Home

User Manual - NTP Software File Auditor for Windows_Rev1

1. HOME Business Copyright 2015 by NTP Software All rights reserved Doc 4825EF na 31 rashad na731 rashad na 31 rashad na 31 rashad User Nam e Galactic co miPlatt Galactic co miPlatt Galactic co miTopper Galactic co Access Type File Rename File Rename File Rename File Rename Change Date 1044 2009 7 59 00 AM 104 4 2009 7 56 20 AM 104 4 2009 7 50 07 AM 104 4 2009 Policy Name MKT POL Marketing MKT POL Marketing MKT POL Dey MKT POL Dev Client Name aasayed xp 4502 l aasayed xp 4502 aasayed xp 4502 aasayed xp Share amp Name IG Machine IG Machine IG Machine IG Machine NTP Software File Auditor Windows Edition An NTP Software User Manual d Files Deleted This report allows you to review all the files that have been deleted The report s input is the file name and or the host name and or the date range and or the file type The report displays the file name the directory path in which the file was located the user name the date the file was last accessed the policy name the client name and the share name within the specified criteria Start Date 10 14 2009 5 09 14 AM ual File Type lbmp cpp doc h rtf tmp txt JEER M41 of 1 gt Files Deleted AhmedIG na 731 rashad End Date 5 3 2011 8 47 04 AM gizi A l 3 OB u H From 10 14 2009 5 09 14
2. HOME Business Shares HOME Business Shares HOME Business Shares HOME Business Shares Support aasayed xp Machine 4502 aasayed xp 4502 Galactic com Clo ver File Open For Write File Open For Write Support Galactic com Clo Machine ver Galactic com Cla ver Support Machine Support File Open For aasayed xp Write 4502 aasayed xp 4502 Galactic com Clo Machine ver User0014 File Open For Write c Access History This report allows you to review all the file and directory operations performed within a specified number of days The report input is the user account and or the number of day s in which the file directory was accessed and or the file name and or the access type performed on the file directory The report displays the user s name the object name the directory path the operation performed the date the operation was performed the policy name the client name and the share name within the specified criteria Accessed in the last days Maximum number 93852 Access Type 78947 Directory Create Directory De x Find Object Name readme txt 0 EET M441 Access History Next off 3 gt Di A l3 aoud Number of records 92 Object Name Readme txt Policy lt 5 _ Client Name Name MKT POL Marketing MKT POL Marketing MKT POL Marketing MKT POL Marketing MKT POL Marketing MKT POL Marketing MKT POL Marketing MKT POL S
3. Humber of deleted directo res Number ofcreated directories 4 Humber ofrenamed directores files b Directory Audit This report allows you to review all the directory operations performed The report s input is the directory name and or the host name and or the date range and or the access type The report displays the directory name the user name accessing the directory access type access date the name of the policy applied on the directory the client name and the share name You can choose to display the previous information within a certain date range and or for a certain access type s and or for a certain directory name Directory Name Host JahmediG na731 rashad Start Date 10 14 2009 5 09 14 AM E End Date 5 3 2011 5 44 11 AM a Access Type Directory Create Directory De EJET 1 f b Pl Ala Eud 10 Find Next Directory Audit From 10 14 2009 5 09 14 AM To 5 3 2011 5 44 11 AM Number of records 249 Directory User Access Access Name Name Type Date HOME BusinessShar Galactic com Plat na731 rashad Directory 1044 2009 MKT POL aasayed xp 4502 IG Machine es iMarketingWser000 t Delete 7 59 04 AM Marketing Old Stuff HOME BusinessShar Galactic com Plat na731 rashad Directory 1044 2009 MKT POL aasayed xp 4502 Machine esiMarketingwWser000 t Rename 7 58 47 AM Marketing BiNew Folder HOME BusinessShar Galactic com Plat na731 rashad Directory 1044 2009 MKT POL aasayed xp 4502 Ma
4. NTP Software File Auditor Windows Edition An NTP Software User Manual EE SE T Abstract This manual details the method for using NTP Software File Auditor Windows Edition from an administrator s perspective Upon completion of the steps within this document NTP Software File Auditor Windows Edition will be used to monitor file and directory operations for users within your enterprise community Rev 1 9 July 2015 Copyright 2015 by NTP Software All rights reserved Doc 4825EF NTP Software File Auditor Windows Edition An NTP Software User Manual The information contained in this document is believed to be accurate as of the date of publication Because NTP Software must constantly respond to changing market conditions this document should not be interpreted as a commitment on the part of NTP Software and NTP Software cannot guarantee the accuracy of any information presented after the date of publication This document is for informational purposes only NTP SOFTWARE MAKES NO WARRANTIES EXPRESS OR IMPLIED IN THIS DOCUMENT NTP Software NTP Software File Auditor and NTP Software Smart Policy Manager are either registered trademarks or trademarks of NTP Software in the United States and or other countries Other product and company names mentioned herein may be the trademarks of their respective owners NTP Software 20A Northwest Blvd 136 Nashua NH 03063 U
5. Email Body This i a notification email for the specified events generated by audit users through policy 2p on served Xs The email contains 4 table of audited users along with events details generated by them Please choose the the columns to be displayed Recetved Time Order By JUser Account ite G a peration Type Receiwed Time i Path User Email Configurations Properties General Email Settings Notification Settings Recipients Notification Frequency Notify for every operation iiy no more than once ever 1 Minutets Event types you want to receive IM Notify Owner Notify Other Recipients Other Recipients List Add Edit Remove Cancel Help Copyright 2015 by NTP Software All rights reserved Doc 4825EF Page 14 NTP Software File Auditor Windows Edition An NTP Software User Manual New File Audit Directory Policy Exempted Subdirectories Audited Users and Groups General Monitored Events File Criteria Directories Exempt Users and Groups Notifications DB Maintenance Notifications Description Notification 1 Ingert Notification 1 description OE Cancel Apply Help 9 Click the Exempted Subdirectories tab Click the Add button and type the subdirectory you want to exempt from the monitored directories list New File Audit Directory Policy General Monitored E vents File Criteria Directories Exempt Users and Group
6. L Number ofrenamed files 4 Number of changed tles Copyright 2015 by NTP Software All rights reserved Doc 4825EF Page 19 NTP Software File Auditor Windows Edition An NTP Software User Manual b File Audit This report allows you to review all the file operations performed The report input is the file name and or the host name and or the file operation performed and or the file type and or the date range The report displays the file name the directory name where the specified file is located the user name accessing the file access type access date the name of the policy applied on the directory the client name and the share name within the specified criteria Start Date 10 14 2009 5 09 14 AM al Access Type Fie Close File Create File Dele EER File Audit From 10 14 2009 5 09 14 AM To 5 3 2011 8 44 37 AM Number of records 1000 File Name Host ahmedtG na 31 rashad End Date 5 3 2011 8 44 37 AM gil File Type bmp cpp doc h rtf tmp txt f 23 X e Of GW we 100 Find Next Share Name Policy Name Host 2 Access 3 Date Access 3 Type Directory 3S Path File S HOME Business IG Machine Shares Marketing Wser000610ld Stutfi HOME Business Shares Marketing Wser000610ld Stuff HOME Business Shares Marketing Wser0006 4frica Customers HOME Business Shares Marketing na 31 rashad File Delete 104 4 2009 7 59 0
7. user s The report input is the user account and or the access type and or the date range and or the host name The report displays the user s name the object name the directory path the host name the operation performed the date the operation was performed the policy name the client name and the share name within the specified criteria User Account Access TYPE Directory Create Directory De 5 3 2011 8 53 20 AM zi Start Date End Date fioji4jz009 5 09 14 aM al ahmedtG na 31 rashad mS E id 4 1 User Audit From 10 14 2009 5 09 14 AM To 5 3 2011 8 53 20 AM Number of records 1000 Host of 23 gt bil Ala Bw ee 100 Find Next Galactic com Cla ver Galactic com Clo ver Directory 3S Path HOME Business Shares HOME Business Shares HOME Business Client Name 10 4 2009 7 59 46 4M 10 14 2009 7 59 43 4M 10 14 2009 MKT POL User6 MKT POL User6 MKT POL na731 Machine rashad na 3i rashad na 3i aasayed xp 4502 aasayed xp 4502 File Open For Write File Open For Write Machine Machine Galactic comiCla Support File Open For aasayed xp Write 4502 7 59 42 AM 10 4 2009 7 59 38 AM 10 14 2009 7 59 36 AM 104 4 2009 7 59 33 AM 104 4 2009 7 59 33 4M User6 MKT POL User6 MKT POL User6 MET POL User6 MKT POL Support rashad na 3t rashad na 3i rashad na731 rashad na 3i rashad Shares
