netwrix file server change reporter

NetWrix File Server Change Reporter

Version 3.2

Enterprise Edition Quick Start Guide

__________________ NetWrix File Server Change Reporter Enterprise Edition Quick Start Guide

Contents 1. INTRODUCTION ............................................................................................................................................................ 3

1.1 KEY FEATURES .................................................................................................................................................................... 3 1.2 LICENSING .......................................................................................................................................................................... 4 1.3 HOW IT WORKS .................................................................................................................................................................. 5

2. GETTING STARTED ........................................................................................................................................................ 7

2.1 SYSTEM REQUIREMENTS ....................................................................................................................................................... 7 2.2 CONFIGURING FILE SYSTEM AUDITING ..................................................................................................................................... 9

2.2.1 Object Access Auditing ..................................................................................................................................... 9 2.2.2 Object Modifications Auditing .......................................................................................................................... 9

2.3 INSTALLATION ................................................................................................................................................................... 11

3. WORKING WITH ENTERPRISE EDITION ....................................................................................................................... 12

3.1 GETTING STARTED ............................................................................................................................................................. 13 3.1.1 Step 1: Specify Object Type ............................................................................................................................. 13 3.1.2 Step 2: Supply Default Data Processing Account ............................................................................................ 14 3.1.3 Step 3: Specify SMTP Settings ......................................................................................................................... 15 3.1.4 Step 4: Specify Computer Collection Name .................................................................................................... 16 3.1.5 Step 5: Enable Features .................................................................................................................................. 17 3.1.6 Step 6: Configure Advanced Reporting Database ........................................................................................... 18 Step 7: Add Computers .............................................................................................................................................. 19 3.1.7 Step 8: Configure Feature Settings ................................................................................................................. 21 3.1.8 Step 9: Review the Settings ............................................................................................................................ 22

3.2 DATA COLLECTION AND REPORTING ...................................................................................................................................... 23 3.2.1 Running a Data Collection Task ...................................................................................................................... 23 3.2.2 Viewing Task Session Results .......................................................................................................................... 24 3.2.3 Viewing Scheduled Reports ............................................................................................................................ 25

4. ABOUT NETWRIX PRODUCTS...................................................................................................................................... 26

5. DISCLAIMER ............................................................................................................................................................... 27

__________________________________ ___ _ NetWrix File Server Change Reporter Enterprise Edition Quick Start Guide

3

1. Introduction File server auditing is a critical requirement for organizations that rely on file servers to store their documents and network applications. Unauthorized and accidental changes to the files and folder structure, permissions, file shares, and other objects can significantly impact your users and infrastructure by facilitating data theft and security threats.

The File Server Change Reporter is an easy-to-use auditing solution that reports changes made to your File Server's shared files and folders. The product reports on changes made to file server shared files and folders. If your situation requires monitoring of some non-default events, custom monitoring templates are available and may be ordered from NetWrix (*). The tool centrally monitors multiple servers and sends daily summary reports about any changes detected through the last day. File access, new or changed files and folders - no change will pass behind the scenes, no matter who made it and how. It is especially easy to track with the Who (*) and When (*) reporting capabilities. You just setup this tool once and start getting daily summary reports about all changes grouped by server name. Advanced Reporting is also a feature with optional custom reports available for ordering from NetWrix (*). The File Server Change Reporter comes in three Editions: Freeware, Standard and Enterprise.

NetWrix File Server Change Reporter audits important file server changes. The tool sends daily reports about:

• Successful and/or failed object modification attempts, including modifications of files, folders, shares, and permissions

• Successful and/or failed read access attempts

1.1 Key Features NetWrix File Server Change Reporter helps you to carry out the following auditing and reporting tasks:

• Detect and report on changes made to file servers and on successful/failed object read access and failed change attempts, as well.

• Reports include information about what changes were made, who (*) made the changes and when (*) were they made.

• Report on previous and current values for every change. • Generate on-demand Web-based reports. (*) • Create custom reports (can also be ordered from NetWrix). (*) • Store collected audit data and enable historical reporting for any period of time. (*)

The product supports the most commonly used file server types: Windows® Server, NetApp® Filer (*), and EMC Celerra (*).

