diff --git a/docs/auditor/10.9/admin/monitoringplans/azurefiles.md b/docs/auditor/10.9/admin/monitoringplans/azurefiles.md index 5943fdb6a6..b11285685b 100644 --- a/docs/auditor/10.9/admin/monitoringplans/azurefiles.md +++ b/docs/auditor/10.9/admin/monitoringplans/azurefiles.md @@ -22,8 +22,8 @@ Create monitoring plans for Azure Files to track file and folder changes across 1. In the **Netwrix Auditor**, go to **Home > Monitoring Plans > + Add Plan** 2. Select **Azure Files** 3. Configure: - - [Audit database (SQL)](/docs/auditor/10_8/admin/settings/auditdatabase) - - [Notifications (SMTP or Exchange Online)](/docs/auditor/10_8/admin/settings/notifications) + - [Audit database (SQL)](/docs/auditor/10.9/admin/settings/auditdatabase) + - [Notifications (SMTP or Exchange Online)](/docs/auditor/10.9/admin/settings/notifications) - Plan name and description - Select **Add item now** @@ -49,32 +49,32 @@ Create monitoring plans for Azure Files to track file and folder changes across - **Read Access (Success/Fail)** → Track file reads and unauthorized read attempts - **Successful** - Show successful attempts to read files - - **Failed** - Use this option to track suspicious activity. Helps find out who was trying to access your private data without proper justification.Enabling this option on public shares will result in a high number of events generated on Azure Files and the amount of data written to the Long-Term Archive + - **Failed** - Use this option to detect unauthorized attempts to read your data. Enabling this option on public shares generates a high volume of events on Azure Files and increases the amount of data written to the Long-Term Archive **Note:** Enabling read access auditing on public shares may generate high event volume **Tip:** Only enable read auditing where compliance requires it (e.g., HR, Finance) -4. Add exclusions → e.g., service accounts that produce excessive logs - -- **Monitored object types** - Select from: +4. **Monitored object types** - Select from: - Files - Folders - Shares -- **Monitored actions** - Configure which file operations to track +5. **Monitored actions** - Configure which file operations to track +6. **Collect data for state-in-time reports** – Enable this option to have Netwrix Auditor store periodic snapshots of your Azure Files permissions. State-in-Time reports, including permission and effective access reports, require these snapshots. See [Configuring State-in-Time Data Collection for Azure Files](/docs/auditor/10.9/configuration/azurefiles/stateintime.md) for the snapshot schedule, historical snapshot import, and optional Active Directory integration for on-premises accounts and groups. +7. Click **Save** + +### Step 4: Configure Exclusions (optional) -### Step 5: Test Connection +What you can exclude depends on the monitored item type: -Click **Test Connection** to verify: -- Microsoft Entra ID authentication -- Storage account access -- Audit log collection +- **Azure Subscription items** – On the item's **Scope** tab, exclude specific **storage accounts** or **resource groups** by name so Netwrix Auditor skips them entirely for this subscription. +- **Azure Storage Account items** – On the item's **Scope** tab, use the **Omit List** to exclude specific shares, folders, or files (Universal Naming Convention (UNC) paths). Choose **All** to exclude an object from all data collection, **SiT** to exclude it from State-in-Time snapshots only, or **User Activity** to exclude it from activity data collection only. See [Configuring the monitoring scope (omit lists)](/docs/auditor/10.9/configuration/azurefiles/stateintime.md#configuring-the-monitoring-scope-omit-lists) for details. ## Next Steps After creating the monitoring plan: 1. **Verify data collection** is working -2. **[Configure reports](/docs/auditor/10_8/admin/reports/overview)** as needed -3. **[Set up alerts](/docs/auditor/10_8/admin/alertsettings/create/)** for important events +2. **[Configure reports](/docs/auditor/10.9/admin/reports/overview)** as needed +3. **[Set up alerts](/docs/auditor/10.9/admin/alertsettings/create/)** for important events For configuration requirements, see [Azure Files Configuration](/docs/auditor/10.9/configuration/azurefiles/overview.md) diff --git a/docs/auditor/10.9/admin/monitoringplans/datasources.md b/docs/auditor/10.9/admin/monitoringplans/datasources.md index 3e7d4d3dba..d63ffb0439 100644 --- a/docs/auditor/10.9/admin/monitoringplans/datasources.md +++ b/docs/auditor/10.9/admin/monitoringplans/datasources.md @@ -7,20 +7,20 @@ sidebar_position: 20 # Manage Data Sources You can fine-tune data collection for each data source. Settings that you configure for the data -source will be applied to all items belonging to that data source. Using data source settings, you +source apply to all items belonging to that data source. Using data source settings, you can, for example: -- Enable state-in-time data collection (currently supported for several data sources) +- Enable state-in-time data collection (supported for several data sources) - Depending on the data source, customize the monitoring scope (e.g., enable read access auditing, monitoring of failed attempts) -To add, modify and remove data sources, enable or disable monitoring, you must be assigned the -Global administrator role in the product or the Configurator role on the plan. See the +To add, modify, and remove data sources, or to enable or disable monitoring, you must have +the Global administrator role in the product or the Configurator role on the plan. See the [Role-Based Access and Delegation](/docs/auditor/10.9/admin/monitoringplans/delegation.md) topic for additional information. ## Modify Data Source Settings -Follow the steps to modify data source settings. +To modify data source settings: **Step 1 –** Select the monitoring plan you need and click **Edit**. @@ -49,7 +49,7 @@ Review the following for additional information: - [SharePoint](/docs/auditor/10.9/admin/monitoringplans/sharepoint/overview.md) - [SharePoint Online](/docs/auditor/10.9/admin/monitoringplans/sharepointonline/overview.md) - [SQL Server](/docs/auditor/10.9/admin/monitoringplans/sqlserver/overview.md) -- [User Activity](/docs/auditor/10.9/admin/monitoringplans/overview_1.md) +- [User Activity](/docs/auditor/10.9/admin/monitoringplans/useractivity/overview.md) - [VMware](/docs/auditor/10.9/admin/monitoringplans/vmware/overview.md) - [Windows File Share](fileservers/scope.md#windows-file-share) @@ -58,7 +58,7 @@ needed. ## Add a Data Source to an Existing Plan -Follow the steps to add a data source to existing plan. +To add a data source to an existing plan: **Step 1 –** Select the monitoring plan you need and click Edit. @@ -72,7 +72,7 @@ Follow the steps to add a data source to existing plan. ## Add Items for Monitoring -Once you completed monitoring plan wizard and specified data sources, add items for monitoring. You +After you complete the monitoring plan wizard and specify data sources, add items for monitoring. You can add as many items for a data source as you want. In this case, all items will share settings you specified for this data source. @@ -84,7 +84,7 @@ associated with your data source. | Active Directory Group Policy Exchange Logon Activity | [Domain](activedirectory/overview.md#domain) | | Active Directory Federation Services | [Federation Server](adfs.md#federation-server) | | Microsoft Entra ID Exchange Online SharePoint Online Microsoft Teams | [Microsoft Entra ID](/docs/auditor/10.9/admin/monitoringplans/microsoftentraid/overview.md) | -| File Servers (including Windows file server, Dell, NetApp, Nutanix File server, Synology, and Qumulo) | [AD Container](activedirectory/overview.md#ad-container) [File Servers](/docs/auditor/10.9/admin/monitoringplans/fileservers/overview.md) [Dell Isilon](fileservers/overview.md#dell-isilon) [Dell VNX VNXe](fileservers/overview.md#dell-vnx-vnxe) [File Servers](/docs/auditor/10.9/admin/monitoringplans/fileservers/overview.md) [NetApp](fileservers/overview.md#netapp) [Windows File Share](fileservers/scope.md#windows-file-share) [Nutanix SMB Shares](fileservers/overview.md#nutanix-smb-shares) [Qumulo](fileservers/overview.md#qumulo) [Synology](fileservers/overview.md#synology) By default, Auditor will monitor all shares stored in the specified location, except for hidden shares (both default and user-defined). If you want to monitor user-defined hidden shares, select the related option in the monitored item settings. Remember that administrative hidden shares like default system root or Windows directory (ADMIN$), default drive shares (D$, E$), etc. will not be monitored. See the topics on the monitored items for details. | +| File Servers (including Windows file server, Dell, NetApp, Nutanix File server, Synology, and Qumulo) | [AD Container](activedirectory/overview.md#ad-container) [File Servers](/docs/auditor/10.9/admin/monitoringplans/fileservers/overview.md) [Dell Isilon](fileservers/overview.md#dell-isilon) [Dell VNX VNXe](fileservers/overview.md#dell-vnx-vnxe) [File Servers](/docs/auditor/10.9/admin/monitoringplans/fileservers/overview.md) [NetApp](fileservers/overview.md#netapp) [Windows File Share](fileservers/scope.md#windows-file-share) [Nutanix SMB Shares](fileservers/overview.md#nutanix-smb-shares) [Qumulo](fileservers/overview.md#qumulo) [Synology](fileservers/overview.md#synology) By default, Auditor will monitor all shares stored in the specified location, except for hidden shares (both default and user-defined). If you want to monitor user-defined hidden shares, select the related option in the monitored item settings. Remember that Auditor doesn't monitor administrative hidden shares like default system root or Windows directory (ADMIN$), default drive shares (D$, E$), and so on. See the topics on the monitored items for details. | | Network Devices | [Syslog Device](networkdevices.md#syslog-device) [Cisco Meraki Dashboard](networkdevices.md#cisco-meraki-dashboard) | | Oracle Database | [Oracle Database Instance](oracle/overview.md#oracle-database-instance) | | SharePoint | [SharePoint Farm](sharepoint/overview.md#sharepoint-farm) | @@ -93,11 +93,11 @@ associated with your data source. | Windows Server User Activity | [File Servers](/docs/auditor/10.9/admin/monitoringplans/fileservers/overview.md) [AD Container](activedirectory/overview.md#ad-container) [File Servers](/docs/auditor/10.9/admin/monitoringplans/fileservers/overview.md) | | Netwrix API | [Integration API](/docs/auditor/10.9/api/overview.md) | -To add, modify and remove items, you must be assigned the Global administrator role in the product +To add, modify, and remove items, you must have the Global administrator role in the product or the **Configurator** role on the plan. See the [Role-Based Access and Delegation](/docs/auditor/10.9/admin/monitoringplans/delegation.md)topic for additional information. -Follow the steps to add a new item to a data source: +To add a new item to a data source: **Step 6 –** Navigate to your plan settings. @@ -113,37 +113,43 @@ monitoring plan and click Edit item. For each item, you can: ## Configure Monitoring Scope -In some environments, it may not be necessary to monitor the entire IT infrastructure. Netwrix -monitoring scope can be configured on the Data Source and/or Item levels. the section below contains +In some environments, you may not need to monitor the entire IT infrastructure. You can configure the +Netwrix monitoring scope on the Data Source and/or Item levels. The following section contains examples on how to use omit functionality in Auditor. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more -granular audit data. Note that the new monitoring scope restrictions apply together with previous -exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.9/admin/monitoringplans/overview.md)topic for +granular audit data. + +:::note +The new monitoring scope restrictions apply together with previous exclusion settings configured in +the \*.txt files. +::: + +See the [Monitoring Plans](/docs/auditor/10.9/admin/monitoringplans/overview.md) topic for additional information. | Use case | Related documentation | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Active Directory** | | -| I want to omit all activity by a specific service account or service accounts with specific naming pattern. | [Active Directory](/docs/auditor/10.9/admin/monitoringplans/activedirectory/overview.md) | -| If Netwrix user is responsible just for a limited scope within corporate AD, s/he needs to omit everything else. | [Active Directory](/docs/auditor/10.9/admin/monitoringplans/activedirectory/overview.md) - Always both activity and state in time data are omitted. - In group/Not in group filters don't not process groups from omitted OUs. | +| Omit all activity by a specific service account or by service accounts with a specific naming pattern. | [Active Directory](/docs/auditor/10.9/admin/monitoringplans/activedirectory/overview.md) | +| If Netwrix user is responsible just for a limited scope within corporate AD, s/he needs to omit everything else. | [Active Directory](/docs/auditor/10.9/admin/monitoringplans/activedirectory/overview.md) - Auditor always omits both activity and state-in-time data. - In group/Not in group filters don't not process groups from omitted OUs. | | **Logon Activity** | | -| I want to omit domain logons by a specific service account or service accounts with specific naming pattern. | [Logon Activity](/docs/auditor/10.9/admin/monitoringplans/logonactivity/overview.md) | +| Omit domain logons by a specific service account or by service accounts with a specific naming pattern. | [Logon Activity](/docs/auditor/10.9/admin/monitoringplans/logonactivity/overview.md) | | **File Servers** (including Windows file server, Dell, NetApp, Nutanix File server) | | -| I have a server named _StationWin16_ where I can't install .Net 4.5 in OU where I keep all member servers. I want to suppress errors from this server by excluding it from the Netwrix auditing scope. | [AD Container](activedirectory/overview.md#ad-container) | -| A Security Officer wants to monitor a file share but s/he does not have access to a certain folder on this share. Then, s/he does not want the product to monitor this folder at all. | [File Servers](/docs/auditor/10.9/admin/monitoringplans/fileservers/overview.md) [Dell Isilon](fileservers/overview.md#dell-isilon) [Dell VNX VNXe](fileservers/overview.md#dell-vnx-vnxe) [NetApp](fileservers/overview.md#netapp) [Windows File Share](fileservers/scope.md#windows-file-share) [Nutanix SMB Shares](fileservers/overview.md#nutanix-smb-shares) | -| A Security Officer wants to monitor a file share but s/he does not have access to a certain folder on this share. Then, s/he does not want the product to monitor this folder at all. | [File Servers](/docs/auditor/10.9/admin/monitoringplans/fileservers/overview.md) [Dell Isilon](fileservers/overview.md#dell-isilon) [Dell VNX VNXe](fileservers/overview.md#dell-vnx-vnxe) [NetApp](fileservers/overview.md#netapp) [Windows File Share](fileservers/scope.md#windows-file-share) [Nutanix SMB Shares](fileservers/overview.md#nutanix-smb-shares) | -| A Security Officer wants to monitor a file share, but it contains a folder with a huge amount of objects, so s/he does not want Netwrix Auditor to collect State-in-Time data for this folder. | [File Servers](/docs/auditor/10.9/admin/monitoringplans/fileservers/overview.md) [Dell Isilon](fileservers/overview.md#dell-isilon) [Dell VNX VNXe](fileservers/overview.md#dell-vnx-vnxe) [NetApp](fileservers/overview.md#netapp) [Windows File Share](fileservers/scope.md#windows-file-share) [Nutanix SMB Shares](fileservers/overview.md#nutanix-smb-shares) | -| I want to exclude specific computers within an IP range from the Netwrix auditing scope. | [File Servers](/docs/auditor/10.9/admin/monitoringplans/fileservers/overview.md) | +| A server named _StationWin16_ can't run .Net 4.5 and belongs to the OU that holds all member servers. Suppress errors from this server by excluding it from the Netwrix auditing scope. | [AD Container](activedirectory/overview.md#ad-container) | +| A Security Officer wants to monitor a file share but s/he doesn't have access to a certain folder on this share. Then, s/he doesn't want the product to monitor this folder at all. | [File Servers](/docs/auditor/10.9/admin/monitoringplans/fileservers/overview.md) [Dell Isilon](fileservers/overview.md#dell-isilon) [Dell VNX VNXe](fileservers/overview.md#dell-vnx-vnxe) [NetApp](fileservers/overview.md#netapp) [Windows File Share](fileservers/scope.md#windows-file-share) [Nutanix SMB Shares](fileservers/overview.md#nutanix-smb-shares) | +| A Security Officer wants to monitor a file share but s/he doesn't have access to a certain folder on this share. Then, s/he doesn't want the product to monitor this folder at all. | [File Servers](/docs/auditor/10.9/admin/monitoringplans/fileservers/overview.md) [Dell Isilon](fileservers/overview.md#dell-isilon) [Dell VNX VNXe](fileservers/overview.md#dell-vnx-vnxe) [NetApp](fileservers/overview.md#netapp) [Windows File Share](fileservers/scope.md#windows-file-share) [Nutanix SMB Shares](fileservers/overview.md#nutanix-smb-shares) | +| A Security Officer wants to monitor a file share, but it contains a folder with a huge amount of objects, so s/he doesn't want Netwrix Auditor to collect State-in-Time data for this folder. | [File Servers](/docs/auditor/10.9/admin/monitoringplans/fileservers/overview.md) [Dell Isilon](fileservers/overview.md#dell-isilon) [Dell VNX VNXe](fileservers/overview.md#dell-vnx-vnxe) [NetApp](fileservers/overview.md#netapp) [Windows File Share](fileservers/scope.md#windows-file-share) [Nutanix SMB Shares](fileservers/overview.md#nutanix-smb-shares) | +| Exclude specific computers within an IP range from the Netwrix auditing scope. | [File Servers](/docs/auditor/10.9/admin/monitoringplans/fileservers/overview.md) | | **SQL Server** | | -| I want to know if _corp\administrator_ user is messing with SQL data. | [SQL Server Instance](sqlserver/items.md#sql-server-instance) | -| As a Auditor administrator I want to exclude the _domain\nwxserviceaccount_ service account activity from SQL server audit so that I get reports without changes made by automatic systems. | [SQL Server Instance](sqlserver/items.md#sql-server-instance) | -| As a Auditor administrator I want to exclude all changes performed by _MyCustomTool_. | [SQL Server Instance](sqlserver/items.md#sql-server-instance) | +| Track whether the _corp\administrator_ user is changing SQL data. | [SQL Server Instance](sqlserver/items.md#sql-server-instance) | +| As an Auditor administrator, exclude the _domain\nwxserviceaccount_ service account activity from the SQL Server audit so that reports omit changes made by automatic systems. | [SQL Server Instance](sqlserver/items.md#sql-server-instance) | +| As an Auditor administrator, exclude all changes performed by _MyCustomTool_. | [SQL Server Instance](sqlserver/items.md#sql-server-instance) | | **SharePoint** | | -| I want to exclude the _domain\nwxserviceaccount_ account from data collection as it produces standard activity that doesn't require monitoring. | [SharePoint Farm](sharepoint/overview.md#sharepoint-farm) | -| As a Auditor Administrator I want to exclude shared _PublicList_ from read audit. | [SharePoint Farm](sharepoint/overview.md#sharepoint-farm) | +| Exclude the _domain\nwxserviceaccount_ account from data collection because it produces standard activity that doesn't require monitoring. | [SharePoint Farm](sharepoint/overview.md#sharepoint-farm) | +| As an Auditor administrator, exclude the shared _PublicList_ from the read audit. | [SharePoint Farm](sharepoint/overview.md#sharepoint-farm) | | Windows Server | | -| I have a server named StationWin16 where I can't install .Net 4.5 in OU where I keep all member servers. I want to suppress errors from this server by excluding it from the Netwrix auditing scope. | [AD Container](activedirectory/overview.md#ad-container) | -| I want to exclude specific computers within an IP range from the Netwrix auditing scope. | [File Servers](/docs/auditor/10.9/admin/monitoringplans/fileservers/overview.md) | +| A server named StationWin16 can't run .Net 4.5 and belongs to the OU that holds all member servers. Suppress errors from this server by excluding it from the Netwrix auditing scope. | [AD Container](activedirectory/overview.md#ad-container) | +| Exclude specific computers within an IP range from the Netwrix auditing scope. | [File Servers](/docs/auditor/10.9/admin/monitoringplans/fileservers/overview.md) | | VMware | | -| I have a virtual machine named "testvm" I use for testing purposes, so I want to exclude it from being monitored. | [VMware ESX/ESXi/vCenter](vmware/overview.md#vmware-esxesxivcenter) | +| A virtual machine named "testvm" serves testing purposes only, so exclude it from monitoring. | [VMware ESX/ESXi/vCenter](vmware/overview.md#vmware-esxesxivcenter) | diff --git a/docs/auditor/10.9/admin/monitoringplans/useractivity/_category_.json