8. 4 gt pi Files Renamed From 10 14 2009 5 09 14 AM To 5 3 2011 Number of records 152 Origina New Directory l File File Path Name Name New Text Readme txt HOME Business Document txt Shares Marketing Wser0006 Aftrica Customers New Bitmap ScreenShoot b HOME Business Image bmp mp Shares Marketing WserD00610ld Stuff GISMain h CGISMain h HOME Business Shares Develop ment ser0005 Projects in Host ahmedtG na731 rashad End Date 5 3 2011 8 50 12 AM EI 2 A l Oud 6 50 12 AM New Directory Path 100 Rena Policy me Name Date WA 731 Galactic com P 1014 2009 MKT POL RASHAD IHOME latt BusinessShares Marketing Jser00 OB Africa Customers 7 59 00 AM Marketing WA 731 Galactic com P 1014 2009 MKT POL latt RASHADHOME BusinessShares MarketingJser00 O6VOld Stuff 7 56 20 AM Marketing WNA 731 Galactic com T 1044 2009 MKT POL Dev RASHAD HOME opper BusinessShares Developments Copyright 2015 by NTP Software All rights reserved Doc 4825EF 7 50 07 AM Find Next Client Name aasayed xp 4502 aasayed xp 4502 aasayed xp 4502 Share Name IG Machine IG Machine IG Machine Page 21 NTP Software File Auditor Windows Edition An NTP Software User Manual f Files Created This type of report allows you to review all the files that have been created The report s input is
9. comiclo ver MKT POL Support na 31 rashad 1044 2009 7 59 36 AM 10 14 2009 7 59 33 AM aasayed xp 4502 aasayed xp 4502 Machine Machine File Open For write File Open For White HOME BusinessSh na731 rashad ares HOME BusinessSh ares Finance MKT POL User6 Galactic com Clo ver Galactic com Clo na 31 rashad ver MKT POL Finance Copyright 2015 by NTP Software All rights reserved Doc 4825EF 104 4 2009 7 59 33 AM 104 4 2009 7 59 25 AM aasayed xp 4502 aasayed xp 4502 Machine Machine Page 24 NTP Software File Auditor Windows Edition An NTP Software User Manual 4 The Directory Reports category has eight views Directory Summary Directory Audit Directory Created Directory Renamed Directory Deleted Deleted Files by Folder Deleted Files Count by Folder and Most Accessed Folders a Directory Summary This report allows you to review the count of all the audited directories It also displays a breakdown for the count of deleted renamed or created directories You can click the count next to any directory operation to display a detailed list of the specified directory operation Directory summary start 3 3 2010 6 33 59 AM Hal End 3 3 2010 5 44 50 4M EG View Report Date Date jd 4 A of i p Fl 75 r Find Next Select a format Esmom os d g Directory Summ ary Report Humber of audited directories 4
10. continue c When File Auditor has been installed you will need to move the new node under the cluster container 6 Open the cluster container in the NTP Software Smart Policy Manager hierarchy and use the drag and drop method to move the nodes into the cluster container They will appear at the same level as the container File Auditor application 7 Click the plus sign next to the NTP Software File Auditor Windows Edition application you have just added to view the global cluster policies Create all policies within this application that will be applied to both nodes They will be propagated automatically to all nodes within the container Copyright 2015 by NTP Software All rights reserved Doc 4825EF Page 41 NTP Software File Auditor Windows Edition An NTP Software User Manual Installing NTP Software File Auditor onto a Node Server To install NTP Software File Auditor Windows Edition onto a node server apply the following steps 1 NTP Software File Auditor Windows Edition enables you to push installation to each of the added nodes 2 Right click the site container and select New gt Container to create a container for the cluster Give the new container the cluster name 3 Click the existing server node and while holding down the mouse button drag and drop the server onto the cluster container to move the server into the cluster hierarchy 4 Right click the cluster container and sel
11. destination or click Next if the default destination location is appropriate ATP Software File Guditor Setup Choose Destination Location T Select folder where setup will install files Fs P SE wave Setup will install WTP Software File Auditor in the following folder To install to this folder click Next To install to a different folder click Browse and select another folder Destination Folder CA ANT PSoftwareSAW7P Software File Auditor InstallShield 4 Inthe Select Features dialog box make sure that only the Admin component is selected then click Next ATP Software File Auditor for Windows Setup Select Features Select the features setup will install _ ontware Select the features you want to install and deselect the features you do not want to install Description Selecting this option will install all of the components required to run the NTF Software File Auditor administrative chert If ou choose not to install these components you may still install the WTP Software File Auditor service but you will not be able to configure it from this machine Been go Service 0 00 ME of space required on the C drive 1439 66 ME of space available on the C drive InstallShield lt Back Cancel Copyright 2015 by NTP Software All rights reserved Doc 4825EF Page 36 NTP Software File Auditor Windows Edition An NTP Software User Manual IMPORTANT Bec
12. name based on the specified criteria Directory Name Host JahmedtG na 3l rashad Start Date 10 14 2009 5 09 14 AM e End Date 5 3 2011 5 47 12 AM EE Ful 441 f3 e O 4G Bw 100 Find Next Directory Renamed From 10 14 2009 5 09 14 AM To 5 3 2011 5 47 12 AM Number of records 103 Sa ithenites o Name i HOME BusinessShares WA 31 na 31 rashad Galactic comP 1044 2009 MKT POL aasayed xp IG Machine MarketingJser0006 RASHADIHOME Busi latt 7 58 47 AM Marketing 4502 Wew Folderi nessShares Marketing wWser0006iA frica Customers HOME BusinessShares WWA731 na 3i rashad Galactic com P 1044 2009 MKT POL aasayed xp IG Machine MarketingJser0006 RASHADIHOME Busi latt 7 56 07 AM Marketing 4502 Wew Folderi nessShares Marketing WserQ006 Old Stuff HOME BusinessShares WA731 na 731 rashad Galactic com T 1044 2009 MKT POL Dey aasayed xp IG Machine DevelopmentWser0005 RASHADIHOME Busi opper 7 48 29 AM 4502 Completed nessShares Developm Projects New Folder entWUser000s Completed Projects GDS Projecti Copyright 2015 by NTP Software All rights reserved Doc 4825EF Page 26 NTP Software File Auditor Windows Edition An NTP Software User Manual e Directory Deleted This report allows you to review all the deleted directories The report s input is the date range and or the directory name and or the host name The report displays the name of the deleted directory the user s name
13. plus sign adjacent to this entry to expand the tree Viewing Shares NTP Software File Auditor Windows Edition enables you to view all the shared directories located your Windows Server In the NTP Software Smart Policy Manager hierarchy view locate your Windows Server with the shared directories you want to view If necessary click the plus sign adjacent to this entry to expand the tree Copyright 2015 by NTP Software All rights reserved Doc 4825EF Page 16 NTP Software File Auditor Windows Edition An NTP Software User Manual NTP Software File Auditor Reports I E y o The NTP Software File Auditor Windows Edition reporting tool allows you to view the file and directory operations that took place at your environment in an easy and efficient display Reports are categorized by user file policy and folder To view NTP Software File Auditor Reports please follow the following steps 1 Run NTP Software File Auditor Administrator by clicking Start gt All Programs gt NTP Software File Auditor gt NTP Software File Auditor Reports On the left pane click the report type you want to display On the upper pane specify the search criteria and click View Report On the lower pane check the report output E E E NTP Software File Auditor Windows Edition also allows you to export the report to different formats Those include XML CSV TIFF PDF Web Archive or Excel Listed below are the diff
14. policy contact your NTP Software representative at 800 226 2755 or 603 622 4400 NTP Software Professional Services offers training and consulting services in support of the deployment and configuration of your storage resource management software NTP Software 20A NW Boulevard 136 Nashua NH 03063 Toll Free 800 226 2755 International 1 603 622 4400 E mail info ntpsoftware com Web Site http www ntpsoftware com Copyright 2015 by NTP Software All rights reserved Doc 4825EF Page 43
15. that you want to connect to Smart Policy Manager Enter the name of the Smart Policy Manager server to connect to Fino Smart Policy Manager Server is specified the local server Will be used Smart Policy Manager Server mvs ERVER Browse Cancel Help Note The Smart Policy Manager Admin component is installed on the local machine so there is no Smart Policy Manager service installed Thus NTP Software File Auditor Windows Edition cannot talk to the local Smart Policy Manager service because it does not exist so we specify the Smart Policy Manager service that NTP Software File Auditor Windows Edition should communicate with In very large organizations you may have offices all over the world Make sure you connect to the server s at reasonable distance to maintain good speed As shown the NTP Software File Auditor Admin Client User interface is displayed with MYSERVER as a node in the left menu tree and all the NTP Software File Auditor policy details 1 To connect to more than one Smart Policy Manager service at the same time click File gt Active Server then insert the server name or the server IP address This allows you to add all the servers on your entire network to administer them as needed Copyright 2015 by NTP Software All rights reserved Doc 4825EF Page 39 NTP Software File Auditor Windows Edition An NTP Software User Manual Installing NTP Software File Auditor in Clust
