NETWRIX CHANGE NOTIFIER

NETWRIX CHANGE NOTIFIER FOR ACTIVE DIRECTORY, EXCHANGE AND GROUP POLICY QUICK-START GUIDE Prduct versin: 7.5.873 February 2014 February 2014.

Legal Ntice The infrmatin in this publicatin is furnished fr infrmatin use nly, and des nt cnstitute a cmmitment frm Netwrix Crpratin f any features r functins discussed. Netwrix Crpratin assumes n respnsibility r liability fr the accuracy f the infrmatin presented, which is subject t change withut ntice. Netwrix is a registered trademark f Netwrix Crpratin. The Netwrix lg and all ther Netwrix prduct r service names and slgans are registered trademarks r trademarks f Netwrix Crpratin. Active Directry is a trademark f Micrsft Crpratin. All ther trademarks and registered trademarks are prperty f their respective wners. Disclaimers This dcument may cntain infrmatin regarding the use and installatin f nn-netwrix prducts. Please nte that this infrmatin is prvided as a curtesy t assist yu. While Netwrix tries t ensure that this infrmatin accurately reflects the infrmatin prvided by the supplier, please refer t the materials prvided with any nn-netwrix prduct and cntact the supplier fr cnfirmatin. Netwrix Crpratin assumes n respnsibility r liability fr incrrect r incmplete infrmatin prvided abut nn-netwrix prducts. 2014 Netwrix Crpratin. All rights reserved. Page 2 f 19

Table f Cntents 1. INTRODUCTION... 4 1.1. Overview... 4 1.2. Licensing... 4 1.3. Hw It Wrks... 4 2. INSTALL NETWRIX CHANGE NOTIFIER FOR ACTIVE DIRECTORY, GROUP POLICY AND EXCHANGE 5 Deplyment Optins... 5 Hardware Requirements... 5 Sftware Requirements... 5 Supprted Envirnments... 6 2.2. Installing Netwrix Change Ntifier... 6 3. CONFIGURE RIGHTS AND PERMISSIONS... 7 4. CONFIGURE NETWRIX CHANGE NOTIFIER FOR ACTIVE DIRECTORY, GROUP POLICY AND EXCHANGE... 9 5. MONITOR YOUR ENVIRONMENT FOR CHANGES... 12 5.1. Launch the Prduct Task Manually... 12 5.2. Mdify the Prduct Task Schedule... 12 5.3. View a Change Summary... 12 5.4. Generating an On-Demand Change Summary... 13 6. REVERT UNWANTED ACTIVE DIRECTORY CHANGES... 15 6.1. Reverting Unwanted Changes... 15 Page 3 f 19

1. INTRODUCTION 1.1. Overview Netwrix Change Ntifier fr Active Directry, Grup Plicy and Exchange tracks all changes t the mnitred Active Directry dmain and emails daily Change Summaries listing all changes that ccurred ver the last 24 hurs, thus prviding cmplete visibility acrss yur IT infrastructure. 1.2. Licensing Netwrix Change Ntifier fr Active Directry, Grup Plicy and Exchange is a freeware prduct with an unlimited license. 1.3. Hw It Wrks The prduct data cllectin and reprting wrkflw is as fllws: 1. An administratr sets the parameters fr autmated data cllectin, chsing which target system t reprt n: Active Directry Users cnfiguratin changes Changes t Active Directry grups Active Directry Cnfiguratin and Schema changes Dmain structure changes Changes t OUs Additins t OUs Additins t dmains Dmains bjects prperties changes Grup Plicy changes Grup Plicy Objects changes Grup Plicy Objects creatin Grup Plicy Objects remval Exchange Servers changes Security plicy vilatins Mailbx creatin and remval Exchange bjects and permissins changes Unauthrized and unplanned changes 2. A dedicated scheduled task which is launched daily cllects audit data and emails Change Summaries t the specified recipients. Yu can als use the Change Viewer tl t generate and view n-demand summaries. Page 4 f 19

