NetWrix File Server Change Reporter. Quick Start Guide

Transcription

1 NetWrix File Server Change Reporter Quick Start Guide

2 Introduction... 3 Product Features... 3 Licensing... 3 How It Works... 4 Getting Started... 5 System Requirements... 5 Setup... 5 Additional Considerations... 6 Viewing Reports... 7 Reports on Changes... 7 Next Steps... 7 Running an On-Demand Report... 7 Reporting on Changes Occurred Between Two Snapshots... 8 Importing Changes Occurred Between Two Snapshots... 8 Configuring Advanced (SSRS-Based) Reporting... 9 Using Advanced Reporting... 9 Editing the Scheduled Task Directly Filtering to Collect and Report On... 10

3 Introduction File server auditing is a critical requirement for organizations that rely on file servers to store their documents and network applications. Unauthorized and accidental changes in files and folder structure, permissions, file shares, and other objects can significantly impact your users and infrastructure by facilitating data theft and security threats. NetWrix File Server Change Reporter audits important file server changes. The tool sends daily reports about all file server access for your review, including changes made to files, folders, shares, and permissions with previous and new values of certain configuration values, read-only access attempts, both successful and failed. The commercial version of this tool provides information about who access/changed files and when it occurred, including detailed information about permission changes. Product Features Detects and reports on changes made to files. Reports include information about what changes were made, who (*) made changes and when (*) they were made. Detects read-only file access attempts, successful and failed (*). Reports previous and current values for every change. Provides on-demand Web-based reporting.(*) Custom reports can be created or ordered from NetWrix.(*) Provides storage for collected audit data and enables historical reporting for any period of time.(*) Supports the most commonly used file server configurations: Windows Server and NetApp Filer. * Features marked with (*) are only available in the commercial version of the product. Licensing The commercial editions of the File Server Change Reporter are available with advanced functionality and technical support. Please refer to version comparison table online for more details. The free version can be used by businesses and individuals for unlimited time, at no charge. Commercial editions can be evaluated for free during 20 days.

4 How It Works Typical NetWrix File Server Change Reporter data flow is described below. 1. File server changes and access events are periodically collected and stored as snapshot files. Reports displaying changes to file servers are generated on schedule and then sent to the specified recipient(s). Optionally, advanced reports can be viewed with SQL Server Reporting Services. 2. You can set up advanced reporting based on SQL Server Reporting Services. For that, you can use the Setup Advanced Reporting dialog box (it can be invoked during installation, or later from the Start NetWrix File Server Change Reporter Configurator). There you have to specify: SSRS location, SQL database, and database connection settings. 3. If the database does not exist at that moment, it will be created after you click OK in that dialog box. Note: If the database was not created during installation for this or that reason (for example, policy settings that require a database admin privileges to create a database), run the adcr_db.sql script from installation folder using the account that possesses the required rights and privileges. 4. When information about file server changes is collected for a snapshot, it will be also automatically stored in the specified database and become available for report generation. 5. Also, after you click OK to save the settings in the Setup Advanced Reporting dialog box, predefined reports (.RDL files) will be loaded to the Home> NetWrix File Server Change Reporter folder on SSRS. 6. You can view HTML reports in the SSRS Report Manager if you enter the URL in your web browser (you can find this URL in Advanced Reporting Settings), or click the More reports link from the report that you have received. The NetWrix File Server Change Reporter collection and reporting workflow is usually as follows: 1. A user launches the Configurator and sets the parameters for automated data collection and reporting. 2. The NetWrix File Server Change Reporter scheduled task is launched periodically (typically, every night, at 3 AM by default; it can also be launched manually when needed). This task collects file server snapshots, and s reports on changes to the specified recipients. 3. If SSRS-based reporting was configured, the task also stores information about file server changes to the specified SQL server database (if automatic data import fails, you can use Database Importer to import data when necessary). 4. A user launches mail client to view the reports sent by If SSRS-based reporting was configured, a user launches the web browser and views the reports in Report Manager.

5 Getting Started Follow the instructions below to install and configure File Server Change Reporter. System Requirements The product can be installed on any computer running Windows XP SP2 or higher. Supported file server configurations: Windows 2000 or higher and NetApp Filer Optionally you will need SQL Server 2005 Express Edition with Advanced Services to create and view the advanced Web-based reports. You can get a free copy from Microsoft Download Center. Setup To install File Server Change Reporter, run the setup program on any computer in the domain where managed file servers are located. On the last step of the installation wizard, the configuration dialog box opens. In this dialog box, specify the following: The Enable File Server Change Reporting check box is selected by default. Use Add, Remove or Import (*) to specify a list of file servers you want to monitor. The Import button lets you add a batch of file servers from an import file. The import file contains a list of file servers names, each server name is on one line.

