Auditing Cayosoft Administrator with Change History and Execution History

---

Content: 

 

Overview: Change History vs. Execution History

Because Cayosoft Administrator uses a 3-tier architecture, understanding where to get information on the activity of the Cayosoft Administration Service and users using Cayosoft Administrator is important. This information may be required for auditing, troubleshooting, or product usage reasons.

Change History is used to provide visibility over recent changes made to specific objects by users of the Web Portal. Simultaneous output of Change History to the Windows Event Logs can also be configured to provide visibility through your preferred auditing tool or SEIM.

Execution History offers a series of individual reports that details tasks that Cayosoft Administrator has performed. This is useful for troubleshooting issues.

 

Video Tutorial

 

Change History 

For day-to-day administrators or help desk staff, Change History shows the recent changes that were made to users, groups, computers, or contacts.  This detail allows the user to understand the who, what and when of changes made that may affect the object.

Previous and new values for compliance

Change history is not meant to track every change to a specific object, rather it is intended to track the most critical changes to attribute data and group memberships. For tracked changes, before and after values are recorded so that it's always possible to return the initial value and understand how its change influences the environment.  

 

Windows events for Active Directory

Windows Event logs can be used to track changes made to Active Directory – if Active Directory Domain Services logging (AD DS Logging) is enabled.  Once enabled AD DS Logging provides detailed information about what was created, modified, or deleted.

Because tasks completed by Cayosoft Administrator are performed in Active Directory by means of a Service Account, the service account will be shown as the initiator of the change. This means that in order to trace an event, you will need to know what was changed and when it was changed, and using this information review the Execution History Reports to determine the User who initiated the change within Cayosoft Administrator.

 

Cayosoft Administrator events for Windows Event Log

Cayosoft Administrator logs its own events related to the most important operations to the Windows Event Log. For more details, please see the List of events that Cayosoft Administrator posts to the Windows Event Log – Cayosoft Help Center.

 

Execution History

For Administrators, Execution History displays a list of rules that were executed and the results. This information is critical for monitoring the system for problems and troubleshooting.

 

Viewing Execution History Reports

1. In the Cayosoft Administrative Console navigate to Execution History

2. In the Filter field enter the name of a specific user or Rule to filter the list to the desired operations
   
   

3. Locate the entry(ies) to be examined

4. Open an entry by double-clicking the entry or by clicking the View Details command on the Action menu

 

Understand the owner field syntax

Understanding the format of the value in the owner field is important because it describes who and how a rule was executed. If a user’s name is displayed, the owner field indicates the user who ran the rule or performed the task in the Web Portal. When this name is followed by an asterisk (*) this indicates the rule initiated by the user executed additional rules usually required to complete a desired set of tasks.

When the owner name is Policy Service (Scheduled Enforcement) the rule that was executed as a scheduled operation. Both user-created rules that are Enforced (Scheduled) and built-in rule used by Cayosoft Administrator to ensure the correct performance of the software will appear under this name.

 

Execution History rule view

When viewing Automation Rules or Web Action Rules in the Cayosoft Administrator Console, the last five rule execution results are displayed at the bottom right corner of the screen:

1. List entries with a green indicator mean that the rule ran successfully.
2. Entries with a red indicator mean there was some issue that may need attention.
3. Clicking an entry will display the associated Execution History Report. 
4. Created\By displays the date, time, and the user name who created the rule. 
5. Updated\By displays the date, time, and the user name who updated the rule.
   
   

 

Exporting rule reports to separate HTML files

1. Select the execution history record(s) to be exported

   Use SHIFT+Select to highlight more than one record

2. Click Export Record(s) on the Action menu

3. Select the folder where the reports will be saved

   Alternatively, you can click Make New Folder to create a location

4. Click OK