Active Directory Change Notifier Quick Start Guide

2014 CionSystems Inc. ALL RIGHTS RESERVED. This guide may not be reproduced or transmitted in part or in whole by any means, electronic or mechanical, including photocopying and recording for any purpose other than the purchaser's use under the licensing agreement, without the written permission of CionSystems Inc. The software application in this guide is provided under a software license (EULA) or nondisclosure agreement. This product may only be used in accordance with the terms of the applicable licensing agreement. This guide contains proprietary information protected by copyright. For questions regarding the use of this material and product, contact us at: CionSystems Inc. 16625 Redmond Way, Ste M106 Redmond, WA. 98052 www.cionsystems.com +1.425.605.5235 Trademarks CionSystems, CionSystems Inc., the CionSystems Inc. logo, CionSystems Active Directory Change Notifier, Active Directory Change Notifier, ADCN are trademarks of CionSystems. Other trademarks and registered trademarks used in this guide are property of their respective owners. Copyright 2014 CionSystems Inc., All Rights Reserved Page 2

Table of Contents Introduction... 4 Active Directory Overview... 4 Objects in Active Directory... 5 Installation... 5 System Requirements... 5 Installing the application... 5 Installation Wizard... 6 Configuring the Active Directory Change Notifier... 7 Data Collection... 9 Configure an Audit Policy Setting for a Domain Controller... 11 Configure Auditing for Specific Active Directory Objects... 11 Report types and descriptions... 12 Copyright 2014 CionSystems Inc., All Rights Reserved Page 3

Introduction Change notification is a critical procedure for managing and limiting authorized and unauthorized changes and errors to the Active Directory configuration. A single unauthorized change can put your organization at risk, introducing security breaches and compliance issues. The built-in Active Directory auditing (if you enable auditing) lacks real time notification capabilities for authorized and unauthorized changes. Security logs can take up enormous space and resources, and taken alone will never paint the whole picture. CionSystems Active Directory Change Notifier is an easy to use, flexible application that notifies you of the changes made to Active Directory in REAL TIME. Notifications contain the 4 W's Who, What, When, and Where for all changes to made to Active Directory as well as Exchange configurations- for example: mailboxes, Group Policy, Active Directory schema, and other Active Directory objects. You can additionally limit noise by choosing to monitor only the objects you care about, and limit the number of notifications. Additionally, these notifications are archived in a log file allowing organizations to analyze any policy violations, adhere to security best practices and maintain established internal policies. You can use these notifications to: 1. Revert unauthorized changes 2. Improve the security policies 3. Monitor day-to-day administrative activities. 4. Prepare compliance reports for your SOX, GLBA and HIPAA auditors. Active Directory Overview Active Directory is a directory service offered by the Windows environment. The term directory service refers to two things a directory where information about users and resources is stored and a service or set of services that let you access and manipulate those resources. AD is a way to manage all elements of your network, including computers, groups, users, domains, security policies, and all types of user-defined objects. It combines several Windows NT services and tools that have functioned separately in the past User Manager for Domains, Server Manager, Domain Name Server and provides additional functionality beyond these services and tools. AD is built around Domain Name System (DNS) and lightweight directory access protocol (LDAP) DNS (Domain Name System) because it is the standard on the Internet and is familiar, LDAP (Lightweight Directory Access Protocol) because most vendors support it. Active Directory clients use DNS and LDAP to locate and access any type of resource on the network. Because these are platform-independent protocols, Unix, Macintosh, and other clients can access resources the same way as Windows clients. The Microsoft Management Console (MMC) is used to implement and manage Active Directory. The two most important goals of this console are: Users should be accessing resources throughout the domain using a single logon. Administrators should be able to centrally manage both users and resources. Copyright 2014 CionSystems Inc., All Rights Reserved Page 4

