Change History

Cayosoft Guardian collects changes from connected systems and presents these changes in the Change History.

Nested group membership records

If nested group membership collection is enabled, Change History also displays transitive membership records alongside the native member changes that triggered them. These records have:

• Action — Add AD Group nested member(s) or Remove AD Group nested member(s)
• Properties — Membership propagation path, Nested members
• The same Correlation ID as the native membership change that caused them

Opening such a record and selecting the Properties tab shows two properties:

• Membership propagation path (va_transitiveMembershipPath) — the propagation path, for example Group B < Group A
• Nested members (va_transitiveMembers) — the effective member(s) added or removed

Object names in these values (member names and the group names in propagation paths) are clickable links that open the corresponding object.

The Related history records property on the record details page lists all records that are part of the same transaction (the native change and its resulting transitive records). This differs from the Find related action, which also returns all records for the same target object.

Changes made through Cayosoft Administrator

If a Cayosoft Administrator server is registered, Change History shows two records for each change made through Cayosoft Administrator:

• A Cayosoft Administrator record for the action performed in the Cayosoft Administrator web portal. The Who column shows the user who performed the action, not the Cayosoft Administrator service account.
• A managed system record, for example, Active Directory or Microsoft Entra ID, for the resulting change in the managed system.

To find both records, search by the object name, or select the Cayosoft Administrator record and click Find related. Find related returns the corresponding managed-system records for the same object, and the other way around.

The properties of a Cayosoft Administrator record also show the originating Cayosoft Administrator server, the initiator address (the IP address of the computer from which the action was performed), and a link to the initiator's user object if that user exists in a managed domain or tenant.

NOTE    Property names in Cayosoft Administrator records are shown as Cayosoft Administrator provides them, for example, CA_MemberOf. They may differ from property names in managed system records and may be localized or customized in Cayosoft Administrator. Property values are shown as plain text.

NOTE    The time of a Cayosoft Administrator record and its managed system record can differ by several minutes, because Cayosoft Administrator may perform several operations before it writes the audit event.

NOTE    Cayosoft Administrator records can't be rolled back. To undo a change, roll back the corresponding managed system record. Learn more: Rolling back changes .

Searching in the Change History

To search for specific changes in Change History:

1. Open the Cayosoft Guardian web portal.

2. Expand the Change Monitoring node.

3. Select Change History.

4. Observe recent change records.

5. Use one of the searching and filtering methods or combine them.

   1. (Optionally) Use the text search box.

   2. (Optionally) Use the quick filter bar to select a saved query, for example, Active Directory users changes.

   3. (Optionally) Use predefined filters such as When, What, Where, and others.

Restoring an object from Change History

When Cayosoft Guardian has recorded the deletion of a supported object, you can restore it directly from the deletion record:

1. Open the Cayosoft Guardian web portal.
2. Expand the Change Monitoring node and select Change History.
3. Locate the deletion record for the object (for example, use the What filter to find Delete operations, or search by the object name).
4. Select the record and choose Rollback > Create rollback job or Add to rollback job.
5. Review the job and run it when ready.

For Microsoft Entra ID security groups, the group is restored from the Microsoft Entra ID Recycle Bin with its original object ID. You can verify in the Microsoft Entra admin center that the restored group retains the same ID it had before deletion.

Restore from Change History is available only for Microsoft Entra ID objects while the deleted object is still in the Microsoft Entra ID Recycle Bin (within the 30-day soft-delete retention window). Learn more in: Objects supported by Cayosoft Guardian.