16. 0 20 257 DOTNET CRITICALSITES LOCAL Vachninistrator 142011 at m 44327 PM COTNET CRMICALSITES LOCAL Administrators COTNET CRMICALSITES LOCAL Mahmoud 202 DOTNET CRTICALSITES LOCAL Vactninestrator 3142011 at Qeams 435 55 PM W142011 af 43555 PM WI4 2011 at 35 55 PM WI42011 at 4 36 55 PM COTNET CRINCALSITES LOCAL Administrators OOTNET CRITICALSITES LOCAL Mahmoud 202 DOTNET CRITICALSITES LOCAL Actnirestrator M42011 dt j Permission Changed This type of report allows you to review the file s whose permission s has changed among user The report displays the name of the file whose permission has changed the directory where the file exists the host IP address the user name the policy name the client name and the share name as well as the permission details within the specified criteria File Permissions Changed From 3 14 2011 4 11 45 PM To 3 15 2011 4 04 30 PM Number of records 503 File Name Directory Host 2 User Name Date Policy Client Share 5 Permission Name Name Name Details COPY 2 OF WOLIWOLO 10 20 2 57 DOTNET CRITICALSITES LOCAL Administrator 3 14 2011 df View NEV MICROSOFT HOME 4 53 10 PM EXCEL WORKSHEET XLS COPY 2 OF WOLIYOLD 10 20 257 DOTNET CRITICALSITES LOCAL Administrator 3442011 df NEV MICROSOFT HOME 4 53 10 PM WORD DOCUMENT DOC COPY 2 OF WOLWOLO 10 20 2257 DOTNET CRITICALSITES LOCAL Administrator 3 14 2011 df R TXT HOME 4 58 10 PM COPY 3 OF wWOLWOL
17. 4 AM MKT POL Galactic com P latt Marketing aasayed xp 4502 na 31 rashad 104 4 2009 7 59 04 AM MKT POL Marketing File Open For IG Machine aasayed xp Read 4502 Galactic com P latt na 31 rashad 104 4 2009 7 59 00 AM MKT POL Marketing Galactic com P File Open For IG Machine write aasayed xp 4502 104 4 2009 7 53 00 AM MKT POL Marketing na731 rashad Galactic com P aasayed xp 4502 File Rename IG Machine c Files Changed This report allows you to view all the changed files The report input is the file name and or the host name and or the date range and or the file type s The report displays the file name the directory path in which the file is located the user name accessing the file the access type the access date the name of the policy applied the client name and the share name within the specified criteria AhmedIG na731 rashad Access Type Fie renamed File Close EndDate 5 3 2011 8 45 25 AM al 2 a l A ee 100 File Type bmp cpp doc h rtf tmp txt Start Date 10 14 2009 5 09 14 AM gi cs ne Files Changed From 10 14 2009 5 09 14 AM To 5 3 2011 6 45 25 AM Number of records 152 Find Next of P PL Directory Path HOME Business Shares Marketing WserD006 4frica Customers HOME Business Shares Marketing WserD00610ld Stuffit HOME Business Shares Develop mentiser0005 Projects in ProgressiGIS Project
18. AM To 5 3 2011 8 47 04 AM Number of records 26 Directory 3S Path HOME Susiness na731 rashad Shares Marketing Wser0006iold Stuffi HOME Business na731 rashad Shares Develop mentiser0005 Projects in Progress GIS Project HOME Business na 3i rashad Shares Support User0012 0ld Tickets SHOME Business na731 rashad Shares Sales Us User Name Galactic com Platt Galactic com Topper Galactic comNorman dy Galactic comantara 100 Policy Name 1044 2009 MKT POL 7 59 04 AM Marketing 1044 2009 MKT POL Dey 7 47 01 AM 1044 2009 MKT POL 7 38 56 AM Support 1014 2009 MKT POL Sales 7 33 29 AM Find Next Client Name aasayed xp 4502 aasayed xp aasayed xp 4502 aasayed xp 4502 Share Name IG Machine IG Machine IG Machine IG Machine e Files Renamed This type of report allows you to review all the files that have been renamed The report s input is the file name and or the host machine name and or the date range and or the file type The report displays the original file name before the change the new file name after the rename the directory path in which the file is located the user name the date the file was accessed the policy name the client name and the share name within the specified criteria File Name Start Date 10 14 2009 5 09 14 AM gizi File Type bmp cpp doc h rtf tmp txt Ful M41 of
19. File Criteria Directories Exempted Subdirectories Audited Users and Groups Exempt Users and Groups Notifications DB Maintenance Accounts gi BUILTINAdministrators ret BUILTIN Backup Operators j BUILTIN Replicator G3 NT AUTHORITYSSYSTEM Cancel Apply Help 8 Click the Notifications tab Click the Add button On the Email Configurations Properties dialog General Tab specify the notification related details including the notification name description and message format On the Email Settings Tab specify the email subject and the email body customize the displayed information about the authorized users and the associating events and choose the detail level On the Notification Settings Tab specify the notification frequency along with the types of events you wish to receive On the Recipients Tab specify the user s who should receive the email Email Configurations Properties General Email Settings Notification Settings Recipients Notification Mame Notification 1 Notification Description l neert Notification 1 description Message Format Plain Text HTML e Copyright 2015 by NTP Software All rights reserved Doc 4825EF Page 13 NTP Software File Auditor Windows Edition An NTP Software User Manual Email Configurations Properties Fa General Email Settings Notification Settings Recipients Email Subject Notification 26h for policy p
20. O 10 20 2 57 DOTNET CRITICALSITES LOCAL Administrator 34 2011 df CAPTURE PNG HOME 4 58 10 PM COPY 3 OF WOLIYOLO 10 20 257 DOTNET CRITICALSITES LOCAL Administrator 3 14 2011 df NEV MICROSOFT HOME 4 58 10 PM EXCEL WORKSHEET XLS COPY 3 OF WOLIOLO 10 20 2257 DOTNET CRITICALSITES LOCAL Administrator 3 14 2011 df NEV MICROSOFT HOME 4 58 10 PM WORD DOCUMENT DOC COPY 3 OF WOLIVOLD 10 20 257 DOTNET CRITICALSITES LOCAL Administrator 3442011 df RIXT HOME 4 58 10 PM Copyright 2015 by NTP Software All rights reserved Doc 4825EF Page 23 NTP Software File Auditor Windows Edition An NTP Software User Manual Clicking on the View link of the Permission Details field displays more details as outlined below Files permission changed id 4 fe of 3 b bi 100 i Find File Permissions Changed File Name COPY 2 OF R TXT User Name Everyone Previous Has Full Control Next Current Has Execute Has Read Has Read Attributes Has Read Extended Attributes Has Write Has Append Has Write Attributes Has Write Extended Attributes Has Delete Has Read SD Has Change DACL Has Take Ownership KAAKA X X XIR RIK K K K K K K IK 3 Policy Reports category has one view the Policy by Date report d Select a format Export Policy by Date This report allows you to review all the policy details within a certain date range The repo
21. SA Copyright 2015 by NTP Software All rights reserved Doc 4825EF Page 2 NTP Software File Auditor Windows Edition An NTP Software User Manual Contents SS y gt a Setting NTP Software File Auditor Windows Edition Properties ccccceceececeeceeeeeeseeeeseeaeseeeeseeaes 5 Setting NTP Software File Auditor Windows Edition Database ccccececeeseceeeeeeeetecseetenseteeseaneesers 5 Setting the NTP Software File Auditor Windows Edition Email ccceceececeeeeeeeeseeseeeeeeeteeeeneesers T7 Setting the NTP Software File Auditor Windows Edition Misc Options ccceceeeeceeeeeeseeseeeeseeees 8 Setting the NTP Software File Auditor Windows Edition Security Level ccceceeseceeeeceeeeseeeeseeaes 9 POV Ol dei gt G 4 eee ners ne er A ee wee eee A eee eee ree 10 NTP Software File Auditor Reports ccceccecceeeeceeteeseeeeceeceeseeaecseseeseseecseseeaeseceeseeaesgeseesesaesetaees 17 NTP Software Smart Policy Manager ccceccecsecseceeseeeeeeeseeseeeeceeceeeeseecseseesesaecseseeaeegeseesesaeeeetaees 30 NTP Software Smart Policy Manager Overview ccccceceeceeceeseeeceeseeseceeceeseeeeeetseseesesgeseeseeeeseesaees 30 Managing the NTP Software File Auditor Service through a NTP Software File Auditor Admin Client Running on a Different Machine c ccccecceeceeeeceeteeseeeeceeceeseeeeeeeceeeeeeeceeseeseceesseteeeeegeseeseseeeeesaees 31 Install
22. anager NTP Software Smart Policy Manager allows you to monitor your users file and directory operations in a way that is a unique fit to your organization If you manage by geography or administrative unit you can use that plan If you manage by class of machine that approach works just as well Often companies use a mixed mode perhaps geography a department and a machine type NTP Software Smart Policy Manager has the flexibility you need to make using NTP Software File Auditor Windows Edition simple Once you have laid out your management structure NTP Software Smart Policy Manager provides policy replication throughout your enterprise It allows machines to access the policies in their containers and inherit policies from all levels above that point in your hierarchy You no longer need to configure and manage the machines on your network one by one As you start to configure the software you have installed begin with the top level container under the root organization in the following example My Site This is the Global Network configuration whose container is created during installation NTP Software Smart Policy Manager TM ME File Edit View Options Help amp a B xX E gt EE NTP Sob are EE ounta amp File 5e QuotaSe Available MTF Software 6 909 19 14 37 8foloo 19 14 37 EEINTP Software F File4uditor Available MTF Software F H2711 13 35 44 27111 13 35 44 ABP File Audit Policies H A Server D