* Features marked with (*) are only available in the Standard and Enterprise Editions of the product.


4

1.2 Licensing The File Server Change Reporter is available in three editions: Freeware Edition, Standard Edition and Enterprise Edition.

The table below outlines the differences between them.

Feature Freeware Standard Edition Enterprise Edition

Who and When fields for every change No Yes Yes

Permissions change reporting Not detailed Detailed Detailed

Advanced reports based on SQL Server Reporting Services, with filtering, grouping and sorting

No Yes Yes

Custom reports No Yes. Create manually or order from NetWrix

Yes. Create manually or order from NetWrix

Long-term archiving and reporting No Any period of time Any period of time

Technical support Support forum Phone, e-mail Phone, e-mail

Supported file servers • Windows Server • Windows Server

• NetApp Filer • EMC Сelerra

• Windows Server • NetApp Filer • EMC Сelerra

Support of large file servers No (no more than 500 000 files) Yes Yes

Supported audit types

• Successful modifications (without who/when fields)

• Successful reads

• Successful modifications (with full information)

• Successful reads • Failed modification

attempts • Failed read attempts

• Successful modifications (with full information)

• Successful reads • Failed modification

attempts • Failed read attempts

Licensing Free of charge Per server; please request a quote

Per server; please request a quote

Integrated interface for all NetWrix products which provides centralized configuration and settings management

No No Yes

Advanced Reporting integrated with the NetWrix Enterprise Management Console

No No Yes

Advanced Reports can be viewed directly from the NetWrix Enterprise Management Console

No No Yes

Handle multiple server collections each with its own individual settings No No Yes

The Free Edition can be used by companies and individuals for an unlimited time, at no charge. The Standard/Enterprise Edition can be evaluated free of charge for 20 days.

http://forum.netwrix.com/�

http://netwrix.com/requestq.html?product=fscr�





5

1.3 How It Works

Figure 1: Product Architecture and data flow


6

NetWrix File Server Change Reporter data collection and reporting workflow is usually as follows:

1. A user launches the configuration utility and sets the parameters for the automated data collection and reporting, choosing whether to report on: • Successful modifications • Failed modification attempts (*) • Successful read access • Failed read access attempts (*)

2. A dedicated scheduled task which is launched periodically (every night, at 3 AM by default; it can also be launched manually when needed) collects file server snapshots and/or audit data, and e-mails the reports to the specified recipients. The task name is NetWrix Management Console - File Server Change Reporter - <your managed object name> (where <your managed object name> is the name of your managed object).

3. A mail client is used to view the reports sent by e-mail (all Editions); for Standard and Enterprise Edition, the following tools can be used to generate and view the on-demand reports: • For Standard Edition, use Report Viewer • For Enterprise Edition, use NetWrix Management Console

* Features marked with (*) are only available in the Standard and Enterprise Editions of the product.


7

2. Getting Started This section describes the necessary prerequisites for the File Server Change Reporter installation.

2.1 System Requirements

Supported file server configurations:

FILE SERVER:

• Microsoft Windows 2000 or later • NetApp Filer (*) • EMC Celerra (*)

OS requirement:

COMPUTER WHERE THE FILE SERVER CHANGE REPORTER WILL BE INSTALLED:

Windows XP SP2 or higher

Necessary additional software: • Microsoft.Net Framework 2.0 or later • Microsoft Windows Installer 3.1 or later • For Enterprise Edition, Microsoft Management Console 3.0 is required (*)

Additional requirements: • Disk space – enough for a temporary data storage (file server configuration snapshots and/or

audit data will be stored there). We recommend at least 20 Gb of free disk space; the required amount depends on the number of files on your file servers and can be calculated as at least 15 bytes of storage per file per day.