b/docs/auditor/10.9/admin/monitoringplans/useractivity/_category_.json new file mode 100644 index 0000000000..d9ca054471 --- /dev/null +++ b/docs/auditor/10.9/admin/monitoringplans/useractivity/_category_.json @@ -0,0 +1,10 @@ +{ + "label": "User Activity", + "position": 180, + "collapsed": true, + "collapsible": true, + "link": { + "type": "doc", + "id": "overview" + } +} \ No newline at end of file diff --git a/docs/auditor/10.9/admin/monitoringplans/useractivity/monitoredcomputers.md b/docs/auditor/10.9/admin/monitoringplans/useractivity/monitoredcomputers.md new file mode 100644 index 0000000000..e44e3f8bb4 --- /dev/null +++ b/docs/auditor/10.9/admin/monitoringplans/useractivity/monitoredcomputers.md @@ -0,0 +1,59 @@ +--- +title: "Monitored Computers" +description: "Monitored Computers" +sidebar_position: 20 +--- + +# Monitored Computers + +The **Monitored Computers** tab in a User Activity monitoring plan gives you a detailed, per-host view of every monitored computer. Instead of showing a single summary status for the entire plan, the tab reports the health of each computer, so you can identify issues quickly and drill into diagnostic details without leaving the interface. + +**To access the Monitored Computers tab:** + +**Step 1** – In the main Netwrix Auditor menu, select **Monitoring Plans**. + +**Step 2** – Select your User Activity monitoring plan and click **Edit**. + +**Step 3** – Click **Edit Data Source** in the right pane, then select **Monitored Computers**. + +## Overview + +When you add computers to a monitoring plan using an IP range or an AD container, Netwrix Auditor resolves and tracks each host individually. The Monitored Computers tab lists all resolved computers with their current health status, so you can immediately see which hosts are collecting data normally and which ones require your attention. + +**NOTE:** The Monitored Computers tab doesn't display computers that you exclude from monitoring with the **Exclude these objects** or **Exclude subranges** setting in the item settings. + +![Monitored Computers tab with details for a selected computer](/images/auditor/10.9/admin/monitoringplans/useractivity/monitored-computers-details1.webp) + +## Monitored Computers Grid + +The grid displays the following columns for each computer: + +| Column | Description | +|---|---| +| **Name** | The hostname or IP address of the monitored computer. | +| **Item** | The source that included this computer in the plan — for example, an IP address, an IP range, or an AD container (OU). | +| **Status** | A consolidated status indicator for the computer. | +| **Last Activity Time** | The timestamp of the last time the service interacted with the computer. | + +## Filtering and Search + +**Search field** — Enter text in the search field in the upper-right corner to filter the list of computers. The search matches entries in the **Name**, **Item**, and **Status** fields. It's case-insensitive and supports partial matches — for example, entering `old` returns computers whose **Name**, **Item**, or **Status** field contains that substring. Press **Enter** to refresh the results. + +**Filters** — Click **Filters** to open the Apply Filters dialog, where you can filter by: + +- **Status** — Select one or more statuses from the dropdown list to show only computers in those states. +- **Name** — Enter a partial or full computer name. +- **Items** — Select one or more items (IP ranges, OUs, or individual computers) from the dropdown list. + +![Apply Filters dialog showing Computer status, Computer name, and Item name options](/images/auditor/10.9/admin/monitoringplans/useractivity/monitored-computers-filter.webp) + +You can combine search and filters. The label next to **Filters** shows a summary of the active filters. To remove all active filters at once, click **Clear All** in the Filters dialog. + +## Exporting the List + +Click **Export** above the grid to save the displayed computers to a file. The export respects any active search term and filters, and includes the following columns: **Name**, **Item**, **Status**, and **Last Activity Time**. + +## Related Topics + +- [Monitoring Plans — User Activity](/docs/auditor/10.9/admin/monitoringplans/useractivity/overview.md) +- [Add Items for Monitoring](/docs/auditor/10.9/admin/monitoringplans/datasources.md#add-items-for-monitoring) diff --git a/docs/auditor/10.9/admin/monitoringplans/overview_1.md b/docs/auditor/10.9/admin/monitoringplans/useractivity/overview.md similarity index 83% rename from docs/auditor/10.9/admin/monitoringplans/overview_1.md rename to docs/auditor/10.9/admin/monitoringplans/useractivity/overview.md index ad47f91cad..1859949582 100644 --- a/docs/auditor/10.9/admin/monitoringplans/overview_1.md +++ b/docs/auditor/10.9/admin/monitoringplans/useractivity/overview.md @@ -6,8 +6,8 @@ sidebar_position: 180 # User Activity -**NOTE:** Prior to configuring your monitoring plan, please read and complete the instructions in -the following topics: +**NOTE:** Before you configure your monitoring plan, read the following topics and complete the +instructions in them: - [Protocols and Ports Required](/docs/auditor/10.9/requirements/ports.md) – To ensure successful data collection and activity monitoring configure necessary protocols and ports for inbound and @@ -24,18 +24,18 @@ Complete the following fields: | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | General | | | Monitor this data source and collect activity data | Enable monitoring of the selected data source and configure Auditor to collect and store audit data. | -| Notify users about activity monitoring | You can enable the message that will be displayed when a user logs in and specify the message text. | -| Record video of user activity within sessions | - If disabled, only user session events will be collected (regardless of whether the user is idle or not). - If enabled, the product will both collect user session events and record video of user activity. By default, this option is disabled. | +| Notify users about activity monitoring | You can enable the message that appears when a user logs in and specify the message text. | +| Record video of user activity within sessions | - If disabled, the product collects only user session events (regardless of whether the user is idle). - If enabled, the product both collects user session events and records video of user activity. By default, this option is disabled. | | Video Recording For these settings to become effective, enable video recording on the General tab. | | | Adjust video quality | Optimize video file by adjusting the following: - File size and video quality - Save video in grayscale - CPU load and Video smoothness. | -| Adjust video duration | Limit video file length by adjusting the following: - Recording lasts for `<...>` minutes—Video recording will be stopped after the selected time period. - User has been idle for `<...>` minutes—Video recording will be stopped if a user is considered inactive during the selected time period. If the Record video of user activity within sessions option is enabled, the User Sessions report shows active time calculated without including user idle period. Mind that a computer is considered to be idle by Windows if there has not been user interaction via the mouse or keyboard for a given time and if the hard drives and processors have been idle more than 90% of that time. - Free disk space is less than `<...>` MB—Video recording will be stopped when upon reaching selected disk space limit. - Consider user activity — Select one of the following: - Stop if user has been idle for `<...>` minutes. Select if you want video recording for a user to be stopped after the specified time period. - Continue video recording regardless of the user idle state. When selected, Netwrix Auditor continues video recording for idle users. | +| Adjust video duration | Limit video file length by adjusting the following: - Recording lasts for `<...>` minutes—Netwrix Auditor stops video recording after the selected time period. - User has been idle for `<...>` minutes—Netwrix Auditor stops video recording if a user is inactive during the selected time period. If the Record video of user activity within sessions option is enabled, the User Sessions report shows active time that excludes the user idle period. Windows treats a computer as idle if the user hasn't interacted with the mouse or keyboard for a given time and if the hard drives and processors have been idle more than 90% of that time. - Free disk space is less than `<...>` MB—Netwrix Auditor stops video recording upon reaching the selected disk space limit. - Consider user activity — Select one of the following: - Stop if user has been idle for `<...>` minutes. Select this option if you want Netwrix Auditor to stop video recording for a user after the specified time period. - Continue video recording regardless of the user idle state. When selected, Netwrix Auditor continues video recording for idle users. | | Set a retention period to clear stale videos | When the selected retention period is over, Netwrix Auditor deletes your video recordings. | | Users | | -| Specify users to track their activity | Select the users whose activity should be recorded. You can select **All users** or create a list of **Specific users or user groups**. Certain users can also be added to **Exceptions** list. | +| Specify users to track their activity | Select the users whose activity you want to record. You can select **All users** or create a list of **Specific users or user groups**. You can also add certain users to the **Exceptions** list. | | Applications | | -| Specify applications you want to track | Select the applications that you want to monitor. You can select All applications or create a list of Specific applications. Certain applications can also be added to Exceptions list. | +| Specify applications you want to track | Select the applications that you want to monitor. You can select All applications or create a list of Specific applications. You can also add certain applications to the Exceptions list. | | Monitored Computers | | -| For a newly created monitoring plan for User Activity, the list of monitored computers is empty. Add items to your monitoring plan and wait until Netwrix Auditor retrieves all computers within these items. See [Add Items for Monitoring](/docs/auditor/10.9/admin/monitoringplans/datasources.md#add-items-for-monitoring)for more information. The list contains computer name, its current status and last activity time. | | +| For a