23. ause we just need the Admin User Interface to manage and configure the policies we checked the Admin Client only We are not seeking a full NTP Software File Auditor Windows Edition installation 5 Specify the program folder using the default program folder is recommended and click Next The setup program adds program icons to the program folder ATP Software File Guditor Setup Select Program Folder T Please select a program folder A Soave Setup will add program icons to the Program Folder listed below ou may type a new folder name or select one from the existing folders list Click Nest to continue Program Folder NTP Software File Auditor Existing Folders ACCESSONes Administrative Tools Microsoft SQL Server 2005 NTF Software File Reporter NTF Software File Reporter Reports Pack NTF Software OOD M NTF Software OFS for NAS NTF Software Storage Investigator Startup InstallShield lt Back Cancel 6 Click Next when the Start Copying Files dialog box appears assuming that the destination paths are correct NTP Software File Auditor setup begins transferring files to the specified locations Copyright 2015 by NTP Software All rights reserved Doc 4825EF Page 37 NTP Software File Auditor Windows Edition An NTP Software User Manual ATP Software File Guditor Setup Start Copying Files T Review settings before copying files Fs i iii SE ave Setup has enough infor
24. ayed xp IG Machine ares Development RASHADIHOME Busi rashad opper 7 48 29 AM Dev 4502 User0005 nessShares Developm Completed entWser0005 Projects New Folder Completed Projects GDS Project Copyright 2015 by NTP Software All rights reserved Doc 4825EF Page 22 NTP Software File Auditor Windows Edition An NTP Software User Manual h Deletion Compliance This type of report allows you to review the files deleted over the specified compliance period The report s input is the compliance period in months the host name and the file type The report displays the files deleted over the specified period Compliance period in months fiz Host AhmedIG na731 rashad File Type bmp cpp doc h rtf tmp txt Pia if 4 ile Of 4 da ee 100 Find Deletion Compliance Report Files deleted over a period of 12 months 100 compliant i Owner Changed This type of report allows you to review the file s whose owner s has changed The report displays the name of the file whose owner has changed the previous owner the new owner the host IP address the user name the policy name the client name and the share name within the specified criteria File Owners Changed From 3 14 2011 4 11 45 PM To 3 15 2011 4 02 02 PM Number of records 180 Directory Previous Owner a q ca K r x 3142011 af Qina 2an 4544 Ph COTNET CRITICALSITES LOCAL Mahmoud COTNELCRITICALSITES LOCAL administrators 1
25. based on the specified criteria Directory owner changed Directory Name Es Host fio202s7 Start Date 371472011 4 11 45 PM ad End Date 3 15 2011 4 23 11 PM 3 io dh osb pi roos Find Next Selecta format j Export Directory Owners Changed From 3 14 2011 4 11 45 PM To 3 16 2011 4 13 11 PM Number of records 180 Previous Owner User Name a gt Chent Share Name WOLWOL DOTNET CRITICALSITES LOCAL Mahmoud DOTNET CRITICALSITES LOCAL Abdala s d 3942011 at Osama 3 HOMEUNEW 4 45 44 PM MICROSOFT EXCEL WORKSHEET XLS wouwvono DOTNET CRITICALSTES LOCAL Mahmoud DOTNET CRITICAL SITES LOCAL Wicninistrators QOTNET CRITICALSITES LOCAL vadministrator 3 14 2011 at HOMEUCAPTURE PNG Osama 4 43 27 PM Hassen DOTNET CRIICALSITES LOCAL Administrators DOTNET CRITICALSITES LOCAL mO DOTNET CRITICALSITES LOCAL Administrator B42011 dt Osama 4 3555 PM 10 20257 s C r 3142011 at 4 3555 PM 34 2011 at 4 3555 PM j Directory Permission Changed This report allows you to review all directories whose permissions have changed The report displays the directory name the host IP address the user name the date the policy name the client name the share name and the permission details based on the specified criteria Directory permission changed Directory Name Host 10 20 2 57 I Start Date 3 14 2011 4 11 45 PM EE End Date 3 15 2011 4 13 44 PM saj id 4i of12 gt bi ficomn Find Next Selectaformat ex
26. chine es iMarketingwWser000 it Create 7 57 31 AM Marketing Siew Folderi HOME BusinessShar Galactic com Plat na 731 rashad Directory 1044 2009 MKT POL aasayed xp 4502 Machine es iMarketingWser000 t Rename 7 56 07 AM Marketing New Folderi HOME BusinessShar Galactic comPlat na731 rashad Directory 1044 2009 MKT POL aasayed xp 4502 Machine es MarketingwJser000 t Create 7 56 04 AM Marketing 6iNew Folder Copyright 2015 by NTP Software All rights reserved Doc 4825EF Page 25 NTP Software File Auditor Windows Edition An NTP Software User Manual c Directory Created This report allows you to review all the directories created The report s input is the date range and or the directory name and or the host name The report displays the name of the created directory the user s name performing the directory create operation the date in which the directory was created the name of the policy governing this directory creation operation the IP address of the machine used to perform the directory create operation and the share name based on the specified criteria Directory Name AhmedIG na 31 rashad Start Date 10 14 2009 5 09 14 AM i End Date 5 3 2011 8 51 00 AM Eil E TRER f3 We O AJE kd 100 Find Next Directory Created From 10 14 2009 5 09 14 AM To 5 3 2011 6 51 00 AM Number of records 126 Directory Name UserName Create Date Policy Client Created Name Name HOME Busines
27. com P 1044 2009 MKT POL aasayed xp Machine es Finance Wser0006 latt 7 53 16 AM Finance 4502 g Files Moved This type of report allows you to review all the files that have been moved The report s input is the date range and or the file name and or the file type and or the host name The report displays the file name the source path and the destination path of the moved file the host name the date on which the file was moved the policy name the machine IP address and the share name within the specified criteria AhmedIG na731 rashad Start Date 10 14 2009 5 09 14 AM Hi End Date 5 3 2011 3 19 17 PM a ile Type bmp cpp doc h rtf tmp txt Ful iS PS f3 aM e OF G OB w 10 Find Next Files Moved From 10 14 2009 5 09 14 AM To 5 3 2011 3 19 17 PM Number of records 103 2 Source Destination Host User S Moye 2 Client Share S Path Path Name Date Name Name HOME BusinessSh WNA731 na 3t Galactic com P 1044 2009 MKT POL aasayed xp IG Machine aresiMarketingwWser RASHADIHOME Busi rashad latt 7 58 47 AM Marketing 4502 0006New Folder nessShares Marketing Wser00064frica Customers HOME BusinessSh WNA731 na 3t Galactic com P 1044 2009 MKT POL aasayed xp IG Machine aresiMarketingwser RASHADIHOME Busi rashad latt 7 56 07 AM Marketing 4502 0006New Folder nessShares Marketing Weser000610ld Stuff HOME BusinessSh WNA731 na 3t Galactic comiT 1044 2009 MKT POL aas
28. d for Smart Policy Manager The Installation Wizard will install Smart Policy Manager on your computer Click nest to continue Cancel 5 Select accept the terms of the license agreement in the License Agreement dialog box and then click Next NTP Software Smart Policy Manager Setup Wizard x License Agreement Please read the following license agreement carefully T iB i i i po NTF Software Smart Policy Managel TM End User License By using or copying the accompanying software you are indicating Your acceptance of the terms of this license IF you do not agree to the terme of this license please return the product UNOPENED to your place of purchase for a full refund GRANT OF LICENSE NTP Software grants you the right to use Smart Policy Manager PAOQOUCT on one computer solely for Your or your company s own intemal use In addition to the specified quantity of copies pou may make one 1 additional copy as a backup to the orginal However you may not cause the software to execute or be loaded Into the active memory of more computers than the above specitied quantity at any one time In addition the PRODUCT ts licensed solely for the management of local storage do not accept the terms of the license agreement InstallShield Back Cancel Copyright 2015 by NTP Software All rights reserved Doc 4825EF Page 32 NTP Software File Auditor Windows Edition An NTP Software U
29. d xp 4502 Machine is Wser0009 Old Customers 7 21 45 AM NHHOME BusinessShares Mark Galactic com Clover na 31 rashad 1044 2009 MKT POL aasayed xp 4502 Machine etingiserQ008 France Plans 7 04 47 AM Marketing f Deleted Files by Directory This report allows you to review all the deleted files grouped by directory The report s input is the directory name and or the host and or the date range The report displays the user s name who has deleted the file s the path from which the file was deleted the file name the host name the file size the date on which the file was deleted the client name used to perform the file delete operation and the share name based on the specified criteria Directory Name AhmedIG na731 rashad StartDate fio 14 2009 5 09 14 AM liss EndDate 5 3 2011 8 48 09 AM EEI E A 4 e Olt G Elda 100 Find Next Deleted files by directory Number of records 26 Size S Delete Client Share Date Name Name Galactic comVRober HOME BusinessShares D TMP1 tmp na 31 rashad 1044 2009 aasayed xp 4502 IG Machine tson evelopmentiJser0001 5 22 21 AM Projects On HoldiDD Project Galactic comwvboyd HOME BusinessShares iD TMP1tmp na 31 rashad 1044 2009 aasayed xp 4502 Machine evelopment WUser0002 5 29 57 AM Projects in Progress Click Projecti Galactic comwvboyd HOME BusinessShares Su New Text na 31 rashad 1044 2009 aasayed xp 4502 Machine pportUser0002 Ticket Document t
30. ect New gt NTP Software File Auditor Application from the pop up menu 5 To view the global cluster policies click the plus sign next to the NTP Software File Auditor Windows Edition application you have just added Note If you choose to install both nodes locally then you need to perform a join operation during the smart policy manager install and then move each added cluster node under the appropriate container Create all policies within this application that will be applied to both nodes They will be propagated down automatically to all nodes within the container Copyright 2015 by NTP Software All rights reserved Doc 4825EF Page 42 NTP Software File Auditor Windows Edition An NTP Software User Manual About NTP Software SS E y gt a NTP Software is the worldwide leader in user focused policy based storage management We create platform independent products that enable companies to automatically control the compliance access quotas content and lifespan of their users stored files NTP Software solutions also gather the analysis and planning data necessary for both short and long term decision making providing everything necessary to actively control all aspects of a user s relationship with local and shared storage NTP Software Professional Services SS E y gt a For further assistance with NTP Software File Auditor or in creating a corporate storage management