• SQL Server 2005 or 2008 with Reporting Services (SSRS) are required for advanced reporting (*). SQL Server Express Edition with Advanced Services is supported; it can be installed and configured automatically. The following article explains how to configure SQL Server 2005 Express Edition to allow remote connections: http://support.microsoft.com/default.aspx?scid=kb;EN-US;914277

Required rights and permissions The account which the File Server Change Reporter service will use for data processing and report generation requires the following:

• ‘Manage auditing and security log’ privilege. There are two ways to enable the necessary Group or Local Policy settings:

Through Group Policy: Launch the Group Policy Object Editor and in the Group Policy object (e.g. Default Domain Controllers Policy), navigate to Computer Configuration | Windows Settings | Security Settings | Local Policies | User Rights Assignment and open the Manage Auditing And Security Log parameter, then click Add User or Group and specify the account under which the File Server Change Reporter is running. Do this for all managed servers. To centrally enable this setting, it is recommended that a dedicated Group Policy Object be created and assigned to your servers OU).

http://support.microsoft.com/default.aspx?scid=kb;EN-US;914277�


8

Through the Local Security Policy: Launch the Local Security Settings, go to Security Settings | Local Policies | User Rights Assignment and open Manage Auditing And Security Log, then click Add User or Group and specify the account under which the File Server Change Reporter is running. Do this for all managed servers.

• Local administrator rights on the computer where the File Server Change Reporter is installed. • Local administrator rights for the servers monitored by the File Server Change Reporter (the account

used to run the File Server Change Reporter must be a member of the local administrators group on the monitored servers)

Note: If you plan to collect data using agents (*), consider that the agent service will be run under the Local System account.

* Features are only available in the Standard and Enterprise Editions of the product.


9

2.2 Configuring File System Auditing Before you start the file system auditing, follow the recommendations provided in this section.

2.2.1 Object Access Auditing Depending on the types of the reports you need, you have to specify the appropriate audit settings (for example, to track all the object access events, or object modifications, etc.). First, you must enable object access auditing by defining auditing policy settings for the Object Access event category.

Important: You must be logged on as a member of the Administrators group or you must be granted the Manage auditing and security log right in Group Policy to perform this procedure.

To centrally enable the audit settings, it’s recommended to create a Group Policy Object and assign it to your file servers OU (as described in the Create a new Group Policy object: Group Policy article). Then

1. In the Group Policy object, navigate to the Computer Configuration | Windows Settings| Security Settings | Local Policies | Audit Policy node;

2. Make sure that the following 'Audit object access' setting are enabled: • Success if you would like to monitor Successful modifications and Successful Read Attempts • Failure is you would like to monitor Failed Modifications and Failed Read Access Attempts.

Alternatively, you can use the local policy, as described in Define or modify auditing policy settings for an event category: Auditing.

2.2.2 Object Modifications Auditing Important: Consider that if you have multiple file shares frequently accessed by significant number users, it is reasonable to audit the object modifications only, as tracking all the access events may result in too much data written to the audit logs, with only some of it being of interest.

1. Modify auditing entries for all managed folders configured as network shares. For that, right-click the folder that you want to audit, click Properties, and then click the Security tab.

2. Click Advanced, and then click the Auditing tab. 3. For the Everyone group, click its name, and then click Edit. 4. From the Apply onto drop-down list, select This folder, subfolders and files. 5. In the Access list, select both the Success and Failure checkboxes for the following audit entries:

• List Folder / Read Data (required only for monitoring access attempts) • Create Files / Write Data (these access options and the ones below are required for monitoring

changes) • Create Folders / Append Data • Write Attributes • Write Extended Attributes • Delete Subfolders and Files • Delete • Change Permissions • Take Ownership

http://technet.microsoft.com/en-us/library/cc738830%28WS.10%29.aspx�

http://technet.microsoft.com/en-us/library/cc787268(WS.10).aspx�

http://technet.microsoft.com/en-us/library/cc787268(WS.10).aspx�


10

Figure 2: Auditing Entry for Test selection window

6. Make sure that Apply these auditing entries to all folders and/or containers within this container only checkbox is cleared.

7. Click OK to save the settings and close the dialog.

Important: If you can see no data in the generated reports, or the Who changed field contains ‘system’ value, please refer to the troubleshooting guidelines at: www.netwrix.com/download/documents/fscrtroubleshooting

http://www.netwrix.com/download/documents/fscrtroubleshooting�


11

2.3 Installation To install the File Server Change Reporter, run the setup program on any computer in the domain where the managed file servers are located.

