • Enable Remote Desktop on this computer
| +| | Startup and Recovery |
  • Automatically Restart
  • Dump File
  • Dump Type
  • Overwrite any existing file
  • Send Alert
  • System Startup Delay
  • Write an Event
| +| | System Time |
  • System time changed from ... to ...
  • Time zone changed
| +| Add/Remove programs | Add or Remove Programs |
  • Installed For\*\*
  • Version
| +| Services | System Service |
  • Action in case of failed service startup
  • Action in case of service stopping
  • Allow service to interact with desktop
  • Caption
  • Created
  • Deleted
  • Description
  • Name
  • Path to executable
  • Service Account
  • Service Type
  • Start Mode
  • Error Control
| +| Audit policies | Local Audit Policy |
  • Added Audit settings Only for the Global Object Access Auditing advanced policies.
  • Successful audit enabled/disabled
  • Failure audit enabled/disabled
| +| | Per-User Local Audit Policy |
  • Success audit include added
  • Success audit include removed
  • Failure audit include added
  • Failure audit include removed
  • Success audit exclude added
  • Success audit exclude removed
  • Failure audit exclude added
  • Failure audit exclude remove
| +| Hardware | Base Board\*\* |
  • Hosting Board
  • Status
  • Manufacturer
  • Product
  • Version
  • Serial Number
| +| | BIOS\*\* |
  • Manufacturer
  • Version
| +| | Bus\*\* |
  • Bus Type
  • Status
| +| | Cache Memory\*\* |
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Purpose
  • Status
| +| | CD-ROM Drive\*\* |
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Media Type
  • Name
  • SCSI Bus
  • SCSI Logical Unit
  • SCSI Port
  • SCSI Target ID
  • Status
| +| | Disk Partition\*\* |
  • Primary Partition
  • Size (bytes)
  • Starting offset (bytes)
| +| | Display Adapter\*\* |
  • Adapter RAM (bytes)
  • Adapter Type
  • Bits/Pixel
  • Configuration Manager Error Code
  • Driver Version
  • Installed Drivers
  • Last Error Description
  • Last Error Code
  • Refresh Rate
  • Resolution
  • Status
| +| | DMA\*\* |
  • Status
| +| | Floppy Drive\*\* |
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Status
| +| | Hard Drive\*\* |
  • Bytes/Sector
  • Configuration Manager Error Code
  • Interface Type
  • Last Error Description
  • Last Error Code
  • Media Loaded
  • Media Type
  • Model
  • Partitions
  • SCSI Bus
  • SCSI Logical Unit
  • SCSI Port
  • SCSI Target ID
  • Sectors/Track
  • Size (bytes)
  • Status
  • Total Cylinders
  • Total Heads
  • Total Sectors
  • Total Tracks
  • Tracks/Cylinder
| +| | IDE\*\* |
  • Configuration Manager Error Code
  • Description
  • Last Error Description
  • Last Error Code
  • Status
| +| | Infrared\*\* |
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Status
| +| | Keyboard\*\* |
  • Configuration Manager Error Code
  • Description
  • Last Error Description
  • Last Error Code
  • Layout
  • Name
  • Status
| +| | Logical Disk\*\* |
  • Description
  • File System
  • Size (bytes)
  • Status
| +| | Monitor\*\* |
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Monitor Type
  • Status
| +| | Network Adapter |
  • Adapter Type \*
  • Configuration Manager Error Code
  • Default IP Gateway \*
  • DHCP Enabled\*
  • DHCP Server
  • DNS Server Search Order
  • IP Address \*
  • Last Error Description
  • Last Error Code
  • MAC Address
  • Network Connection Name
  • Network Connection Status
  • Service Name
  • Status \* — indicates the properties whose changes may not be reported correctly, displaying "_Who_" (i.e. initiator's account) as _System_.
| +| | Network Protocol\*\* |
  • Description
  • Status
| +| | Parallel Ports\*\* |
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Status
| +| | PCMCIA Controller\*\* |
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Status
| +| | Physical Memory\*\* |
  • Capacity (bytes)
  • Status
  • Manufacturer
  • Memory Type
  • Speed
  • Part Number
  • Serial Number
| +| | Pointing Device\*\* |
  • Configuration Manager Error Code
  • Double Click Threshold
  • Handedness
  • Hardware Type
  • Last Error Description
  • Last Error Code
  • Number of buttons
  • Status
| +| | Printing |
  • Comment\*\*
  • Hidden\*\*
  • Local\*\*
  • Location\*\*
  • Name\*\*
  • Network\*\*
  • Port Name\*\*
  • Printer error information
  • Published\*\*
  • Shared\*\*
  • Share Name\*\*
  • Status
| +| | Processor\*\* |
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Max Clock Speed (MHz)
  • Name
  • Status
| +| | SCSI\*\* |
  • Configuration Manager Error Code
  • Description
  • Last Error Description
  • Last Error Code
  • Status
| +| | Serial Ports\*\* |
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Maximum Bits/Second
  • Name
  • Status
| +| | Sound Device\*\* |
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Status
| +| | System Slot\*\* |
  • Slot Designation
  • Status
| +| | USB Controller\*\* |
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Name
  • Status
| +| | USB Hub\*\* |
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Name
  • Status
| +| DHCP configuration | Server role |
  • Added
  • Removed
| +| | Server settings |
  • Type:
  • IPv4
  • IPv4 Filters
  • IPv6
  • Action:
  • Modified
| +| | DHCP scope |
  • Type:
  • IPv4
  • Multicast IPv4
  • Superscope for IPv4
  • IPv6
  • Action:
  • Added
  • Removed
  • Modified
  • Moved
| +| | DHCP Reservation |
  • Type:
  • IPv4
  • IPv6
  • Action:
  • Added
  • Removed
  • Modified
| +| | DHCP Policy |
  • Type:
  • IPv4
  • IPv4 server-wide
  • Action:
  • Added
  • Removed
  • Modified
  • Renamed
| +| Removable media | Removable Storage Media\*\* | Netwrix Auditor doesn't report on floppy/optical disk and memory card storage medias. For removable storages, the When value reports actual time when a change was made and/or a target server was started.
  • Device class:
  • CD and DVD
  • Floppy Drives
  • Removable Disk
  • Tape Drives
  • Windows Portable Devices When the Audit Object Access local audit policy and/or the Audit Central Access Policy Staging \ Audit Removable Storage advanced audit policies are enabled on the target server, the `gpupdate /force` command execution issues removable storage restart. These actions are disclosed in Netwrix Auditor reports, search, and activity summaries. These actions are system, not user-effected.
| +| Scheduled tasks | Scheduled Task |
  • Account Name
  • Application
  • Comment
  • Creator
  • Enabled
  • Parameters
  • Triggers
| +| Local users and groups | Local Group |
  • Description
  • Name
  • Members
| +| | Local User |
  • Description
  • Disabled/Enabled
  • Full Name
  • Name
  • User can't change password
  • Password Never Expires
  • User must change password at next logon
| + +:::note +Netwrix Auditor reports the Who value for DNS configuration settings only if the DNS server runs on Windows Server 2012 R2. See the following Microsoft article for additional information: [Update adds query logging and change auditing to Windows DNS servers](https://support.microsoft.com/en-us/kb/2956577). +::: + +| Component | Object type | Attributes | +| --- | --- | --- | +| DNS configuration | DNS Server |
  • Address Answer Limit
  • Allow Update
  • Auto Cache Update
  • Auto Config File Zones
  • Bind Secondaries
  • Boot Method
  • Default Aging State
  • Default No Refresh Interval
  • Default Refresh Interval
  • Disable Auto Reverse Zones
  • Disjoint Nets
  • Ds Available
  • Ds Polling Interval
  • Ds Tombstone Interval
  • EDns Cache Timeout
  • Enable Directory Partitions
  • Enable Dns Sec
  • Enable EDns Probes
  • CD-ROM D Enable Netmask Ordering
  • Event Log Level
  • Fail On Load If Bad Zone Data
  • Forward Delegations
  • Forwarders
  • Forwarding Timeout
  • Is Slave
  • Listen Addresses
  • Log File Max Size
  • Log File Path
  • Log Level
  • Loose Wildcarding
  • Max Cache TTL
  • Max Negative Cache TTL
  • Name Check Flag
  • No Recursion
  • Recursion Retry
  • Recursion Timeout
  • Round Robin
  • Rpc Protocol
  • Scavenging Interval
  • Secure Cache Against Pollution
  • Send Port
  • Server Addresses
| +| | DNS Zone |
  • Aging State
  • Allow update
  • Auto created
  • Data file name
  • Ds integrated
  • Expires after
  • Forwarder slave
  • Forwarder timeout
  • Master servers
  • Minimum TTL
  • No refresh interval
  • Notify
  • Notify servers
  • Owner name
  • Paused
  • Primary server
  • Refresh interval
  • Responsible person
  • Retry interval
  • Reverse
  • Scavenge servers
  • Secondary servers
  • Secure secondaries
  • Shutdown
  • TTL
  • User NB stat
  • Use WINS
  • Zone type
| + +:::note +Netwrix Auditor reports the Who value for DNS Resource Records only if the DNS server runs Windows Server 2012 R2. See the following Microsoft article for additional information: [Update adds query logging and change auditing to Windows DNS servers](https://support.microsoft.com/en-us/kb/2956577). +::: + +| Component | Object type | Attributes | +| --- | --- | --- | +| DNS resource records | DNS AAAA |
  • Container name
  • IPv6 Address
  • Owner name
  • Record class
  • TTL
  • Zone type
| +| | DNS AFSDB |
  • Container name
  • Owner name
  • Server name
  • Server subtype
  • Record class
  • TTL
  • Zone type
| +| | DNS ATM A |
  • ATM Address
  • Container name
  • Format
  • Owner name
  • Record class
  • TTL
  • Value
  • Zone type
| +| | DNS A |
  • Container name
  • IP Address
  • Owner name
  • Record class
  • TTL
  • Zone type
| +| | DNS CNAME |
  • Container name
  • FQDN for target host
  • Owner name
  • Record class
  • TTL
  • Zone type
| +| | DNS DHCID |
  • Container name
  • DHCID (base 64)
  • Owner name
  • Record class
  • TTL
  • Zone type
| +| | DNS DNAME |
  • Container name
  • FQDN for target domain
  • Owner name
  • Record class
  • TTL
  • Zone type
| +| | DNS DNSKEY |
  • Algorithm
  • Container name
  • Key type
  • Key (base 64)
  • Name type
  • Owner name
  • Protocol
  • Record class
  • Signatory field
  • TTL
  • Zone type
| +| | DNS DS |
  • Algorithm
  • Container name
  • Data
  • DigestType
  • Key tag
  • Owner name
  • Record class
  • TTL
  • Zone type
| +| | DNS HINFO |
  • Container name
  • CPU type
  • Operating system
  • Owner name
  • Record class
  • TTL
  • Zone type
| +| | DNS ISDN |
  • Container name
  • ISDN phone number and DDI
  • ISDN subaddress
  • Owner name
  • Record class
  • TTL
  • Zone type
| +| | DNS KEY |
  • Algorithm
  • Container name
  • Key type
  • Key (base 64)
  • Name type
  • Owner name
  • Protocol
  • Record class
  • Signatory field
  • TTL
  • Zone type
| +| | DNS MB\*\* |
  • Container name
  • Mailbox host
  • Owner name
  • Record class
  • TTL
  • Zone type
| +| | DNS MD |
  • Container name
  • MD host
  • Owner name
  • Record class
  • TTL
  • Zone type
| +| | DNS MF |
  • Container name
  • MF host
  • Owner name
  • Record class
  • TTL
  • Zone type
| +| | DNS MG |
  • Container name
  • Member mailbox
  • Owner name
  • Record class
  • TTL
  • Zone type
| +| | DNS MINFO |
  • Container name
  • Error mailbox
  • Owner name
  • Responsible mailbox
  • Record class
  • TTL
  • Zone type
| +| | DNS MR |
  • Container name
  • Owner name
  • Replacement mailbox
  • Record class
  • TTL
  • Zone type
| +| | DNS MX |
  • Container name
  • FQDN of mail server
  • Mail server priority
  • Owner name
  • Record class
  • TTL
  • Zone type
| +| | DNS NAPTR |
  • Container name
  • Flag string
  • Order
  • Owner name
  • Preference
  • Record class
  • Regular expression string
  • Replacement domain
  • Service string
  • TTL
  • Zone type
| +| | DNS NS |
  • Container name
  • Name servers
  • Owner name
  • TTL
| +| | DNS NXT |
  • Container name
  • Next domain name
  • Owner name
  • Record class
  • Record types
  • TTL
  • Zone type
| +| | DNS PTR |
  • Container name
  • Owner name
  • PTR domain name
  • Record class
  • TTL
  • Zone type
| +| | DNS RP |
  • Container name
  • Mailbox of responsible person
  • Optional associated text (TXT) record
  • Owner name
  • Record class
  • TTL
  • Zone type
| +| | DNS RRSIG |
  • Algorithm
  • Container name
  • Key tag
  • Labels
  • Original TTL
  • Owner name
  • Record class
  • Signature expiration (GMT)
  • Signature inception (GMT)
  • Signature (base 64)
  • Signer's name
  • TTL
  • Type covered
  • Zone type
| +| | DNS RT |
  • Container name
  • Intermediate host
  • Owner name
  • Preference
  • Record class
  • TTL
  • Zone type
| +| | DNS SIG |
  • Algorithm
  • Container name
  • Key tag
  • Labels
  • Original TTL
  • Owner name
  • Record class
  • Signature expiration (GMT)
  • Signature inception (GMT)
  • Signature (base 64)
  • Signer's name
  • TTL
  • Type covered
  • Zone type
| +| | DNS SRV |
  • Container name
  • Host offering this service
  • Owner name
  • Port number
  • Priority
  • Record class
  • TTL
  • Weight
  • Zone type
| +| | DNS TEXT |
  • Container name
  • Owner name
  • Record class
  • Text
  • TTL
  • Zone type
| +| | DNS WINS |
  • Cache time-out
  • Container name
  • Don't replicate this record
  • Lookup time-out
  • Owner name
  • Record class
  • Wins servers
  • Zone type
| +| | DNS WKS |
  • Container name
  • IP address
  • Owner name
  • Protocol
  • Record class
  • Services
  • TTL
  • Zone type
| +| | DNS X25 |
  • Container name
  • Owner name
  • Record
  • Record class
  • TTL
  • X.121 PSDN address
  • Zone type
| +| File shares | Share |
  • Access-based enumeration
  • Caching
  • Description
  • Enable BranchCache
  • Encrypt data access
  • Folder path
  • Share permissions
  • User limit
| ### Windows Server Registry Keys -If you want to monitor changes to system components on a Windows Server, ensure that Windows -Registry audit settings are configured on that Windows server. +If you want to monitor changes to system components on a Windows Server, ensure that you configure +Windows Registry audit settings on that Windows server. This refers to the following keys: @@ -263,7 +249,7 @@ type required): - Write DAC - Write Owner -The below is the full list of keys (and subkeys) involved in Windows Server auditing. +The following table lists all keys (and subkeys) involved in Windows Server auditing. | Category | Registry Keys | |----------------|-------------------------------------------------------------------------------------------------------------------| @@ -284,17 +270,17 @@ The below is the full list of keys (and subkeys) involved in Windows Server audi | RemovableMedia | - SYSTEM\CurrentControlSet\Enum\* | -Consider that audit data for the registry keys themselves will not appear in Netwrix Auditor reports, alerts, or search results, as it is only used as one of the sources for Activity Record formation. +Consider that audit data for the registry keys themselves will not appear in Netwrix Auditor reports, alerts, or search results, as the product uses it only as one of the sources for Activity Record formation. - You can configure these settings automatically using Netwrix Auditor, as described in the [Settings for Data Collection](/docs/auditor/10.7/admin/monitoringplans/create.md#settings-for-data-collection) - topic. Corresponding audit settings will be also applied automatically after you select a checkbox - under **Monitor changes to system components** on the **General** tab in the Windows Server data - source properties. + topic. The product also applies the corresponding audit settings automatically after you select a + checkbox under **Monitor changes to system components** on the **General** tab in the Windows + Server data source properties. -Audit settings will be automatically adjusted only for the keys/subkeys involved in the monitoring -of selected components (granular adjustment). For example, if you selected **Services**, the program -will adjust the audit settings for the following subkeys: +Netwrix Auditor automatically adjusts audit settings only for the keys/subkeys involved in the +monitoring of selected components (granular adjustment). For example, if you selected **Services**, +the program adjusts the audit settings for the following subkeys: - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services(|\\.\*) - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services(|\\.\*) @@ -321,9 +307,9 @@ For example: **Step 3 –** Consider the following: - Each entry must be a separate line. -- Wildcards (\* and ?) are supported (except for the `registry key name` field). A backslash (\) - must be put in front of (\*), (?), (,), and (\) if they are a part of an entry value. -- Lines that start with the # sign are treated as comments and are ignored. +- The product supports wildcards (\* and ?), except for the `registry key name` field. Put a backslash (\) + in front of (\*), (?), (,), and (\) if they are a part of an entry value. +- The product treats lines that start with the # sign as comments and ignores them. ![customregistrykey](/images/auditor/10.7/configuration/windowsserver/customregistrykey.webp) @@ -332,10 +318,10 @@ there is no necessary event in the Security log with this path. ## VM Template Cloning -While VM cloning is supported by Netwrix Auditor, an additional setup process should be taken into -consideration before the deployment process. +Netwrix Auditor supports VM cloning, but you must complete an additional setup process before +deployment. -Every monitored VM instance gets a unique ID assigned for monitoring and data collection purposes. To ensure proper operation, the VM template must be excluded from the monitoring scope beforehand. Omitting the VM template allows Netwrix Auditor to assign unique IDs correctly and collect data as intended. +Every monitored VM instance gets a unique ID assigned for monitoring and data collection purposes. To ensure proper operation, you must exclude the VM template from the monitoring scope beforehand. Omitting the VM template allows Netwrix Auditor to assign unique IDs correctly and collect data as intended. **Step 1 –** In main Netwrix Auditor menu, select **Monitoring plans**. @@ -349,4 +335,4 @@ the right pane. **Step 5 –** Check the **Exclude these objects** checkbox and add the template VM by clicking **Add Computer**. -VM template server is added to exclusions and ready to use. +The VM template server is now in the exclusions list and ready to use. diff --git a/docs/auditor/10.7/configuration/windowsserver/ports.md b/docs/auditor/10.7/configuration/windowsserver/ports.md index c4c67fddea..d50956bc02 100644 --- a/docs/auditor/10.7/configuration/windowsserver/ports.md +++ b/docs/auditor/10.7/configuration/windowsserver/ports.md @@ -19,7 +19,7 @@ inbound connections to local 139 TCP port. | Port | Protocol | Source | Target | Purpose | | -------------------------- | -------- | ------------------------------------------------------------------------------ | ---------------------- | ------------------------------------------------------------------------------------------------------------------- | -| 139 445 | TCP | Netwrix Auditor Server | Monitored computer | Service Control Manager Remote Protocol (RPC) Remote registry | +| 139, 445 | TCP | Netwrix Auditor Server | Monitored computer | Service Control Manager Remote Protocol (RPC) Remote registry | | 135 + Dynamic: 1024 -65535 | TCP | Netwrix Auditor Server | Monitored computer | Windows Management Instrumentation Collect objects | | 135 + Dynamic: 1024 -65535 | TCP | Netwrix Auditor Server | Monitored computer | Collect removable storage insertions. Allow the following process to use the port: %systemroot%\system32\plasrv.exe | | 135 | TCP | Netwrix Auditor Server | Monitored computer | Service Control Manager Remote Protocol (RPC) Core Service installation | diff --git a/docs/auditor/10.7/configuration/windowsserver/registrykey.md b/docs/auditor/10.7/configuration/windowsserver/registrykey.md index ea0538b4eb..b8d74aa3d2 100644 --- a/docs/auditor/10.7/configuration/windowsserver/registrykey.md +++ b/docs/auditor/10.7/configuration/windowsserver/registrykey.md @@ -1,10 +1,10 @@ --- -title: "Windows Server Registry Keys" -description: "Windows Server Registry Keys" +title: "Windows Server Auditing Registry Keys" +description: "Windows Server Auditing Registry Keys" sidebar_position: 110 --- -# Windows Server Registry Keys +# Windows Server Auditing Registry Keys Review the basic registry keys that you may need to configure for monitoring Windows Server with Netwrix Auditor. Navigate to Start → Run and type _"regedit"_. @@ -12,8 +12,8 @@ Netwrix Auditor. Navigate to Start → Run and type _"regedit"_. | Registry key (REG_DWORD type) | Description / Value | | -------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Netwrix Auditor\Windows Server Change Reporter | | -| CleanAutoBackupLogs | Defines the retention period for the security log backups:
  • 0—Backups are never deleted from Domain controllers
  • [X]— Backups are deleted after [X] hours
| -| ProcessBackupLogs | Defines whether to process security log backups:
  • 0—No
  • 1—Yes Even if this key is set to _"0"_, the security log backups will not be deleted regardless of the value of the CleanAutoBackupLogs key.