31. entinel EE quota File GQuotaSe Available 6 909 19 15 54 69 09 19 15 54 EEINTr Software File4uditor Available NTP Softw J211 172742 Sel 172742 l a CLTESTBOX Local Host Num a 3 objectis Copyright 2015 by NTP Software All rights reserved Doc 4825EF Page 40 NTP Software File Auditor Windows Edition An NTP Software User Manual 4 Right click the site container and then select New gt Container from the pop up menu to create your cluster container Give the new container the name of the cluster In the example we have used Cluster 1 as the name 5 Right click the cluster container and select New gt NTP Software File Auditor Application from the pop up menu Notes To add the rest of the Nodes of the Cluster follow one of these options e Push software to node To push the software to the new node follow these steps Add a server object to the cluster container You will be asked to install Smart Policy Manager on the new node After the new node is added add a File Auditor application object to the new server object You will be asked if you want to install File Auditor onto the remote machine e Usea local install To perform a local install of File Auditor onto the other nodes of the cluster follow these steps a Choose the Join an Existing Hierarchy option during the installation of Smart Policy Manager b When that completes the installation of File Auditor will
32. ered Environments CTE 2 6 Sa a a Note e NTP Software File Auditor Windows Edition requires a manual setup by an administrator for clustered environments Installing NTP Software File Auditor Windows Edition in Clustered Environments To install NTP Software File Auditor Windows Edition in a clustered environment apply the following steps 1 Install NTP Software File Auditor Windows Edition on a server as described in NTP Software File Auditor installation guides 2 After NTP Software File Auditor Windows Edition is installed successfully open NTP Software File Auditor Windows Edition to find the global container My Organization in this example at the top of the hierarchy Click the plus sign to expand the container 3 Click the plus sign to expand your site container in the second tier of the hierarchy Notice the installation server in the third tier of the hierarchy The NTP Software File Auditor Windows Edition application is also in the third tier NTP Software Smart Policy Manager TM Iofs File Edit wiew Options Help I As x fan pe wir eis PEE E My Organization Mame oF a Type pe Status Description Created Modified Plate NTP Software File Auditor Calmysite BROS 19 1202 H291 03043 a EA Quota amp File Sentinel Hg MySite H E FileSrvO1 H E NTP Software File Auditor ES File Audit Policies H Server Directories lS Server Shares E8 guata amp File S
33. erent types of reports provided by NTP Software File Auditor 1 The User Reports category has four different views the User Summary the User Audit the Access History and the Most Active Users a User Summary This report allows you to search by user name Clicking on a specific user name you can review the count of each operation performed including the count of the deleted renamed moved files the count of the created changed owner changed permission changed files the count of the created deleted directories and the count of the renamed directories files In addition it displays a list of the most used client names along with the count of operation s performed using the specified IP address Number of deleted files Number of changed files Number of renamed files Number of owner changed files Number of moved files Number of permission changed files Number of created files Number of deleted directories Number of renamed directories 1 Number of created directories 4 Last activity Date Time 10 14 2009 7 59 04 AM Used Client Machine Names Top 5 used client machines Client Name Number of operations done from the IP aasayed xp 4502 View All Copyright 2015 by NTP Software All rights reserved Doc 4825EF Page 17 NTP Software File Auditor Windows Edition An NTP Software User Manual b User Audit This report allows you to review all the file and directory operations performed by
34. ftware File Auditor Admin Client User Interface is using Remote RPC to communicate to the NTP Software Smart Policy Manager service Therefore NTP Software File Auditor Administrator needs to have permissions to run and execute Remote RPC on the managed machine A standard user does not have RPC Permission by default So if the user performing the administration is not an administrator in the domain the user needs to be added to the Distributed COM Users group on the machine to be managed Installing the NTP Software Smart Policy Manager Admin Component 1 Logon to your local computer using an account with administrator privileges 2 On the NTP Software Product Installation page click your product installation link under the Product Components section 3 When prompted to install NTP Software Smart Policy Manager click Yes to launch the Installation Wizard x NTP Software Smart Policy Manager is not installed on your system You need it to run this application ue If you do not install Smart Policy Manager the setup will exit Do you want to install Smart Policy Manager at this time Copyright 2015 by NTP Software All rights reserved Doc 4825EF Page 31 NTP Software File Auditor Windows Edition An NTP Software User Manual 4 Inthe NTP Software Smart Policy Manager installation welcome dialog box click Next NTP Software Smart Policy Manager Setup Wizard i x Welcome to the HTP Software Installation Wizar
35. herit Directory Connector Properties Use Active Directory Connector to retrieve email addresses Use LOAP Connector to retrieve email addresses Primary Host Secondary Host LEAP Mail Name mai LEAR Port LEAF Fort LEAF Filter Hame aod 359 uid Cancel Appl Help Copyright 2015 by NTP Software All rights reserved Doc 4825EF Page 8 NTP Software File Auditor Windows Edition An NTP Software User Manual Setting the NTP Software File Auditor Windows Edition Security Level The NTP Software File Auditor Properties tab enables you to set up several application properties including the application security level To adjust your NTP Software File Auditor Windows Edition application security level please follow these steps 1 Right click NTP Software File Auditor under the main application container 2 Click Properties on the pop up menu 3 Click the Security tab Clear the Inherit Security box and check the Enable Security box Click Add to choose the members or groups for which you want to apply security options Tip In the Non Owner Permissions section of the dialog box choose the desired settings for the types of policies and properties NTP Software File 4uditor Configuration Database Configuration Email Configuration Misc Options Security T Inherit Security 7 Enable Secunty SEFE veryone Non Ownrer Permissions Local Policies Full Control Read Only H
36. icy Manager Setup Wizard Start Copying Files T Review settings before copying files J os Sb oare Setup has enough information to start copying the program files fF you want to review or change any settings click Back If you are satished with the settings click Nest to begin copying files Current Settings Destination Path C Program Files Smart Policy Manager Components to install Smart Policy Manager Administration Tool a lt Back Cancel InstallShield 9 When the file installation is complete a dialog box offers you the opportunity to view the readme file which may contain documentation updates and other items If you do not want to view the readme file at this time clear the option Yes want to view the readme file Click Finish ATP Software Smart Policy Manager Setup Wizard i HTF Software Installation Wizard for Smart Policy Manager Complete The Installation Wizard has successtully installed Smart Policy Manager Click Finish to exit the wizard Copyright 2015 by NTP Software All rights reserved Doc 4825EF Page 34 NTP Software File Auditor Windows Edition An NTP Software User Manual Installing the NTP Software File Auditor Admin Component 1 The NTP Software File Auditor welcome dialog box pops up automatically Click Next to continue ATP Software File Auditor amp Setup Welcome to the HTP Software Installation Wizard for NTP Software File A
37. il Notifications option Enter the correct information in each of the text boxes as appropriate for your email settings and click OK Tip Click the Test Connection button to test your connection to the specified SMTP Sever STP Software File 4uditor Configuration Database Configuration Email Configuration Misc Options Security Inherit Email Configuration 7 Enable Email Notifications SMTP Server SMTP SERVER HAME SMTP Domains SMTP DOMAIN MAME Sender s Address SENDER ADDRESS woody server requires authentication Username SERVER USERNAME User Domain USER DOMAIN Password Test Mail Settings Status Not sent pet Cancel Apply Help Copyright 2015 by NTP Software All rights reserved Doc 4825EF Page 7 NTP Software File Auditor Windows Edition An NTP Software User Manual Setting the NTP Software File Auditor Windows Edition Misc Options The NTP Software File Auditor Properties tab enables you to set up several application properties including the application misc options To adjust your NTP Software File Auditor application misc options please follow these steps 1 Right click NTP Software File Auditor under the main application container 2 Click Properties on the pop up menu 3 Click the Misc Options tab Clear the Inherit Directory Connector Properties box and select the appropriate directory connector option STP Software File 4uditor Configuration In