Follow the steps of the wizard. When prompted, accept the license agreement, then specify the installation folder, and click Next to proceed with the installation.

On the last step of the installation wizard, the following dialog appears:

Figure 3: The File Server Change Reporter Setup configuration utility selection dialog window

To launch the full-featured NetWrix Enterprise Management Console, select Launch full featured configurator and click Finish.


12

3. Working with Enterprise Edition If you are using an Enterprise license, the Full Featured configuration utility mode is available to you. It features the NetWrix Management Console (implemented as MMC snap-in) that provides flexible configuration and management capabilities. With NetWrix Management Console, you can:

• Enable and configure long-term archiving • Enable and configure SQL SRS-based Advanced Reporting • Enable agent-based data collection • Use snapshots file versioning and rollback capabilities (based on Volume Shadow Copy) • Enable and configure NetApp Filer and EMC Celerra support • Define the management scope for the NetWrix product you are using (these can be domains or OUs

for AD Change Reporter, Exchange servers for Exchange Change Reporter, file servers for the File Server Change Reporter, and so on)

• Enable management features for selected objects in bulk, for example, specify report generation frequency and recipients, and so on

• Handle numerous managed objects(domains, OUs, multiple server collections) with a single installation

• Manage all NetWrix products configuration and settings via a truly integrated interface • View Advanced Reports right from the NetWrix Enterprise Management Console

Start the Management Console by selecting NetWrix | NetWrix File Server Change Reporter Commercial Version | Configurator (Full Featured Mode) from the Start menu.

Figure 4: NetWrix Management Console


13

3.1 Getting Started When you start NetWrix Management Console for the first time, no managed objects exist. So, you have to create a new managed object and perform its initial configuration, as described below.

3.1.1 Step 1: Specify Object Type 1. In the NetWrix Management Console main window, navigate to the Managed Objects tree node,

right-click it and select New Managed Object. Alternatively, you can click Create New Managed Object in the Task pad on the right.

2. The New Managed Object wizard starts. On the Select Managed Object Type step, select Computer Collection to create a collection of computers to be configured for data gathering and reporting.

Figure 5: New Managed Object Wizard – “Select Managed Object Type” dialog window


14

3.1.2 Step 2: Supply Default Data Processing Account Next, you should select a user account that will be used by the File Service Change Reporter scheduled task as the default one for scheduled data processing and report generation.

Figure 6: New Managed Object Wizard – “Data Processing Account setup” dialog window

Click Specify Account; when selecting the account, consider that it should be granted the necessary access rights (see the 2.1 System Requirements section above). At the next console launch, you can specify different accounts for object processing (as described later in this document).

Note: You will be presented with this step only if the Data Processing Account settings were not yet supplied via Settings -> Schedule NetWrix Management Console submenu.


15

3.1.3 Step 3: Specify SMTP Settings Next, specify the settings of SMTP server that will be used to e-mail the reports. Supply SMTP server name, port, and the From address.

Figure 7: New Managed Object Wizard – “Configure SMTP Server Settings” dialog window

Note: You will be presented with this step only if the SMTP settings were not yet supplied via Settings -> E-mail Settings NetWrix Management Console submenu.


16

3.1.4 Step 4: Specify Computer Collection Name Next you have to enter the name of the computer collection (managed object) you are creating:

Figure 8: New Managed Object Wizard – “Computer Collection Name setup” dialog window

Enter the collection name, e.g., My Servers. Also, if you want to use a specific account to process objects from this collection, enter user name and password at this step. Alternatively, you can leave the Default account here (the one you supplied on Step 2 will be used).

Important: Make sure the processing account is granted the necessary rights and permissions (see section 2.1 System Requirements section above).