| +| CleanAutoBackupLogs | Defines the retention period for the security log backups:
  • 0—The product never deletes backups from domain controllers
  • [X]—The product deletes backups after [X] hours
| +| ProcessBackupLogs | Defines whether to process security log backups:
  • 0—No
  • 1—Yes Even if you set this key to _"0"_, the product doesn't delete the security log backups regardless of the CleanAutoBackupLogs key value.
| ## Event Log @@ -28,8 +28,8 @@ Auditor. Navigate to Start → Run and type _"regedit"_. | BatchTimeOut | Defines batch writing timeout (in seconds). | | DeadLockErrorCount | Defines the number of write attempts to a SQL database. | | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\Netwrix Auditor\Event Log Manager | | -| CleanAutoBackupLogs | Defines the retention period for the security log backups:
  • 0—Backups are never deleted from Domain controllers
  • [X]— Backups are deleted after [X] hours
| -| ProcessBackupLogs | Defines whether to process security log backups:
  • 0—No
  • 1—Yes Even if this key is set to _"0"_, the security log backups will not be deleted regardless of the value of the CleanAutoBackupLogs key.
| +| CleanAutoBackupLogs | Defines the retention period for the security log backups:
  • 0—The product never deletes backups from domain controllers
  • [X]—The product deletes backups after [X] hours
| +| ProcessBackupLogs | Defines whether to process security log backups:
  • 0—No
  • 1—Yes Even if you set this key to _"0"_, the product doesn't delete the security log backups regardless of the CleanAutoBackupLogs key value.
| | WriteAgentsToApplicationLog | Defines whether to write the events produced by the Netwrix Auditor Event Log Compression Service to the Application Log of a monitored machine:
  • 0—Disabled
  • 1—Enabled
| | WriteToApplicationLog | Defines whether to write events produced by Netwrix Auditor to the Application Log of the machine where the product is installed:
  • 0—No
  • 1—Yes
| diff --git a/docs/auditor/10.7/configuration/windowsserver/remoteregistry.md b/docs/auditor/10.7/configuration/windowsserver/remoteregistry.md index 611104a4e7..afba13a26e 100644 --- a/docs/auditor/10.7/configuration/windowsserver/remoteregistry.md +++ b/docs/auditor/10.7/configuration/windowsserver/remoteregistry.md @@ -21,6 +21,6 @@ set to _Automatic_ and click **Start**. **Step 4 –** In the Services window, ensure that the Remote Registry service has the _Running_ status on Windows Server 2012 and above. -**NOTE:** The Remote Registry service should be enabled on the target server. +**NOTE:** You must enable the Remote Registry service on the target server. -5. Locate the Windows Management Instrumentation service and repeat these steps. +**Step 5 –** Locate the Windows Management Instrumentation service and repeat these steps. diff --git a/docs/auditor/10.7/configuration/windowsserver/removablestorage.md b/docs/auditor/10.7/configuration/windowsserver/removablestorage.md index 6d476fc2b5..5213cbd9bf 100644 --- a/docs/auditor/10.7/configuration/windowsserver/removablestorage.md +++ b/docs/auditor/10.7/configuration/windowsserver/removablestorage.md @@ -9,101 +9,123 @@ sidebar_position: 80 You can configure IT infrastructure for monitoring removable storage media both locally and remotely. -Review the following: +Review the following for additional information: -To configure removable storage media monitoring on the local server +- [Configure Removable Storage Media Monitoring on the Local Server](#configure-removable-storage-media-monitoring-on-the-local-server) +- [Configure Removable Storage Media Monitoring Remotely](#configure-removable-storage-media-monitoring-remotely) +- [Review Event Trace Session Object Configuration](#review-event-trace-session-object-configuration) -1. On the target server, create the following catalog: _“%ALLUSERSPROFILE%\Netwrix Auditor\Windows - Server Audit\ETS\”_ to store event logs. To review Event Trace Session objects' configurationhow - to modify the root directory. +## Configure Removable Storage Media Monitoring on the Local Server - If you don't want to use the Netwrix Auditor for Windows Server Compression Service for data - collection, ensure that this path is readable via any shared resource. +**Step 1 –** On the target server, create the following folder to store event logs: +_"%ALLUSERSPROFILE%\Netwrix Auditor\Windows Server Audit\ETS\"_. For instructions on how to modify +the root directory, see [Review Event Trace Session Object Configuration](#review-event-trace-session-object-configuration). - After environment variable substitution, the path shall be as follows: +:::note +If you don't want to use the Netwrix Auditor for Windows Server Compression Service for data +collection, ensure that this path is readable via any shared resource. +::: - `C:\ProgramData\Netwrix Auditor\Windows Server Audit\ETS` +After environment variable substitution, the path is as follows: - If your environment variable accesses another directory, update the path. +`C:\ProgramData\Netwrix Auditor\Windows Server Audit\ETS` -2. Run the Command Prompt as Administrator. -3. Execute the commands below. +:::note +If your environment variable accesses another directory, update the path. +::: - - To create the Event Trace Session object: +**Step 2 –** Run the Command Prompt as Administrator. - `logman import -n "Session\NetwrixAuditorForWindowsServer" -xml ""` +**Step 3 –** Execute the following commands. - - To start the Event Trace Session object automatically every time the server starts: +- To create the Event Trace Session object: - `logman import -n "AutoSession\NetwrixAuditorForWindowsServer" -xml ""` + `logman import -n "Session\NetwrixAuditorForWindowsServer" -xml ""` - where: +- To start the Event Trace Session object automatically every time the server starts: - - `NetwrixAuditorForWindowsServer`—Fixed name the product uses to identify the Event Trace - Session object. The name can't be changed. - - ``—Path to the Event Trace Session - template file that comes with Netwrix Auditor. The default path is _"C:\Program Files - (x86)\Netwrix Auditor\Windows Server Auditing\EventTraceSessionTemplate.xml"_. + `logman import -n "AutoSession\NetwrixAuditorForWindowsServer" -xml ""` -To configure removable storage media monitoring remotely + where: -1. On the target server, create the following catalog: _“%ALLUSERSPROFILE%\Netwrix Auditor\Windows - Server Audit\ETS\”_ to write data to. To review Event Trace Session objects' configurationhow to - modify the root directory. + - `NetwrixAuditorForWindowsServer`—Fixed name the product uses to identify the Event Trace + Session object. You can't change the name. + - ``—Path to the Event Trace Session + template file that comes with Netwrix Auditor. The default path is _"C:\Program Files + (x86)\Netwrix Auditor\Windows Server Auditing\EventTraceSessionTemplate.xml"_. - If you don't want to use the Netwrix Auditor for Windows Server Compression Service for data - collection, ensure that this path is readable via any shared resource. +## Configure Removable Storage Media Monitoring Remotely - After environment variable substitution, the path shall be as follows: +**Step 1 –** On the target server, create the following folder to write data to: +_"%ALLUSERSPROFILE%\Netwrix Auditor\Windows Server Audit\ETS\"_. For instructions on how to modify +the root directory, see [Review Event Trace Session Object Configuration](#review-event-trace-session-object-configuration). - `\\\c$\ProgramData\Netwrix Auditor\Windows Server Audit\ETS` +:::note +If you don't want to use the Netwrix Auditor for Windows Server Compression Service for data +collection, ensure that this path is readable via any shared resource. +::: - If your environment variable accesses another directory, update the path. +After environment variable substitution, the path is as follows: -2. Run the Command Prompt under the target server Administrator's account. -3. Execute the commands below. +`\\\c$\ProgramData\Netwrix Auditor\Windows Server Audit\ETS` - - To create the Event Trace Session object: +:::note +If your environment variable accesses another directory, update the path. +::: - `logman import -n "Session\NetwrixAuditorForWindowsServer" -xml "" -s ` +**Step 2 –** Run the Command Prompt under the target server Administrator's account. - - To create the Event Trace Session object automatically every time the server starts: +**Step 3 –** Execute the following commands. - `logman import -n "AutoSession\NetwrixAuditorForWindowsServer" -xml "" -s ` +- To create the Event Trace Session object: - where: + `logman import -n "Session\NetwrixAuditorForWindowsServer" -xml "" -s ` - - `NetwrixAuditorForWindowsServer`—Fixed name the product uses to identify the Event Trace - Session object. The name can't be changed. - - ``—Path to the Event Trace Session - template file that comes with Netwrix Auditor. The default path is _"C:\Program Files - (x86)\Netwrix Auditor\Windows Server Auditing\EventTraceSessionTemplate.xml"_. - - ``—Name of the target server. Provide a server name by entering its FQDN, NETBIOS, or IPv4 address. +- To create the Event Trace Session object automatically every time the server starts: -To review Event Trace Session objects' configuration + `logman import -n "AutoSession\NetwrixAuditorForWindowsServer" -xml "" -s ` -An Administrator can only modify the root directory and log file name. Other configurations aren't -supported by Netwrix Auditor. + where: -1. On the target server, navigate to Start → Administrative Tools → Performance Monitor. -2. In the Performance Monitor snap-in, navigate to Performance → Data Collectors Set → Event Trace - Sessions. -3. Stop the NetwrixAuditorForWindowsServer object. -4. Locate the NetwrixAuditorForWindowsServer object, right-click it and select Properties. Complete - the following fields: + - `NetwrixAuditorForWindowsServer`—Fixed name the product uses to identify the Event Trace + Session object. You can't change the name. + - ``—Path to the Event Trace Session + template file that comes with Netwrix Auditor. The default path is _"C:\Program Files + (x86)\Netwrix Auditor\Windows Server Auditing\EventTraceSessionTemplate.xml"_. + - ``—Name of the target server. Provide a server name by entering its + FQDN, NETBIOS, or IPv4 address. - | Option | Description | - | -------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | - | Directory → Root Directory | Path to the directory where event log is stored. If you want to change root directory, do the following: 1. Under the Root directory option, click Browse and select a new root directory. 2. Navigate to _C:\ProgramData\Netwrix Auditor\Windows Server Audit_ and copy the ETS folder to a new location. | - | File → Log file name | Name of the event log where the events will be stored. | +## Review Event Trace Session Object Configuration -5. Start the NetwrixAuditorForWindowsServer object. -6. In the Performance Monitor snap-in, navigate to Performance → Data Collectors Set → Startup Event - Trace Sessions. -7. Locate the NetwrixAuditorForWindowsServer object, right-click it and select Properties. Complete - the following fields: +:::note +An Administrator can only modify the root directory and log file name. Netwrix Auditor doesn't +support other configurations. +::: - | Option | Description | - | -------------------------- | ------------------------------------------------------------------------------------------------------------------------------- | - | Directory → Root Directory | Path to the directory where event log is stored. Under the Root directory option, click Browse and select a new root directory. | - | File → Log file name | Name of the event log where the events will be stored. | +**Step 1 –** On the target server, navigate to Start → Administrative Tools → Performance Monitor. + +**Step 2 –** In the Performance Monitor snap-in, navigate to Performance → Data Collectors Set → +Event Trace Sessions. + +**Step 3 –** Stop the NetwrixAuditorForWindowsServer object. + +**Step 4 –** Locate the NetwrixAuditorForWindowsServer object, right-click it and select +**Properties**. Complete the following fields: + +| Option | Description | +| --- | --- | +| Directory → Root Directory | Path to the directory where the event log is stored. To change the root directory:
1. Under the Root directory option, click **Browse** and select a new root directory.
2. Navigate to _C:\ProgramData\Netwrix Auditor\Windows Server Audit_ and copy the ETS folder to the new location. | +| File → Log file name | Name of the event log where the events are stored. | + +**Step 5 –** Start the NetwrixAuditorForWindowsServer object. + +**Step 6 –** In the Performance Monitor snap-in, navigate to Performance → Data Collectors Set → +Startup Event Trace Sessions. + +**Step 7 –** Locate the NetwrixAuditorForWindowsServer object, right-click it and select +**Properties**. Complete the following fields: + +| Option | Description | +| --- | --- | +| Directory → Root Directory | Path to the directory where the event log is stored. Under the Root directory option, click **Browse** and select a new root directory. | +| File → Log file name | Name of the event log where the events are stored. | diff --git a/docs/auditor/10.7/install/useractivitycoreservice.md b/docs/auditor/10.7/install/useractivitycoreservice.md index a0652f58cf..d852ee04f2 100644 --- a/docs/auditor/10.7/install/useractivitycoreservice.md +++ b/docs/auditor/10.7/install/useractivitycoreservice.md @@ -6,15 +6,24 @@ sidebar_position: 60 # Install for User Activity Core Service -By default, Netwrix Auditor automatically installs the Core Service on the audited computers when setting up -auditing. If, for some reason, installation has failed, you must install the Core -Service manually on each audited computer. +By default, Netwrix Auditor automatically installs the User Activity Core Service on the audited +computers when you set up auditing. If the installation fails, you must install the Netwrix Auditor +User Activity Core Service manually on each audited computer. -To install Netwrix Auditor User Activity Core Service, complete the following steps: +Before installing the Netwrix Auditor User Activity Core Service manually, ensure that: + +- The audit settings are configured properly. +- The Data Processing Account has access to the administrative shares. + +## Install User Activity Core Service Manually **Step 1 –** On the computer where Auditor Server resides, navigate to _%ProgramFiles% (x86)\Netwrix Auditor\User Activity Video Recording_ and copy the UACoreSvcSetup.msi file to the audited computer. +:::note +This is the default location. It may differ because users can move this folder. +::: + **Step 2 –** Run the installation package. **Step 3 –** Follow the instructions of the setup wizard. When prompted, accept the license @@ -23,6 +32,8 @@ agreement and specify the installation folder. **Step 4 –** On the Core Service Settings page, specify the host server (i.e., the name of the computer where Netwrix Auditor is installed) and the server TCP port. +The Netwrix Auditor User Activity Core Service is installed and ready to audit user activity. + ## Install User Activity Core Service with the Command Prompt To perform a silent installation of the User Activity Core Service with the command prompt, complete the following steps: diff --git a/docs/auditor/10.8/admin/monitoringplans/datasources.md b/docs/auditor/10.8/admin/monitoringplans/datasources.md index a169519e20..06e7132500 100644 --- a/docs/auditor/10.8/admin/monitoringplans/datasources.md +++ b/docs/auditor/10.8/admin/monitoringplans/datasources.md @@ -6,15 +6,15 @@ sidebar_position: 20 # Manage Data Sources -You can fine-tune data collection for each data source. Settings that you configure for the data -source will be applied to all items belonging to that data source. Using data source settings, you -can, for example: +You can fine-tune data collection for each data source. Netwrix Auditor applies the settings that +you configure for the data source to all items belonging to that data source. Using data source +settings, you can, for example: - Enable state-in-time data collection (supported for several data sources) - Depending on the data source, customize the monitoring scope (e.g., enable read access auditing, monitoring of failed attempts) -To add, modify, and remove data sources, enable, or disable monitoring, you must be assigned the +To add, modify, and remove data sources, enable, or disable monitoring, you must have the Global administrator role in the product or the Configurator role on the plan. See the [Role-Based Access and Delegation](/docs/auditor/10.8/admin/monitoringplans/delegation.md) topic for additional information. @@ -81,21 +81,22 @@ associated with your data source. | Data Source | Item | | ----------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| Active Directory Group Policy Exchange Logon Activity | [Domain](activedirectory/overview.md#domain) | +| Active Directory
Group Policy
Exchange
Logon Activity | [Domain](activedirectory/overview.md#domain) | | Active Directory Federation Services | [Federation Server](adfs.md#federation-server) | -| Microsoft Entra ID Exchange Online SharePoint Online Microsoft Teams | [Microsoft Entra ID](/docs/auditor/10.8/admin/monitoringplans/microsoftentraid/overview.md) | -| File Servers (including Windows file server, Dell, NetApp, Nutanix File server, Synology, and Qumulo) | [AD Container](activedirectory/overview.md#ad-container) [File Servers](/docs/auditor/10.8/admin/monitoringplans/fileservers/overview.md) [Dell Isilon](fileservers/overview.md#dell-isilon) [Dell VNX VNXe](fileservers/overview.md#dell-vnx-vnxe) [File Servers](/docs/auditor/10.8/admin/monitoringplans/fileservers/overview.md) [NetApp](fileservers/overview.md#netapp) [Windows File Share](fileservers/scope.md#windows-file-share) [Nutanix SMB Shares](fileservers/overview.md#nutanix-smb-shares) [Qumulo](fileservers/overview.md#qumulo) [Synology](fileservers/overview.md#synology) By default, Auditor will monitor all shares stored in the specified location, except for hidden shares (both default and user-defined). If you want to monitor user-defined hidden shares, select the related option in the monitored item settings. Remember that administrative hidden shares like default system root or Windows directory (ADMIN$), default drive shares (D$, E$), etc. will not be monitored. See the topics on the monitored items for details. | +| Microsoft Entra ID
Exchange Online
SharePoint Online
Microsoft Teams | [Microsoft 365 tenant](/docs/auditor/10.8/admin/monitoringplans/microsoftentraid/overview.md#configure-office-365-tenant-as-a-monitored-item) | +| File Servers (including Windows file server, Dell, NetApp, Nutanix File server, Synology, and Qumulo) | [AD Container](activedirectory/overview.md#ad-container)
[Computer](fileservers/windowsfileserver.md#computer)
[Dell Isilon](fileservers/overview.md#dell-isilon)
[Dell VNX VNXe](fileservers/overview.md#dell-vnx-vnxe)
[IP Range](fileservers/windowsfileserver.md#ip-range)
[NetApp](fileservers/overview.md#netapp)
[Windows File Share](fileservers/scope.md#windows-file-share)
[Nutanix SMB Shares](fileservers/overview.md#nutanix-smb-shares)
[Qumulo](fileservers/overview.md#qumulo)
[Synology](fileservers/overview.md#synology) By default, Auditor will monitor all shares stored in the specified location, except for hidden shares (both default and user-defined). If you want to monitor user-defined hidden shares, select the related option in the monitored item settings. Remember that Auditor doesn't monitor administrative hidden shares like default system root or Windows directory (ADMIN$), default drive shares (D$, E$), etc. See the topics on the monitored items for details. | | Network Devices | [Syslog Device](networkdevices.md#syslog-device) [Cisco Meraki Dashboard](networkdevices.md#cisco-meraki-dashboard) | | Oracle Database | [Oracle Database Instance](oracle/overview.md#oracle-database-instance) | | SharePoint | [SharePoint Farm](sharepoint/overview.md#sharepoint-farm) | | SQL Server | [SQL Server Instance](sqlserver/items.md#sql-server-instance) [SQL Server Availability Group](sqlserver/items.md#sql-server-availability-group) | | VMware | [VMware ESX/ESXi/vCenter](vmware/overview.md#vmware-esxesxivcenter) | -| Windows Server User Activity | [File Servers](/docs/auditor/10.8/admin/monitoringplans/fileservers/overview.md) [AD Container](activedirectory/overview.md#ad-container) [File Servers](/docs/auditor/10.8/admin/monitoringplans/fileservers/overview.md) | +| Windows Server | [Computer](/docs/auditor/10.8/admin/monitoringplans/windows/overview.md#computer) [AD Container](/docs/auditor/10.8/admin/monitoringplans/windows/overview.md#ad-container) [IP Range](/docs/auditor/10.8/admin/monitoringplans/windows/overview.md#ip-range) | +| User Activity | [Computer](/docs/auditor/10.8/admin/monitoringplans/overview_1.md#computer) [AD Container](/docs/auditor/10.8/admin/monitoringplans/overview_1.md#ad-container) [IP Range](/docs/auditor/10.8/admin/monitoringplans/overview_1.md#ip-range) | | Netwrix API | [Integration API](/docs/auditor/10.8/api/overview.md) | -To add, modify, and remove items, you must be assigned the Global administrator role in the product +To add, modify, and remove items, you must have the Global administrator role in the product or the **Configurator** role on the plan. See the -[Role-Based Access and Delegation](/docs/auditor/10.8/admin/monitoringplans/delegation.md)topic for additional information. +[Role-Based Access and Delegation](/docs/auditor/10.8/admin/monitoringplans/delegation.md) topic for additional information. To add a new item to a data source: @@ -113,9 +114,9 @@ monitoring plan and click Edit item. For each item, you can: ## Configure Monitoring Scope -In some environments, it may not be necessary to monitor the entire IT infrastructure. Netwrix -monitoring scope can be configured on the Data Source and/or Item levels. the section below contains -examples on how to use omit functionality in Auditor. +In some environments, you don't need to monitor the entire IT infrastructure. You can configure the +Netwrix monitoring scope at the Data Source and/or Item levels. The following table provides +examples of how to use the omit functionality in Auditor. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. @@ -130,17 +131,16 @@ See the [Monitoring Plans](/docs/auditor/10.8/admin/monitoringplans/overview.md) | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Active Directory** | | | You want to omit all activity by a specific service account or service accounts with a specific naming pattern. | [Active Directory](/docs/auditor/10.8/admin/monitoringplans/activedirectory/overview.md) | -| If Netwrix user is responsible just for a limited scope within corporate AD, s/he needs to omit everything else. | [Active Directory](/docs/auditor/10.8/admin/monitoringplans/activedirectory/overview.md) - Always both activity and state in time data are omitted. - In group/Not in group filters don't not process groups from omitted OUs. | +| If Netwrix user is responsible just for a limited scope within corporate AD, s/he needs to omit everything else. | [Active Directory](/docs/auditor/10.8/admin/monitoringplans/activedirectory/overview.md) - The product always omits both activity and state in time data. - In group/Not in group filters don't process groups from omitted OUs. | | **Logon Activity** | | | You want to omit domain logons by a specific service account or service accounts with a specific naming pattern. | [Logon Activity](/docs/auditor/10.8/admin/monitoringplans/logonactivity/overview.md) | | **File Servers** (including Windows file server, Dell, NetApp, Nutanix File server) | | | You have a server named _StationWin16_ where you can't install .Net 4.5 in the OU where you keep all member servers. You want to suppress errors from this server by excluding it from the Netwrix auditing scope. | [AD Container](activedirectory/overview.md#ad-container) | | A Security Officer wants to monitor a file share but s/he doesn't have access to a certain folder on this share. Then, s/he doesn't want the product to monitor this folder at all. | [File Servers](/docs/auditor/10.8/admin/monitoringplans/fileservers/overview.md) [Dell Isilon](fileservers/overview.md#dell-isilon) [Dell VNX VNXe](fileservers/overview.md#dell-vnx-vnxe) [NetApp](fileservers/overview.md#netapp) [Windows File Share](fileservers/scope.md#windows-file-share) [Nutanix SMB Shares](fileservers/overview.md#nutanix-smb-shares) | -| A Security Officer wants to monitor a file share but s/he doesn't have access to a certain folder on this share. Then, s/he doesn't want the product to monitor this folder at all. | [File Servers](/docs/auditor/10.8/admin/monitoringplans/fileservers/overview.md) [Dell Isilon](fileservers/overview.md#dell-isilon) [Dell VNX VNXe](fileservers/overview.md#dell-vnx-vnxe) [NetApp](fileservers/overview.md#netapp) [Windows File Share](fileservers/scope.md#windows-file-share) [Nutanix SMB Shares](fileservers/overview.md#nutanix-smb-shares) | | A Security Officer wants to monitor a file share, but it contains a folder with a huge amount of objects, so s/he doesn't want Netwrix Auditor to collect State-in-Time data for this folder. | [File Servers](/docs/auditor/10.8/admin/monitoringplans/fileservers/overview.md) [Dell Isilon](fileservers/overview.md#dell-isilon) [Dell VNX VNXe](fileservers/overview.md#dell-vnx-vnxe) [NetApp](fileservers/overview.md#netapp) [Windows File Share](fileservers/scope.md#windows-file-share) [Nutanix SMB Shares](fileservers/overview.md#nutanix-smb-shares) | | You want to exclude specific computers within an IP range from the Netwrix auditing scope. | [File Servers](/docs/auditor/10.8/admin/monitoringplans/fileservers/overview.md) | | **SQL Server** | | -| You want to know if the _corp\administrator_ user is messing with SQL data. | [SQL Server Instance](sqlserver/items.md#sql-server-instance) | +| You want to know if the _corp\administrator_ user is changing SQL data. | [SQL Server Instance](sqlserver/items.md#sql-server-instance) | | As an Auditor administrator, you want to exclude the _domain\nwxserviceaccount_ service account activity from SQL server audit so that you get reports without changes made by automatic systems. | [SQL Server Instance](sqlserver/items.md#sql-server-instance) | | As an Auditor administrator, you want to exclude all changes performed by _MyCustomTool_. | [SQL Server Instance](sqlserver/items.md#sql-server-instance) | | **SharePoint** | | @@ -150,4 +150,4 @@ See the [Monitoring Plans](/docs/auditor/10.8/admin/monitoringplans/overview.md) | You have a server named StationWin16 where you can't install .Net 4.5 in the OU where you keep all member servers. You want to suppress errors from this server by excluding it from the Netwrix auditing scope. | [AD Container](activedirectory/overview.md#ad-container) | | You want to exclude specific computers within an IP range from the Netwrix auditing scope. | [File Servers](/docs/auditor/10.8/admin/monitoringplans/fileservers/overview.md) | | VMware | | -| You have a virtual machine named "testvm" that you use for testing purposes, so you want to exclude it from being monitored. | [VMware ESX/ESXi/vCenter](vmware/overview.md#vmware-esxesxivcenter) | +| You have a virtual machine named "testvm" that you use for testing, so you want to exclude it from monitoring. | [VMware ESX/ESXi/vCenter](vmware/overview.md#vmware-esxesxivcenter) | diff --git a/docs/auditor/10.8/admin/monitoringplans/microsoftentraid/overview.md b/docs/auditor/10.8/admin/monitoringplans/microsoftentraid/overview.md index 33f5bf8315..21d73a5b29 100644 --- a/docs/auditor/10.8/admin/monitoringplans/microsoftentraid/overview.md +++ b/docs/auditor/10.8/admin/monitoringplans/microsoftentraid/overview.md @@ -6,8 +6,8 @@ sidebar_position: 60 # Microsoft Entra ID -**NOTE:** Before configuring your monitoring plan, read and complete the instructions in -the following topics: +**NOTE:** Read and complete the instructions in the following topics before configuring +your monitoring plan: - [Protocols and Ports Required](/docs/auditor/10.8/requirements/ports.md) – To ensure successful data collection and activity monitoring configure necessary protocols and ports for inbound and @@ -26,14 +26,14 @@ You can use the following data collecting account options: Monitoring Plan Using Netwrix Privilege Secure topics for additional information. - Application and secret for Microsoft 365 with modern authentication. -To add a new monitoring plan for Entra ID, you need to launch the New Monitoring Plan wizard, either -from the Home screen, or from the Monitoring plans menu under the All Monitoring Plans section. +To add a new monitoring plan for Entra ID, launch the New Monitoring Plan wizard, either from the +Home screen, or from the Monitoring plans menu under the All Monitoring Plans section. ## Configure Data Source Settings -Default data source settings will be configured during the completion of the New Monitoring Plan -wizard. To customize the settings, you need to open your monitoring plan, and click **Edit data -source** on the right side of the screen. +The New Monitoring Plan wizard configures default data source settings when you complete it. To +customize the settings, open your monitoring plan and click **Edit data source** on the right side +of the screen. Complete the following fields: @@ -61,18 +61,18 @@ Ensure you have the following at hand: - Application secret - For basic authentication: User name and password -Types of data that can be collected by Netwrix Auditor from the Microsoft 365 tenant depend on the +The types of data that Netwrix Auditor can collect from the Microsoft 365 tenant depend on the authentication option you choose. -To configure Office 365 tenant as a monitored item. +## Configure Office 365 Tenant as a Monitored Item **Step 1 –** On the **General** page of the item properties, specify **Tenant name**: -- If you are going to use **Basic authentication**, you can proceed to the next step – **Tenant - name** will be filled in automatically after it. +- If you are going to use **Basic authentication**, you can proceed to the next step – the product + fills in **Tenant name** automatically after that. :::note -Basic authentication is no longer possible for Exchange Online. For the already existing tenants it is still possible to use basic authentication for SharePoint Online and Microsoft Entra ID monitoring. +Basic authentication is no longer possible for Exchange Online. For existing tenants, you can still use basic authentication for SharePoint Online and Microsoft Entra ID monitoring. ::: - If you are going to use **Modern authentication**, paste the obtained name. See the @@ -84,22 +84,23 @@ Basic authentication is no longer possible for Exchange Online. For the already If you are using a government tenant, click the **Tenant Environment** tab and select the desired tenant environment. -**Step 2 –** Select authentication method that will be used when accessing Office 365 services: +**Step 2 –** Select the authentication method to use when accessing Office 365 services: - Basic authentication: - - Selected, Office 365 organization will be accessed on behalf of the user you specify. + - If selected, Netwrix Auditor accesses the Office 365 organization on behalf of the user you + specify. - Enter **User name** and **password**; use any of the following formats: _user@domain.com_ or _user@domain.onmicrosoft.com_. - - The **Tenant name** field then will be filled in automatically. + - The product then fills in the **Tenant name** field automatically. - Ensure this user account has sufficient access rights. See [Using Basic Authentication with Microsoft Entra ID](/docs/auditor/10.8/configuration/microsoft365/microsoftentraid/permissions/basicauth.md) topic for additional information. - Modern authentication: - - Selected, Office 365 organization will be accessed using the Microsoft Entra ID (formerly - Azure AD) app you prepared. Enter: + - If selected, Netwrix Auditor accesses the Office 365 organization using the Microsoft Entra + ID (formerly Azure AD) app you prepared. Enter: - **Application ID**; @@ -120,7 +121,7 @@ individual credentials for each of them. ## How to Add Microsoft Entra ID Monitoring Plan Using Netwrix Privilege Secure **NOTE:** Netwrix Privilege Secure resource-based integration works only with basic authentication. -Ephemeral accounts will be created or elevated to be used as data collecting accounts. If you want +Netwrix Privilege Secure creates or elevates ephemeral accounts to use as data collecting accounts. If you want to use modern authentication and the Netwrix Privilege Secure integration, you need to choose a credential-based access policy, save your application and secret in Netwrix Privilege Secure, and provide the Application ID instead of the user name. @@ -128,8 +129,8 @@ provide the Application ID instead of the user name. Starting with version 10.7, you can use Netwrix Privilege Secure to manage the account for collecting data, after configuring the integration. See the [Netwrix Privilege Secure](/docs/auditor/10.8/admin/settings/privilegesecure.md) topic for additional information about -integration and supported data sources. In this case, the credentials will not be stored by Netwrix -Auditor. Instead, they will be managed by Netwrix Privilege Secure and provided on demand, ensuring +integration and supported data sources. In this case, Netwrix Auditor doesn't store the credentials. +Instead, Netwrix Privilege Secure manages them and provides them on demand, ensuring password rotation or using temporary accounts for data collection. To use Netwrix Privilege Secure as an account for data collection. @@ -144,10 +145,10 @@ collection. **Step 3 –** Select the type of the Access Policy you want to use in Netwrix Privilege Secure. Credential-based is the default option. Refer to the [Netwrix Privilege Secure](https://helpcenter.netwrix.com/category/privilegesecure_accessmanagement) -documentation to Access Policies documentation. +documentation for details about Access Policies. -In this case, you need to provide the username of the account managed by Netwrix Privilege Secure, -and to which Netwrix Auditor has the access through a Credential-based access policy. +In this case, provide the username of the account that Netwrix Privilege Secure manages and that +Netwrix Auditor can access through a Credential-based access policy. **NOTE:** Netwrix recommends using different credentials for different monitoring plans and data sources. @@ -158,8 +159,8 @@ The second option is Resource-based. To use this option, you need to provide the Resource names, assigned to Netwrix Auditor in the corresponding Resource-based policy. Ensure that you specified the same names as in Netwrix Privilege Secure. -The Resource name in this case is where the activity will be performed. For example, if you grant +The Resource name in this case is where the activity takes place. For example, if you grant the data collecting account the access to a local Administrators group - the resource is the server -where the permission will be granted. +where you grant the permission. Netwrix Privilege Secure is ready to use as an account for data collection. diff --git a/docs/auditor/10.8/admin/monitoringplans/overview_1.md b/docs/auditor/10.8/admin/monitoringplans/overview_1.md index e2e37562ab..0c574b7cb0 100644 --- a/docs/auditor/10.8/admin/monitoringplans/overview_1.md +++ b/docs/auditor/10.8/admin/monitoringplans/overview_1.md @@ -6,17 +6,18 @@ sidebar_position: 180 # User Activity -**NOTE:** before configuring your monitoring plan, read and complete the instructions in -the following topics: +:::note +Read and complete the instructions in the following topics before configuring your monitoring +plan: - [Protocols and Ports Required](/docs/auditor/10.8/requirements/ports.md) – To ensure successful data collection and activity monitoring configure necessary protocols and ports for inbound and outbound connections - [Data Collecting Account](/docs/auditor/10.8/admin/monitoringplans/dataaccounts.md) – Configure data collecting accounts as required to audit your IT systems - - [User Activity](/docs/auditor/10.8/configuration/useractivity/overview.md) – Configure data source as required to be monitored +::: Complete the following fields: @@ -24,18 +25,17 @@ Complete the following fields: | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | General | | | Monitor this data source and collect activity data | Enable monitoring of the selected data source and configure Auditor to collect and store audit data. | -| Notify users about activity monitoring | You can enable the message that will be displayed when a user logs in and specify the message text. | -| Record video of user activity within sessions | - If disabled, only user session events will be collected (regardless of whether the user is idle or not). - If enabled, the product will both collect user session events and record video of user activity. By default, this option is disabled. | -| Video Recording For these settings to become effective, enable video recording on the General tab. | | -| Adjust video quality | Optimize video file by adjusting the following: - File size and video quality - Save video in grayscale - CPU load and Video smoothness. | -| Adjust video duration | Limit video file length by adjusting the following: - Recording lasts for `<...>` minutes—Video recording will be stopped after the selected time period. - User has been idle for `<...>` minutes—Video recording will be stopped if a user is considered inactive during the selected time period. If the Record video of user activity within sessions option is enabled, the User Sessions report shows active time calculated without including user idle period. Mind that a computer is considered to be idle by Windows if there has not been user interaction via the mouse or keyboard for a given time and if the hard drives and processors have been idle more than 90% of that time. - Free disk space is less than `<...>` MB—Video recording will be stopped when upon reaching selected disk space limit. - Consider user activity — Select one of the following: - Stop if user has been idle for `<...>` minutes. Select if you want video recording for a user to be stopped after the specified time period. - Continue video recording regardless of the user idle state. When selected, Netwrix Auditor continues video recording for idle users. | +| Notify users about activity monitoring | You can enable the message that appears when a user logs in and specify the message text. | +| Record video of user activity within sessions |
  • If disabled, the product collects only user session events (regardless of whether the user is idle or not).
  • If enabled, the product will both collect user session events and record video of user activity.
By default, this option is disabled. | +| Video Recording | | +| Adjust video quality | For these settings to become effective, enable video recording on the General tab. Optimize video file by adjusting the following:
  • File size and video quality
  • Save video in grayscale
  • CPU load and Video smoothness
| +| Adjust video duration | For these settings to become effective, enable video recording on the General tab. Limit video file length by adjusting the following:
  • Recording lasts for `<...>` minutes—Video recording stops after the selected time period.
  • User has been idle for `<...>` minutes—Video recording stops if the product considers a user inactive during the selected time period.
If the Record video of user activity within sessions option is enabled, the User Sessions report shows active time calculated without including user idle period. Mind that Windows considers a computer idle if there has not been user interaction via the mouse or keyboard for a given time and if the hard drives and processors have been idle more than 90% of that time.
  • Free disk space is less than `<...>` MB—Video recording stops when the selected disk space limit is reached.
  • Consider user activity — Select one of the following:
    • Stop if user has been idle for `<...>` minutes. Select if you want the product to stop video recording for a user after the specified time period.
    • Continue video recording regardless of the user idle state. When selected, Netwrix Auditor continues video recording for idle users.
| | Set a retention period to clear stale videos | When the selected retention period is over, Netwrix Auditor deletes your video recordings. | | Users | | -| Specify users to track their activity | Select the users whose activity should be recorded. You can select **All users** or create a list of **Specific users or user groups**. Certain users can also be added to **Exceptions** list. | +| Specify users to track their activity | Select the users whose activity you want to record. You can select **All users** or create a list of **Specific users or user groups**. You can also add certain users to the **Exceptions** list. | | Applications | | -| Specify applications you want to track | Select the applications that you want to monitor. You can select All applications or create a list of Specific applications. Certain applications can also be added to Exceptions list. | -| Monitored Computers | | -| For a newly created monitoring plan for User Activity, the list of monitored computers is empty. Add items to your monitoring plan and wait until Netwrix Auditor retrieves all computers within these items. See [Add Items for Monitoring](/docs/auditor/10.8/admin/monitoringplans/datasources.md#add-items-for-monitoring)for more information. The list contains computer name, its current status and last activity time. | | +| Specify applications you want to track | Select the applications that you want to monitor. You can select All applications or create a list of Specific applications. You can also add certain applications to the Exceptions list. | +| Monitored Computers | For a newly created monitoring plan for User Activity, the list of monitored computers is empty. Add items to your monitoring plan and wait until Netwrix Auditor retrieves all computers within these items. See [Add Items for Monitoring](/docs/auditor/10.8/admin/monitoringplans/datasources.md#add-items-for-monitoring) for more information. The list contains computer name, its current status and last activity time. | Review your data source settings and click **Add** to go back to your plan. The newly created data source will appear in the **Data source** list. As a next step, click **Add item** to specify an @@ -45,19 +45,18 @@ information. ## How to Include/Exclude Applications -To create a list of application to include in / exclude from monitoring, you will need to provide: +To create a list of applications to include in or exclude from monitoring, provide the following: - Title — application title as shown on top of the application window, for example, **MonthlyReport.docx - Word**. - - Title can also be found in the "_What_" column of related Netwrix Auditor reports and search - results, for example, in the **User Sessions** report. + - You can also find the title in the "_What_" column of related Netwrix Auditor reports and + search results, for example, in the **User Sessions** report. -- Description — as shown in the Description column on theDetails tab of Windows Task Manager. +- Description — as shown in the Description column on the Details tab of Windows Task Manager. - Using Description can help to filter out several components of a single application — for - example, all executables having _TeamViewer 14_ description belong to the same app (see the - screenshot above). + example, all executables having _TeamViewer 14_ description belong to the same app. To create a list of inclusions / exclusions for applications: @@ -65,13 +64,15 @@ To create a list of inclusions / exclusions for applications: **Step 2 –** Enter application title and description you have identified. -Wildcards (\*?) are supported and applied as follows: +The product supports wildcards (\*?) and applies them as follows: - _\* - Notepad_ (the "Title" filter) will exclude all Notepad windows. - _colo?r \*_ (the "Title" filter) will exclude all application window titles containing "_color_" or "_colour_". +:::note Same logic applies to the inclusion rules. +::: Example @@ -88,8 +89,8 @@ To exclude the Notepad application window with "_Document1_" open, add the follo ## Computer For evaluation purposes, Netwrix recommends selecting Computer as an item for a monitoring plan. -After the product is configured to collect data from the specified items, audit settings (including -Core and Compression services installation) will be applied to all computers within AD Container or +After you configure the product to collect data from the specified items, it applies audit settings +(including Core and Compression services installation) to all computers within AD Container or IP Range. Complete the following fields: @@ -98,7 +99,7 @@ Complete the following fields: | --------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | General | | | Specify a computer | Provide a server name by entering its FQDN, NETBIOS, or IPv4 address. You can click Browse to select a computer from the list of computers in your network. | -| Specify the account for collecting data | Select the account that will be used to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select account type you want to use and enter credentials. The following choices are available: - User/password. The account must be granted the same permissions and access rights as the default account used for data collection. See the [Data Collecting Account](/docs/auditor/10.8/admin/monitoringplans/dataaccounts.md) topic for additional information. - Group Managed Service Account (gMSA). You should specify only the account name in the domain\account$ format. See the [Use Group Managed Service Account (gMSA)](/docs/auditor/10.8/requirements/gmsa.md) topic for additional information. | +| Specify the account for collecting data | Select the account you want to use to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select account type you want to use and enter credentials. The following choices are available: - User/password. The account must have the same permissions and access rights as the default account used for data collection. See the [Data Collecting Account](/docs/auditor/10.8/admin/monitoringplans/dataaccounts.md) topic for additional information. - Group Managed Service Account (gMSA). You should specify only the account name in the domain\account$ format. See the [Use Group Managed Service Account (gMSA)](/docs/auditor/10.8/requirements/gmsa.md) topic for additional information. | ## IP Range @@ -108,7 +109,7 @@ Complete the following fields: | --------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | General | | | Specify IP range | Specify an IP range for the audited computers. To exclude computers from within the specified range, click **Exclude**. Enter the IP subrange you want to exclude, and click **Add**. | -| Specify the account for collecting data | Select the account that will be used to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select **Custom account** and enter credentials. The credentials are case sensitive. A custom account must be granted the same permissions and access rights as the default account used for data collection. See the [Data Collecting Account](/docs/auditor/10.8/admin/monitoringplans/dataaccounts.md) topic for additional information. | +| Specify the account for collecting data | Select the account the same way as for the [Computer](#computer) item. | ## AD Container @@ -117,5 +118,5 @@ Complete the following fields: | Option | Description | | --------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | General | | -| Specify AD container | Specify a whole AD domain, OU, or container. Click **Browse** to select from the list of containers in your network. You can also: - Select a particular computer type to be audited within the chosen AD container: **Domain controllers, Servers (excluding domain controllers)**, or **Workstations**. - Click **Exclude** to specify AD domains, OUs, and containers you don't want to audit. In the Exclude Containers dialog, click Add and specify an object. The list of containers doesn't include child domains of trusted domains. Use other options **(Computer, IP range** to specify the target computers. | -| Specify the account for collecting data | Select the account that will be used to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select **Custom account** and enter credentials. The credentials are case sensitive. If using a group Managed Service Account (gMSA), you can specify only the account name in the _domain\account$_ format. Password field can be empty. A custom account must be granted the same permissions and access rights as the default account used for data collection. See the[Data Collecting Account](/docs/auditor/10.8/admin/monitoringplans/dataaccounts.md) topic for additional information. | +| Specify AD container | Specify a whole AD domain, OU, or container. Click **Browse** to select from the list of containers in your network. You can also:
  • Select a particular computer type to audit within the chosen AD container: **Domain controllers, Servers (excluding domain controllers)**, or **Workstations**.