38. ing the NTP Software Smart Policy Manager Admin COMpone nt ccececeeceeeeceeeeseeeseeeees 31 Installing the NTP Software File Auditor Admin COMPONENL ccecseceeceeseeeeeeceeseteeseeceeseeeeeaeeaees 35 Installing NTP Software File Auditor in Clustered ENvirOnMentS cccceccecececeeeeseceeeeuseseeeeaneesenseas 40 Apout iN ees 0 1g 0 pa oe ce er ee eee nee ee eee eee eee ee ee ere 43 NTP Software Professional Services ccccccecceccecceeceeceeceeceeceecseeeeeseesueseeceeceeseeseeseesueseeseeseesaeeaes 43 Copyright 2015 by NTP Software All rights reserved Doc 4825EF Page 3 NTP Software File Auditor Windows Edition An NTP Software User Manual Introduction ES y gt a Thank you for your interest in NTP Software File Auditor Windows Edition NTP Software File Auditor Windows Edition lets you monitor your users file and directory operations It lets you create and enforce file audit policies that enable you to monitor certain events taking place in your environment Such events include directories created renamed and or deleted and files opened for read write create rename delete close and move as well as file permission changes and owner changes in your environment NTP Software File Auditor Windows Edition has two main components 1 NTP Software File Auditor Administrator 2 NTP Software File Auditor Reports Each of the above components will be explained in further de
39. irectories lS Server Shares H E Quota amp File Sentinel 2 objectis ICLTESTBOX Local Host MUM we Copyright 2015 by NTP Software All rights reserved Doc 4825EF Page 30 NTP Software File Auditor Windows Edition An NTP Software User Manual Managing the NTP Software File Auditor Service through a NTP Software File Auditor Admin Client Running on a Different Machine This section provides step by step instructions on installing the NTP Software File Auditor Admin Client enabling you to administer the NTP Software File Auditor service running on a different machine This kind of NTP Software File Auditor Admin Client installation enables NTP Software File Auditor administrators to easily administer NTP Software File Auditor that is installed on all the servers over the entire network This can be done through a local user interface that is easily installed on the administrator s local machine For an NTP Software File Auditor administrator to be able to use the NTP Software File Auditor Admin Client NTP Software Smart Policy Manager Admin and NTP Software File Auditor Admin components should be installed on the administrator s local machine per the following instructions IMPORTANT NOTES There is a slight difference in the installation of NTP Software Smart Policy Manager and NTP Software File Auditor on an NTP Software File Auditor Server versus the installation on an administrator s local machine NTP So
40. licy Name Policy 1 Description Manitoring Directories Created Distinguished Name Policy Owner Last Modified by Created Wednesday December 01 2010 11 06 14 AM Modified Wednesday December 01 2010 11 06 14 AM Cancel Apply Help Copyright 2015 by NTP Software All rights reserved Doc 4825EF Page 10 NTP Software File Auditor Windows Edition An NTP Software User Manual 4 Click the Monitored Events tab check the event s you want to monitor from the list of events Check the Store monitored events into the database checkbox if you wish to store the monitored events in the File Auditor database You can clear the Store monitored events into the database checkbox if you wish to use the notifications option without recording the events to the File Auditor database New File Audit Directory Policy Exempted Subdirectories Audited Users and Groups Exempt Users and Groups Notifications DB Maintenance General Monitored Events File Criteria Directories Check the events you wank to monitor Directory Create Directory Rename Hees This option monitors the rename of e acinar directories in the managed paths shares Directory Move File Open for Read File Open for Write File Create File Rename File Delete File Close File Move Ownrer Change Pernission Change W Store monitored events into the database Cancel Apply Help C
41. mation to start copying the program files IF you want to review or change any settings click Back IF you are satished with the settings click Next to begin copying files Current Settings Destination Path C Program FilesSNT PSoftwareSh TP Software File Auditor Components to install File Auditor Service File Auditor Sdminigtration Tool Start Menu Folder NTF Software File Auditor P Cancel 7 When the files installation is complete a dialog box offers you the opportunity to view the readme file If you do not want to view the readme file at this time clear the option Yes want to view the readme file Click Finish By this step NTP Software File Auditor installation is completed InstallShield ATP Software File Auditor Setup HTF Software Installation Wizard for NTP Software File Auditor Complete The Installation Wizard has successfully installed MTP Software File Auditor Click Finish to exit the wizard Back Cancel Copyright 2015 by NTP Software All rights reserved Doc 4825EF Page 38 NTP Software File Auditor Windows Edition An NTP Software User Manual Administering NTP Software File Auditor through an NTP Software File Auditor Admin Client Running on a Different Machine 1 Click Start gt Programs gt NTP Software File Auditor gt NTP Software File Auditor Admin 2 Inthe Smart Policy Manager dialog box specify the Smart Policy Manager Server
42. one Owner Last Modified by E Cancel Apply Help Copyright 2015 by NTP Software All rights reserved Doc 4825EF Page 9 NTP Software File Auditor Windows Edition An NTP Software User Manual Policy Creation I E y o a This section outlines standard NTP Software File Auditor Windows Edition procedures for creating a file auditor policy Note e NTP Software File Auditor Windows Edition monitors two main types of paths directory paths and share paths Creating File Audit Policies This section walks you through creating a typical file audit policy We will create a file audit policy for all your user home directories in a typical server configuration This policy will be applied to all users in your Users directory 1 In the NTP Software Smart Policy Manager hierarchy view locate the Windows Server If necessary click the plus sign adjacent to this entry to expand the tree Then click the plus sign next to File Auditor to expand the policy types 2 Right click File Audit Policies and select New gt Folder Policy Using Directories 3 In the New File Audit Directory Policy dialog box click the General tab Enter a name and a description for your new policy New File Audit Directory Policy Exempted Subdirectories Audited Users and Groups Exempt Users and Groups Notifications DB Maintenance General Monitored Events File Criteria Directories Po
43. opyright 2015 by NTP Software All rights reserved Doc 4825EF Page 11 NTP Software File Auditor Windows Edition An NTP Software User Manual 5 Click the File Criteria tab Click the Add button Select the files that you wish to monitor and the associated patterns will be displayed automatically and you can also specify a custom pattern Note If the Patterns list is empty the policy will audit all files To monitor all files you can also use the A pattern New File Audit Directory Policy Exempt Users and Groups Notifications DB Maintenance Exempted Subdirectories Audited Users and Groups General Monitored Events File Criteria Directories Patten r Common Audio Files Add Edit Remove Cancel Apply Help 6 Click the Directories tab Click the Add button type the appropriate directory path for your Users directory followed by a backslash Add or Edit an Item Enter a director name JE Users Browse Copyright 2015 by NTP Software All rights reserved Doc 4825EF Page 12 NTP Software File Auditor Windows Edition An NTP Software User Manual 7 Administrators Backup Operators Replicators and the System account are exempt from policies You can verify this fact by clicking the Exempt Users and Groups tab To change this setting select the appropriate entry and click Remove New File Audit Directory Policy xi General Monitored Events
44. ot 53 Directory Permissions Changed From 3 14 2011 4 11 45 PM To 3 15 2011 4 13 44 PM Number of records 503 Policy Client S Share 2 Permission User Name s Name Name Name Details WOLWOLO 10 20 2 57 DOTNET CRITICALSITES LOCAL Administrator 344 2011 df WHOMEWCOPY 2 OF 4 58 10 PM NEVY MICROSOFT EXCEL WORKSHEET XLS WOLWOLO 10 20 2 57 DOTNET CRITICALSITES LOCAL Administrator 344 2011 df HOMEWCOPY 2 OF 4 58 10 PM NEV MICROSOFT WORD DOCUMENT DOC WOLIVOLO 10 20 2 57 DOTNET CRITICALSITES LOCAL Administrator 3 14 2011 df HOMEWCOPY 2 OF 4 58 10 PM R TXT WOLWOLO 10 20 2 57 DOTNET CRITICALSITES LOCAL Administrator 34 2011 df THOMEWCOPY 3 OF 4 58 10 PM CAPTURE PNG WOLWOLO 10 20 2 57 DOTNET CRITICALSITES LOCAL Administrator 344 2011 df WHOMEWCOPY 3 OF 4 58 10 PM NEVY MICROSOFT EXCEL VWWORKSHEET XLS WOLIWOLO 10 20 2 57 DOTNET CRITICALSITES LOCAL Administrator 34412011 df Copyright 2015 by NTP Software All rights reserved Doc 4825EF Page 29 NTP Software File Auditor Windows Edition An NTP Software User Manual NTP Software Smart Policy Manager CTE 6 Sa a a NTP Software Smart Policy Manager Overview The first step in using NTP Software File Auditor Windows Edition is to lay out your strategy for managing users file and directory operations Before doing this though let us look at our underlying policy based rules engine NTP Software Smart Policy M