newly created monitoring plan for User Activity, the list of monitored computers is empty. Add items to your monitoring plan and wait until Netwrix Auditor retrieves all computers within these items. See [Add Items for Monitoring](/docs/auditor/10.9/admin/monitoringplans/datasources.md#add-items-for-monitoring) for the item types each data source supports and the steps for adding them. The list contains computer name, its current status and last activity time. | | Review your data source settings and click **Add** to go back to your plan. The newly created data source will appear in the **Data source** list. As a next step, click **Add item** to specify an @@ -45,13 +45,13 @@ information. ## How to Include/Exclude Applications -To create a list of application to include in / exclude from monitoring, you will need to provide: +To create a list of applications to include in or exclude from monitoring, provide the following: - Title — application title as shown on top of the application window, for example, **MonthlyReport.docx - Word**. - - Title can also be found in the "_What_" column of related Netwrix Auditor reports and search - results, for example, in the **User Sessions** report. + - You can also find the title in the "_What_" column of related Netwrix Auditor reports and + search results, for example, in the **User Sessions** report. - Description — as shown in the Description column on theDetails tab of Windows Task Manager. @@ -65,7 +65,7 @@ To create a list of inclusions / exclusions for applications: **Step 2 –** Enter application title and description you have identified. -Wildcards (\*?) are supported and applied as follows: +Netwrix Auditor supports wildcards (\*?) and applies them as follows: - _\* - Notepad_ (the "Title" filter) will exclude all Notepad windows. - _colo?r \*_ (the "Title" filter) will exclude all application window titles containing "_color_" @@ -88,8 +88,8 @@ To exclude the Notepad application window with "_Document1_" open, add the follo ## Computer For evaluation purposes, Netwrix recommends selecting Computer as an item for a monitoring plan. -Once the product is configured to collect data from the specified items, audit settings (including -Core and Compression services installation) will be applied to all computers within AD Container or +After you configure the product to collect data from the specified items, it applies audit settings (including +Core and Compression services installation) to all computers within the AD Container or IP Range. Complete the following fields: @@ -97,8 +97,8 @@ Complete the following fields: | Option | Description | | --------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | General | | -| Specify a computer | Provide a server name by entering its FQDN, NETBIOS or IPv4 address. You can click Browse to select a computer from the list of computers in your network. | -| Specify the account for collecting data | Select the account that will be used to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select account type you want to use and enter credentials. The following choices are available: - User/password. The account must be granted the same permissions and access rights as the default account used for data collection. See the [Data Collecting Account](/docs/auditor/10.9/admin/monitoringplans/dataaccounts.md) topic for additional information. - Group Managed Service Account (gMSA). You should specify only the account name in the domain\account$ format. See the [Use Group Managed Service Account (gMSA)](/docs/auditor/10.9/requirements/gmsa.md) topic for additional information. | +| Specify a computer | Provide a server name by entering its FQDN, NETBIOS, or IPv4 address. You can click Browse to select a computer from the list of computers in your network. | +| Specify the account for collecting data | Select the account that Netwrix Auditor will use to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select account type you want to use and enter credentials. The following choices are available: - User/password. The account must have the same permissions and access rights as the default account used for data collection. See the [Data Collecting Account](/docs/auditor/10.9/admin/monitoringplans/dataaccounts.md) topic for additional information. - Group Managed Service Account (gMSA). You should specify only the account name in the domain\account$ format. See the [Use Group Managed Service Account (gMSA)](/docs/auditor/10.9/requirements/gmsa.md) topic for additional information. | ## IP Range @@ -108,8 +108,8 @@ Complete the following fields: | --------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | General | | | Specify IP range | Specify an IP range for the audited computers. To exclude computers from within the specified range, click **Exclude**. Enter the IP subrange you want to exclude, and click **Add**. | -| Specify the account for collecting data | Select the account that will be used to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select **Custom account** and enter credentials. The credentials are case sensitive. A custom account must be granted the same permissions and access rights as the default account used for data collection. See the [Data Collecting Account](/docs/auditor/10.9/admin/monitoringplans/dataaccounts.md) topic for additional information. | -| Specify monitoring restrictions | Specify restriction filters to narrow your monitoring scope (search results, reports and Activity Summaries). To exclude specific IP subranges from data collection, click **Exclude** next to the IP range fields. In the **Exclude Subranges** dialog, specify the **Start IP** and **End IP** for each subrange you want to exclude. Click **+ Add** to add more subranges. Exclusions apply only to the specific monitoring plan item in which they are configured. | +| Specify the account for collecting data | Select the account that Netwrix Auditor will use to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select **Custom account** and enter credentials. The credentials are case sensitive. A custom account must have the same permissions and access rights as the default account used for data collection. See the [Data Collecting Account](/docs/auditor/10.9/admin/monitoringplans/dataaccounts.md) topic for additional information. | +| Specify monitoring restrictions | Specify restriction filters to narrow your monitoring scope (search results, reports, and Activity Summaries). To exclude specific IP subranges from data collection, click **Exclude** next to the IP range fields. In the **Exclude Subranges** dialog, specify the **Start IP** and **End IP** for each subrange you want to exclude. Click **+ Add** to add more subranges. Exclusions apply only to the specific monitoring plan item where you configure them. | ## AD Container @@ -118,6 +118,6 @@ Complete the following fields: | Option | Description | | --------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | General | | -| Specify AD container | Specify a whole AD domain, OU or container. Click **Browse** to select from the list of containers in your network. You can also: - Select a particular computer type to be audited within the chosen AD container: **Domain controllers, Servers (excluding domain controllers)**, or **Workstations**. - Click **Exclude** to specify AD domains, OUs, and containers you do not want to audit. In the Exclude Containers dialog, click Add and specify an object. The list of containers does not include child domains of trusted domains. Use other options **(Computer, IP range** to specify the target computers. | -| Specify the account for collecting data | Select the account that will be used to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select **Custom account** and enter credentials. The credentials are case sensitive. If using a group Managed Service Account (gMSA), you can specify only the account name in the _domain\account$_ format. Password field can be empty. A custom account must be granted the same permissions and access rights as the default account used for data collection. See the[Data Collecting Account](/docs/auditor/10.9/admin/monitoringplans/dataaccounts.md) topic for additional information. | -| Specify monitoring restrictions | Specify restriction filters to narrow your monitoring scope (search results, reports and Activity Summaries). All filters are applied using AND logic. Depending on the type of the object you want to exclude, select one of the following: - **Add AD Container** – Browse for a container to be excluded from being audited. You can select a whole AD domain, OU or container. - **Add Computer** – Provide the name of the computer you want to exclude as shown in the "Where" column of reports and Activity Summaries. For example, backupsrv01.mydomain.local. Wildcards (*) are not supported. | \ No newline at end of file +| Specify AD container | Specify a whole AD domain, OU, or container. Click **Browse** to select from the list of containers in your network. You can also: - Select a particular computer type to audit within the chosen AD container: **Domain controllers, Servers (excluding domain controllers)**, or **Workstations**. - Click **Exclude** to specify AD domains, OUs, and containers you don't want to audit. In the Exclude Containers dialog, click Add and specify an object. The list of containers doesn't include child domains of trusted domains. Use other options **(Computer, IP range** to specify the target computers. | +| Specify the account for collecting data | Select the account that Netwrix Auditor will use to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select **Custom account** and enter credentials. The credentials are case sensitive. If using a group Managed Service Account (gMSA), you can specify only the account name in the _domain\account$_ format. Password field can be empty. A custom account must have the same permissions and access rights as the default account used for data collection. See the[Data Collecting Account](/docs/auditor/10.9/admin/monitoringplans/dataaccounts.md) topic for additional information. | +| Specify monitoring restrictions | Specify restriction filters to narrow your monitoring scope (search results, reports, and Activity Summaries). Netwrix Auditor applies all filters using AND logic. Depending on the type of the object you want to exclude, select one of the following: - **Add AD Container** – Browse for a container to exclude from auditing. You can select a whole AD domain, OU, or container. - **Add Computer** – Provide