  • Click **Exclude** to specify AD domains, OUs, and containers you don't want to audit. In the Exclude Containers dialog, click Add and specify an object. The list of containers doesn't include child domains of trusted domains.
Use other options (**Computer**, **IP range**) to specify the target computers. | +| Specify the account for collecting data | Select the account the same way as for the [Computer](#computer) item. | diff --git a/docs/auditor/10.8/admin/monitoringplans/windows/overview.md b/docs/auditor/10.8/admin/monitoringplans/windows/overview.md index 8c7fe5894b..dd8a30a878 100644 --- a/docs/auditor/10.8/admin/monitoringplans/windows/overview.md +++ b/docs/auditor/10.8/admin/monitoringplans/windows/overview.md @@ -6,14 +6,13 @@ sidebar_position: 200 # Windows Server -**NOTE:** Before configuring your monitoring plan, read and complete the instructions in the following topics: +**NOTE:** Read and complete the instructions in the following topics before configuring your monitoring plan: - [Protocols and Ports Required](/docs/auditor/10.8/requirements/ports.md) – To ensure successful data collection and activity monitoring configure necessary protocols and ports for inbound and outbound connections - [Data Collecting Account](/docs/auditor/10.8/admin/monitoringplans/dataaccounts.md) – Configure data collecting accounts as required to audit your IT systems - - [Windows Server](/docs/auditor/10.8/configuration/windowsserver/overview.md) – Configure data source as required to be monitored @@ -23,12 +22,12 @@ Complete the following fields: | -------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | General | | | Monitor this data source and collect activity data | Enable monitoring of the selected data source and configure Auditor to collect and store audit data. | -| Monitor changes to system components | Select the system components that you want to audit for changes. Review the following for additional information: - General computer settings—Enables auditing of general computer settings. For example, computer name or workgroup changes. - Hardware—Enables auditing of hardware devices configuration. For example, your network adapter configuration changes. - Add/Remove programs—Enables auditing of installed and removed programs. For example, Microsoft Office package has been removed from the audited Windows Server. - Services—Enables auditing of started/stopped services. For example, the Windows Firewall service stopped. - Audit policies—Enables auditing of local advanced audit policies configuration. For example, the Audit User Account Management advanced audit policy is set to "_Failure_". - DHCP configuration—Enables auditing of DHCP configuration changes. - Scheduled tasks—Enables auditing of enabled / disabled / modified scheduled tasks. For example, the GoogleUpdateTaskMachineUA scheduled task trigger changes. - Local users and groups—Enables auditing of local users and groups. For example, an unknown user was added to the Administrators group. - DNS configuration—Enables auditing of your DNS configuration changes. For example, your DNS security parameters' changes. - DNS resource records—Enables auditing of all types of DNS resource records. For example, A-type resource records (Address record) changes. - File shares—Enables auditing of created / removed / modified file shares and their properties. For example, a new file share was created on the audited Windows Server. - Removable media—Enables auditing of USB thumb drives insertion. | -| Specify data collection method | You can enable **network traffic compression.** If enabled, a Compression Service will be automatically launched on the audited computer, collecting and prefiltering data. This significantly improves data transfer and minimizes the impact on the target computer performance. | -| Configure audit settings | You can adjust audit settings automatically. Your current audit settings will be checked on each data collection and adjusted if necessary. This method is recommended for evaluation purposes in test environments. If any conflicts are detected with your current audit settings, automatic audit configuration will not be performed. Don't select the checkbox if you want to configure audit settings manually. See the [Windows Server](/docs/auditor/10.8/configuration/windowsserver/overview.md) configuration topic for additional information about audit settings required to collect comprehensive audit data and the instructions on how to configure them. | -| Collect data for state-in-time reports | Configure Auditor to store daily snapshots of your system configuration required for further state-in-time reports generation. See the [State–In–Time Reports](/docs/auditor/10.8/admin/reports/types/stateintime/overview.md) topic for additional information. When auditing file servers, changes to effective access permissions can be tracked in addition to audit permissions. By default, Combination of file and share permissions is tracked. File permissions define who has access to local files and folders. Share permissions provide or deny access to the same resources over the network. The combination of both determines the final access permissions for a shared folder—the more restrictive permissions are applied. Upon selecting Combination of file and share permissions only the resultant set will be written to the Audit Database. Select File permissions option too if you want to see difference between permissions applied locally and the effective file and share permissions set. To disable auditing of effective access, unselect all checkboxes under Include details on effective permissions. In the Schedule state-in-time data collection section, you can select a custom weekly interval for snapshots collection. Click Modify and select days of week you want your snapshot to be collected. In the Manage historical snapshots section, you can click **Manage** and select the snapshots that you want to import to the Audit Database to generate a report on the data source's state at the specific moment in the past. You must be assigned the Global administrator or the Global reviewer role to import snapshots. Move the selected snapshots to the Snapshots available for reporting list using the arrow button. The product updates the latest snapshot on the regular basis to keep users up to date on actual system state. Users can also configure Only the latest snapshot is available for reporting in Auditor. If you want to generate reports based on different snapshots, you must import snapshots to the Audit Database. | +| Monitor changes to system components | Select the system components that you want to audit for changes. Review the following for additional information:
  • General computer settings—Enables auditing of general computer settings. For example, computer name or workgroup changes.
  • Hardware—Enables auditing of hardware devices configuration. For example, your network adapter configuration changes.
  • Add/Remove programs—Enables auditing of installed and removed programs. For example, Microsoft Office package has been removed from the audited Windows Server.
  • Services—Enables auditing of started/stopped services. For example, the Windows Firewall service stopped.
  • Audit policies—Enables auditing of local advanced audit policies configuration. For example, the Audit User Account Management advanced audit policy is set to "_Failure_".
  • DHCP configuration—Enables auditing of DHCP configuration changes.
  • Scheduled tasks—Enables auditing of enabled / disabled / modified scheduled tasks. For example, the GoogleUpdateTaskMachineUA scheduled task trigger changes.
  • Local users and groups—Enables auditing of local users and groups. For example, an unknown user was added to the Administrators group.
  • DNS configuration—Enables auditing of your DNS configuration changes. For example, your DNS security parameters' changes.
  • DNS resource records—Enables auditing of all types of DNS resource records. For example, A-type resource records (Address record) changes.
  • File shares—Enables auditing of created / removed / modified file shares and their properties. For example, a new file share was created on the audited Windows Server.
  • Removable media—Enables auditing of USB thumb drives insertion.
| +| Specify data collection method | You can enable **network traffic compression.** If enabled, the product automatically launches a Compression Service on the audited computer to collect and prefilter data. This significantly improves data transfer and minimizes the impact on the target computer performance. | +| Configure audit settings | You can adjust audit settings automatically. Auditor checks your current audit settings on each data collection and adjusts them if necessary. Netwrix recommends this method for evaluation purposes in test environments. If Auditor detects conflicts with your current audit settings, it doesn't perform automatic audit configuration. Don't select the checkbox if you want to configure audit settings manually. See the [Windows Server](/docs/auditor/10.8/configuration/windowsserver/overview.md) configuration topic for additional information about audit settings required to collect comprehensive audit data and the instructions on how to configure them. | +| Collect data for state-in-time reports | Configure Auditor to store daily snapshots of your system configuration required for further state-in-time reports generation. See the [State–In–Time Reports](/docs/auditor/10.8/admin/reports/types/stateintime/overview.md) topic for additional information. In the Manage historical snapshots section, you can click **Manage** and select the snapshots that you want to import to the Audit Database to generate a report on the data source's state at the specific moment in the past. You must have the Global administrator or the Global reviewer role to import snapshots. Move the selected snapshots to the Snapshots available for reporting list using the arrow button. The product updates the latest snapshot regularly to keep users up to date on the actual system state. Users can also configure Only the latest snapshot is available for reporting in Auditor. If you want to generate reports based on different snapshots, you must import snapshots to the Audit Database. | | Activity | | -| Specify monitoring restrictions | Specify restriction filters to narrow your Windows Server monitoring scope (search results, reports, and Activity Summaries). For example, you can exclude system activity on a particular objects on all computers. All filters are applied using AND logic. Click Add and complete the following fields: - User who initiated the change: – provide the name of the user whose changes you want to ignore as shown in the "_Who_" column of reports and Activity Summaries. Example: _mydomain\user1_. You can provide the "_System_" value to exclude events containing the “_System_” instead of an account name in the “_Who_” column. - Windows Server which setting was changed: – provide the name of the server in your IT infrastructure whose changes you want to ignore as shown in the "_What_" column of reports and Activity Summaries. Example: _winsrv2016-01.mydomain.local_. - Setting changed: – provide the name for unwanted settings as shown in the "_What_" column in reports and Activity Summaries. Example: _System Properties\*_. You can use a wildcard (\*) to replace any number of characters in filters. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. The new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.8/admin/monitoringplans/overview.md)topic for additional information. | +| Specify monitoring restrictions | Specify restriction filters to narrow your Windows Server monitoring scope (search results, reports, and Activity Summaries). For example, you can exclude system activity on a particular objects on all computers. The product applies all filters using AND logic. Click Add and complete the following fields:
  • User who initiated the change: provide the name of the user whose changes you want to ignore as shown in the "_Who_" column of reports and Activity Summaries. Example: _mydomain\user1_. You can provide the "_System_" value to exclude events containing the “_System_” instead of an account name in the “_Who_” column.
  • Windows Server which setting was changed: provide the name of the server in your IT infrastructure whose changes you want to ignore as shown in the "_What_" column of reports and Activity Summaries. Example: _winsrv2016-01.mydomain.local_.
  • Setting changed: provide the name for unwanted settings as shown in the "_What_" column in reports and Activity Summaries. Example: _System Properties\*_.
You can use a wildcard (\*) to replace any number of characters in filters. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. The new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.8/admin/monitoringplans/overview.md) topic for additional information. | Review your data source settings and click **Add** to go back to your plan. The newly created data source will appear in the **Data source** list. As a next step, click **Add item** to specify an @@ -38,11 +37,11 @@ information. ## Computer -Select the account that will be used to collect data for this item. If you want to use a specific +Select the account you want to use to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select account type you want to use and enter credentials. The following choices are available: -- User/password. The account must be granted the same permissions and access rights as the default +- User/password. The account must have the same permissions and access rights as the default account used for data collection. See the [Data Collecting Account](/docs/auditor/10.8/admin/monitoringplans/dataaccounts.md) topic for additional information. - Group Managed Service Account (gMSA). You should specify only the account name in the @@ -61,7 +60,7 @@ Complete the following fields: | --------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | General | | | Specify IP range | Specify an IP range for the audited computers. To exclude computers from within the specified range, click **Exclude**. Enter the IP subrange you want to exclude, and click **Add**. | -| Specify the account for collecting data | Select the account that will be used to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select **Custom account** and enter credentials. The credentials are case sensitive. A custom account must be granted the same permissions and access rights as the default account used for data collection. See the [Data Collecting Account](/docs/auditor/10.8/admin/monitoringplans/dataaccounts.md) topic for additional information. | +| Specify the account for collecting data | Select the account the same way as for the [Computer](#computer) item. | ## AD Container @@ -70,19 +69,17 @@ Complete the following fields: | Option | Description | | --------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | General | | -| Specify AD container | Specify a whole AD domain, OU, or container. Click **Browse** to select from the list of containers in your network. You can also: - Select a particular computer type to be audited within the chosen AD container: **Domain controllers, Servers (excluding domain controllers)**, or **Workstations**. - Click **Exclude** to specify AD domains, OUs, and containers you don't want to audit. In the Exclude Containers dialog, click Add and specify an object. The list of containers doesn't include child domains of trusted domains. Use other options **(Computer, IP range** to specify the target computers. | -| Specify the account for collecting data | Select the account that will be used to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select **Custom account** and enter credentials. The credentials are case sensitive. If using a group Managed Service Account (gMSA), you can specify only the account name in the _domain\account$_ format. Password field can be empty. Starting with version 10.7, you can implement the integration between Netwrix Auditor and Netwrix Privilege Secure. See the [Netwrix Privilege Secure](/docs/auditor/10.8/admin/settings/privilegesecure.md) topic for additional information. Refer to the [Permissions for Active Directory Auditing](/docs/auditor/10.8/configuration/activedirectory/permissions.md) topic for more information on using Netwrix Privilege Secure as an account for data collection. A custom account must be granted the same permissions and access rights as the default account used for data collection. See the[Data Collecting Account](/docs/auditor/10.8/admin/monitoringplans/dataaccounts.md) topic for additional information. | -| Containers and Computers | | -| Monitor hidden shares | By default, Auditor will monitor all shares stored in the specified location, except for hidden shares (both default and user-defined). Select **Monitor user-defined hidden shares** if necessary. Even when this option is selected, the product will not collect data from administrative hidden shares such as: default system root or Windows directory (ADMIN$), default drive shares (D$, E$, etc.), shares used by printers to enable remote administration (PRINT$), etc. | -| Specify monitoring restrictions | Specify restriction filters to narrow your monitoring scope (search results, reports, and Activity Summaries). All filters are applied using AND logic. Depending on the type of the object you want to exclude, select one of the following: - Add AD Container – Browse for a container to be excluded from being audited. You can select a whole AD domain, OU, or container. - Add Computer – Provide the name of the computer you want to exclude as shown in the "_Where_" column of reports and Activity Summaries. For example, _backupsrv01.mydomain.local_. Wildcards (\*) aren't supported. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. The new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.8/admin/monitoringplans/overview.md)topic for additional information. | +| Specify AD container | Specify a whole AD domain, OU, or container. Click **Browse** to select from the list of containers in your network. You can also:
  • Select a particular computer type to audit within the chosen AD container: **Domain controllers, Servers (excluding domain controllers)**, or **Workstations**.
  • Click **Exclude** to specify AD domains, OUs, and containers you don't want to audit. In the Exclude Containers dialog, click Add and specify an object. The list of containers doesn't include child domains of trusted domains.
Use other options (**Computer**, **IP range**) to specify the target computers. | +| Specify the account for collecting data | Select the account the same way as for the [Computer](#computer) item. | +| Specify monitoring restrictions | Specify restriction filters to narrow your monitoring scope (search results, reports, and Activity Summaries). The product applies all filters using AND logic. Depending on the type of the object you want to exclude, select one of the following:
  • Add AD Container – Browse for a container to exclude from auditing. You can select a whole AD domain, OU, or container.
  • Add Computer – Provide the name of the computer you want to exclude as shown in the "_Where_" column of reports and Activity Summaries. For example, _backupsrv01.mydomain.local_. The product doesn't support wildcards (\*).