Objects in Active Directory Contacts - Used to store information about external users Computers - Used to maintain information about computers on the domain Users - Used to allow a user access to resources and contain information defining that user Groups - Group objects are a collection of other objects such as users, contacts or computers, and are used to grant access to resources or to distribute e-mail Local Groups: The scope is limited to the machine on which they exist. Mainly used to grant permissions to access resources. Domain Local Groups: These objects have domain-wide scope. They grant resource permissions to any of the machines in that domain. Global Groups: They have domain-wide scope. They grant Global access to the entire domain for the group. Universal Groups: These objects can grant permissions in any domain, including domains in other forests. Printers - Printer objects are network printers, or shared local printers that have been published either automatically or manually in the Active Directory Group Policies - Group policy objects are used to configure the desktop environment of Windows 2000 and XP Professional machines Shared Folders - Shared folder objects are pointers to a network share that has been published in Active Directory OU S - Organizational Units are containers for other Active Directory objects Installation System Requirements CionSystems Active Directory Change Notifier needs: 512MB RAM (1GB Recommended) 16 MB of disk space Windows Server 2000, 2003, 2008 Microsoft.NET 2.0 Framework CionSystems Active Directory Change Notifier can be installed from a CD or a web link. This application does not have to be installed on a Domain Controller- it can be installed on a regular workstation by someone with privileges high enough to allow connection to the Active Directory for the configuration process. We recommend installing it from a domain admin level account. Installing the application 1. Insert CionSystems Active Directory Change Notifier CD into your CD drive. The Setup window should start. If not please follow the steps below: 2. Go to your CD Drive 3. Double click on ADChangeNotifier.msi file This will start the setup process. Go to Step 1 in the Installation Wizard. Copyright 2014 CionSystems Inc., All Rights Reserved Page 5

Installation Wizard Once you start the install you ll see the Welcome Screen 1. Click Next 2. Click Next 3. Agree to the License Agreement/EULA and Click Next 4. Confirm installation and Click Next 5. Active Directory Change Notifier will start installing 6. When the installation is complete, click Close Copyright 2014 CionSystems Inc., All Rights Reserved Page 6

Configuring the Active Directory Change Notifier 1. Start the application 2. Click on Configuration, choose Domain Settings Enter the domain name, domain controller name Enter the Username/Password and to start AD monitoring click on Start and click on OK Click on save The account has to be privileged enough to permit a connection to the Active Directory. Copyright 2014 CionSystems Inc., All Rights Reserved Page 7

3. Click on Configuration, choose Email Settings Enter the SMTP Server, Configure the Email settings, and click Save If SMTP server requires authentication then enter the user name and password Test the email, ensure you have received email 4. Click on Configuration, choose Audit Settings Uncheck any objects you do not want to be notified about, and click Save Copyright 2014 CionSystems Inc., All Rights Reserved Page 8

4. Click on Configuration, choose Sql Server Configuration Enter the SQL Server, User Name and password, Provide interval in hours. To save change history in the database then please select Yes save changes into Database radio button and then click on Save. The database that provide here is the same database at Active Directory Reporter will create at the time of installation. You can use Active Directory Reporter application s Audit reports tab to generate different auditing reports. Data Collection Auditing of the Directory Service Access Success category must be turned on for all domain controllers. To centrally enable this setting, go to the Domain Controller Security Policy (available from the Administrative Tools menu on any DC), navigate to Computer Configuration Windows Settings Security Settings Local Policies Audit Policy node and make sure that Audit directory service access setting is set to Success (or Success and Failure). DC policy (not a domain policy) must be used to enable this setting, because domain controllers don t inherit domain policy settings by default. Similar to Directory Service Access, auditing of the Account Management Success category must be turned on if you want to report on password resets. Configuration instructions are the same (see above). If you get errors about Group Policy Management Console (GPMC) not installed when it is actually installed, try to repair the GPMC installation by running the following: regsvr32.exe C:\Program Files\GPMC\gpmgmt.dll Copyright 2014 CionSystems Inc., All Rights Reserved Page 9

If you get incorrect values in the Who changed fields: Please remember that the size of Security Event Logs on your Domain Controllers must be large enough to hold events. Also ensure that Overwrite events as needed option is selected. Copyright 2014 CionSystems Inc., All Rights Reserved Page 10