the name of the computer you want to exclude as shown in the "Where" column of reports and Activity Summaries. For example, backupsrv01.mydomain.local. Wildcards (*) aren't supported. | diff --git a/docs/auditor/10.9/admin/settings/longtermarchive.md b/docs/auditor/10.9/admin/settings/longtermarchive.md index 232f455e57..51b730a0c8 100644 --- a/docs/auditor/10.9/admin/settings/longtermarchive.md +++ b/docs/auditor/10.9/admin/settings/longtermarchive.md @@ -6,8 +6,8 @@ sidebar_position: 30 # Long-Term Archive -The Long-Term Archive is configured by default, irrespective of your subscription plan and settings -you specified when configuring a monitoring plan. To review and update your Long-Term Archive +Netwrix Auditor configures the Long-Term Archive by default, irrespective of your subscription plan +and the settings you specified when configuring a monitoring plan. To review and update your Long-Term Archive settings, navigate to **Settings** > **Long-Term Archive** and click Modify. ![lta_settings_thumb_0_0](/images/auditor/10.9/admin/settings/lta_settings_thumb_0_0.webp) @@ -17,9 +17,9 @@ Review the following for additional information: | Option | Description | | ------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Long-Term Archive settings | | -| Write audit data to | Specify the path to a local or shared folder where your audit data will be stored. By default, it is set to _"C:\ProgramData\Netwrix Auditor\Data"_. By default, the LocalSystem account is used to write data to the local-based Long-Term Archive and computer account is used for the file share-based storage. Subscriptions created in the Auditor client are uploaded to file servers under the Long-Term Archive service account as well. It is not recommended to store your Long-Term Archive on a system disk. If you want to move the Long-Term Archive to another location, refer to the following Netwrix Knowledge base article: [How to move Long-Term Archive to a new location](/docs/kb/auditor/features-and-operations/glossaries-and-faqs/how-to-move-long-term-archive-to-a-new-location). | -| Keep audit data for (in months) | Specify how long data will be stored. By default, it is set to 120 months. | -| Use custom credentials (for the file share-based Long-Term Archive only) | Select the checkbox and provide user name and password for the Long-Term Archive service account. You can specify a custom account only for the Long-Term Archive stored on a file share. The custom Long-Term Archive service account can be granted the following rights and permissions: - Advanced permissions on the folder where the Long-term Archive is stored: - List folder / read data - Read attributes - Read extended attributes - Create files / write data - Create folders / append data - Write attributes - Write extended attributes - Delete subfolders and files - Read permissions - On the file shares where report subscriptions are saved: - Change share permission - Create files / write data folder permission Subscriptions created in the Auditor client  are uploaded to file servers under the Long-Term Archive service account as well. See the [Subscriptions](/docs/auditor/10.9/admin/subscriptions/overview.md) topic for additional information. | +| Write audit data to | Specify the path to a local or shared folder where Netwrix Auditor will store your audit data. By default, the path is _"C:\ProgramData\Netwrix Auditor\Data"_. By default, Netwrix Auditor uses the LocalSystem account to write data to the local-based Long-Term Archive and the computer account for the file share-based storage. Netwrix Auditor also uploads subscriptions created in the Auditor client to file servers under the Long-Term Archive service account. Netwrix doesn't recommend storing your Long-Term Archive on a system disk. To move the Long-Term Archive to another location, see the Netwrix Knowledge base article: [How to move Long-Term Archive to a new location](/docs/kb/auditor/features-and-operations/glossaries-and-faqs/how-to-move-long-term-archive-to-a-new-location). | +| Keep audit data for (in months) | Specify how long Netwrix Auditor stores data. The default is 120 months. | +| Use custom credentials (for the file share-based Long-Term Archive only) | Select the checkbox and provide user name and password for the Long-Term Archive service account. You can specify a custom account only for the Long-Term Archive stored on a file share. You can grant the custom Long-Term Archive service account the following rights and permissions: - Advanced permissions on the folder where Netwrix Auditor stores the Long-Term Archive: - List folder / read data - Read attributes - Read extended attributes - Create files / write data - Create folders / append data - Write attributes - Write extended attributes - Delete subfolders and files - Read permissions - On the file shares where Netwrix Auditor saves report subscriptions: - Change share permission - Create files / write data folder permission Netwrix Auditor also uploads subscriptions created in the Auditor client  to file servers under the Long-Term Archive service account. See the [Subscriptions](/docs/auditor/10.9/admin/subscriptions/overview.md) topic for additional information. | Setting Recording Settings @@ -27,11 +27,11 @@ Setting Recording Settings | | | | ----------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -| Configure custom location of session recordings | Default location for storing session recordings is set to _"\\``\Netwrix_UAVR$"_. However, storing extra files on the Auditor Server may produce additional load on it, so consider using this option to specify another location where session recordings will be stored. | -| Enter UNC path to shared folder: | Specify UNC path to the shared folder where user session video recordings will be stored. You can use server name or IP address, for example: _\\172.28.6.33\NA_UserSessions_ Using a local folder for that purpose is not recommended, as storing extra files on the Auditor Server will produce additional load on it. Make sure the specified shared folder has enough capacity to store the video files. Retention period for the video files can be adjusted in the related monitoring plan settings (targeted at User Activity data source); default retention is 7 days. See the [User Activity](/docs/auditor/10.9/admin/monitoringplans/overview_1.md) topic for additional information. After you specify and save settings for session recordings, it is recommended that you leave them unchanged. Otherwise — if you change the storage location while using Netwrix Auditor for User Activity — please be aware of possible data loss, as Auditor will not automatically move session recordings to a new location. | -| User name / Password | Provide user name and password for the account that will be used to store session recordings to the specified shared folder. Make sure the account has at least the Write permission for that folder. | +| Configure custom location of session recordings | The default location for storing session recordings is _"\\``\Netwrix_UAVR$"_. However, storing extra files on the Auditor Server may produce additional load on it, so consider using this option to specify another location where Netwrix Auditor stores session recordings. | +| Enter UNC path to shared folder: | Specify UNC path to the shared folder where Netwrix Auditor will store user session video recordings. You can use server name or IP address, for example: _\\172.28.6.33\NA_UserSessions_ Netwrix doesn't recommend using a local folder for that purpose, as storing extra files on the Auditor Server produces additional load on it. ensure the specified shared folder has enough capacity to store the video files. You can adjust the retention period for the video files in the related monitoring plan settings (targeted at User Activity data source); default retention is 7 days. See the [User Activity](/docs/auditor/10.9/admin/monitoringplans/useractivity/overview.md) topic for additional information. After you specify and save settings for session recordings, leave them unchanged. Otherwise — if you change the storage location while using Netwrix Auditor for User Activity — be aware of possible data loss, as Auditor will not automatically move session recordings to a new location. | +| User name / Password | Provide user name and password for the account that Netwrix Auditor will use to store session recordings to the specified shared folder. ensure the account has at least the Write permission for that folder. | Auditor informs you if you are running out of space on a system disk where the Long-Term Archive is -stored by default. You will see events in the Netwrix Auditor **System Health** log once the free -disk space starts approaching minimum level. When the free disk space is less than 3 GB, the -Netwrix services responsible for audit data collection will be stopped. +stored by default. You will see events in the Netwrix Auditor **System Health** log when the free +disk space starts approaching the minimum level. When the free disk space is less than 3 GB, Auditor +stops the Netwrix services responsible for audit data collection. diff --git a/docs/auditor/10.9/api/prerequisites.md b/docs/auditor/10.9/api/prerequisites.md index 519b63fe1b..d322e6f7b5 100644 --- a/docs/auditor/10.9/api/prerequisites.md +++ b/docs/auditor/10.9/api/prerequisites.md @@ -6,38 +6,35 @@ sidebar_position: 10 # Prerequisites -Netwrix Auditor Integration API uses HTTPS for communication with the automatically generated +Netwrix Auditor Integration API uses HTTPS (Hypertext Transfer Protocol Secure) for communication with the automatically generated certificate. The default communication port is 9699. Refer to the [Security](/docs/auditor/10.9/api/security.md) topic for detailed instructions on how to disable HTTPS and manage other API settings. -## Configure Integration API Settings +## Configure Integration API settings -Follow the steps to change the port. +On this page, you can view the current port settings and restrictions on the TLS (Transport Layer Security) version used for encrypted connections. -**Step 1 –** In the Netwrix Auditor main window, navigate to the Integration tile. - -**Step 2 –** Make sure the Leverage Integration API option is enabled. - -**Step 3 –** Click Modify under the API settings section and specify a port number. Windows firewall -rule will be automatically created. - -**Step 4 –** If you use a third-party firewall, you must create a rule for inbound connections -manually. +1. In the Netwrix Auditor main