2. INSTALL NETWRIX CHANGE NOTIFIER FOR ACTIVE DIRECTORY, GROUP POLICY AND EXCHANGE Deplyment Optins Netwrix Change Ntifier fr Active Directry, Grup Plicy and Exchange can be installed n any cmputer that belngs t the mnitred Active Directry dmain, but it is nt recmmended t install it n a dmain cntrller. If yu want t install the prduct n the cmputer which des nt belng t the audited dmain, yu must establish a trust relatinship between the audited dmain and the dmain where the prduct is installed. Hardware Requirements Befre installing Netwrix Change Ntifier fr Active Directry, Grup Plicy and Exchange, make sure that yur hardware meets the fllwing requirements: Table 1: Netwrix Change Ntifier Hardware Requirements Hardware Cmpnent Minimum Recmmended Prcessr Intel r AMD 32 bit, 2GHz Intel Cre 2 Du 2x 64 bit, 3GHz Memry* 512 MB RAM 4 GB RAM Disk space 50MB physical disk space fr prduct installatin. Additinal space is required fr the Audit Archive and depends n the number f AD bjects and changes per day. Tw physical drives with a ttal f 1GB free space * These are rugh estimatins. The actual required memry size depends n the average number f changes per day in the mnitred envirnment. Sftware Requirements This sectin lists the minimum sftware requirements fr Netwrix Change Ntifier fr Active Directry. Make sure that this sftware has been installed befre prceeding with the installatin. Table 2: Netwrix Change Ntifier Sftware Requirements Cmpnent Requirement Operating System Windws 7 and abve Additinal sftware.net Framewrk 3.5 Windws Installer 3.1 r abve Grup Plicy Management Cnsle* * Only required t track changes t Grup Plicy Objects. Page 5 f 19

Supprted Envirnments This sectin prvides a list f Windws and Micrsft Exchange Server versins supprted by Netwrix Change Ntifier fr Active Directry, Grup Plicy and Exchange. Table 3: Netwrix Change Ntifier Supprted Envirnments Cmpnent Versin Active Directry envirnment Windws Server 2003 (any frest mde: mixed/native/2003) Windws Server 2008/2008 R2 Windws Server 2012 Micrsft Exchange Server Micrsft Exchange Server 2003 Micrsft Exchange Server 2007 Micrsft Exchange Server 2010 Micrsft Exchange Server 2013 2.2. Installing Netwrix Change Ntifier T install Netwrix Change Ntifier fr Active Directry, Grup Plicy and Exchange, dwnlad and run the Netwrix_Change_Ntifier_fr_Active_Directry.msi file. Fllw the instructins f the installatin wizard. When prmpted, accept the license agreement and specify the installatin flder. Page 6 f 19

3. CONFIGURE RIGHTS AND PERMISSIONS The accunt under which Netwrix Change Ntifier fr Active Directry cllects data frm the mnitred dmain, must have the fllwing rights and permissins: The accunt must be a member f the Lcal Administratrs grup n the cmputer where the prduct is installed The Lg n as a batch jb plicy must be defined fr this accunt (see Prcedure 1 T define the Lg n as a batch jb plicy) The accunt must be granted read permissins fr the deleted bjects cntainer (see Prcedure 2 T grant permissins fr the Deleted Object cntainer) Prcedure 1. T define the Lg n as a batch jb plicy 1. Open the Grup Plicy Management cnsle n any dmain cntrller in the mnitred dmain: navigate t Start Administrative Tls Grup Plicy Management. 2. In the left pane, navigate t Frest: <dmain_name> Dmains <dmain_name>, right-click Default Dmain Plicy and select Edit frm the pp-up menu. 3. In the Grup Plicy Management Editr dialg, expand the Cmputer Cnfiguratin nde n the left and navigate t Plicies Windws Settings Security Settings Lcal Plicies User Rights Assignment and lcate the Lg n as a batch jb plicy: Figure 1: Grup Plicy Management Editr 4. Duble-click this plicy, select Define these plicy settings and click Add User r Grup. Specify the accunt that yu want t define this plicy fr. Page 7 f 19