In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. The new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Windows Server Monitoring Scope](/docs/auditor/10.8/admin/monitoringplans/windows/scope.md) topic for additional information. | ## Use Netwrix Privilege Secure as a Data Collecting Account Starting with version 10.7, you can use Netwrix Privilege Secure to manage the account for collecting data, after configuring the integration. See the [Netwrix Privilege Secure](/docs/auditor/10.8/admin/settings/privilegesecure.md) topic for additional information about -integration and supported data sources. In this case, the credentials will not be stored by Netwrix -Auditor. Instead, they will be managed by Netwrix Privilege Secure and provided on demand, ensuring +integration and supported data sources. In this case, Netwrix Auditor doesn't store the credentials. +Instead, Netwrix Privilege Secure manages them and provides them on demand, ensuring password rotation or using temporary accounts for data collection. To use Netwrix Privilege Secure as an account for data collection. @@ -97,8 +94,8 @@ collection. **Step 3 –** Select the type of the Access Policy you want to use in Netwrix Privilege Secure. Credential-based is the default option. Refer to the [Netwrix Privilege Secure Access Policies documentation](https://helpcenter.netwrix.com/category/privilegesecure_accessmanagement) for details. -In this case, you need to provide the username of the account managed by Netwrix Privilege Secure, -and to which Netwrix Auditor has the access through a Credential-based access policy. +In this case, provide the username of the account that Netwrix Privilege Secure manages and that +Netwrix Auditor can access through a Credential-based access policy. **NOTE:** Netwrix recommends using different credentials for different monitoring plans and data sources. @@ -109,8 +106,8 @@ The second option is Resource-based. To use this option, you need to provide the Resource names, assigned to Netwrix Auditor in the corresponding Resource-based policy. Ensure that you specified the same names as in Netwrix Privilege Secure. -The Resource name in this case is where the activity will be performed. For example, if you grant +The Resource name in this case is where the activity takes place. For example, if you grant the data collecting account the access to a local Administrators group - the resource is the server -where the permission will be granted. +where you grant the permission. Netwrix Privilege Secure is ready to use as an account for data collection. diff --git a/docs/auditor/10.8/configuration/useractivity/datacollection.md b/docs/auditor/10.8/configuration/useractivity/datacollection.md index ce1f170e6d..1926faf98f 100644 --- a/docs/auditor/10.8/configuration/useractivity/datacollection.md +++ b/docs/auditor/10.8/configuration/useractivity/datacollection.md @@ -10,18 +10,20 @@ To successfully track user activity, ensure that the following settings are conf audited computers and on the computer where Netwrix Auditor Server is installed: - The **Windows Management Instrumentation** and the **Remote Registry** services are running and - their **Startup Type** is set to _"Automatic"_. See the Check the Windows Services Status topic - for additional information. + their **Startup Type** is set to _"Automatic"_. See the + [Check the Windows Services Status](#check-the-windows-services-status) topic for additional + information. - The **File and Printer Sharing** and the **Windows Management Instrumentation** features are - allowed to communicate through Windows Firewall. See the Windows Features Communication topic for - additional information. + allowed to communicate through Windows Firewall. See the + [Windows Features Communication](#windows-features-communication) topic for additional + information. - Local TCP Port 9004 is opened for inbound connections on the computer where Netwrix Auditor Server - is installed. This is done automatically on the product installation. See the Open Local TCP Port - 9004 topic for additional information. -- Local TCP Port 9003 is opened for inbound connections on the audited computers. See the Open Local - TCP Port 9003 topic for additional information. -- Remote TCP Port 9004 is opened for outbound connections on the audited computers. See the Open - Remote TCP Port 9004 topic for additional information. + is installed. The product does this automatically during installation. See the + [Open Local TCP Port 9004](#open-local-tcp-port-9004) topic for additional information. +- Local TCP Port 9003 is opened for inbound connections on the audited computers. See the + [Open Local TCP Port 9003](#open-local-tcp-port-9003) topic for additional information. +- Remote TCP Port 9004 is opened for outbound connections on the audited computers. See the + [Open Remote TCP Port 9004](#open-remote-tcp-port-9004) topic for additional information. ## Check the Windows Services Status @@ -37,7 +39,7 @@ its status is _"Started"_ (on pre-Windows Server 2012 versions) and _"Running"_ service. In the **Remote Registry Properties** dialog, in the **General** tab, select _"Automatic"_ from the dropdown list. -**Step 4 –** Perform the steps above for the **Windows Management Instrumentation** service. +**Step 4 –** Repeat these steps for the **Windows Management Instrumentation** service. ## Windows Features Communication @@ -67,7 +69,7 @@ settings** on the left. **Step 3 –** In the Windows Firewall with Advanced Security dialog, select Inbound Rules on the left. -**Step 4 –** Click New Rule. In the New Inbound Rule wizard, complete the steps as described below: +**Step 4 –** Click New Rule. In the New Inbound Rule wizard, complete the following steps: - On the Rule Type step, select Program. - On the Program step, specify the path: %Netwrix Auditor installation folder%/Netwrix Auditor/User @@ -78,7 +80,7 @@ left. **Step 5 –** Double-click the newly created rule and open the Protocols and Ports tab. -**Step 6 –** In the Protocols and Ports tab, complete the steps as described below: +**Step 6 –** In the Protocols and Ports tab, complete the following steps: - Set Protocol type to _"TCP"_. - Set Local port to _"Specific Ports"_ and specify to _"9004"_. @@ -96,7 +98,7 @@ settings** on the left. **Step 3 –** In the Windows Firewall with Advanced Security dialog, select Inbound Rules on the left. -**Step 4 –** Click New Rule. In the New Inbound Rule wizard, complete the steps as described below. +**Step 4 –** Click New Rule. In the New Inbound Rule wizard, complete the following steps. | Option | Setting | | --------- | ---------------------------------------------------------------------------------------------------------------------------------- | @@ -108,7 +110,7 @@ left. **Step 5 –** Double-click the newly created rule and open the Protocols and Ports tab. -**Step 6 –** In the Protocols and Ports tab, complete the steps as described below: +**Step 6 –** In the Protocols and Ports tab, complete the following steps: - Set Protocol type to _"TCP"_. - Set Local port to _"Specific Ports"_ and specify to _"9003"_. @@ -126,7 +128,7 @@ settings** on the left. **Step 3 –** In the Windows Firewall with Advanced Security dialog, select Outbound Rules on the left. -**Step 4 –** Click New Rule. In the New Outbound Rule wizard, complete the steps as described below. +**Step 4 –** Click New Rule. In the New Outbound Rule wizard, complete the following steps. | Option | Setting | | --------- | ---------------------------------------------------------------------------------------------------------------------------------- | @@ -138,7 +140,7 @@ left. **Step 5 –** Double-click the newly created rule and open the Protocols and Ports tab. -**Step 6 –** In the Protocols and Ports tab, complete the steps as described below: +**Step 6 –** In the Protocols and Ports tab, complete the following steps: - Set Protocol type to _"TCP"_. - Set Remote port to _"Specific Ports"_ and specify to _"9004"_. diff --git a/docs/auditor/10.8/configuration/useractivity/overview.md b/docs/auditor/10.8/configuration/useractivity/overview.md index 135477a24a..d702086327 100644 --- a/docs/auditor/10.8/configuration/useractivity/overview.md +++ b/docs/auditor/10.8/configuration/useractivity/overview.md @@ -9,10 +9,10 @@ sidebar_position: 120 Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and access auditing requires a certain configuration of native audit settings in the audited environment and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data -integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data. +certain built-in Windows services, etc. Proper audit configuration ensures audit data integrity. +Without it, your change reports may contain warnings, errors, or incomplete audit data. -**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See +**CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. @@ -21,14 +21,14 @@ You can use group Managed Service Accounts (gMSA) as data collecting accounts. You can configure your IT Infrastructure for monitoring in one of the following ways: -- **Automatically through a monitoring plan** – This is a recommended method. If you select to - automatically configure audit in the target environment, your current audit settings will be - checked on each data collection and adjusted if necessary. -- **Manually** – Native audit settings must be adjusted manually to ensure collecting comprehensive and +- **Automatically through a monitoring plan** – Netwrix recommends this method. If you select to + automatically configure audit in the target environment, Auditor checks your current audit + settings on each data collection and adjusts them if necessary. +- **Manually** – You must adjust native audit settings manually to ensure collecting comprehensive and reliable audit data. You can enable Auditor to continually enforce the relevant audit policies or configure them manually. - **IMPORTANT:** Even if automatic configuration is selected, the following prerequisites must be configured manually. + **IMPORTANT:** Even if you select automatic configuration, you must configure the following prerequisites manually. - On the audited systems: @@ -39,8 +39,9 @@ You can configure your IT Infrastructure for monitoring in one of the following - Local **TCP Port 9003** must be opened for inbound connections. - Remote **TCP Port 9004** must be opened for outbound connections. - The **User Activity Core Service** must be installed on the monitored computers. - It is deployed automatically by Netwrix Auditor, provided that all required prerequisites are met. If necessary, you can install it manually. - For manual installation instructions, see the _Install Netwrix Auditor Agent to Audit User Activity_ topic below. + Netwrix Auditor deploys it automatically, provided that your environment meets all required prerequisites. If necessary, you can install it manually. + For manual installation instructions, see the + [Install for User Activity Core Service](/docs/auditor/10.8/install/useractivitycoreservice.md) topic. - **.NET Framework 4.8** must be installed. - On the Netwrix Auditor host system/server: @@ -56,28 +57,31 @@ See the following topics for additional information: - [Configure Data Collection Settings](/docs/auditor/10.8/configuration/useractivity/datacollection.md) - [Configure Video Recordings Playback Settings](/docs/auditor/10.8/configuration/useractivity/videorecordings.md) +- [Install for User Activity Core Service](/docs/auditor/10.8/install/useractivitycoreservice.md) ## User Sessions Review a full list of all session actions when auditing user sessions with Netwrix Auditor. -| Object type | Action | What | Description | -| --------------------------- | -------------------------------- | ----------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------- | -| User session | Session start | Monitoring start | - Logon (session creation) - Start of monitoring (after service install or deploy) | -| Session start | Local session start | — | | -| Session end | Sign-out | - User initiated sign-out / logoff | | -| Session end | Shutdown | - Computer shutdown - Service stop / crash (appears after one starts service again) | | -| Session start / Session end | Screensaver off / Screensaver on | — | | -| Session start / Session end | Unlock / Lock | — | | -| Session start | Console connection | - Connect locally to existing session | | -| Session end | Console disconnection | - Switch user - Remote connect to existing session | | -| Session start | Remote connection | - Connect through RDP | | -| Session end | Remote disconnection | - Disconnect in RDP or just close RDP session | | +Netwrix Auditor reports all of these actions under the **User session** object type. + +| Action | What | Description | +| ---------------------------- | --------------------------------- | -------------------------------------------------------------------------------------------------------- | +| Session start | Monitoring start |
  • Logon (session creation)
  • Start of monitoring (after service install or deploy)
| +| Session start | Local session start | — | +| Session end | Sign-out | User initiated sign-out / logoff | +| Session end | Shutdown |
  • Computer shutdown
  • Service stop / crash (appears after one starts service again)
| +| Session start / Session end | Screensaver off / Screensaver on | — | +| Session start / Session end | Unlock / Lock | — | +| Session start | Console connection | Connect locally to existing session | +| Session end | Console disconnection |
  • Switch user
  • Remote connect to existing session
| +| Session start | Remote connection | Connect through RDP | +| Session end | Remote disconnection | Disconnect in RDP or just close RDP session | ### Run As Monitoring Netwrix Auditor for User Activity can monitor programs executed under different user accounts. -Review the table below to discover how different "run as" scenarios are reflected in the product. +Review the following table to discover how the product reflects different "run as" scenarios. | Object type | Details | Description | | --------------- | ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------- | @@ -85,32 +89,3 @@ Review the table below to discover how different "run as" scenarios are reflecte | Window | Application Run As: `` | Standard user runs an application under credentials of another standard user. | | Elevated Window | Application Run As: `` | User runs program through Run As Administrator or Accepts UAC (User Account Control) elevation prompts. | | Elevated Window | None | Administrator needs to run the program with Run as Administrator enabled. Server Manager is one of the main examples for this case. | - -## Install Netwrix Auditor Agent to Audit User Activity - -By default, the agent is installed automatically on the audited computers upon the **New Managed -Object** wizard completion. If, for some reason, installation has failed, you must install the agent -manually on each of the audited computers. - -Before installing Netwrix Auditor agent to audit user activity, ensure that: - -- The audit settings are configured properly. -- The Data Processing Account has access to the administrative shares. - -To install Netwrix Auditor agent to audit user activity. - -**Step 1 –** Navigate to _%Netwrix Auditor Installation Folder%\User Activity Video Recording_ and -copy the UACoreSvcSetup.msi file to the audited computer. - -**NOTE:** This is the default location. However, it may be changed because users can move this -folder. - -**Step 2 –** Run the installation package. - -**Step 3 –** Follow the instructions of the setup wizard. When prompted, accept the license -agreement and specify the installation folder. - -**Step 4 –** On the Agent Settings page, specify the host server (i.e., the name of the computer -where Netwrix Auditor is installed) and the server TCP port. - -Netwrix Auditor agent is installed and ready to audit user activity. diff --git a/docs/auditor/10.8/configuration/useractivity/ports.md b/docs/auditor/10.8/configuration/useractivity/ports.md index 8834d40722..d3e2ac93a7 100644 --- a/docs/auditor/10.8/configuration/useractivity/ports.md +++ b/docs/auditor/10.8/configuration/useractivity/ports.md @@ -21,9 +21,9 @@ allow inbound connections to local 9004 TCP port. | -------------------- | -------- | ---------------------- | ---------------------- | ---------------------------------------------------------------------------------------------- | | 9004 | TCP | Monitored computer | Netwrix Auditor Server | Network Traffic Compression Service communications | | 9003 | TCP | Netwrix Auditor Server | Monitored computer | Network Traffic Compression Service communications | -| 139 445 | TCP | Netwrix Auditor Server | Monitored computer | Service Control Manager Remote Protocol (RPC) Remote registry | +| 139, 445 | TCP | Netwrix Auditor Server | Monitored computer | Service Control Manager Remote Protocol (RPC) Remote registry | | Dynamic: 1024 -65535 | TCP | Netwrix Auditor Server | Monitored computer | Windows Management Instrumentation | -| 135 | TCP | Netwrix Auditor Server | Monitored computer | Service Control Manager Remote Protocol (RPC) Network Traffic Compression Service installation | -| 137 through 139 | UDP | Netwrix Auditor Server | Monitored computer | Service Control Manager Remote Protocol (RPC) Network Traffic Compression Service installation | +| 135 | TCP | Netwrix Auditor Server | Monitored computer | Service Control Manager Remote Protocol (RPC) — Network Traffic Compression Service installation | +| 137 through 139 | UDP | Netwrix Auditor Server | Monitored computer | Service Control Manager Remote Protocol (RPC) — Network Traffic Compression Service installation | | 445 | TCP | Netwrix Auditor Server | Monitored computer | SMB 2.0/3.0 Video files copy | | – | ICMP | Netwrix Auditor Server | Monitored computer | Network Traffic Compression Service communications | diff --git a/docs/auditor/10.8/configuration/useractivity/videorecordings.md b/docs/auditor/10.8/configuration/useractivity/videorecordings.md index 3e3c4eda61..1f87f670ef 100644 --- a/docs/auditor/10.8/configuration/useractivity/videorecordings.md +++ b/docs/auditor/10.8/configuration/useractivity/videorecordings.md @@ -6,47 +6,48 @@ sidebar_position: 30 # Configure Video Recordings Playback Settings -Video recordings of users' activity can be watched in any Netwrix Auditor client. Also, recordings +You can watch video recordings of users' activity in any Netwrix Auditor client. Also, recordings are available as links in web-based reports and email-based Activity Summaries. You can use group Managed Service Accounts (gMSA) as data collecting accounts. -To be able to watch video files captured by Netwrix Auditor via console, the following settings must -be configured: +To watch video files captured by Netwrix Auditor via console, configure the following settings: - The user must have read permissions (resultant set) to the **Netwrix_UAVR$** shared folder where video files are stored. By default, all members of the **Netwrix Auditor Client Users** group can - access this shared folder. Both the group and the folder are created automatically by Netwrix - Auditor. Ensure to grant sufficient permissions on folder or explicitly add user to the group - (regardless his or her role delegated in the product). See the To Add an Account to Netwrix - Auditor Client Users Group topic for additional information. -- A dedicated codec must be installed. This codec is installed automatically on the computer where - Netwrix Auditor is deployed, and on the monitored computers. To install it on a different + access this shared folder. Netwrix Auditor creates both the group and the folder automatically. + Grant sufficient permissions on the folder or explicitly add the user to the group, regardless of + the role delegated to them in the product. See the + [To Add an Account to Netwrix Auditor Client Users Group](#to-add-an-account-to-netwrix-auditor-client-users-group) + topic for additional information. +- A dedicated codec must be installed. Netwrix Auditor installs this codec automatically on the + computer where you deploy it, and on the monitored computers. To install it on a different computer, download it from [https://www.netwrix.com/download/ScreenPressorNetwrix.zip](https://www.netwrix.com/download/ScreenPressorNetwrix.zip). - The Ink and Handwriting Services, Media Foundation, and Desktop Experience Windows features must be installed on the computer where Netwrix Auditor Server is deployed. These features allow - enabling Windows Media Player and sharing video recordings via DLNA. See the To Enable Windows - Features topic for additional information. + enabling Windows Media Player and sharing video recordings via DLNA. See the + [To Enable Windows Features](#to-enable-windows-features) topic for additional information. -To be able to watch video files captured by Netwrix Auditor via direct links, the following settings -must be configured: +To watch video files captured by Netwrix Auditor via direct links, configure the following settings: - Microsoft Internet Explorer 7.0 and above must be installed and ActiveX must be enabled. -- Internet Explorer security settings must be configured properly. See the To Configure Internet - Explorer Security Settings topic for additional information. -- JavaScript must be enabled. See the To Enable JavaScript topic for additional information. -- Internet Explorer Enhanced Security Configuration (IE ESC) must be disabled. See the To Disable - Internet Explorer Enhanced Security Configuration (IE ESC) topic for additional information. - -All Internet Explorer-related settings are relevant only for those who watch videos not in Netwrix -Auditor console. - -**NOTE:** Microsoft is in the process of deprecating Internet Explorer. However, if you are trying -to access the video recordings from browser via direct links (reports on SSRS portal, subscriptions, -activity summaries, search export results), IE engine should be present on the client machine. IE -might be disabled with GPO, but it shouldn't be removed completely. Recommended option is to use -Edge with "IE mode" option enabled. +- Internet Explorer security settings must be configured properly. See the + [To Configure Internet Explorer Security Settings](#to-configure-internet-explorer-security-settings) + topic for additional information. +- JavaScript must be enabled. See the [To Enable JavaScript](#to-enable-javascript) topic for + additional information. +- Internet Explorer Enhanced Security Configuration (IE ESC) must be disabled. See the + [To Disable Internet Explorer Enhanced Security Configuration (IE ESC)](#to-disable-internet-explorer-enhanced-security-configuration-ie-esc) + topic for additional information. + +All Internet Explorer-related settings are relevant only for those who watch videos outside the +Netwrix Auditor console. + +**NOTE:** Microsoft is deprecating Internet Explorer. However, if you access the video recordings +from a browser via direct links (reports on SSRS portal, subscriptions, activity summaries, search +export results), the IE engine must be present on the client machine. You can disable IE with GPO, +but don't remove it completely. Netwrix recommends using Edge with the "IE mode" option enabled. ## To Configure Internet Explorer Security Settings @@ -82,8 +83,8 @@ disable it. ## To Add an Account to Netwrix Auditor Client Users Group -All members of the Netwrix Auditor Client Users group are granted the Global reviewer role in -Netwrix Auditor and have access to all collected data. +Netwrix Auditor grants all members of the Netwrix Auditor Client Users group the Global reviewer +role and access to all collected data. **Step 1 –** On the computer where Netwrix Auditor Server is installed, start the Local Users and Computers snap-in. @@ -92,11 +93,11 @@ Computers snap-in. **Step 3 –** In the Netwrix Auditor Client Users Properties dialog, click **Add**. -**Step 4 –** Specify the users you want to be included in this group. +**Step 4 –** Specify the users you want to add to this group. ## To Enable Windows Features -Follow the steps if Netwrix