window, navigate to the **Integration** tile. +2. Ensure the **Leverage Integration API** option is enabled. +3. Click **Modify settings** under the API settings section. +4. Specify a port number. The product automatically creates a Windows firewall rule. +5. Select the minimum TLS version from the list. For a new installation, this defaults to 1.2. +6. If you use a third-party firewall, create a rule for inbound connections manually. ![Integration API Settings](/images/auditor/10.9/addon/connectwise/integrations_thumb_0_0.webp) -## Configure Audit Database Settings +## Configure Audit Database settings When you first configure the Audit Database settings in Netwrix Auditor, the product also creates -several databases for special purposes, including Netwrix_Auditor_API. This database is designed to -store data imported from the other sources using Netwrix Auditor Integration API. +several databases for special purposes, including `Netwrix_Auditor_API`. This database stores data +imported from other sources through Netwrix Auditor Integration API. -Make sure that the Audit Database settings are configured in Netwrix Auditor. To check or configure -these settings, navigate to the **Settings > Audit Database**. +Ensure that you have configured the Audit Database settings in Netwrix Auditor. To check or configure +these settings, navigate to **Settings** > **Audit Database**. -You cannot use Netwrix Auditor Integration API without configuring the Audit Database. +Netwrix Auditor Integration API requires a configured Audit Database. Refer to the [Audit Database](/docs/auditor/10.9/admin/settings/auditdatabase.md) topic for detailed instructions on how to configure SQL Server settings. diff --git a/docs/auditor/10.9/api/security.md b/docs/auditor/10.9/api/security.md index aba998bef3..66134b9cb8 100644 --- a/docs/auditor/10.9/api/security.md +++ b/docs/auditor/10.9/api/security.md @@ -7,39 +7,40 @@ sidebar_position: 120 # Security By default, Netwrix Auditor API uses HTTPS for sending requests to its endpoints. Netwrix encrypts -data with a self-signed automatically generated SSL certificate and strongly recommends you to +data with a self-signed automatically generated SSL (Secure Sockets Layer) certificate and strongly recommends that you replace it with a new secured certificate acquired from any reliable source. -The automatically generated Netwrix API certificate is located in the Personal store. To enable +The automatically generated Netwrix API certificate resides in the Personal store. To enable trust on remote computers, install this certificate in the Trusted Root Certification Authorities store. ![certificatestore_thumb_0_0](/images/auditor/10.7/api/certificatestore_thumb_0_0.webp) -To manage API security settings with APIAdminTool.exe +## Manage API security settings with `APIAdminTool.exe` -Netwrix provides a command-line tool for managing Integration API. The tool allows switching between -HTTP and HTTPS, assigning new certificates, etc. +Netwrix provides a command-line tool for managing Integration API. Use the tool to switch between +HTTP and HTTPS, assign new certificates, and manage other API settings. -1. On the computer where Auditor Server resides, start the Command Prompt and run the tool. The tool - is located in the _Netwrix Auditor installation folder_, inside the _Audit Core_ folder. For +1. On the computer where Auditor Server resides, start the Command Prompt. +2. Navigate to the Netwrix Auditor installation folder, inside the Audit Core folder, and run the tool. For example: `C:\>cd C:\Program Files (x86)\Netwrix Auditor\Audit Core` `C:\Program Files (x86)\Netwrix Auditor\Audit Core>APIAdminTool.exe` -2. Execute one of the following commands depending on your task. Review the tips for running the +3. Execute one of the following commands depending on your task. Review the tips for running the tool: - - Some commands require parameters. Provide parameters with values (parameter= value) if you - want to use non-default. E.g., `APIAdminTool.exe api http port= 4431`. - - Append `help `to any command to see available parameters and sub-commands. E.g., + - Some commands require parameters. Provide parameters with values (parameter= value) to use + non-default values. E.g., `APIAdminTool.exe api http port= 4431`. + - Append `help` to any command to see available parameters and sub-commands. E.g., `APIAdminTool.exe api help`. -| To... | Execute... | -| ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| Disable API | `APIAdminTool.exe api disable` This command duplicates the checkbox on the Integrations page in Netwrix Auditor. | -| Switch to HTTP | `APIAdminTool.exe api http` Netwrix recommends switching to HTTP only in safe intranet environments. To use a non-default port (9699), append a parameter port with value to the command above (e.g.,` port= 4431`). | -| Switch to HTTPS | `APIAdminTool.exe api https` Run this command if you want to continue using Netwrix-generated certificate. To use a non-default port (9699), append a parameter port with value to the command above (e.g., `port= 4431`). | -| Assign a new SSL certificate | `APIAdminTool.exe api https certificate` Run this command if you want to apply a new certificate and use it instead default. You must add a certificate to the store before running this command. Provide parameters to specify a certificate: | +| To... | Execute... | +| ---------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| Disable API | `APIAdminTool.exe api disable` This command duplicates the checkbox on the Integrations page in Netwrix Auditor. | +| Switch to HTTP | `APIAdminTool.exe api http` Netwrix recommends switching to HTTP only in safe intranet environments. To use a non-default port (9699), append the port parameter with a value to this command (e.g., `port= 4431`). | +| Switch to HTTPS | `APIAdminTool.exe api https` Run this command to continue using the Netwrix-generated certificate. To use a non-default port (9699), append the port parameter with a value to this command (e.g., `port= 4431`). | +| Assign a new SSL certificate | `APIAdminTool.exe api https certificate` Run this command to apply a new certificate instead of the default. You must add a certificate to the store before running this command. Provide parameters to specify a certificate: | +| Set the minimum TLS version | `APIAdminTool.exe api https minTlsVersion` Use this command to set the minimum version of TLS (Transport Layer Security) used when connecting (e.g., `minTlsVersion= 1.2`) | diff --git a/docs/auditor/10.9/configuration/azurefiles/overview.md b/docs/auditor/10.9/configuration/azurefiles/overview.md index 0199776f89..060003b337 100644 --- a/docs/auditor/10.9/configuration/azurefiles/overview.md +++ b/docs/auditor/10.9/configuration/azurefiles/overview.md @@ -65,6 +65,8 @@ Register an application so Netwrix Auditor can authenticate to Azure and read au **Note:** Switching audiences later may cause errors +**Recommendation:** Use a separate, dedicated application for Azure Files data collection rather than reusing an application for other purposes. By default, Netwrix Auditor omits its own collection application's activity from auditing — if the collection app is shared with other workloads, that other activity will not be captured. + ### Step 2: Gather App Details @@ -102,6 +104,7 @@ The Purpose column references Microsoft Graph API endpoints that Netwrix Auditor | `User.Read` | Basic user information. Sign in and read user profile. *(default)* | | `User.Read.All` | Read all users' full profiles. Required to resolve user security identifiers (SIDs) into display names and User Principal Names (UPNs), and to map access control entries (ACEs) from group membership via the Microsoft Graph endpoint `/users/{id}/transitiveMemberOf` | | `Group.Read.All` | Resolve groups and search by SID from discretionary access control lists (DACLs). Required to expand group membership via the Microsoft Graph endpoint `/groups/{id}/transitiveMembers` and filter groups by `securityIdentifier` | +| `Application.Read.All` | Resolve service principal (application) identities in audit records. Required when file or folder activity is performed by a service principal rather than a user — these objects have no SID and no UPN, so they cannot be resolved by `User.Read.All` or `Group.Read.All`. Without this permission, such records show a raw object ID instead of a display name, and the collector logs a "no SID and no UPN available to resolve the identity" error in the monitoring plan log. | 1. In your app in EntraID, go to **Manage > API permissions > + Add a permission**. @@ -110,10 +113,12 @@ The Purpose column references Microsoft Graph API endpoints that Netwrix Auditor - **User.Read (default)** - **User.Read.All** - **Group.Read.All** + - **Application.Read.All** - *User.Read* – "Sign in and read user profile." *(default)* - *User.Read.All* – "Read all users' full profiles" - *Group.Read.All* – "Read all groups" +- *Application.Read.All* – "Read all applications" — required to resolve service principal display names ### Step 2: Grant Admin Consent @@ -122,10 +127,11 @@ Click **Grant admin consent for TenantName** **Why this is required:** - By default, applications cannot query Microsoft Graph for directory-wide information -- Admin consent allows the app to use **User.Read.All** and **Group.Read.All** +- Admin consent allows the app to use **User.Read.All**, **Group.Read.All**, and **Application.Read.All** - **User.Read.All** lets Netwrix Auditor query Microsoft Entra ID and resolve **user SIDs → user accounts → display names** - **Group.Read.All** lets Netwrix Auditor resolve groups from DACLs and expand group membership so reports show which users inherit access through group ACEs -- Without admin consent, audit logs will only show unresolved SIDs and object IDs instead of usernames and group names, making reports incomplete and less useful +- **Application.Read.All** lets Netwrix Auditor resolve **service principal (application) identities** that have no SID and no UPN, so activity performed by applications — not just users — shows a display name instead of a raw object ID +- Without admin consent, audit logs will only show unresolved SIDs and object IDs instead of usernames, group names, and application names, making reports incomplete and less useful **At the end of this step, your app has granted Microsoft Graph API permissions** @@ -242,7 +248,7 @@ Azure Files audit logs will now be archived into your **Log Storage Account** ## Checklist - [Azure Application registered](#azure-application-registration) with App ID + Secret -- [API permissions](#configure-api-permissions) (User.Read, User.Read.All, Group.Read.All) granted +- [API permissions](#configure-api-permissions) (User.Read, User.Read.All, Group.Read.All, Application.Read.All) granted - [IAM roles assigned](#assign-iam-roles-to-the-app) (Reader, Storage File Data Privileged Reader, Storage Blob Data Reader) - [Diagnostic Settings configured](#diagnostic-settings) to log to a Log Storage Account diff --git a/docs/auditor/10.9/configuration/azurefiles/stateintime.md b/docs/auditor/10.9/configuration/azurefiles/stateintime.md index 4caf72fca2..0795a3f245 100644 --- a/docs/auditor/10.9/configuration/azurefiles/stateintime.md +++ b/docs/auditor/10.9/configuration/azurefiles/stateintime.md @@ -2,12 +2,7 @@ This topic describes how to enable State-in-Time data collection for an Azure Files monitoring plan in Netwrix Auditor, configure the monitoring scope using omit lists, and set up optional Azure diagnostic settings for activity-based reports. -> **Note:** When Azure file shares use on-premises Active Directory (AD DS) authentication, the following limitations apply to State-in-Time permission reports: -> -> - **Group expansion is unavailable for on-premises AD groups that are not synced to Microsoft Entra ID.