Alerts Specification. NetWrix SCOM Management Pack for Active Directory Change Reporter Technical Article

Transcription

1 Alerts Specification NetWrix SCOM Management Pack for Active Directory Change Reporter Technical Article

2 Table of Contents SCOM Management Pack for Active Directory Change Reporter Technical Article 1. Applies To Summary Alerts Audit Alerts Administration Groups Changed Administrative Password Reset Changes to Domain Trust Relationships Domain Controller Modifications Domain Controller Demoted Domain Controller Promoted Security Group Membership Changes Security Group Removed User Account Lockout User Account Enabled User Account Disabled... 4 ii

3 SCOM Management Pack for Active Directory Change Reporter Technical Article 3.2 Data Collection Alerts Data Collection Warning Data Collection Error Additional... 4 Contacting NetWrix Support If you have any questions please feel free to contact the NetWrix support team. NetWrix provides unlimited phone and support for customers who purchase the commercial version (including evaluation). In addition, on the NetWrix Support Forum, a limited support is provided for customers who use the freeware version. Disclaimer The information in this publication is furnished for information use only, does not constitute a commitment from NetWrix Corporation of any features or functions discussed and is subject to change without notice. NetWrix Corporation assumes no responsibility or liability for any errors or inaccuracies that may appear in this publication. NetWrix is a registered trademark of NetWrix Corporation. The NetWrix logo and all other NetWrix product or service names and slogans are registered trademarks or trademarks of NetWrix Corporation. Active Directory is a trademark of Microsoft Corporation. All other trademarks and registered trademarks are property of their respective owners NetWrix Corporation. All rights reserved. iii

4 SCOM Management Pack for Active Directory Change Reporter Technical Article 1. Applies To NetWrix SCOM Management Pack for Active Directory Change Reporter. 2. Summary NetWrix Active Directory Change Reporter records change events to the NetWrix Change Reporter event log if integration with Microsoft System Center Operations Manager (also known as SCOM) is enabled. NetWrix SCOM Management Pack for Active Directory Change Reporter is a solution that uses this event log to capture all changes made to Active Directory and feeds the audit data to SCOM, which generates appropriate reports and alerts. This article describes alerts triggered by SCOM alerting rules. For each alert, the following information is available: Alert severity level Trigger events Name and brief description of the alerting rule that triggered the alert. 1

5 3. Alerts SCOM Management Pack for Active Directory Change Reporter Technical Article This section describes SCOM alerts. The alerts fall into two categories: Audit alerts and Data Collection alerts. 3.1 Audit Alerts This section describes alerts triggered by changes made to Active Directory objects. The alerts help you detect unauthorized changes and violations of your security policy Administration Groups Changed Warning Removing or adding members to the administration groups. The administration groups list includes: Enterprise Admins, Domain Admins, Schema Admins, Account Operators, Administrators, Incoming Forest Trust Builders, Server Operators, and Backup Operators groups. Administrative Group Membership Changed. Tracks changes to the administration groups membership Administrative Password Reset A user password has been reset. Administrative Password Reset. Tracks changes to user password Changes to Domain Trust Relationships. Any changes to domain trusts (e.g. some trusts have been added or removed). Changes to Domain Trust Relationships Tracks changes to domain trusts Domain Controller Modifications Any changes to properties of DC computer objects. Domain Controller Modifications Tracks changes to Domain Controller computers. 2

6 SCOM Management Pack for Active Directory Change Reporter Technical Article Domain Controller Demoted A domain controller has been demoted. Domain Controller Demoted. Tracks changes to servers role Domain Controller Promoted A member server or a standalone computer has been promoted to domain controller. Domain Controller Promoted. Tracks changes to servers role Security Group Membership Changes Removing or adding members to security groups (including local, global, and universal groups). Security Group Membership Changes. Detects membership changes in all security groups Security Group Removed Deletion of security groups (including local, global, and universal groups). Security Group Removed. Monitors deletions of security groups User Account Lockout Warning User account was locked. User Account Lockout. Detects user account lockouts. 3

7 User Account Enabled SCOM Management Pack for Active Directory Change Reporter Technical Article A disabled user account was enabled. User Account Enabled. Monitors enabling of user account User Account Disabled User account was disabled. User Account Disabled. Monitors disabling of users accounts. 3.2 Data Collection Alerts This section describes alerts triggered by errors and warnings encountered when NetWrix Active Directory Change Reporter gathers the audit data Data Collection Warning Alert Alert Name Description Warning Active Directory Change Reporter encountered warnings while data gathering. Data Collection Warning. Monitors status of Active Directory Change Reporter data collection tasks Data Collection Error Alert Alert Name Description Critical Active Directory Change Reporter encountered errors while data gathering. Data Collection Error. Monitors status of Active Directory Change Reporter data collection tasks. 4. Additional Last updated: June 28, 2011 For more information, refer to 4