5. Navigate t Start Run and type cmd. Input the gpupdate /frce cmmand and click Enter t update the grup plicy. Prcedure 2. T grant permissins fr the Deleted Object cntainer 1. Lg n t any dmain cntrller in the target dmain with a user accunt that is member f the Dmain Admins grup. 2. Open a cmmand prmpt: navigate t Start, type cmmand prmpt and click Enter. 3. Type the fllwing cmmand and press Enter: dsacls <deleted_bject_dn> /<takewnership> where deleted_bject_dn is the distinguished name f the deleted directry bject. Example: dsacls "CN=Deleted Objects,DC=Crp,DC=lcal" /takewnership 4. T grant permissin t view the bjects in the Deleted Objects cntainer t a user r a grup, type the fllwing cmmand and press Enter: dsacls <deleted_bject_dn> /G <user_r_grup>:<permissins> where deleted_bject_dn is the distinguished name f the deleted directry bject, user_r_grup is the user r grup fr whm the permissin apply, and Permissins is the permissin t grant. Example: dsacls "CN=Deleted Objects,DC=Crp,DC=lcal" /G Crp\jsmith:LCRP 5. In this example, the user CORP\jsmith has been granted List Cntents and Read Prperty permissins fr the Deleted Objects cntainer in the crp.lcal dmain. These permissins let this user view the cntents f the Deleted Objects cntainer, but d nt let this user make any changes t bjects in this cntainer. These permissins are equivalent t the default permissins that are granted t the Dmain Administratrs grup. Page 8 f 19

4. CONFIGURE NETWRIX CHANGE NOTIFIER FOR ACTIVE DIRECTORY, GROUP POLICY AND EXCHANGE After yu have installed Netwrix Change Ntifier fr Active Directry, Grup Plicy and Exchange, enable and cnfigure Active Directry, Grup Plicy and Exchange Server audit. Prcedure 3. T cnfigure audit 6. Navigate t Start All Prgrams Netwrix Freeware Netwrix Change Ntifier fr Active Directry. The prduct cnfiguratin dialg will pen: Figure 2: Netwrix Change Ntifier fr Active Directry Cnfiguratin Dialg Page 9 f 19

7. Specify the fllwing settings and parameters: Nte: The table belw describes cnfiguratin f the basic parameters required fr the prduct evaluatin purpses. Table 4: Netwrix Change Ntifier fr Active Directry Settings Parameter Enable Active Directry Change Reprter Enable Grup Plicy Change Reprter Enable Exchange Change Reprter Instructin Enable this ptin t activate Active Directry audit. Enable this ptin t activate Grup Plicy audit. Nte: Grup Plicy audit als requires the activatin f the Enable Active Directry Change Reprter ptin. Enable this ptin t activate Exchange Servers audit. Nte: The Exchange Servers audit als requires the activatin f the Enable Active Directry Change Reprter ptin. Mnitred Dmain Mnitred dmain: Enable Lightweight Agents Enter the name f an Active Directry dmain that yu want t audit. The name shuld be in the FQDN frmat, fr example acme.cm This ptin is nt available in Netwrix Change Ntifier fr Active Directry. Change Summary Send Active Directry Change Reprter Change Summary t: Send Grup Plicy Change Reprter Change Summary t: Send Exchange Change Reprter Change summary t: SMTP server: Prt: Sender address: Cnfigure advanced delivery ptins Enter the email address f the Change Summary recipient; yu can enter several addresses separated by a semicln. Enter the email address f the Change Summary recipient; yu can enter several addresses separated by a semicln. Enter the email address f the Change Summary recipient; yu can enter several addresses separated by a semicln. Enter yur SMTP server name. Specify yur SMTP server prt number. Enter the address that will appear in the Frm field in Change Summaries. T check the email address, click Verify. The system will send a test message t the specified address and will infrm yu if any prblems are detected. This ptin is nt available in Netwrix Change Ntifier fr Active Directry. Audit Archive Lcatin Stre audit data fr x mnth Leave the default setting r specify anther path t save the change histry data. All audit data cllected by the prduct will be stred in the crrespnding subflders f that flder. Active the ptin and specify the number f Page 10 f 19