** If access to a file or folder is granted through such a group, the report does not list individual group members. -> - **SID resolution is unavailable for on-premises AD groups and accounts that are not synced to Microsoft Entra ID.** These objects appear as unresolved SIDs instead of display names in permission reports. -> -> These limitations do not affect environments that use Microsoft Entra ID-only identities or fully synced hybrid identities. +> **Note:** By default, Azure Files permission reports display only users and groups that you migrated to Entra ID from a local Windows domain and added directly to role-based access control (RBAC) or New Technology File System (NTFS) permissions. The reports don't display users who gain access through built-in (well-known) domain or Azure groups. To see all accounts that receive access rights through any groups, enable Active Directory integration. See [Configuring Active Directory integration (optional)](#configuring-active-directory-integration-optional). ## Prerequisites @@ -31,16 +26,39 @@ After you save the monitoring plan, Netwrix Auditor will begin collecting State- > **Note:** Netwrix Auditor collects the first snapshot at the next scheduled run. Reports won't contain data until then. +## Configuring Active Directory integration (optional) + +By default, Azure Files permission reports display only users and groups that you migrated to Entra ID from a local Windows domain and added directly to RBAC or NTFS permissions. The reports don't display users who gain access through built-in (well-known) domain or Azure groups. If your environment uses on-premises Active Directory (AD DS), you can provide read-only AD credentials so that Netwrix Auditor can: + +- Resolve display names for on-premises accounts not synced to Microsoft Entra ID. +- List individual members of on-premises AD groups (including members of nested groups, resolved transitively) as separate rows in permission reports. + +If you don't provide credentials, report output remains identical to earlier versions — this capability is optional and additive. + +**To configure Active Directory integration:** + +1. In Netwrix Auditor, navigate to **Configuration → Monitoring Plans**. +2. Select the Azure Files monitoring plan and click **Edit**. +3. Open a monitored item (Azure Subscription or Azure Storage Account) and click **Edit**. +4. Go to the **Active Directory Integration** tab. (The **Learn more…** link on this tab points to this section.) +5. Turn on the toggle under **Specify Active Directory account**. +6. In the **User name** field, enter an AD account with read access to Active Directory. Use the format `domain\user` or `user@domain.local`. +7. Enter the **Password** for the account. +8. Click **Save**. + +> **Note:** If Netwrix Auditor can't authenticate with the configured AD account, it records a collection error in the System Health log and continues snapshot collection using cloud-resolved identities only. Netwrix Auditor records transient AD connectivity issues as warnings and doesn't stop collection for these issues. + ## Configuring the monitoring scope (omit lists) Use omit lists to exclude specific folders or files from State-in-Time data collection, reducing collection time and storage requirements. -Netwrix Auditor for Azure Files supports two types of omit lists: +Netwrix Auditor for Azure Files supports three types of omit lists: | Omit list type | Scope | |----------------|-------| | **All** | Excludes objects from all data collection (activity and State-in-Time) | | **SiT** | Excludes objects from State-in-Time data collection only | +| **User Activity** | Excludes objects from activity data collection only | ### Configuring omit lists in the Netwrix Auditor UI @@ -82,7 +100,7 @@ By default, Netwrix Auditor collects State-in-Time snapshots daily. To customize ### Importing historical snapshots -Historical snapshots allow generating reports for past dates. A Global administrator must import historical snapshots. +Historical snapshots let you generate reports for past dates. A Global administrator must import historical snapshots. **To import a historical snapshot:** diff --git a/docs/auditor/10.9/tools/passwordexpirationnotifier/gmsa.md b/docs/auditor/10.9/tools/passwordexpirationnotifier/gmsa.md new file mode 100644 index 0000000000..6b015db01b --- /dev/null +++ b/docs/auditor/10.9/tools/passwordexpirationnotifier/gmsa.md @@ -0,0 +1,59 @@ +--- +title: "Use a Group Managed Service Account (gMSA)" +description: "Use a group Managed Service Account (gMSA) as the data collecting account for Password Expiration Notifier." +sidebar_position: 5 +--- + +# Use a Group Managed Service Account (gMSA) + +Password Expiration Notifier supports a group Managed Service Account (gMSA) as the data collecting account. With a gMSA, Active Directory generates and rotates the password automatically, so you don't maintain a password for the account or rotate it on a schedule. + +See the [Use Group Managed Service Account (gMSA)](/docs/auditor/10.9/requirements/gmsa.md) topic for the general prerequisites that apply to every Auditor data source: create the Key Distribution Services (KDS) root key, create the gMSA with the `New-ADServiceAccount` cmdlet, install it on the Auditor Server with `Install-ADServiceAccount`, and add it to the local **Administrators** group on the Auditor Server. + +After you complete those prerequisites, specify the gMSA in the Password Expiration Notifier monitoring plan. + +## Active Directory Permissions + +Password Expiration Notifier reads Active Directory user attributes to determine password and account expiration dates. The gMSA needs the following Active Directory permission: + +| Permission | Applies to | Purpose | +| ---------- | ---------- | ------- | +| `GenericRead` | User objects in the target OUs | Read `pwdLastSet`, `msDS-UserPasswordExpiryTimeComputed`, `accountExpires`, `userAccountControl`, `mail`, `manager`, `sAMAccountName`, and related attributes | + +:::note +In a default Active Directory configuration, the built-in **Authenticated Users** group has read access to user objects, and a gMSA inherits that access. You usually don't need additional delegation. If your domain restricts read access (for example, an administrator removed **Authenticated Users** from an OU's ACL), grant the gMSA membership in a group that has read access to the target OUs, or delegate read permissions to the gMSA directly through Active Directory Users and Computers. +::: + +## Specify the gMSA in the Monitoring Plan + +To use the gMSA in a Password Expiration Notifier monitoring plan: + +**Step 1 –** On the Auditor Server, launch Password Expiration Notifier and open an existing monitoring plan for editing, or create a new one. See the [Configure Password Expiration Alerting](/docs/auditor/10.9/tools/passwordexpirationnotifier/overview.md#configure-password-expiration-alerting) section for the full monitoring plan procedure. + +**Step 2 –** On the **General** tab, in the **User name** field, enter the gMSA account name in one of the supported formats: + +- `\$` — NetBIOS domain name and `sAMAccountName`, for example `CONTOSO\penGmsa$`. Netwrix recommends this format. +- `$@` — UPN format, for example `penGmsa$@contoso.local`. + +You must include the trailing `$`. Password Expiration Notifier uses the `$` to recognize the account as a gMSA and switch to the appropriate authentication path. + +**Step 3 –** Leave the **Password** field as it is. When you enter a gMSA name, Password Expiration Notifier locks the field automatically and displays `(Managed by Active Directory)`. Active Directory manages the password, so there is nothing to enter. + +**Step 4 –** Complete the remaining tabs of the monitoring plan and click **Save**. + +When you save the monitoring plan, Password Expiration Notifier creates a Windows scheduled task that runs the data collection under the `NT AUTHORITY\SYSTEM` account. The scheduled task performs the actual data collection and sends the notifications. + +## Limitations + +:::warning +The **Select OUs**, **Select Groups**, and **Generate** buttons in the Password Expiration Notifier UI don't work when a gMSA is configured. These buttons issue an LDAP request when you click them from the interactive session of the user who launched Password Expiration Notifier, and interactive sessions don't support gMSA impersonation. Use the scheduled task and the email reports to view password expiration data when the monitoring plan uses a gMSA. +::: + +## Troubleshooting + +The following table lists common issues you may encounter when configuring a gMSA for Password Expiration Notifier. + +| Symptom | Likely cause | Resolution | +| ------- | ------------ | ---------- | +| `Cannot find an account...