Auditor Server is installed on the Windows Server 2012 and later. +Follow these steps if Netwrix Auditor Server runs on Windows Server 2012 or later. **Step 1 –** Navigate to **Start** > **Server Manager**. diff --git a/docs/auditor/10.8/configuration/windowsserver/advancedpolicy.md b/docs/auditor/10.8/configuration/windowsserver/advancedpolicy.md index c856f388be..e45d54ad2a 100644 --- a/docs/auditor/10.8/configuration/windowsserver/advancedpolicy.md +++ b/docs/auditor/10.8/configuration/windowsserver/advancedpolicy.md @@ -6,7 +6,7 @@ sidebar_position: 50 # Configure Advanced Audit Policies -Advanced audit policies can be configured instead of local policies. Any of them are required if you +You can configure advanced audit policies instead of local policies. Any of them are required if you want to get the "Who" and "When" values for the changes to the following monitored system components: @@ -22,8 +22,8 @@ components: ## Configure Security Options -Setting up both basic and advanced audit policies may lead to incorrect audit reporting. To force -basic audit policies to be ignored and prevent conflicts, enable the _Audit: Force audit policy +Setting up both basic and advanced audit policies may lead to incorrect audit reporting. To make +Windows ignore basic audit policies and prevent conflicts, enable the _Audit: Force audit policy subcategory settings_ policy. **Step 1 –** On the audited server, open the Local Security Policy snap-in and navigate to Start > @@ -36,55 +36,11 @@ Force audit policy subcategory settings policy. **Step 3 –** Double-click the policy and enable it. -## Configure Advanced Audit Policy on Windows Server 2016 +## Configure Advanced Audit Policy in Local Security Policy -In Windows Server 2016 audit policies aren't integrated with the Group Policies and can only be -deployed using logon scripts generated with the native Windows **auditpol.exe** command line tool. -Therefore, these settings aren't permanent and will be lost after server reboot. - -The procedure below explains how to configure Advanced audit policy for a single server. If you -audit multiple servers, you may want to create logon scripts and distribute them to all target -machines via Group Policy. Refer to the -[Create System Startup / Shutdown and User Logon / Logoff Scripts](https://technet.microsoft.com/en-us/library/dd630947.aspx) -Microsoft article for more information. - -**Step 1 –** On an audited server, navigate to Start > Run and type "cmd". - -**Step 2 –** Disable the Object Access, Account Management, and Policy Change categories by -executing the following command in the command line interface: - -``` -auditpol /set /category:"Object Access" /success:disable /failure:disable -auditpol /set /category:"Account Management" /success:disable /failure:disable -auditpol /set /category:"Policy Change" /success:disable /failure:disable -``` - -**Step 3 –** Enable the following audit subcategories: - -| Audit subcategory | Command | -| -------------------------- | ------------------------------------------------------------------------------------------ | -| Security Group Management | `auditpol /set /subcategory:"Security Group Management" /success:enable /failure:disable` | -| User Account Management | `auditpol /set /subcategory:"User Account Management" /success:enable /failure:disable` | -| Handle Manipulation | `auditpol /set /subcategory:"Handle Manipulation" /success:enable /failure:disable` | -| Other Object Access Events | `auditpol /set /subcategory:"Other Object Access Events" /success:enable /failure:disable` | -| Registry | `auditpol /set /subcategory:"Registry" /success:enable /failure:disable` | -| File Share | `auditpol /set /subcategory:"File Share" /success:enable /failure:disable` | -| Audit Policy Change | `auditpol /set /subcategory:"Audit Policy Change" /success:enable /failure:disable` | - -It is recommended to disable all other subcategories unless you need them for other purposes. You -can check your current effective settings by executing the following commands: - -``` -auditpol /set /category:"Object Access"  -auditpol /set /category:"Account Management"  -auditpol /set /category:"Policy Change"  -``` - -## Configure Advanced Audit Policy on Windows Server 2016 and Above - -In Windows Server 2016 and above, Advanced audit policies are integrated with Group Policies, so -they can be applied via Group Policy Object or Local Security Policies. The procedure below -describes how to apply Advanced policies via Local Security Policy console. +Advanced audit policies integrate with Group Policies, so you can apply them via Group Policy +Object or Local Security Policies. The following procedure describes how to apply Advanced policies +via the Local Security Policy console. **Step 1 –** On the audited server, open the **Local Security Policy** snap-in and navigate to Start > Windows Administrative Tools >Local Security Policy. diff --git a/docs/auditor/10.8/configuration/windowsserver/eventlog.md b/docs/auditor/10.8/configuration/windowsserver/eventlog.md index 5525bd089f..943f1ddc88 100644 --- a/docs/auditor/10.8/configuration/windowsserver/eventlog.md +++ b/docs/auditor/10.8/configuration/windowsserver/eventlog.md @@ -6,8 +6,8 @@ sidebar_position: 60 # Adjusting Event Log Size and Retention Settings -Consider that if the event log size is insufficient, overwrites may occur before data is written to -the Long-Term Archive and the Audit Database, and some audit data may be lost. +Consider that if the event log size is insufficient, overwrites may occur before the product writes +data to the Long-Term Archive and the Audit Database, and you may lose some audit data. To prevent overwrites, you can increase the maximum size of the event logs and set retention method for these logs to "_Overwrite events as needed_". This refers to the following event logs: @@ -16,16 +16,17 @@ for these logs to "_Overwrite events as needed_". This refers to the following e - Security - Setup - System -- Applications and Services logs > Microsoft>Windows > TaskScheduler > Operational +- Applications and Services logs > Microsoft > Windows > TaskScheduler > Operational - Applications and Services logs > Microsoft > Windows > DNS-Server > Audit (only for DCs running Windows Server 2012 R2 and above) - Applications and Services logs > AD FS > Admin log (for AD FS servers ) See the [recommended event log settings](https://support.microsoft.com/en-us/help/957662/recommended-settings-for-event-log-sizes-in-windows) article for more information. -The procedure below provides a possible way to specify the event log settings manually. However, if -you have multiple target computers, consider configuring these settings via Group Policy as also -described in this section +The following procedure provides a possible way to specify the event log settings manually. However, +if you have multiple target computers, consider configuring these settings via Group Policy as +described in +[Configure the Event Log Size Using Group Policy](#configure-the-event-log-size-using-group-policy). ## Configure the Event Log Size Manually @@ -77,8 +78,7 @@ Configuration > Policies > Administrative Templates > Windows Components > Event **Step 2 –** Select the log you need. -**Step 3 –** Edit Specify the maximum log file size setting; the value is usually set to _4194240 -KB_. +**Step 3 –** Edit Specify the maximum log file size setting; the value is usually _4194240 KB_. **Step 4 –** Specify retention settings for the log; usually it is Overwrite as needed. @@ -93,7 +93,7 @@ HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Directory Service ![gpo_eventlog_regedit_thumb_0_0](/images/auditor/10.7/configuration/windowsserver/gpo_eventlog_regedit_thumb_0_0.webp) You can configure Group Policy Preferences to push registry changes to the target domain computers. -For the example above (Directory Service Log), perform the following steps. +For the preceding example (Directory Service Log), perform the following steps. **Step 1 –** In Group Policy Management Console on the domain controller go to **Computer > Preferences > Windows Settings > Registry**. diff --git a/docs/auditor/10.8/configuration/windowsserver/iis.md b/docs/auditor/10.8/configuration/windowsserver/iis.md index c8f515616f..9cbea114c0 100644 --- a/docs/auditor/10.8/configuration/windowsserver/iis.md +++ b/docs/auditor/10.8/configuration/windowsserver/iis.md @@ -6,8 +6,8 @@ sidebar_position: 100 # Internet Information Services (IIS) -To be able to process Internet Information Services (IIS) events, you must enable the Remote -Registry service on the target computers. [Windows Server](/docs/auditor/10.8/configuration/windowsserver/overview.md) +To process Internet Information Services (IIS) events, you must enable the Remote +Registry service on the target computers. See [Enable Remote Registry](/docs/auditor/10.8/configuration/windowsserver/remoteregistry.md) for more information. To configure the Operational log size and retention method diff --git a/docs/auditor/10.8/configuration/windowsserver/overview.md b/docs/auditor/10.8/configuration/windowsserver/overview.md index 7fbac706b7..397b883db8 100644 --- a/docs/auditor/10.8/configuration/windowsserver/overview.md +++ b/docs/auditor/10.8/configuration/windowsserver/overview.md @@ -9,20 +9,20 @@ sidebar_position: 140 Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and access auditing requires a certain configuration of native audit settings in the audited environment and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data -integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data. +certain built-in Windows services, etc. Proper audit configuration ensures audit data integrity. +Without it, your change reports may contain warnings, errors, or incomplete audit data. -**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See +**CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. You can configure your IT Infrastructure for monitoring in one of the following ways: -- Automatically through a monitoring plan – This is a recommended method. If you select to - automatically configure audit in the target environment, your current audit settings will be - checked on each data collection and adjusted if necessary. -- Manually – Native audit settings must be adjusted manually to ensure collecting comprehensive and +- Automatically through a monitoring plan – Netwrix recommends this method. If you select to + automatically configure audit in the target environment, Auditor checks your current audit + settings on each data collection and adjusts them if necessary. +- Manually – You must adjust native audit settings manually to ensure collecting comprehensive and reliable audit data. You can enable Auditor to continually enforce the relevant audit policies or configure them manually: @@ -35,21 +35,16 @@ You can configure your IT Infrastructure for monitoring in one of the following - The Audit: Force audit policy subcategory settings (Windows 7 or later) security option must be enabled. - - For Windows Server 2008—The Object Access, Account Management, and Policy Change - categories must be disabled while the Security Group Management, User Account Management, - Handle Manipulation, Other Object Access Events, Registry, File Share, and Audit Policy - Change subcategories must be enabled for _"Success"_. - - For Windows Server 2008 R2 / Windows 7 and above—Audit Security Group Management, Audit - User Account Management, Audit Handle Manipulation, Audit Other Object Access Events, - Audit Registry, Audit File Share, and Audit Policy Change advanced audit policies - must be set to _"Success"_. + - Audit Security Group Management, Audit User Account Management, Audit Handle + Manipulation, Audit Other Object Access Events, Audit Registry, Audit File Share, and + Audit Policy Change advanced audit policies must be set to _"Success"_. - See the [Configure Local Audit Policies](/docs/auditor/10.8/configuration/windowsserver/localpolicy.md) topic and the [Configure Advanced Audit Policies](/docs/auditor/10.8/configuration/windowsserver/advancedpolicy.md) topic for additional information. - The following legacy audit policies can be configured instead of advanced: Audit object access, Audit policy change, and **Audit account management** must be set to _"Success"_. - - The Enable Persistent Time Stamp local group policy must be enabled. This policy should be - configured manually since Auditor doesn't enable it automatically. See the + - The Enable Persistent Time Stamp local group policy must be enabled. You must configure this + policy manually because Auditor doesn't enable it automatically. See the [Configure Enable Persistent Time Stamp Policy](/docs/auditor/10.8/configuration/windowsserver/persistenttimestamp.md) topic for additional information. - The Application, Security, and System event log maximum size must be set to 4 GB. The @@ -83,7 +78,7 @@ You can configure your IT Infrastructure for monitoring in one of the following - Performance Logs and Alerts (TCP-In) - If the audited servers are behind the Firewall, review the list of protocols and ports - required for Netwrix Auditor and ensure that these ports are opened. See the + required for Netwrix Auditor and ensure that these ports are open. See the [Windows Server Ports](/docs/auditor/10.8/configuration/windowsserver/ports.md) topic for additional information. - For auditing removable storage media, two Event Trace Session objects must be created. See the [Configure Removable Storage Media for Monitoring](/docs/auditor/10.8/configuration/windowsserver/removablestorage.md) topic for additional @@ -106,147 +101,138 @@ remember to do the following: 2. Configure required protocols and ports, as described in the [Windows Server Ports](/docs/auditor/10.8/configuration/windowsserver/ports.md) topic. -## Exclude Monitored Objects +## Windows Server Monitoring Scope You can fine-tune Netwrix Auditor by specifying data that you want to exclude from the Windows -Server monitoring scope. - -**Step 1 –** Navigate to the _%Netwrix Auditor installation folder%\Windows Server Auditing_ folder. - -**Step 2 –** Edit the \*.txt files, based on the following guidelines: - -- Each entry must be a separate line. -- Wildcards (\* and ?) are supported. A backslash (\) must be put in front of (\*), (?), (,), and - (\) if they are a part of an entry value. -- Lines that start with the # sign are treated as comments and are ignored. - -| File | Description | Syntax | -| ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| omitcollectlist.txt | Contains a list of objects and their properties to be excluded from being monitored. If you want to restart monitoring these objects, remove them from the omitcollectlist.txt and run data collection at least twice. | `monitoring plan name,server name,class name,property name,property value` `class name` is a mandatory parameter, it can't be replaced with a wildcard. `property name` and `property value` are optional, but can't be replaced with wildcards either. For example: `#*,server,MicrosoftDNS_Server `````` #*,*,StdServerRegProv` | -| omiterrors.txt | Contains a list of errors/warnings to be omitted from logging to the Netwrix Auditor System Health event log. | `monitoring plan name,server name,error text` For example: `*,productionserver1.corp.local,*Access is denied*` | -| omitreportlist.txt | Contains a list of objects to be excluded from reports and Activity Summary emails. In this case audit data is still being collected. | `monitoring plan name,who,where,object type,what,property name` For example: `*,CORP\\jsmith,*,*,*,*` | -| omitsitcollectlist.txt | Contains a list of objects to be excluded from State-in-time reports. | `monitoring planname,server name,class name,property name,property value` `class name` is a mandatory parameter, it can't be replaced with a wildcard. `property name` and `property value` are optional, but can't be replaced with wildcards either. For example: `*,server,MicrosoftDNS_Server` `*,*,StdServerRegProv` | -| omitstorelist.txt | Contains a list of objects to be excluded from being stored to the Audit Archive and showing up in reports. In this case audit data is still being collected. | `monitoring plan name,who,where,object type,what,property name` For example: `*,*,*,Scheduled task,Scheduled Tasks\\User_Feed_Synchronization*,*` | +Server monitoring scope. See the +[Windows Server Monitoring Scope](/docs/auditor/10.8/admin/monitoringplans/windows/scope.md) topic for +additional information. ## Monitored Objects This section lists Windows Server components and settings whose changes Netwrix Auditor can monitor. -When monitoring a Windows Server, Netwrix Auditor needs to audit some registry settings. See the -Windows Server Registry Keys section for additional information. If you want Netwrix Auditor to -audit custom registry keys, see the Monitoring Custom Registry Keys topic for additional information. - -In the table below, double asterisks (\*\*) indicates the components and settings for which the Who -value is reported as _“Not Applicable”_. - -| Object type | Attributes | -| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| General Computer Settings | | -| Computer |
  • System state changed to Started
  • System state changed to Stopped. Reason: Reason type
  • System state changed to Stopped. Reason: unexpected shutdown or system failure
| -| Computer Name |
  • Computer Description
  • Name
  • Domain
| -| Environment Variables |
  • Type
  • Value
| -| Event Log |
  • Event Log Cleared
| -| General |
  • Caption
  • Organization
  • Registered User
  • Serial Number
  • Service Pack\*\*
  • Version\*\*
| -| Remote |
  • Enable Remote Desktop on this computer
| -| Startup and Recovery |
  • Automatically Restart
  • Dump File
  • Dump Type
  • Overwrite any existing file
  • Send Alert
  • System Startup Delay
  • Write an Event
| -| System Time |
  • System time changed from ... to ...
  • Time zone changed Not supported on Windows Server 2008 SP2 and Windows Server 2008 R2.
| -| Add / Remove Programs | | -| Add or Remove Programs |
  • Installed For\*\*
  • Version
| -| Services | | -| System Service |
  • Action in case of failed service startup
  • Action in case of service stopping
  • Allow service to interact with desktop
  • Caption
  • Created
  • Deleted
  • Description
  • Name
  • Path to executable
  • Service Account
  • Service Type
  • Start Mode
  • Error Control
| -| Audit Policies | | -| Local Audit Policy |
  • Added Audit settings Only for the Global Object Access Auditing advanced policies.
  • Successful audit enabled/disabled
  • Failure audit enabled/disabled
| -| Per-User Local Audit Policy |
  • Success audit include added
  • Success audit include removed
  • Failure audit include added
  • Failure audit include removed
  • Success audit exclude added
  • Success audit exclude removed
  • Failure audit exclude added
  • Failure audit exclude remove
| -| Hardware | | -| Base Board\*\* |
  • Hosting Board
  • Status
  • Manufacturer
  • Product
  • Version
  • Serial Number
| -| BIOS\*\* |
  • Manufacturer
  • Version
| -| Bus\*\* |
  • Bus Type
  • Status
| -| Cache Memory\*\* |
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Purpose
  • Status
| -| CD-ROM Drive\*\* |
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Media Type
  • Name
  • SCSI Bus
  • SCSI Logical Unit
  • SCSI Port
  • SCSI Target ID
  • Status
| -| Disk Partition\*\* |
  • Primary Partition
  • Size (bytes)
  • Starting offset (bytes)
| -| Display Adapter\*\* |
  • Adapter RAM (bytes)
  • Adapter Type
  • Bits/Pixel
  • Configuration Manager Error Code
  • Driver Version
  • Installed Drivers
  • Last Error Description
  • Last Error Code
  • Refresh Rate
  • Resolution
  • Status
| -| DMA\*\* |
  • Status
| -| Floppy Drive\*\* |
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Status
| -| Hard Drive\*\* |
  • Bytes/Sector
  • Configuration Manager Error Code
  • Interface Type
  • Last Error Description
  • Last Error Code
  • Media Loaded
  • Media Type
  • Model
  • Partitions
  • SCSI Bus
  • SCSI Logical Unit
  • SCSI Port
  • SCSI Target ID
  • Sectors/Track
  • Size (bytes)
  • Status
  • Total Cylinders
  • Total Heads
  • Total Sectors
  • Total Tracks
  • Tracks/Cylinder
| -| IDE\*\* |
  • Configuration Manager Error Code
  • Description
  • Last Error Description
  • Last Error Code
  • Status
| -| Infrared\*\* |
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Status
| -| Keyboard\*\* |
  • Configuration Manager Error Code
  • Description
  • Last Error Description
  • Last Error Code
  • Layout
  • Name
  • Status
| -| Logical Disk\*\* |
  • Description
  • File System
  • Size (bytes)
  • Status
| -| Monitor\*\* |
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Monitor Type
  • Status
| -| Network Adapter |
  • Adapter Type \*
  • Configuration Manager Error Code
  • Default IP Gateway \*
  • DHCP Enabled\*
  • DHCP Server
  • DNS Server Search Order
  • IP Address \*
  • Last Error Description
  • Last Error Code
  • MAC Address
  • Network Connection Name
  • Network Connection Status
  • Service Name
  • Status \* — indicates the properties whose changes may not be reported correctly, displaying "_Who_" (i.e. initiator's account) as _System_.
| -| Network Protocol\*\* |
  • Description
  • Status
| -| Parallel Ports\*\* |
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Status
| -| PCMCIA Controller\*\* |
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Status
| -| Physical Memory\*\* |
  • Capacity (bytes)
  • Status
  • Manufacturer
  • Memory Type
  • Speed
  • Part Number
  • Serial Number
| -| Pointing Device\*\* |
  • Configuration Manager Error Code
  • Double Click Threshold
  • Handedness
  • Hardware Type
  • Last Error Description
  • Last Error Code
  • Number of buttons
  • Status
| -| Printing |
  • Comment\*\*
  • Hidden\*\*
  • Local\*\*
  • Location\*\*
  • Name\*\*
  • Network\*\*
  • Port Name\*\*
  • Printer error information
  • Published\*\*
  • Shared\*\*
  • Share Name\*\*
  • Status
| -| Processor\*\* |
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Max Clock Speed (MHz)
  • Name
  • Status
| -| SCSI\*\* |
  • Configuration Manager Error Code
  • Description
  • Last Error Description
  • Last Error Code
  • Status
| -| Serial Ports\*\* |
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Maximum Bits/Second
  • Name
  • Status
| -| Sound Device\*\* |
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Status
| -| System Slot\*\* |
  • Slot Designation
  • Status
| -| USB Controller\*\* |
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Name
  • Status
| -| USB Hub\*\* |
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Name
  • Status
| -| DHCP configuration | | -| If the DHCP server runs on Windows Server 2008 (or below), then the Who value for DHCP server configuration events is reported as _“Not Applicable”_. | | -| Server role |
  • Added
  • Removed
| -| Server settings |
  • Type:
  • IPv4
  • IPv4 Filters
  • IPv6
  • Action:
  • Modified
| -| DHCP scope |
  • Type:
  • IPv4
  • Multicast IPv4
  • Superscope for IPv4
  • IPv6
  • Action:
  • Added
  • Removed
  • Modified
  • Moved
| -| DHCP Reservation |
  • Type:
  • IPv4
  • IPv6
  • Action:
  • Added
  • Removed
  • Modified
| -| DHCP Policy |
  • Type:
  • IPv4
  • IPv4 server-wide
  • Action:
  • Added
  • Removed
  • Modified
  • Renamed
| -| Removable media | | -| Removable Storage Media\*\* | Netwrix Auditor doesn't report on floppy/optical disk and memory card storage medias. For removable storages, the When value reports actual time when a change was made and/or a target server was started.
  • Device class:
  • CD and DVD
  • Floppy Drives
  • Removable Disk
  • Tape Drives
  • Windows Portable Devices When the Audit Object Access local audit policy and/or the Audit Central Access Policy Staging \ Audit Removable Storage advanced audit policies are enabled on the target server, the `gpupdate /force` command execution issues removable storage restart. These actions are disclosed in Netwrix Auditor reports, search, and activity summaries. These actions are system-generated, not user-initiated.