Cnfigure SSRS-based Reprts mnths fr the audit data t be stred in Audit Archive. Reprts This ptin is nt available in Netwrix Change Ntifier fr Active Directry. 8. Save yur cnfiguratin by clicking the Apply buttn. The Scheduled Task Credentials dialg will be displayed. 9. Specify the accunt under which the prduct scheduled task will cllect the changes data and email Change Summaries t the specified recipients. Make sure that this accunt has the required rights and permissins (see Chapter 3 Cnfigure Rights and Permissins) 10. Enter and cnfirm the accunt passwrd and click OK. The NEXT STEPS: CHECKLIST dialg will pen; fllw its instructins t get the first Change Summary right after yu have cnfigured the prduct. Nte: T change the settings later, invke the prduct cnfiguratin dialg frm the Start menu. Page 11 f 19

5. MONITOR YOUR ENVIRONMENT FOR CHANGES When the prduct has been cnfigured, it starts cllecting data n Active Directry, Grup Plicy and Exchange Server changes frm the mnitred dmain. By default, the data cllectin task is launched daily at 3:00 AM. If required, yu can launch the prduct scheduled task manually r mdify its schedule. 5.1. Launch the Prduct Task Manually Prcedure 4. T launch the prduct scheduled task manually: 1. Launch Task Scheduler. 2. In the left pane, expand the Task Scheduler Library nde. In the right pane, select the task called Netwrix Management Cnsle Active Directry Change Reprter - <yur_dmain_name> (where <yur_dmain_name> is the name f the dmain yu specified in the cnfiguratin settings). 3. Right-click the task and select Run frm the drp-dwn list. Alternatively, use the Run ptin frm the Actins menu. 5.2. Mdify the Prduct Task Schedule Prcedure 5. T mdify the prduct task schedule: 1. Launch Task Scheduler. 2. In the left pane, expand the Task Scheduler Library nde. In the right pane, select the task called Netwrix Management Cnsle Active Directry Change Reprter - <yur_dmain_name> (where <yur_dmain_name> is the name f the dmain yu specified in the cnfiguratin settings). 3. Right-click the task, select Prperties Triggers and click Edit. Alternatively, use the Prperties ptin frm the Actins menu. 5.3. View a Change Summary After the first data cllectin task has finished, an email will be delivered t the specified address ntifying yu that the initial analysis has been cmpleted. After that, yu can make test changes t yur envirnment t see hw they are reprted. When the task is launched the next time (either autmatically r manually), it detects the changes made since the last data cllectin, generates and delivers the Change Summary t the specified recipients. A Change Summary cntains the fllwing infrmatin: Change type (Added/Remved/Mdified) Object type (fr example, user, OU) Object name (fr example, the full user name) Details (the mdified prperties and their befre and after values) Page 12 f 19

Belw is an example f the Netwrix Change Ntifier fr Active Directry Change Summary: Figure 3: Netwrix Change Ntifier Change Summary Example 5.4. Generating an On-Demand Change Summary Yu can generate Change Summaries fr a specific perid f time using the Change Viewer tl. Prcedure 6. Nte: The prduct allws yu t generate a summary f changes cllected within the last 4 days nly. T generate an n-demand Change Summary 1. Navigate t Start All Prgrams Netwrix Freeware Netwrix Change Ntifier fr Active Directry Advanced Tls and click Change Viewer. The fllwing dialg is displayed: Page 13 f 19

Figure 4: Change Viewer Dialg 2. Select the audited system frm the Mdule drp-dwn list and the time range yu want t generate the reprt n. 3. Click Generate. The Save as windw appears allwing yu t name yur reprt and select the lcatin fr it. Click Save. 4. The Change Summary is saved lcally in the HTML frmat and displayed in yur default web brwser. Figure 5: Change Summary Page 14 f 19