17

3.1.5 Step 5: Enable Features From the list available, check File Server Change Reporter (on this screenshot you can see that the File Server Change Reporter and the Event Log Manager are checked):

Figure 9: New Managed Object Wizard – “Enable Features” dialog window


18

3.1.6 Step 6: Configure Advanced Reporting Database This step presents you with the Advanced Reporting settings configuration. Skip it by clicking Next. For more information on Advanced Reporting, please refer to the NetWrix File Server Change Reporter Administrator Guide.

Figure 10: “New Managed Object Wizard – Advanced Reporting SQL Settings” dialog window

http://www.netwrix.com/download/documents/NetWrix_File_Server_Change_Reporter_Administrator_Guide.pdf�

http://www.netwrix.com/download/documents/NetWrix_File_Server_Change_Reporter_Administrator_Guide.pdf�


19

Step 7: Add Computers Next, populate the managed object (computer collection) with the computers (file servers) whose audit data is to be processed.

Figure 11: “New Managed Object Wizard" – the Add submenu

Click Add… and choose a Computer or a UNC Path:

Figure 22: “Add Computer” dialog window

Enter computer name or UNC path here, or Browse your network for the computers you want to add.


20

Figure 13: New Managed Object Wizard – the “Add Items to Collection” dialog window


21

3.1.7 Step 8: Configure Feature Settings Next, configure the settings for the feature/product that will process with this managed object (computer collection). The File Server Change Reporter settings are described below:

Figure 14: New Managed Object Wizard – “Configure FSCR Settings” dialog window

1. Check Enable File Server Change Reporting checkbox. 2. Enter the e-mail addresses of reports recipients. There are two types of reports: file and folder

changes (successful and failed attempts) and file and folder read access (successful and failed attempts), you can have both sent to the same e-mail address.

3. Then, enable all the types of events to be reported on: successful modifications, successful reads, failed modification attempts and successful file reads.

4. Click Advanced… to reach the Advanced Settings and enable agent usage and large server support.


22

3.1.8 Step 9: Review the Settings Then you can review the settings you have configured for the new managed object, and Finish the Wizard.

When created, the new object (computer collection) is displayed in the NetWrix Management Console under the Managed Objects node:

Figure 15: NetWrix Management Console – “Managed Objects window”

Here on the General tab you can: • Click Managed Computers – to view the list of managed computers (included in the created

collection, i.e., in managed object) • Click Add/Remove Features – to specify the products you want to use for processing data from these

computers You can Run an event processing task that will be performed by the feature/product configured, or Stop the task execution.


23

3.2 Data Collection and Reporting This section tells you how to perform data collection and reporting using NetWrix Management Console.

3.2.1 Running a Data Collection Task To run data collection, select a managed object (from which you want to collect and report the changes) from the tree in the NetWrix Management Console, and then click Run in the right pane on the General tab:

Figure 16: NetWrix Management Console – “Running Data Collection” Task window

File server snapshots will be collected, and specified reports will be e-mailed to the selected recipients. Task session information can be examined using NetWrix Management Console, as described below.


24

3.2.2 Viewing Task Session Results All task operation information is shown in the NetWrix Management Console. Expand the node of the feature (product) you need, for example, File Server Change Reporter, and select Sessions. Then select the data collection session you need to examine, and review the information shown in the right pane:

Figure 17: NetWrix Management Console – “Task Session Results” window

For each selected session, you can review the following information: • Session status – that is, Success, Warning, Error, or Fatal Error (meaning that data collection failed to

start due to incorrect account, remote computer powered off, or other reason specified in the Details below).

• Type – the product that processed data during the selected session. • File Server – the list of servers included in the managed object (collection) processed during the

session • Details – the detailed results of audit data collection.

To generate a report on data collected during the selected session, use the settings in the lower pane on the right:

• Server name - supply a file server name whose data will be included in the report. • Contents list - select which type of events will be reported: successful modifications, failed

modification attempts, successful reads, or failed read attempts. Click Run to launch the report generation process and automatically show the result. To see the report generated earlier (i.e., history), click View report (if the report has no history, it will be first generated and then displayed).


25

3.2.3 Viewing Scheduled Reports At the first run of the scheduled task, the message notifies you of the initial analysis being completed. Next, you can make some changes to your file server to see the way they will be reported. After that, you can launch the scheduled task again, and then check the mailbox, specified in the email setup section, for the new report. The changes should be reported as shown in the figure below; if so, consider the product installation and configuration complete.