6 Select the Monitor hidden shares (e.g. C$, D$) option if needed. Specify the data storage path in the Store data to: text box. Note that you must have at least 15 bytes of storage per file per day. By default, NetWrix File Server Change Reporter stores data for the last two days. Select the Enable long-term archiving for: option if you need tracking for longer periods and specify its value.(*) To provide for advanced reporting based on SQL Server Reporting Services (SSRS), click Configure... For more details, see the Using SSRS-based Reporting section in this document.(*) Click Change to change the report delivery schedule. By default, reports are delivered at 3.00 AM every day. Under report delivery settings, enter the addresses to which reports are delivered (multiple addresses should be separated by comma) and supply SMTP server settings (name, port,) and From address). When you have finished with these settings, click Apply. You will be prompted for the credentials to run data collection and report generation. The account you specify will be used to run the Netwrix File Server Change Reporter scheduled task (it can also be launched manually,as described later in this document). Features marked with (*) are only available in the commercial version of the product. Important: The freeware version reports only file system permission changes. The information about who made the change and when it occurred is reported by commercial version only. If necessary, you can later change configuration settings by invoking Configurator from the Start menu (select NetWrix File Server Change Reporter and then click Configurator). Additional Considerations Please read this section before you start file system auditing. The Who changed and When changed fields may be shown as 'system' when file system auditing is not configured correctly. 1. Please modify auditing entries for all managed folders configured as network shares. In order to receive reports about both successful and failed modifications and read attempts you should set the following entries to Successful and Failed for Everyone: List Folder / Read Data Create Files / Write Data Create Folders / Append Data Write Attributes Write Extended Attributes Delete Subfolders and Files Delete Change Permissions Take Ownership

7 2. Enable Object Access auditing in Group Policy settings for all managed file servers. To centrally enable this setting, it's recommended to create a Group Policy Object and assign it to your server's OU. In the Group Policy Object, navigate to the Computer Configuration Windows Settings Security Settings Local Policies Audit Policy node and make sure that the 'Audit object access' setting is set to Success and Failure. Viewing Reports The reports are ed to the addresses specified during the configuration. Reports on Changes At the first run of the scheduled task, the message notifies you of the initial analysis completed. Next, you can make some changes to your file server to see how they will be reported. For example, you can change share permission. After that, you can launch the scheduled task again, and then check the mailbox for the new report. The changes should be reported like shown in the figure below; if so, consider the product installation and configuration completed. Next Steps This section tells you how to manage File Server Change Reporter beyond the initial configuration. For more details, see the NetWrix File Server Change Reporter online help. Running an On-Demand Report To get a report on changes made to file server right away, you can select the Netwrix File Server Change Reporter in the list of the scheduled tasks, and select Run from its shortcut menu. The program will check for file server changes and automatically the report to the specified recipient(s).

8 Reporting on Changes Occurred Between Two Snapshots To view the changes that occurred between the particular snapshots, Report Viewer can be used. Select the file server and snapshots (by date) and click Generate to generate and save a report on changes between them (in the HTM format). The report will be opened in the web browser to show you the changes that occurred between selected snapshots. Note: Actually, this report will be identical to the report on changes you received by at the time of the second snapshot generation. Importing Changes Occurred Between Two Snapshots Database Importer allows you to import file server changes occurred between two snapshots saved by NetWrix File Server Change Reporter to an SQL server database for performing the advanced analysis through Microsoft SQL Server SRS. In most cases the use of Database Importer is not required, because the data is imported according to the schedule and automatically stored in the specified database if the corresponding option is selected. However, you may need to manually import the data when, for example, the database fails, or any other error occurs.

9 Configuring Advanced (SSRS-Based) Reporting To configure advanced SSRS-based reporting, take the following steps: 1) Open the product configuration settings (either during the setup, or by clicking the Start menu, selecting NetWrix File Server Change Reporter and then Configurator). 2) Click Configure... to open the Advanced Reporting Settings. 3) Specify the name of your SQL server. 4) Enter the name of the database where Change Reporter will store the collected data. If the database does not exist, it will be created after you close the configuration dialog. 5) Specify the way to connect to SQL Server. You can either supply proper SQL Server authentication credentials, or select Windows Authentication to connect using the scheduled task account. 6) Enter the URLs of your SQL Reporting Services installation (Report Server and optionally - Report Manager). Verify the URLs you supplied (try them in your Web browser). 7) Click OK to create the database for report data and to upload predefined reports. Change Reporter is now configured to gather and import data to the SQL database and then generate the SSRS reports at the next run according to the specified schedule. You can locate these reports in the NetWrix File Server Change Reporter subfolder of the SSRS' Home folder. Also, you can access them by clicking the More reports link from the report that you have received by e- mail. For more details on configuring SSRS-based reporting, refer to the Using Advanced Reporting With SQL Server Reporting Services deployed, you can also configure advanced reporting (SSRS-based). In this case, you can use the advantages of SSRS-based reporting: Change the report filters to fine-tune the data view according to your needs. Use one of popular formats: PDF, XLS, etc. to save the report. Apply grouping and sorting to report data, and so on. To use this type of reporting, you can either click Configure when supplying configuration settings during the setup, or invoke the Configurator later on.

10 Editing the Scheduled Task Directly File Server Change Reporter uses a standard Windows scheduled task called Netwrix File Server Change Reporter to schedule its operation. In addition to using the Change button in the program's configuration dialog box, you can edit the schedule and other parameters of this task directly in its properties. Filtering to Collect and Report On You may need to fine-tune data collection and reporting by including or excluding the following: To filter out the attributes and classes you do not want in your reports, add their names to the following files: omitproplist.txt (for attributes) and omitobjlist.txt (for object classes). To change attribute display names in the report, you can modify this names in propnames.txt. To prevent certain properties from being saved to the data storage, add their names to the omitstorelist.txt file. To exclude certain file path from auditing, add this file path to the omitpathlist.txt file.