45. performing the directory delete operation the date in which the directory was deleted the name of the policy governing this directory deletion operation the client name used to perform the directory delete operation and the share name based on the specified criteria irectory Name Host ahmediG na 3l rashad Start Date 10 14 2009 5 09 14 AM i si End Date 5 3 2011 5 37 43 4M gii Ful id 4 i of 1 A e Of 4 Wd we 10 Find Next Directory Deleted From 10 14 2009 5 09 14 AM To 5 9 2011 5 37 43 AM Number of records 18 Directory Name UserName Host 3 Delete amp Deleted Date NHOME BusinessShares iMark Galactic com Platt na 31 rashad 1044 2009 MKT POL aasayed xp 4502 IG Machine etingserQ006 Old Stuftt 7 59 04 AM Marketing HHOME BusinessShares Sup Galactic comiNormandy na731 rashad 1044 2009 MKT POL aasayed xp 4502 Machine portWser001 2 0ld Tickets 7 38 56 AM Support NHOME BusinessSharesiSup Galactic com Normandy na 731 rashad 1044 2009 MKT POL aasayed xp 4502 Machine portWser001 2 0ld Tickets 7 38 56 AM Support NHOME BusinessSharesiSale Galactic com antara nha 31 rashad 1044 2009 MKT POL Sales aasayed xp 4502 Machine is Wser0011 Old Records 7 33 30 AM NHOME BusinessSharesiSale Galactic comXantara na 31 rashad 1044 2009 MKT POL Sales aasayed xp 4502 Machine sWiser0011 Old Recordsi 7 33 29 AM NHOME BusinessSharesiSale Galactic com Merrill na 31 rashad 1044 2009 MKT POL Sales aasaye
46. port allows you to review the most active users with the users activities sorted in a descending or ascending order The report input is the date range and or the number of most active users to view The report displays the user name and the number of activities performed by this user within the specified criteria Most active users Start Date 3 3 2010 8 23 23 AM ee 3 5 2010 10 47 23 AM He view Report ate View top 20 users Maximum number 2147483647 d F ofi gt bi 75 Find Next Select a format Export Most active users Number ofrecords 5 rpqgre at como 1320 10 pare att com 23 Doka ipaq at comio pqr atcom Do baxy igre at coms arta 10 2 The File Reports category has nine different views File Summary File Audit Files Changed Files Deleted Files Renamed Files Created Deletion Compliance Owner Changed and Permission Changed d File Summary This report allows you to review the count of all the audited files It also displays a breakdown for the count of deleted renamed created or changed files You can click the count next to any file operation to display a detailed list of the specified file operation File summary StartDate 3 3 2010 8 23 23 AM S9 EndDate 3 5 2010 10 47 23 AM Eaj view Report id 4 F ofi gt Pi 75 Find Next Select a format Export Ei File Summ ary Report Number ofaudited files 359 Number of deleted files Number ofcreated fles
47. r and database storing the audited operations Use the Test button to test the connection to the specified database on the specified server Database Maintenance Settings x Age Limit Remove records older than f Monthis Required Action Delete old records Export as raw data Export az XML SQL Server a Database Test Size Limit Specify the number of records to be retained in the database in thousands of records When the record limit i reached the oldest records will be removed as defined in the Required Action below Maxinun number of records allowed fi O00 Thousands The maximum size of the database will be approximately Required Action Overmite old records ExportasXML Export as raw data Export Fath mea Copyright 2015 by NTP Software All rights reserved Doc 4825EF Page 6 NTP Software File Auditor Windows Edition An NTP Software User Manual Setting the NTP Software File Auditor Windows Edition Email The NTP Software File Auditor Properties tab enables you to set up several application properties including the application emails To adjust your NTP Software File Auditor application email feature please follow these steps 1 Right click NTP Software File Auditor under the main application container 2 Click Properties on the pop up menu 3 Click the Email Configuration tab Clear the Inherit Email Configuration box Check the Enable Ema
48. rt s input is the date range and or the policy name The report displays the policy name the user name the directory path on which the policy applies the access type the access date the machine IP address and the share name within the specified criteria Start Date 10 14 2009 5 09 14 AM End Date 5 3 2011 8 52 08 AM DemoPolicy MKT POL Dev MK Ja IM 4 i f 23 Hl le O Alsa Hw W 10 Policy by Date From 10 14 2009 5 09 14 AM To 5 3 2011 8 52 08 AM Number of records 1000 Policy Access Type File Open For Write File Open For Write Directory Path HOME BusinessSh ares SHOME BusinessSh ares Policy Name MKT POL User6 Galactic com Clo na731 rashad ver Galactic comiClo ver MKT POL User6 na731 rashad Date 1044 2009 7 53 46 AM 10 14 2009 7 59 43 AM Find Next Client Name aasayed xp 4502 aasayed xp 4502 Share IG Machine Machine SHOME BusinessSh ares File Open For Write Galactic com Clo ver MKT POL User6 na 31 rashad 1044 2009 7 59 42 AM aasayed xp 4502 Machine HOME BusinessSh na731 rashad ares Galactic comClo ver MKT POL User File Open For Write 1014 2009 7 59 38 AM aasayed xp 4502 G Machine MKT POL User6 JHOME BusinessSh na731 rashad ares HOME BusinessSh ares Support Galactic comiClo File Open For Write File Open For White Galactic
49. s Notifications DB Maintenance Exempted Subdirectories Audited Users and Groups Each subdirectory you enter here will be appended to the managed directores or shares to make the full list of the exempted directoires Subdirectones Subfalder Add Edit Remove OF Cancel Apply Help Copyright 2015 by NTP Software All rights reserved Doc 4825EF Page 15 NTP Software File Auditor Windows Edition An NTP Software User Manual 10 Click the Audited User and Groups tab Choose whether you want to audit all users within your environment or specify certain user s to audit New File Audit Directory Policy General Monitored E vents File Criteria Directories Exempt Users and Groups Notifications DB Maintenance Evempted Subdirectories Audited Users and Groups Audit Certain Users Accounts Add Edit Remove Cancel Apply Help 11 Click OK to close the New File Audit Directory Policy dialog box NTP Software File Auditor Windows Edition will create the new directory policy which will be inherited by all systems from this point down in your hierarchy Viewing Directories NTP Software File Auditor Windows Edition enables you to view all the directories that are located on your Windows Server In the NTP Software Smart Policy Manager hierarchy view locate your Windows Server containing the directories you want to view If necessary click the
50. sSharesiMark Galactic com Platt ha 31 rashad 104 4 2009 7 57 31 MKT POL aasayed xp 4502 IG Machine tingUserQ006 New Folder AM Marketing HOME BusinessShares Mark Galactic com Platt na 31 rashad 104 4 2009 7 56 04 MKT POL aasayed xp 4502 IG Machine etingiJser0006 New Folder AM Marketing HOME BusinessShares Fina Galactic com Platt na 31 rashad 104 4 2009 7 53 16 MKT POL aasayed xp 4502 IG Machine nceWser0006 TimeSheets AM Finance HOME BusinessShares Fina Galactic com Platt na 31 rashad 104 4 2009 7 53 15 MKT POL aasayed xp 4502 IG Machine nceWser0006Ynvoices AM Finance HOME BusinessShares Fina Galactic com Toppe na731 rashad 104 4 2009 7 50 23 MKT POL aasayed xp 4502 IG Machine nceWser0005 TimeSheets r AM Finance HOME BusinessShares Fina Galactic com Toppe na 31 rashad 104 4 2009 7 50 22 MKT POL aasayed xp 4502 Machine nceWser0005Ynvoices t AM Finance d Directory Renamed This report allows you to review all the renamed directories The report s inputs are the directory name and or the host name and or the date range The report displays the original directory name before the renaming operation the new directory name after renaming the user s name performing the directory rename operation the date in which the directory was renamed the name of the policy governing this directory rename operation the IP address of the machine used to perform the directory rename operation and the share
51. se Configuration box enter the correct information in each of the text boxes as appropriate for your database and click OK Note My Organization is the main application container so the database configuration specified here is inherited by any other server created within the tree This saves the administrators from having to enter the database configuration manually NTP Software File 4uditor Configuration Database Configuration E mail Configuration Misc Options Security Inherit database configuration Database Connection SOL ServerName CLTESTBOX Database Name FileAuditorDB Authentication Type SOL Authentication Username Fassword ie Windows Authentication Test Connection Maintenance Cancel Apply Help Copyright 2015 by NTP Software All rights reserved Doc 4825EF Page 5 NTP Software File Auditor Windows Edition An NTP Software User Manual 4 Click the Maintenance button if you want to back up delete old files to maintain the size of your database This can be adjusted through the Database Maintenance Settings dialog box Notes 1 The DB Maintenance option works on two levels the server level and the policy level 2 The Export to SQL Server option under the Required Action section enables you to specify another database to store the aging data You can choose to enter server and database names which could be different from the serve