Figure 18: Scheduled Reports email example


26

4. About NetWrix Products Solutions developed by NetWrix Corporation help organizations to meet compliance standards, simplify identity management, and reduce IT infrastructure costs. The product line includes solutions for change management, identity management, virtualization, and Active Directory troubleshooting.

Enterprise Management Suite: NetWrix Enterprise Management Suite is a rich collection of all NetWrix products combined together into one integrated solution. The suite is well-maintained and regularly updated with new versions and completely new products that all customers are entitled to as long as their maintenance is up to date.

Change Reporter Suite: The Change Reporter Suite is an integrated solution for automated tracking and reporting of all critical changes in the entire IT infrastructure, including Active Directory, file servers, Microsoft Exchange, filer appliances such as NetApp or EMC, virtual and physical infrastructure, SQL Server databases. Everything is centrally audited, consolidated, and presented in easy to understand reports with before and after values of all “who, what, when and where” modifications.

Identity Management Suite: The NetWrix Identity Management Suite brings convenience, enhanced security, and brings sensible benefits to everyone within an organization. The solution resolves account lockouts, forgotten passwords and password expiration problems, while also providing user account de-provisioning and privileged password management.

Active Directory Change Reporter: Full-featured Active Directory auditing and compliance solution with full coverage of AD, Group Policy, Exchange, and object-level rollback capabilities. Tracks who changed what, when, and where in Active Directory and related systems.

USB Blocker: USB Blocker enforces centralized access control to prevent unauthorized use of removable media that connects to computer USB ports—memory sticks, removable hard disks, iPods, and more.

File Server Change Reporter: File server and filer appliance auditing solution. Supports Windows servers, NetApp Filers, EMC appliances.

SQL Server Change Reporter: Auditing and reporting solution to monitor changes to SQL servers, instances, database schema, logins and roles, etc.

Privileged Account Manager: Shared access to privileged accounts with automatic password maintenance.

Non-owner Mailbox Access Reporter: Track users who access other user’s mailboxes and report unauthorized access to mailboxes of C and VP-level accounts.

Password Manager: product gives end users the ability to securely manage their passwords and resolve account lockout incidents in a self-service fashion without involvement of help desk personnel.

Account Lockout Examiner: detects, diagnoses, and resolves account lockouts in real time to reduce administrative costs associated with manual resolution of account lockouts.

Full list of products: http://www.netwrix.com/products.html For more information, please visit www.netwrix.com or call our toll-free number: +1-888-638-9749.

http://netwrix.com/Enterprise_Management_Suite.html�

http://netwrix.com/change_auditing_solution.html�

http://netwrix.com/identity_management.html�

http://netwrix.com/active_directory_change_reporting_freeware.html�

http://netwrix.com/usb_blocker_freeware.html�

http://netwrix.com/file_server_auditing_change_reporting_freeware.html�

http://netwrix.com/sql_server_audit_change_reporter_freeware.html�

http://netwrix.com/privileged_account_manager.html�

http://netwrix.com/non_owner_mailbox_access_reporter_exchange_freeware.html�

http://www.netwrix.com/requeste.html?product=prm�

http://www.netwrix.com/requeste.html?product=ale�

http://www.netwrix.com/products.html�

http://www.netwrix.com/�


27

5. Disclaimer The information in this publication is furnished for information use only, does not constitute a commitment from NetWrix Corporation of any features or functions discussed and is subject to change without notice. NetWrix Corporation assumes no responsibility or liability for any errors or inaccuracies that may appear in this publication.

NetWrix is a registered trademark of NetWrix Corporation. The NetWrix logo and all other NetWrix product or service names and slogans are registered trademarks or trademarks of NetWrix Corporation. Active Directory is a trademark of Microsoft Corporation. All other trademarks and registered trademarks are property of their respective owners.

© 2010 NetWrix Corporation. All rights reserved. www.netwrix.com

http://www.netwrix.com/�

netwrix file server change reporter

Documents