| -| Scheduled Tasks | | -| Scheduled Task |
  • Account Name
  • Application
  • Comment
  • Creator
  • Enabled
  • Parameters
  • Triggers
| -| Local Users and Groups | | -| Local Group |
  • Description
  • Name
  • Members
| -| Local User |
  • Description
  • Disabled/Enabled
  • Full Name
  • Name
  • User can't change password
  • Password Never Expires
  • User must change password at next logon
| -| DNS Configuration | | -| The Who value will be reported for DNS configuration settings only if the DNS server runs on Windows Server 2012 R2. See the following Microsoft article for additional information: [Update adds query logging and change auditing to Windows DNS servers](https://support.microsoft.com/en-us/kb/2956577). | | -| DNS Server |
  • Address Answer Limit
  • Allow Update
  • Auto Cache Update
  • Auto Config File Zones
  • Bind Secondaries
  • Boot Method
  • Default Aging State
  • Default No Refresh Interval
  • Default Refresh Interval
  • Disable Auto Reverse Zones
  • Disjoint Nets
  • Ds Available
  • Ds Polling Interval
  • Ds Tombstone Interval
  • EDns Cache Timeout
  • Enable Directory Partitions
  • Enable Dns Sec
  • Enable EDns Probes
  • CD-ROM D Enable Netmask Ordering
  • Event Log Level
  • Fail On Load If Bad Zone Data
  • Forward Delegations
  • Forwarders
  • Forwarding Timeout
  • Is Slave
  • Listen Addresses
  • Log File Max Size
  • Log File Path
  • Log Level
  • Loose Wildcarding
  • Max Cache TTL
  • Max Negative Cache TTL
  • Name Check Flag
  • No Recursion
  • Recursion Retry
  • Recursion Timeout
  • Round Robin
  • Rpc Protocol
  • Scavenging Interval
  • Secure Cache Against Pollution
  • Send Port
  • Server Addresses
| -| DNS Zone |
  • Aging State
  • Allow update
  • Auto created
  • Data file name
  • Ds integrated
  • Expires after
  • Forwarder slave
  • Forwarder timeout
  • Master servers
  • Minimum TTL
  • No refresh interval
  • Notify
  • Notify servers
  • Owner name
  • Paused
  • Primary server
  • Refresh interval
  • Responsible person
  • Retry interval
  • Reverse
  • Scavenge servers
  • Secondary servers
  • Secure secondaries
  • Shutdown
  • TTL
  • User NB stat
  • Use WINS
  • Zone type
| -| DNS Resource Records | | -| The Who value will be reported for DNS Resource Records only if the DNS server runs Windows Server 2012 R2. See the following Microsoft article for additional information: [Update adds query logging and change auditing to Windows DNS servers](https://support.microsoft.com/en-us/kb/2956577). | | -| DNS AAAA |
  • Container name
  • IPv6 Address
  • Owner name
  • Record class
  • TTL
  • Zone type
| -| DNS AFSDB |
  • Container name
  • Owner name
  • Server name
  • Server subtype
  • Record class
  • TTL
  • Zone type
| -| DNS ATM A |
  • ATM Address
  • Container name
  • Format
  • Owner name
  • Record class
  • TTL
  • Value
  • Zone type
| -| DNS A |
  • Container name
  • IP Address
  • Owner name
  • Record class
  • TTL
  • Zone type
| -| DNS CNAME |
  • Container name
  • FQDN for target host
  • Owner name
  • Record class
  • TTL
  • Zone type
| -| DNS DHCID |
  • Container name
  • DHCID (base 64)
  • Owner name
  • Record class
  • TTL
  • Zone type
| -| DNS DNAME |
  • Container name
  • FQDN for target domain
  • Owner name
  • Record class
  • TTL
  • Zone type
| -| DNS DNSKEY |
  • Algorithm
  • Container name
  • Key type
  • Key (base 64)
  • Name type
  • Owner name
  • Protocol
  • Record class
  • Signatory field
  • TTL
  • Zone type
| -| DNS DS |
  • Algorithm
  • Container name
  • Data
  • DigestType
  • Key tag
  • Owner name
  • Record class
  • TTL
  • Zone type
| -| DNS HINFO |
  • Container name
  • CPU type
  • Operating system
  • Owner name
  • Record class
  • TTL
  • Zone type
| -| DNS ISDN |
  • Container name
  • ISDN phone number and DDI
  • ISDN subaddress
  • Owner name
  • Record class
  • TTL
  • Zone type
| -| DNS KEY |
  • Algorithm
  • Container name
  • Key type
  • Key (base 64)
  • Name type
  • Owner name
  • Protocol
  • Record class
  • Signatory field
  • TTL
  • Zone type
| -| DNS MB\*\*\* |
  • Container name
  • Mailbox host
  • Owner name
  • Record class
  • TTL
  • Zone type
| -| DNS MD |
  • Container name
  • MD host
  • Owner name
  • Record class
  • TTL
  • Zone type
| -| DNS MF |
  • Container name
  • MF host
  • Owner name
  • Record class
  • TTL
  • Zone type
| -| DNS MG |
  • Container name
  • Member mailbox
  • Owner name
  • Record class
  • TTL
  • Zone type
| -| DNS MINFO |
  • Container name
  • Error mailbox
  • Owner name
  • Responsible mailbox
  • Record class
  • TTL
  • Zone type
| -| DNS MR |
  • Container name
  • Owner name
  • Replacement mailbox
  • Record class
  • TTL
  • Zone type
| -| DNS MX |
  • Container name
  • FQDN of mail server
  • Mail server priority
  • Owner name
  • Record class
  • TTL
  • Zone type
| -| DNS NAPTR |
  • Container name
  • Flag string
  • Order
  • Owner name
  • Preference
  • Record class
  • Regular expression string
  • Replacement domain
  • Service string
  • TTL
  • Zone type
| -| DNS NS |
  • Container name
  • Name servers
  • Owner name
  • TTL
| -| DNS NXT |
  • Container name
  • Next domain name
  • Owner name
  • Record class
  • Record types
  • TTL
  • Zone type
| -| DNS PTR |
  • Container name
  • Owner name
  • PTR domain name
  • Record class
  • TTL
  • Zone type
| -| DNS RP |
  • Container name
  • Mailbox of responsible person
  • Optional associated text (TXT) record
  • Owner name
  • Record class
  • TTL
  • Zone type
| -| DNS RRSIG |
  • Algorithm
  • Container name
  • Key tag
  • Labels
  • Original TTL
  • Owner name
  • Record class
  • Signature expiration (GMT)
  • Signature inception (GMT)
  • Signature (base 64)
  • Signer's name
  • TTL
  • Type covered
  • Zone type
| -| DNS RT |
  • Container name
  • Intermediate host
  • Owner name
  • Preference
  • Record class
  • TTL
  • Zone type
| -| DNS SIG |
  • Algorithm
  • Container name
  • Key tag
  • Labels
  • Original TTL
  • Owner name
  • Record class
  • Signature expiration (GMT)
  • Signature inception (GMT)
  • Signature (base 64)
  • Signer's name
  • TTL
  • Type covered
  • Zone type
| -| DNS SRV |
  • Container name
  • Host offering this service
  • Owner name
  • Port number
  • Priority
  • Record class
  • TTL
  • Weight
  • Zone type
| -| DNS TEXT |
  • Container name
  • Owner name
  • Record class
  • Text
  • TTL
  • Zone type
| -| DNS WINS |
  • Cache time-out
  • Container name
  • Don't replicate this record
  • Lookup time-out
  • Owner name
  • Record class
  • Wins servers
  • Zone type
| -| DNS WKS |
  • Container name
  • IP address
  • Owner name
  • Protocol
  • Record class
  • Services
  • TTL
  • Zone type
| -| DNS X25 |
  • Container name
  • Owner name
  • Record
  • Record class
  • TTL
  • X.121 PSDN address
  • Zone type
| -| File Shares | | -| Share |
  • Access-based enumeration
  • Caching
  • Description
  • Enable BranchCache
  • Encrypt data access
  • Folder path
  • Share permissions
  • User limit
| +When monitoring a Windows Server, Netwrix Auditor needs to audit some registry settings. See +[Windows Server Registry Keys](#windows-server-registry-keys) for additional information. If you +want Netwrix Auditor to audit custom registry keys, see +[Monitoring Custom Registry Keys](#monitoring-custom-registry-keys) for additional information. + +The following table has three levels: a **Component** is a system component you enable for +auditing in the monitoring plan (see the Windows Server monitoring plan topic, Monitor changes to +system components, for a description of each component); each component contains one or more **Object types**, which +are the specific entities Netwrix Auditor tracks; and **Attributes** are the individual properties +of that object type whose changes Netwrix Auditor reports. + +Double asterisks (\*\*) indicate the object types and attributes for which Netwrix Auditor reports +the Who value as _“Not Applicable”_. + +| Component | Object type | Attributes | +| --- | --- | --- | +| General computer settings | Computer |
  • System state changed to Started
  • System state changed to Stopped. Reason: Reason type
  • System state changed to Stopped. Reason: unexpected shutdown or system failure
| +| | Computer Name |
  • Computer Description
  • Name
  • Domain
| +| | Environment Variables |
  • Type
  • Value
| +| | Event Log |
  • Event Log Cleared
| +| | General |
  • Caption
  • Organization
  • Registered User
  • Serial Number
  • Service Pack\*\*
  • Version\*\*
| +| | Remote |
  • Enable Remote Desktop on this computer
| +| | Startup and Recovery |
  • Automatically Restart
  • Dump File
  • Dump Type
  • Overwrite any existing file
  • Send Alert
  • System Startup Delay
  • Write an Event
| +| | System Time |
  • System time changed from ... to ...
  • Time zone changed
| +| Add/Remove programs | Add or Remove Programs |
  • Installed For\*\*
  • Version
| +| Services | System Service |
  • Action in case of failed service startup
  • Action in case of service stopping
  • Allow service to interact with desktop
  • Caption
  • Created
  • Deleted
  • Description
  • Name
  • Path to executable
  • Service Account
  • Service Type
  • Start Mode
  • Error Control
| +| Audit policies | Local Audit Policy |
  • Added Audit settings Only for the Global Object Access Auditing advanced policies.
  • Successful audit enabled/disabled
  • Failure audit enabled/disabled
| +| | Per-User Local Audit Policy |
  • Success audit include added
  • Success audit include removed
  • Failure audit include added
  • Failure audit include removed
  • Success audit exclude added
  • Success audit exclude removed
  • Failure audit exclude added
  • Failure audit exclude remove
| +| Hardware | Base Board\*\* |
  • Hosting Board
  • Status
  • Manufacturer
  • Product
  • Version
  • Serial Number
| +| | BIOS\*\* |
  • Manufacturer
  • Version
| +| | Bus\*\* |
  • Bus Type
  • Status
| +| | Cache Memory\*\* |
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Purpose
  • Status
| +| | CD-ROM Drive\*\* |
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Media Type
  • Name
  • SCSI Bus
  • SCSI Logical Unit
  • SCSI Port
  • SCSI Target ID
  • Status
| +| | Disk Partition\*\* |
  • Primary Partition
  • Size (bytes)
  • Starting offset (bytes)
| +| | Display Adapter\*\* |
  • Adapter RAM (bytes)
  • Adapter Type
  • Bits/Pixel
  • Configuration Manager Error Code
  • Driver Version
  • Installed Drivers
  • Last Error Description
  • Last Error Code
  • Refresh Rate
  • Resolution
  • Status
| +| | DMA\*\* |
  • Status
| +| | Floppy Drive\*\* |
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Status
| +| | Hard Drive\*\* |
  • Bytes/Sector
  • Configuration Manager Error Code
  • Interface Type
  • Last Error Description
  • Last Error Code
  • Media Loaded
  • Media Type
  • Model
  • Partitions
  • SCSI Bus
  • SCSI Logical Unit
  • SCSI Port
  • SCSI Target ID
  • Sectors/Track
  • Size (bytes)
  • Status
  • Total Cylinders
  • Total Heads
  • Total Sectors
  • Total Tracks
  • Tracks/Cylinder
| +| | IDE\*\* |
  • Configuration Manager Error Code
  • Description
  • Last Error Description
  • Last Error Code
  • Status
| +| | Infrared\*\* |
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Status
| +| | Keyboard\*\* |
  • Configuration Manager Error Code
  • Description
  • Last Error Description
  • Last Error Code
  • Layout
  • Name
  • Status
| +| | Logical Disk\*\* |
  • Description
  • File System
  • Size (bytes)
  • Status
| +| | Monitor\*\* |
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Monitor Type
  • Status
| +| | Network Adapter |
  • Adapter Type \*
  • Configuration Manager Error Code
  • Default IP Gateway \*
  • DHCP Enabled\*
  • DHCP Server
  • DNS Server Search Order
  • IP Address \*
  • Last Error Description
  • Last Error Code
  • MAC Address
  • Network Connection Name
  • Network Connection Status
  • Service Name
  • Status \* — indicates the properties whose changes may not be reported correctly, displaying "_Who_" (i.e. initiator's account) as _System_.
| +| | Network Protocol\*\* |
  • Description
  • Status
| +| | Parallel Ports\*\* |
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Status
| +| | PCMCIA Controller\*\* |
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Status
| +| | Physical Memory\*\* |
  • Capacity (bytes)
  • Status
  • Manufacturer
  • Memory Type
  • Speed
  • Part Number
  • Serial Number
| +| | Pointing Device\*\* |
  • Configuration Manager Error Code
  • Double Click Threshold
  • Handedness
  • Hardware Type
  • Last Error Description
  • Last Error Code
  • Number of buttons
  • Status
| +| | Printing |
  • Comment\*\*
  • Hidden\*\*
  • Local\*\*
  • Location\*\*
  • Name\*\*
  • Network\*\*
  • Port Name\*\*
  • Printer error information
  • Published\*\*
  • Shared\*\*
  • Share Name\*\*
  • Status
| +| | Processor\*\* |
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Max Clock Speed (MHz)
  • Name
  • Status
| +| | SCSI\*\* |
  • Configuration Manager Error Code
  • Description
  • Last Error Description
  • Last Error Code
  • Status
| +| | Serial Ports\*\* |
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Maximum Bits/Second
  • Name
  • Status
| +| | Sound Device\*\* |
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Status
| +| | System Slot\*\* |
  • Slot Designation
  • Status
| +| | USB Controller\*\* |
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Name
  • Status
| +| | USB Hub\*\* |
  • Configuration Manager Error Code
  • Last Error Description
  • Last Error Code
  • Name
  • Status
| +| DHCP configuration | Server role |
  • Added
  • Removed
| +| | Server settings |
  • Type:
  • IPv4
  • IPv4 Filters
  • IPv6
  • Action:
  • Modified
| +| | DHCP scope |
  • Type:
  • IPv4
  • Multicast IPv4
  • Superscope for IPv4
  • IPv6
  • Action:
  • Added
  • Removed
  • Modified
  • Moved
| +| | DHCP Reservation |
  • Type:
  • IPv4
  • IPv6
  • Action:
  • Added
  • Removed
  • Modified
| +| | DHCP Policy |
  • Type:
  • IPv4
  • IPv4 server-wide
  • Action:
  • Added
  • Removed
  • Modified
  • Renamed
| +| Removable media | Removable Storage Media\*\* | Netwrix Auditor doesn't report on floppy/optical disk and memory card storage medias. For removable storages, the When value reports actual time when a change was made and/or a target server was started.
  • Device class:
  • CD and DVD
  • Floppy Drives
  • Removable Disk
  • Tape Drives
  • Windows Portable Devices When the Audit Object Access local audit policy and/or the Audit Central Access Policy Staging \ Audit Removable Storage advanced audit policies are enabled on the target server, the `gpupdate /force` command execution issues removable storage restart. These actions are disclosed in Netwrix Auditor reports, search, and activity summaries. These actions are system, not user-effected.
| +| Scheduled tasks | Scheduled Task |
  • Account Name
  • Application
  • Comment
  • Creator
  • Enabled
  • Parameters
  • Triggers
| +| Local users and groups | Local Group |
  • Description
  • Name
  • Members
| +| | Local User |
  • Description
  • Disabled/Enabled
  • Full Name
  • Name
  • User can't change password
  • Password Never Expires
  • User must change password at next logon
| + +:::note +Netwrix Auditor reports the Who value for DNS configuration settings only if the DNS server runs on Windows Server 2012 R2. See the following Microsoft article for additional information: [Update adds query logging and change auditing to Windows DNS servers](https://support.microsoft.com/en-us/kb/2956577). +::: + +| Component | Object type | Attributes | +| --- | --- | --- | +| DNS configuration | DNS Server |
  • Address Answer Limit
  • Allow Update
  • Auto Cache Update
  • Auto Config File Zones
  • Bind Secondaries
  • Boot Method
  • Default Aging State
  • Default No Refresh Interval
  • Default Refresh Interval
  • Disable Auto Reverse Zones
  • Disjoint Nets
  • Ds Available
  • Ds Polling Interval
  • Ds Tombstone Interval
  • EDns Cache Timeout
  • Enable Directory Partitions
  • Enable Dns Sec
  • Enable EDns Probes
  • CD-ROM D Enable Netmask Ordering
  • Event Log Level
  • Fail On Load If Bad Zone Data
  • Forward Delegations
  • Forwarders
  • Forwarding Timeout
  • Is Slave
  • Listen Addresses
  • Log File Max Size
  • Log File Path
  • Log Level
  • Loose Wildcarding
  • Max Cache TTL
  • Max Negative Cache TTL
  • Name Check Flag
  • No Recursion
  • Recursion Retry
  • Recursion Timeout
  • Round Robin
  • Rpc Protocol
  • Scavenging Interval
  • Secure Cache Against Pollution
  • Send Port
  • Server Addresses
| +| | DNS Zone |
  • Aging State
  • Allow update
  • Auto created
  • Data file name
  • Ds integrated
  • Expires after
  • Forwarder slave
  • Forwarder timeout
  • Master servers
  • Minimum TTL
  • No refresh interval
  • Notify
  • Notify servers
  • Owner name
  • Paused
  • Primary server
  • Refresh interval
  • Responsible person
  • Retry interval
  • Reverse
  • Scavenge servers
  • Secondary servers
  • Secure secondaries
  • Shutdown
  • TTL
  • User NB stat
  • Use WINS
  • Zone type
| + +:::note +Netwrix Auditor reports the Who value for DNS Resource Records only if the DNS server runs Windows Server 2012 R2. See the following Microsoft article for additional information: [Update adds query logging and change auditing to Windows DNS servers](https://support.microsoft.com/en-us/kb/2956577). +::: + +| Component | Object type | Attributes | +| --- | --- | --- | +| DNS resource records | DNS AAAA |
  • Container name
  • IPv6 Address
  • Owner name
  • Record class
  • TTL
  • Zone type
| +| | DNS AFSDB |
  • Container name
  • Owner name
  • Server name
  • Server subtype
  • Record class
  • TTL
  • Zone type
| +| | DNS ATM A |
  • ATM Address
  • Container name
  • Format
  • Owner name
  • Record class
  • TTL
  • Value
  • Zone type
| +| | DNS A |
  • Container name
  • IP Address
  • Owner name
  • Record class
  • TTL
  • Zone type
| +| | DNS CNAME |
  • Container name
  • FQDN for target host
  • Owner name
  • Record class
  • TTL
  • Zone type
| +| | DNS DHCID |
  • Container name
  • DHCID (base 64)
  • Owner name
  • Record class
  • TTL
  • Zone type
| +| | DNS DNAME |
  • Container name
  • FQDN for target domain
  • Owner name
  • Record class
  • TTL
  • Zone type
| +| | DNS DNSKEY |
  • Algorithm
  • Container name
  • Key type
  • Key (base 64)
  • Name type
  • Owner name
  • Protocol
  • Record class
  • Signatory field
  • TTL
  • Zone type
| +| | DNS DS |
  • Algorithm
  • Container name
  • Data
  • DigestType
  • Key tag
  • Owner name
  • Record class
  • TTL
  • Zone type
| +| | DNS HINFO |
  • Container name
  • CPU type
  • Operating system
  • Owner name
  • Record class
  • TTL
  • Zone type
| +| | DNS ISDN |
  • Container name
  • ISDN phone number and DDI
  • ISDN subaddress
  • Owner name
  • Record class
  • TTL
  • Zone type
| +| | DNS KEY |
  • Algorithm
  • Container name
  • Key type
  • Key (base 64)
  • Name type
  • Owner name
  • Protocol
  • Record class
  • Signatory field
  • TTL
  • Zone type
| +| | DNS MB\*\* |
  • Container name
  • Mailbox host
  • Owner name
  • Record class
  • TTL
  • Zone type
| +| | DNS MD |
  • Container name
  • MD host
  • Owner name
  • Record class
  • TTL
  • Zone type
| +| | DNS MF |
  • Container name
  • MF host
  • Owner name
  • Record class
  • TTL
  • Zone type
| +| | DNS MG |
  • Container name
  • Member mailbox
  • Owner name
  • Record class
  • TTL
  • Zone type
| +| | DNS MINFO |
  • Container name
  • Error mailbox
  • Owner name
  • Responsible mailbox
  • Record class
  • TTL
  • Zone type
| +| | DNS MR |
  • Container name
  • Owner name
  • Replacement mailbox
  • Record class
  • TTL
  • Zone type
| +| | DNS MX |
  • Container name
  • FQDN of mail server
  • Mail server priority
  • Owner name
  • Record class
  • TTL
  • Zone type
| +| | DNS NAPTR |
  • Container name
  • Flag string
  • Order
  • Owner name
  • Preference
  • Record class
  • Regular expression string
  • Replacement domain
  • Service string
  • TTL
  • Zone type
| +| | DNS NS |
  • Container name
  • Name servers
  • Owner name
  • TTL
| +| | DNS NXT |
  • Container name
  • Next domain name
  • Owner name
  • Record class
  • Record types
  • TTL
  • Zone type
| +| | DNS PTR |
  • Container name
  • Owner name
  • PTR domain name
  • Record class
  • TTL
  • Zone type
| +| | DNS RP |
  • Container name
  • Mailbox of responsible person
  • Optional associated text (TXT) record
  • Owner name
  • Record class
  • TTL
  • Zone type
| +| | DNS RRSIG |
  • Algorithm
  • Container name
  • Key tag
  • Labels
  • Original TTL
  • Owner name
  • Record class
  • Signature expiration (GMT)
  • Signature inception (GMT)
  • Signature (base 64)
  • Signer's name
  • TTL
  • Type covered
  • Zone type
| +| | DNS RT |
  • Container name
  • Intermediate host
  • Owner name
  • Preference
  • Record class
  • TTL
  • Zone type
| +| | DNS SIG |
  • Algorithm
  • Container name
  • Key tag
  • Labels
  • Original TTL
  • Owner name
  • Record class
  • Signature expiration (GMT)
  • Signature inception (GMT)
  • Signature (base 64)
  • Signer's name
  • TTL
  • Type covered
  • Zone type
| +| | DNS SRV |
  • Container name
  • Host offering this service
  • Owner name
  • Port number
  • Priority
  • Record class
  • TTL
  • Weight
  • Zone type
| +| | DNS TEXT |
  • Container name
  • Owner name
  • Record class
  • Text
  • TTL
  • Zone type
| +| | DNS WINS |
  • Cache time-out
  • Container name
  • Don't replicate this record
  • Lookup time-out
  • Owner name
  • Record class
  • Wins servers
  • Zone type
| +| | DNS WKS |
  • Container name
  • IP address
  • Owner name
  • Protocol
  • Record class
  • Services
  • TTL
  • Zone type
| +| | DNS X25 |
  • Container name
  • Owner name
  • Record
  • Record class
  • TTL
  • X.121 PSDN address
  • Zone type
| +| File shares | Share |
  • Access-based enumeration
  • Caching
  • Description
  • Enable BranchCache
  • Encrypt data access
  • Folder path
  • Share permissions
  • User limit