52. ser Manual 6 In the Choose Destination Location dialog box browse to the needed location and then click Next NTP Software Smart Policy Manager Setup Wizard F x Choose Destination Location T Select folder where setup will install files i B i Sh ware Setup will install MTP Software Smart Policy Manager in the following folder To install to this folder click Mest To install to a different tolder click Browse and select another folder Destination Folder C Program Files Smart Policy Manager Browse InstallShield 7 Select only the Smart Policy Manager Admin component in the Select Features dialog box Click Next NTP Software Smart Policy Manager Setup Wizard x Select Features i Select the features setup will install amp Ontware Select the features you want to install and deselect the features you do not want to install Description i E Die Si S mart Policy M anager Admin Selecting this option will install all of the components required to run the Smart Policy Manager administrative client 2 09 ME of space required on the C drive 1756 38 ME of space available on the C drive InstallShield Back Cancel Copyright 2015 by NTP Software All rights reserved Doc 4825EF Page 33 NTP Software File Auditor Windows Edition An NTP Software User Manual 8 The Start Copying Files dialog box prompts you to begin copying files NTP Software Smart Pol
53. ss Shares Sippo e O01 Z0K Thketss WOMEW ts hess Shares Sipporte OOO2ZTeket 000 10 Select a format Export A Number of files 3 3 2 2 2 1 1 h Most Accessed Directories This report allows you to review the most accessed directories The report s input is the date range and or number of most accessed directories to display The report displays the directory path and the number of times each directory was accessed Most accessed directories Start Date 10 14 2009 5 09 14 AM Be ee 1 14 2011 10 46 24 AM Baj view Report view top 5 folders Maximum number 2147483647 q fi ofi gt bi 100 Find Next Most accessed directories Number of records 5 Directory Path HOME BusinessShares HOME BusinessShares Finance WJser0007 TimeSheets HOME BusinessShares FinanceWUser0007 Invoices HOME BusinessShares FinanceWser0002 Invoices HOME BusinessShares Development User0001 Projects in Progress FTP Projecti Copyright 2015 by NTP Software All rights reserved Doc 4825EF Select a format Export A Number of Accesses 3 Page 28 NTP Software File Auditor Windows Edition An NTP Software User Manual i Directory Owner Changed This report allows you to review all directories whose owners have changed The report displays the directory name the previous and new owners the host IP address the user name the date the policy name the client name and the share name
54. tail in the next sections NTP Software File Auditor Windows Edition imposes no restrictions on how you monitor your file and directory operations You can impose policies on individual files directories users and or groups of users To install NTP Software File Auditor Windows Edition a login with administrator rights is needed You will be installing two different services the NTP Software Smart Policy Manager service and the NTP Software File Auditor service Your hardware should be appropriate for the services running on each machine Copyright 2015 by NTP Software All rights reserved Doc 4825EF Page 4 NTP Software File Auditor Windows Edition An NTP Software User Manual Setting NTP Software File Auditor Windows Edition Properties TEE Se N a a Setting NTP Software File Auditor Windows Edition Database The NTP Software File Auditor Properties tab enables you to set up several application properties including the application database Your application database configuration should be adjusted before creating any file audit policies because all the events monitored through the File Auditor policies are saved to your configured database To configure the database please follow these steps 1 Right click NTP Software File Auditor under the main application container My Organization in this example 2 Click Properties on the pop up menu 3 On the Database Configuration tab clear the Inherit Databa
55. the date range and or the file name and or the file type and or the user account The report displays the file name the directory path in which the file exists the user name the access type which is file create the access date the policy name the client name and the share name within the specified criteria File Name Host JahmediG na 31 rashad Start Date 10 14 2009 5 09 14 AM EE End Date 5 3 2011 8 46 17 AM a File Type bmp cpp doc h rtf tmp txt eli i441 of gt Aje OF G OM 100 Files Created From 10 14 2009 5 09 14 AM To 5 3 2011 6 46 17 AM Number of records 235 File Name Directory S G 2 Client Share Path Name Name New Text SHOME BusinessShar na731 rashad Galactic com P 1044 2009 MKT POL aasayed xp IG Machine Document txt es MarketingUser000 latt 7 58 56 AM Marketing 4502 Africa Customers New Text HOME BusinessShar na731 rashad Galactic com P 1044 2009 MKT POL aasayed xp Machine Document txt es MarketingUser000 latt 7 56 35 AM Marketing 4502 Bild Stuff New Bitmap HOME BusinessShar na 31 rashad Galactic com P 1044 2009 MKT POL aasayed xp Machine Imaqe bmp es MarketingiJser000 latt 7 56 12 AM Marketing 4502 Old Stuff August HOME SusinessShar na731 rashad Galactic com P 1044 2009 MKT POL aasayed xp Machine TimeSheet xls es Finance User0006 latt 7 53 16 AM Finance 4502 TimeSheetsi July Invoice xls HOME BusinessShar na 31 rashad Galactic
56. uditor The Installation Wizard will install NTP Software File Auditor on your computer Click nest to continue 2 Inthe License Agreement dialog box select accept the terms of the license agreement then click Next ATP Software File Guditor Setup License Agreement Please read the following license agreement carefully i g license aa NTR ave NTF Software File Auditor T M Base and Terabyte License Agreement IMPORTANT PLEASE READ CAREFULUY By using of copying the accompanying zoltware you are indicating your acceptance of the terms of this license and agree to be bound by it IF YOU CO NOT AGREE TO THE TERMS OF THIS LICENSE YOU MUST MOT INSTALL OR USE THE PRODUCT fou may return the product UNUSED to your place of purchase for a refund of pour license fee GRANT OF LICENSE NTF Softwarel A grants you the right to use WTP Software File Auditor TM the PRODUCT on the number of computers andor virtual machines for which You have paid a license fee provided the use is solely for your personal or your company s own Internal use Furthermore you may only use the PRODUCT to manage the do not accept the terms of the license agreement InstallShield lt Back Cancel Copyright 2015 by NTP Software All rights reserved Doc 4825EF Page 35 NTP Software File Auditor Windows Edition An NTP Software User Manual 3 In the Choose Destination Location dialog box browse to the desired
57. upport Access amp Type File Delete User Name amp Directory Path Access 3S 1044 2009 7 59 04 AM 10 4 2009 7 56 48 AM 10 4 2009 7 56 47 AM 104 4 2009 7 56 46 AM 10 4 2009 7 56 46 4M 104 4 2009 7 56 42 AM 104 4 2009 7 56 42 AM 104 4 2009 7 42 26 AM SHOME BusinessShares IG Machine MarketingUser000610ld SHOME BusinessShares MarketingUser000610ld HOME BusinessShares MarketingUJser0006 0ld SHOME BusinessShares MarketingUser000610ld SHOME BusinessShares MarketingUser000610ld HOME BusinessShares File Open For MarketingWJser0006 0ld Write HOME BusinessShares MarketingUser000610ld HOME BusinessShares SupportWser001 3iTicket Galactic com Platt aasayed xp 4502 Galactic com Platt Readme txt File Close aasayed xp 4502 IG Machine Galactic com Platt Readme txt aasayed xp 4502 IG Machine File Open For Write Galactic com Platt Readme txt File Close aasayed xp 4502 IG Machine Galactic com Platt Readme txt File Close aasayed xp 4502 IG Machine Galactic com Platt Readme txt aasayed xp 4502 G Machine File Open For Machine write File Open For write Galactic com Platt Readme txt aasayed xp 4502 IG Galactic comwvood readme tot aasayed xp 4502 Machine Copyright 2015 by NTP Software All rights reserved Doc 4825EF Page 18 NTP Software File Auditor Windows Edition An NTP Software User Manual Most Active Users This re
58. xt 5 35 10 AM 00010 Galactic comVVolco HOME BusinessSharesiD New Text na 31 rashad 1044 2009 aasayed xp 4502 Machine evelopment WUser0003 Document txt 5 39 25 AM Projects DeliveredhOFS Project Galactic com Volco HOME BusinessShares D team notes na 31 rashad 1044 2009 aasayed xp 4502 Machine tt evelopmentJser0003 meeting txt 5 44 21 AM Projects in Progress FTP Project Copyright 2015 by NTP Software All rights reserved Doc 4825EF Page 27 NTP Software File Auditor Windows Edition An NTP Software User Manual g Deleted Files Count by Directory This report allows you to review the number of deleted files with a directory The report s input is the date range and or the directory name The report displays the folder path and the number of files deleted within the specified directory directories within the specified date range Deleted files count by directory Start Date 10 14 2009 5 09 14 AM BE End 1 14 2011 10 42 51 AM a View Report Date Directory Name l4 d fi ofi gt Pil 75 Find Next Deleted files count by directory Number ofrecords 21 WHO ME A ts hess Shares Deue bpme stke OOTP rect b Progress FTP Project WOME ts bess Shares Deve bpme rty erno dP rect b Progress SiSParse n WHO ME A ts less Shares We ue bpme rte e OOFIOM Stirea bg 1 Project HO MEA ts he ss Shares Sab aee 100110 Records WHO MEA ts hess Shares Si ppor e OOITCket 0016 HOMEA ts he

User Manual - NTP Software File Auditor for Windows_Rev1

Contents

Download Pdf Manuals

Related Search

Related Contents