6. REVERT UNWANTED ACTIVE DIRECTORY CHANGES Restring deleted bjects and reverting unwanted r unauthrized changes t Active Directry bjects can be a difficult and errr-prne task, and smetimes it is simply impssible. In mst cases, native and third-party Active Directry backup and recvery tls require nn-authritative restre and dmain cntrllers dwntime. Mrever, they d nt always have bject-level restre capabilities. With Netwrix Change Ntifier fr Active Directry yu can quickly restre deleted and mdified bjects using the Active Directry Object Restre tl integrated with the prduct. This tl enables AD bject restre withut rebting a dmain cntrller and tuching the rest f the AD structure. 6.1. Reverting Unwanted Changes By default, when a user r cmputer accunt is deleted frm Active Directry, its passwrd is discarded. When yu restre deleted accunts with the Active Directry Object Restre tl, it sets randm passwrds which then have t be changed manually. If yu want t be able t restre AD bjects with their passwrds preserved, yu need t mdify the Schema cntainer settings s that accunt passwrds are retained when accunts are deleted. This sectin prvides detailed step-by-step instructins n hw t: Prcedure 7. Mdify yur Schema cntainer settings t retain passwrds fr deleted accunts Revert unwanted changes t yur AD bjects T mdify Schema cntainer settings Nte: T perfrm this prcedure, yu will need the ADSI Edit utility. In Windws 2003 systems, this utility is a cmpnent f Windws Server Supprt Tls. If it has nt been installed, dwnlad Windws Server Supprt Tls frm the fficial website. On Windws 2008 systems and abve, this cmpnent is installed tgether with the AD DS rle. 1. Navigate t Start Prgrams Administrative Tls ADSI Edit. The ADSI Edit dialg will pen. Figure 6: ADSI Edit dialg 2. Right-click the ADSI Edit nde and select the Cnnect T ptin. In the Cnnectin Settings dialg, enable the Select a well-knwn Naming Cntext ptin and select Schema frm the drp-dwn list: Page 15 f 19

Figure 7: Cnnectin Settings Dialg 3. Click OK. 4. In the left pane, expand the Schema <Yur_Rt_Dmain_Name> nde. Lcate the attribute called CN=Unicde-Pwd, right-click it and select Prperties frm the ppup menu: Figure 8: CN=Unicde-Pwd Prperties 5. Lcate the attribute called searchflags, duble-click it and set its value t 8: Page 16 f 19

Figure 9: Attribute Editr 6. Click OK. Nw yu will be able t restre deleted accunts with their passwrds preserved. Prcedure 8. T revert changes t AD bjects 1. Navigate t Start All Prgrams Netwrix Freeware Active Directry Object Restre. The welcme page f the Active Directry Object Restre wizard will be displayed. Click Next t prceed. 2. On the Select Rllback Perid step, specify the perid f time when unwanted changes that yu want t revert ccurred. Yu can either select a perid between a specified date and the present date, r between tw specified dates. Nte that the prduct nly keeps data n deleted Active Directry bjects fr the last 4 days. Figure 10: Active Directry Object Restre Wizard: Select Rllback Perid Page 17 f 19

3. On the Select Rllback Surce step, yu must select a dmain and the Rllback Surce: Figure 11: Active Directry Object Restre Wizard: Select Rllback Surce 4. Tw ptins are supprted: Restre frm state-in-time snapshts: this ptin allws restring bjects frm cnfiguratin snapshts made by the prduct. This ptin is preferable since it allws attribute-level bject restre. Restre frm AD tmbstnes: this ptin is recmmended when n snapsht is available. This is a last resrt measure as the tmbstne hlds nly the basic bject attributes. 5. If yu have selected t use a rllback pint as a surce, yu can select the Select a state-in-time snapsht ptin if yu want t revert t a specific snapsht. Otherwise, the prduct will autmatically search fr the mst recent snapsht that will cver the selected time perid. Click Next t prceed. 6. On the Analyzing Changes step, the prduct analyzes the changes made during the specified time perid. When reverting t a snapsht, the tl lks at the changes that ccurred between the specified snapshts. When restring frm a tmbstne, the tl lks at all AD bjects put in the tmbstne during the specified perid f time. When the analysis is cmplete, click Next t prceed. 7. On the Select Changes t Rll Back step, the results f the analysis are displayed. Select a change t see its rllback details in the bttm f the windw. 8. T see detailed rllback infrmatin n an attribute, select it and click the Details buttn. A windw will ppup shwing what changes will be applied if this attribute is selected fr rllback: Page 18 f 19

Figure 12: Change Details 9. Specify the changes yu want t revert by selecting the crrespnding check bxes and click Next t restre the selected bjects t their previus state. 10. Wait until the tl has finished restring the selected bjects. On the last step, review the results and click Finish t exit the wizard. Page 19 f 19