| ### Windows Server Registry Keys -If you want to monitor changes to system components on a Windows Server, ensure that Windows -Registry audit settings are configured on that Windows server. +If you want to monitor changes to system components on a Windows Server, ensure that you configure +Windows Registry audit settings on that Windows server. This refers to the following keys: @@ -263,7 +249,7 @@ type required): - Write DAC - Write Owner -The below is the full list of keys (and subkeys) involved in Windows Server auditing. +The following table lists all keys (and subkeys) involved in Windows Server auditing. | Category | Registry Keys | |----------------|-------------------------------------------------------------------------------------------------------------------| @@ -285,18 +271,18 @@ The below is the full list of keys (and subkeys) involved in Windows Server audi Consider that audit data for the registry keys themselves will not appear in Netwrix Auditor -reports, alerts, or search results, as it is only used as one of the sources for the Activity Records -formation. +reports, alerts, or search results, as the product uses it only as one of the sources for Activity +Record formation. - You can configure these settings automatically using Netwrix Auditor, as described in the [Settings for Data Collection](/docs/auditor/10.8/admin/monitoringplans/create.md#settings-for-data-collection) - topic. Corresponding audit settings will be also applied automatically after you select a checkbox - under **Monitor changes to system components** on the **General** tab in the Windows Server data - source properties. + topic. The product also applies the corresponding audit settings automatically after you select a + checkbox under **Monitor changes to system components** on the **General** tab in the Windows + Server data source properties. -Audit settings will be automatically adjusted only for the keys/subkeys involved in the monitoring -of selected components (granular adjustment). For example, if you selected **Services**, the program -will adjust the audit settings for the following subkeys: +Netwrix Auditor automatically adjusts audit settings only for the keys/subkeys involved in the +monitoring of selected components (granular adjustment). For example, if you selected **Services**, +the program adjusts the audit settings for the following subkeys: - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services(|\\.\*) - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services(|\\.\*) @@ -323,9 +309,9 @@ For example: **Step 3 –** Consider the following: - Each entry must be a separate line. -- Wildcards (\* and ?) are supported (except for the `registry key name` field). A backslash (\) - must be put in front of (\*), (?), (,), and (\) if they are a part of an entry value. -- Lines that start with the # sign are treated as comments and are ignored. +- The product supports wildcards (\* and ?), except for the `registry key name` field. Put a backslash (\) + in front of (\*), (?), (,), and (\) if they are a part of an entry value. +- The product treats lines that start with the # sign as comments and ignores them. ![customregistrykey](/images/auditor/10.8/configuration/windowsserver/customregistrykey.webp) @@ -334,12 +320,12 @@ there is no necessary event in the Security log with this path. ## VM Template Cloning -While VM cloning is supported by Netwrix Auditor, an additional setup process should be taken into -consideration before the deployment process. +Netwrix Auditor supports VM cloning, but you must complete an additional setup process before +deployment. Every monitored VM instance gets a unique ID assigned for monitoring and data collection purposes. -To ensure proper operation, the VM template must be excluded from the monitoring scope beforehand. -Omitting the VM template will allow Netwrix Auditor to assign unique IDs correctly and collect data +To ensure proper operation, you must exclude the VM template from the monitoring scope beforehand. +Omitting the VM template allows Netwrix Auditor to assign unique IDs correctly and collect data as intended. **Step 1 –** In main Netwrix Auditor menu, select **Monitoring plans**. @@ -354,4 +340,4 @@ the right pane. **Step 5 –** Check the **Exclude these objects** checkbox and add the template VM by clicking **Add Computer**. -VM template server is added to exclusions and ready to use. +The VM template server is now in the exclusions list and ready to use. diff --git a/docs/auditor/10.8/configuration/windowsserver/ports.md b/docs/auditor/10.8/configuration/windowsserver/ports.md index c4c67fddea..d50956bc02 100644 --- a/docs/auditor/10.8/configuration/windowsserver/ports.md +++ b/docs/auditor/10.8/configuration/windowsserver/ports.md @@ -19,7 +19,7 @@ inbound connections to local 139 TCP port. | Port | Protocol | Source | Target | Purpose | | -------------------------- | -------- | ------------------------------------------------------------------------------ | ---------------------- | ------------------------------------------------------------------------------------------------------------------- | -| 139 445 | TCP | Netwrix Auditor Server | Monitored computer | Service Control Manager Remote Protocol (RPC) Remote registry | +| 139, 445 | TCP | Netwrix Auditor Server | Monitored computer | Service Control Manager Remote Protocol (RPC) Remote registry | | 135 + Dynamic: 1024 -65535 | TCP | Netwrix Auditor Server | Monitored computer | Windows Management Instrumentation Collect objects | | 135 + Dynamic: 1024 -65535 | TCP | Netwrix Auditor Server | Monitored computer | Collect removable storage insertions. Allow the following process to use the port: %systemroot%\system32\plasrv.exe | | 135 | TCP | Netwrix Auditor Server | Monitored computer | Service Control Manager Remote Protocol (RPC) Core Service installation | diff --git a/docs/auditor/10.8/configuration/windowsserver/registrykey.md b/docs/auditor/10.8/configuration/windowsserver/registrykey.md index ea0538b4eb..b8d74aa3d2 100644 --- a/docs/auditor/10.8/configuration/windowsserver/registrykey.md +++ b/docs/auditor/10.8/configuration/windowsserver/registrykey.md @@ -1,10 +1,10 @@ --- -title: "Windows Server Registry Keys" -description: "Windows Server Registry Keys" +title: "Windows Server Auditing Registry Keys" +description: "Windows Server Auditing Registry Keys" sidebar_position: 110 --- -# Windows Server Registry Keys +# Windows Server Auditing Registry Keys Review the basic registry keys that you may need to configure for monitoring Windows Server with Netwrix Auditor. Navigate to Start → Run and type _"regedit"_. @@ -12,8 +12,8 @@ Netwrix Auditor. Navigate to Start → Run and type _"regedit"_. | Registry key (REG_DWORD type) | Description / Value | | -------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Netwrix Auditor\Windows Server Change Reporter | | -| CleanAutoBackupLogs | Defines the retention period for the security log backups:
  • 0—Backups are never deleted from Domain controllers
  • [X]— Backups are deleted after [X] hours
| -| ProcessBackupLogs | Defines whether to process security log backups:
  • 0—No
  • 1—Yes Even if this key is set to _"0"_, the security log backups will not be deleted regardless of the value of the CleanAutoBackupLogs key.
| +| CleanAutoBackupLogs | Defines the retention period for the security log backups:
  • 0—The product never deletes backups from domain controllers
  • [X]—The product deletes backups after [X] hours
| +| ProcessBackupLogs | Defines whether to process security log backups:
  • 0—No
  • 1—Yes Even if you set this key to _"0"_, the product doesn't delete the security log backups regardless of the CleanAutoBackupLogs key value.
| ## Event Log @@ -28,8 +28,8 @@ Auditor. Navigate to Start → Run and type _"regedit"_. | BatchTimeOut | Defines batch writing timeout (in seconds). | | DeadLockErrorCount | Defines the number of write attempts to a SQL database. | | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\Netwrix Auditor\Event Log Manager | | -| CleanAutoBackupLogs | Defines the retention period for the security log backups:
  • 0—Backups are never deleted from Domain controllers
  • [X]— Backups are deleted after [X] hours
| -| ProcessBackupLogs | Defines whether to process security log backups:
  • 0—No
  • 1—Yes Even if this key is set to _"0"_, the security log backups will not be deleted regardless of the value of the CleanAutoBackupLogs key.
| +| CleanAutoBackupLogs | Defines the retention period for the security log backups:
  • 0—The product never deletes backups from domain controllers
  • [X]—The product deletes backups after [X] hours
| +| ProcessBackupLogs | Defines whether to process security log backups:
  • 0—No
  • 1—Yes Even if you set this key to _"0"_, the product doesn't delete the security log backups regardless of the CleanAutoBackupLogs key value.
| | WriteAgentsToApplicationLog | Defines whether to write the events produced by the Netwrix Auditor Event Log Compression Service to the Application Log of a monitored machine:
  • 0—Disabled
  • 1—Enabled
| | WriteToApplicationLog | Defines whether to write events produced by Netwrix Auditor to the Application Log of the machine where the product is installed:
  • 0—No
  • 1—Yes
| diff --git a/docs/auditor/10.8/configuration/windowsserver/remoteregistry.md b/docs/auditor/10.8/configuration/windowsserver/remoteregistry.md index 611104a4e7..afba13a26e 100644 --- a/docs/auditor/10.8/configuration/windowsserver/remoteregistry.md +++ b/docs/auditor/10.8/configuration/windowsserver/remoteregistry.md @@ -21,6 +21,6 @@ set to _Automatic_ and click **Start**. **Step 4 –** In the Services window, ensure that the Remote Registry service has the _Running_ status on Windows Server 2012 and above. -**NOTE:** The Remote Registry service should be enabled on the target server. +**NOTE:** You must enable the Remote Registry service on the target server. -5. Locate the Windows Management Instrumentation service and repeat these steps. +**Step 5 –** Locate the Windows Management Instrumentation service and repeat these steps. diff --git a/docs/auditor/10.8/configuration/windowsserver/removablestorage.md b/docs/auditor/10.8/configuration/windowsserver/removablestorage.md index eb19bef373..5213cbd9bf 100644 --- a/docs/auditor/10.8/configuration/windowsserver/removablestorage.md +++ b/docs/auditor/10.8/configuration/windowsserver/removablestorage.md @@ -9,102 +9,123 @@ sidebar_position: 80 You can configure IT infrastructure for monitoring removable storage media both locally and remotely. -Review the following: +Review the following for additional information: -To configure removable storage media monitoring on the local server +- [Configure Removable Storage Media Monitoring on the Local Server](#configure-removable-storage-media-monitoring-on-the-local-server) +- [Configure Removable Storage Media Monitoring Remotely](#configure-removable-storage-media-monitoring-remotely) +- [Review Event Trace Session Object Configuration](#review-event-trace-session-object-configuration) -1. On the target server, create the following catalog: _"%ALLUSERSPROFILE%\Netwrix Auditor\Windows - Server Audit\ETS\"_ to store event logs. To review Event Trace Session objects' configuration, see how - to modify the root directory. +## Configure Removable Storage Media Monitoring on the Local Server - If you don't want to use the Netwrix Auditor for Windows Server Compression Service for data - collection, ensure that this path is readable via any shared resource. +**Step 1 –** On the target server, create the following folder to store event logs: +_"%ALLUSERSPROFILE%\Netwrix Auditor\Windows Server Audit\ETS\"_. For instructions on how to modify +the root directory, see [Review Event Trace Session Object Configuration](#review-event-trace-session-object-configuration). - After environment variable substitution, the path shall be as follows: +:::note +If you don't want to use the Netwrix Auditor for Windows Server Compression Service for data +collection, ensure that this path is readable via any shared resource. +::: - `C:\ProgramData\Netwrix Auditor\Windows Server Audit\ETS` +After environment variable substitution, the path is as follows: - If your environment variable accesses another directory, update the path. +`C:\ProgramData\Netwrix Auditor\Windows Server Audit\ETS` -2. Run the Command Prompt as Administrator. -3. Execute the commands below. +:::note +If your environment variable accesses another directory, update the path. +::: - - To create the Event Trace Session object: +**Step 2 –** Run the Command Prompt as Administrator. - `logman import -n "Session\NetwrixAuditorForWindowsServer" -xml ""` +**Step 3 –** Execute the following commands. - - To start the Event Trace Session object automatically every time the server starts: +- To create the Event Trace Session object: - `logman import -n "AutoSession\NetwrixAuditorForWindowsServer" -xml ""` + `logman import -n "Session\NetwrixAuditorForWindowsServer" -xml ""` - where: +- To start the Event Trace Session object automatically every time the server starts: - - `NetwrixAuditorForWindowsServer`—Fixed name the product uses to identify the Event Trace - Session object. The name can't be changed. - - ``—Path to the Event Trace Session - template file that comes with Netwrix Auditor. The default path is _"C:\Program Files - (x86)\Netwrix Auditor\Windows Server Auditing\EventTraceSessionTemplate.xml"_. + `logman import -n "AutoSession\NetwrixAuditorForWindowsServer" -xml ""` -To configure removable storage media monitoring remotely + where: -1. On the target server, create the following catalog: _"%ALLUSERSPROFILE%\Netwrix Auditor\Windows - Server Audit\ETS\"_ to write data to. To review Event Trace Session objects' configuration, see how to - modify the root directory. + - `NetwrixAuditorForWindowsServer`—Fixed name the product uses to identify the Event Trace + Session object. You can't change the name. + - ``—Path to the Event Trace Session + template file that comes with Netwrix Auditor. The default path is _"C:\Program Files + (x86)\Netwrix Auditor\Windows Server Auditing\EventTraceSessionTemplate.xml"_. - If you don't want to use the Netwrix Auditor for Windows Server Compression Service for data - collection, ensure that this path is readable via any shared resource. +## Configure Removable Storage Media Monitoring Remotely - After environment variable substitution, the path shall be as follows: +**Step 1 –** On the target server, create the following folder to write data to: +_"%ALLUSERSPROFILE%\Netwrix Auditor\Windows Server Audit\ETS\"_. For instructions on how to modify +the root directory, see [Review Event Trace Session Object Configuration](#review-event-trace-session-object-configuration). - `\\\c$\ProgramData\Netwrix Auditor\Windows Server Audit\ETS` +:::note +If you don't want to use the Netwrix Auditor for Windows Server Compression Service for data +collection, ensure that this path is readable via any shared resource. +::: - If your environment variable accesses another directory, update the path. +After environment variable substitution, the path is as follows: -2. Run the Command Prompt under the target server Administrator's account. -3. Execute the commands below. +`\\\c$\ProgramData\Netwrix Auditor\Windows Server Audit\ETS` - - To create the Event Trace Session object: +:::note +If your environment variable accesses another directory, update the path. +::: - `logman import -n "Session\NetwrixAuditorForWindowsServer" -xml "" -s ` +**Step 2 –** Run the Command Prompt under the target server Administrator's account. - - To create the Event Trace Session object automatically every time the server starts: +**Step 3 –** Execute the following commands. - `logman import -n "AutoSession\NetwrixAuditorForWindowsServer" -xml "" -s ` +- To create the Event Trace Session object: - where: + `logman import -n "Session\NetwrixAuditorForWindowsServer" -xml "" -s ` - - `NetwrixAuditorForWindowsServer`—Fixed name the product uses to identify the Event Trace - Session object. The name can't be changed. - - ``—Path to the Event Trace Session - template file that comes with Netwrix Auditor. The default path is _"C:\Program Files - (x86)\Netwrix Auditor\Windows Server Auditing\EventTraceSessionTemplate.xml"_. - - ``—Name of the target server. Provide a server name by entering its - FQDN, NETBIOS, or IPv4 address. +- To create the Event Trace Session object automatically every time the server starts: -To review Event Trace Session objects' configuration + `logman import -n "AutoSession\NetwrixAuditorForWindowsServer" -xml "" -s ` -An Administrator can only modify the root directory and log file name. Other configurations aren't -supported by Netwrix Auditor. + where: -1. On the target server, navigate to Start → Administrative Tools → Performance Monitor. -2. In the Performance Monitor snap-in, navigate to Performance → Data Collectors Set → Event Trace - Sessions. -3. Stop the NetwrixAuditorForWindowsServer object. -4. Locate the NetwrixAuditorForWindowsServer object, right-click it and select Properties. Complete - the following fields: + - `NetwrixAuditorForWindowsServer`—Fixed name the product uses to identify the Event Trace + Session object. You can't change the name. + - ``—Path to the Event Trace Session + template file that comes with Netwrix Auditor. The default path is _"C:\Program Files + (x86)\Netwrix Auditor\Windows Server Auditing\EventTraceSessionTemplate.xml"_. + - ``—Name of the target server. Provide a server name by entering its + FQDN, NETBIOS, or IPv4 address. - | Option | Description | - | -------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | - | Directory → Root Directory | Path to the directory where event log is stored. If you want to change root directory, do the following: 1. Under the Root directory option, click Browse and select a new root directory. 2. Navigate to _C:\ProgramData\Netwrix Auditor\Windows Server Audit_ and copy the ETS folder to a new location. | - | File → Log file name | Name of the event log where the events will be stored. | +## Review Event Trace Session Object Configuration -5. Start the NetwrixAuditorForWindowsServer object. -6. In the Performance Monitor snap-in, navigate to Performance → Data Collectors Set → Startup Event - Trace Sessions. -7. Locate the NetwrixAuditorForWindowsServer object, right-click it and select Properties. Complete - the following fields: +:::note +An Administrator can only modify the root directory and log file name. Netwrix Auditor doesn't +support other configurations. +::: - | Option | Description | - | -------------------------- | ------------------------------------------------------------------------------------------------------------------------------- | - | Directory → Root Directory | Path to the directory where event log is stored. Under the Root directory option, click Browse and select a new root directory. | - | File → Log file name | Name of the event log where the events will be stored. | +**Step 1 –** On the target server, navigate to Start → Administrative Tools → Performance Monitor. + +**Step 2 –** In the Performance Monitor snap-in, navigate to Performance → Data Collectors Set → +Event Trace Sessions. + +**Step 3 –** Stop the NetwrixAuditorForWindowsServer object. + +**Step 4 –** Locate the NetwrixAuditorForWindowsServer object, right-click it and select +**Properties**. Complete the following fields: + +| Option | Description | +| --- | --- | +| Directory → Root Directory | Path to the directory where the event log is stored. To change the root directory:
1. Under the Root directory option, click **Browse** and select a new root directory.
2. Navigate to _C:\ProgramData\Netwrix Auditor\Windows Server Audit_ and copy the ETS folder to the new location. | +| File → Log file name | Name of the event log where the events are stored. | + +**Step 5 –** Start the NetwrixAuditorForWindowsServer object. + +**Step 6 –** In the Performance Monitor snap-in, navigate to Performance → Data Collectors Set → +Startup Event Trace Sessions. + +**Step 7 –** Locate the NetwrixAuditorForWindowsServer object, right-click it and select +**Properties**. Complete the following fields: + +| Option | Description | +| --- | --- | +| Directory → Root Directory | Path to the directory where the event log is stored. Under the Root directory option, click **Browse** and select a new root directory. | +| File → Log file name | Name of the event log where the events are stored. | diff --git a/docs/auditor/10.8/install/useractivitycoreservice.md b/docs/auditor/10.8/install/useractivitycoreservice.md index fcb88bbcd4..d852ee04f2 100644 --- a/docs/auditor/10.8/install/useractivitycoreservice.md +++ b/docs/auditor/10.8/install/useractivitycoreservice.md @@ -6,13 +6,24 @@ sidebar_position: 60 # Install for User Activity Core Service -By default, the Core Service is installed automatically on the audited computers when setting up -auditing in Netwrix Auditor. If, for some reason, installation has failed, you must install the Core -Service manually on each audited computer. +By default, Netwrix Auditor automatically installs the User Activity Core Service on the audited +computers when you set up auditing. If the installation fails, you must install the Netwrix Auditor +User Activity Core Service manually on each audited computer. + +Before installing the Netwrix Auditor User Activity Core Service manually, ensure that: + +- The audit settings are configured properly. +- The Data Processing Account has access to the administrative shares. + +## Install User Activity Core Service Manually **Step 1 –** On the computer where Auditor Server resides, navigate to _%ProgramFiles% (x86)\Netwrix Auditor\User Activity Video Recording_ and copy the UACoreSvcSetup.msi file to the audited computer. +:::note +This is the default location. It may differ because users can move this folder. +::: + **Step 2 –** Run the installation package. **Step 3 –** Follow the instructions of the setup wizard. When prompted, accept the license @@ -21,8 +32,12 @@ agreement and specify the installation folder. **Step 4 –** On the Core Service Settings page, specify the host server (i.e., the name of the computer where Netwrix Auditor is installed) and the server TCP port. +The Netwrix Auditor User Activity Core Service is installed and ready to audit user activity. + ## Install User Activity Core Service with the Command Prompt +To perform a silent installation of the User Activity Core Service with the command prompt, complete the following steps: + **Step 1 –** On the computer where Auditor Server resides, navigate to _%ProgramFiles% (x86)\Netwrix Auditor\User Activity Video Recording_ and copy the **UACoreSvcSetup.msi** file to the audited computer or to a file share the target servers can access.