Configure an Audit Policy Setting for a Domain Controller 1. Click Start Programs Administrative Tools, and then click Active Directory Users and Computers. 2. View Menu, click Advanced Features. 3. Right-click Domain Controllers Properties. 4. Click the Group Policy tab Default Domain Controller Policy Edit. 5. Click Computer Configuration Windows Settings Security Settings Local Policies Audit Policy. 6. In the right pane, right-click Audit Directory Services Access, and then click Properties. 7. Click Define These Policy Settings, and then click to select one or both of the following check boxes: Success: Select this box to audit successful attempts for the event category. Failure: Select this box to audit failed attempts for the event category. 8. Right-click any other event category that you want to audit, click Properties. 9. Click OK. Because the changes that you make to your computer's audit policy setting take effect only when the policy setting is propagated or applied to your computer, complete either of the following steps to initiate policy propagation. Wait for automatic policy propagation that occurs at regular intervals that you can configure. By default, policy propagation occurs every five minutes. 10. Open the Security log to view logged events. If you are either a domain or an enterprise administrator, you can enable security auditing for workstations, member servers, and domain controllers remotely. Configure Auditing for Specific Active Directory Objects After you configure the audit policy setting, you can configure auditing for specific objects such as users, computers, organizational units, or groups, by specifying both the types of access and the users whose access you want to audit. To configure auditing for specific Active Directory objects: 1. Click Start Programs Administrative Tools Active Directory Users and Computers. 2. Make sure that Advanced Features is selected on the View Menu by making sure that the command has a check mark next to it. 3. Right-click the Active Directory object that you want to audit Properties. 4. Click the Security tab Advanced. 5. Click the Auditing tab Add. 6. Complete one of the following: Type the name of either the user or the group whose access you want to audit, and then click OK. Copyright 2014 CionSystems Inc., All Rights Reserved Page 11

In the list of names, double-click either the user or the group whose access you want to audit. 7. Click to select either Successful or Failed check box, then click OK. 8. Click OK twice. If you want to monitor changes to domain configuration or Exchange configuration, please follow these steps to enable object-level auditing for Configuration and Schema containers: 1. Run ADSI Edit utility (a part of the Windows Support Tools package) 2. Right-click the root node, select Connect to, and connect to the Configuration naming context of your domain. 3. Right-click the Configuration node for properties and go to the Security tab. 4. Click Advanced and select the Auditing tab. 5. Click Add and type Everyone, click OK. 6. In the Apply onto list select This object and all child objects. 7. Select all Successful Audit items except for the following: Full Control, List Contents, Read Permissions, Read All Properties DO NOT click the checkbox named Apply these auditing to objects and/or containers within this container only. 8. Click OK Repeat all steps above for the Schema container. Report types and descriptions Once you start the Active Directory Change Notifier, the application will e-mail you anytime a change occurs to any objects within your Directory Services. Additionally, it logs the changes to: %program files%\ CionSystems Inc\AD Change Notifier\auditlog The 3 different types of reports are ADD, MODIFY and DELETE: Copyright 2014 CionSystems Inc., All Rights Reserved Page 12

Contact Notes: For technical support or feature requests, please contact us at Support@CionSystems.com or 425.605.5325 For sales or other business inquiries, we can be reached at Sales@CionSystems.com or 425.605.5325 If you d like to view a complete list of our Active Directory Management solutions, please visit us online at www.cionsystems.com Disclaimer The information in this document is provided in connection with CionSystems products. No license, express or implied, to any intellectual property right is granted by this document or in connection with the sale of CionSystems products. EXCEPT AS SET FORTH IN CIONSYSTEMS LICENSE AGREEMENT FOR THIS PRODUCT, CIONSYSTEMS INC. ASSUMES NO LIABILITY WHATSOEVER AND DISCLAIMS ANY EXPRESS, IMPLIED OR STATUTORY WARRANTY RELATING TO ITS PRODUCTS INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. IN NO EVENT SHALL CIONSYSTEMS INC. BE LIABLE FOR ANY DIRECT, INDIRECT, CONSEQUENTIAL, PUNITIVE, SPECIAL OR INCIDENTAL DAMAGES (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF PROFITS, BUSINESS INTERRUPTION OR LOSS OF INFORMATION) ARISING OUT OF THE USE OR INABILITY TO USE THIS DOCUMENT, EVEN IF CIONSYSTEMS INC. HAS BEEN ADVISED IN WRITING OF THE POSSIBILITY OF SUCH DAMAGES. CionSystems may update this document or the software application without notice. CionSystems Inc 16625 Redmond Way, Ste M106 Redmond, WA 98052 425.605.5325 This guide is provided for informational purposes only, and the contents may not be reproduced or transmitted in any form or by any means without our written permission. Copyright 2014 CionSystems Inc., All Rights Reserved Page 13