` error when specifying the account | You entered the gMSA name without the trailing `$` or with the wrong domain. | Use the `\$` format, for example `CONTOSO\penGmsa$`. | +| The **Select OUs**, **Select Groups**, or **Generate** buttons don't work; the log shows `failed to create impersonation token` | Known gMSA limitation in interactive sessions. | See the Limitations section. Use the scheduled task and email reports instead. | diff --git a/docs/auditor/10.9/tools/passwordexpirationnotifier/overview.md b/docs/auditor/10.9/tools/passwordexpirationnotifier/overview.md index 267ab3abcb..e642d22da8 100644 --- a/docs/auditor/10.9/tools/passwordexpirationnotifier/overview.md +++ b/docs/auditor/10.9/tools/passwordexpirationnotifier/overview.md @@ -8,8 +8,8 @@ sidebar_position: 50 Netwrix Auditor Password Expiration Notifier standalone tool checks which domain accounts or passwords are about to expire in the specified number of days and sends notifications to users. It -also generates summary reports that can be delivered to system administrators and/or users' -managers. Besides, Netwrix Auditor Password Expiration Notifier allows checking the effects of a +also generates summary reports that it can deliver to system administrators and/or users' +managers. You can also use Netwrix Auditor Password Expiration Notifier to check the effects of a password policy change before applying it to the managed domain. - Windows Server 2025 @@ -25,15 +25,16 @@ Review the following for additional information: - Registry Key Configuration - [Password Expiration Notifier Ports](/docs/auditor/10.9/tools/passwordexpirationnotifier/ports.md) - [Password Expiration Monitoring Scope](/docs/auditor/10.9/tools/passwordexpirationnotifier/monitoringscope.md) +- [Use a Group Managed Service Account (gMSA)](/docs/auditor/10.9/tools/passwordexpirationnotifier/gmsa.md) ## Configure Password Expiration Alerting -Follow the steps to configure password expiration alerting. +To configure password expiration alerting: **Step 1 –** Navigate to **Start** > **Netwrix Auditor** > **Password Expiration Notifier**. -**Step 2 –** On the main page, you will be prompted to select a monitoring plan. Click Add to add a -new monitoring plan. +**Step 2 –** On the main page, Password Expiration Notifier prompts you to select a monitoring plan. +Click Add to add a new monitoring plan. **Step 3 –** Configure basic parameters as follows: @@ -47,39 +48,39 @@ new monitoring plan. | Option | Description | | -------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -| Specify account which will be used to collect data: - User name - Password | Enter the account which will be used for data collection. For a full list of the rights and permissions of this account, and instructions on how to configure them, refer to [Monitoring Plans](/docs/auditor/10.9/admin/monitoringplans/overview.md). | -| Filter users by organizational unit | To audit users for expiring accounts/passwords that belong to certain organizational units within your Active Directory domain, select this option and click Select OUs. In the dialog that opens, specify the OUs that you want to audit. Only users belonging to these OUs will be notified and included in the administrators and managers reports. | -| Filter users by group | To audit users for expiring accounts/passwords that belong to certain groups within your Active Directory domain, select this option and click Select Groups. In the dialog that opens, specify the groups that you want to audit. Only users belonging to these groups will be notified and included in the administrators and managers reports. | -| Filter by account name | Specify one or several user account names (e.g., \*John\*). Use semicolon to separate several names. Only user accounts that contain selected name will be notified and included in the administrators and managers reports. | +| Specify account which will be used to collect data: - User name - Password | Enter the account that Password Expiration Notifier will use for data collection. For a full list of the rights and permissions of this account, and instructions on how to configure them, refer to [Monitoring Plans](/docs/auditor/10.9/admin/monitoringplans/overview.md). To use a group Managed Service Account (gMSA) instead of a user account, see the [Use a Group Managed Service Account (gMSA)](/docs/auditor/10.9/tools/passwordexpirationnotifier/gmsa.md) topic. | +| Filter users by organizational unit | To audit users for expiring accounts/passwords that belong to certain organizational units within your Active Directory domain, select this option and click Select OUs. In the dialog that opens, specify the OUs that you want to audit. Password Expiration Notifier notifies only the users belonging to these OUs and includes only those users in the administrators and managers reports. | +| Filter users by group | To audit users for expiring accounts/passwords that belong to certain groups within your Active Directory domain, select this option and click Select Groups. In the dialog that opens, specify the groups that you want to audit. Password Expiration Notifier notifies only the users belonging to these groups and includes only those users in the administrators and managers reports. | +| Filter by account name | Specify one or several user account names (e.g., \*John\*). Use semicolon to separate several names. Password Expiration Notifier notifies only the user accounts that contain the selected name and includes only those accounts in the administrators and managers reports. | **Step 5 –** Navigate to the **Actions** tab and complete the following fields: | Option | Description | | --------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Send report to the users’ managers | Enable this option to deliver reports to the user’s managers. To review and edit the user's managers 1. Start **Active Directory Users and Computers**. 2. Navigate to each group where the user belongs to, right-click it and select Properties. 3. In the `` Properties dialog, select the Managed By tab and review a manager. Update it if necessary. To edit a report template, click **Customize**. You can use HTML tags when editing a template. | -| List users whose accounts or passwords expire in `<>` days or less | Specify the expiration period for accounts and/or passwords to be included in the administrators and managers reports. | -| Only report on users with expiring accounts | Select this option to deliver reports on users with expiring accounts only and ignore users whose passwords will be valid for a rather long time. | +| List users whose accounts or passwords expire in `<>` days or less | Specify the expiration period for accounts and passwords to include in the administrators and managers reports. | +| Only report on users with expiring accounts | Select this option to deliver reports on users with expiring accounts only and ignore users whose passwords remain valid for a long time. | | Notify users | Select this option to notify users that their passwords and/or accounts are about to expire. | -| Every day if password expires in `<>` days or less | Select this option for users to be notified daily that their passwords are going to expire, and specify the number of days before the expiration date. To edit a report template, click **Customize**. You can use HTML tags when editing a template. To send a test email, click **Test** and select an account. Make sure this account has a password that expires within the period you specified next to this option. | -| First/Second/Last time when password expires in `<>` days | Select this option for users to be notified three times, and specify the number of days before the expiration date for each of three notifications. To edit a report template, click **Customize**. You can use HTML tags when editing a template. To send a test email, click Test and select an account. Make sure this account has a password that expires within the period you specified next to this option. | -| Notify users by email every day if their accounts expire in `<>` days | Select this option for users to be notified daily that their account is going to expire, and specify the number of days before the expiration date. To send a test email, click **Test** and select an account. Make sure this account has a password that expires within the period you specified next to this option. | -| Notify users by text messages | Select this option for users to receive text messages if their passwords are about to expire. To edit SMS Notifications template, click Customize. - Every day if password expires in `<>` days or less — Select this option for users to be notified daily that their passwords are going to expire, and specify the number of days before the expiration date. - First/Second/Last time when password expires in `<>` days — Select this option for users to be notified three times, and specify the number of days before the expiration date for each of three notifications. - Provider name — Specify provider name. - Property name — Specify the name of the Active Directory User Property where the recipient's phone number is stored. Pager is the default property. If the Pager property of an AD User contains a full email address, Provider Name will be ignored. | +| Every day if password expires in `<>` days or less | Select this option to notify users daily that their passwords are going to expire, and specify the number of days before the expiration date. To edit a report template, click **Customize**. You can use HTML tags when editing a template. To send a test email, click **Test** and select an account. ensure this account has a password that expires within the period you specified next to this option. | +| First/Second/Last time when password expires in `<>` days | Select this option to notify users three times, and specify the number of days before the expiration date for each of three notifications. To edit a report template, click **Customize**. You can use HTML tags when editing a template. To send a test email, click Test and select an account. ensure this account has a password that expires within the period you specified next to this option. | +| Notify users by email every day if their accounts expire in `<>` days | Select this option to notify users daily that their accounts are going to expire, and specify the number of days before the expiration date. To send a test email, click **Test** and select an account. ensure this account has a password that expires within the period you specified next to this option. | +| Notify users by text messages | Select this option for users to receive text messages if their passwords are about to expire. To edit SMS Notifications template, click Customize. - Every day if password expires in `<>` days or less — Select this option to notify users daily that their passwords are going to expire, and specify the number of days before the expiration date. - First/Second/Last time when password expires in `<>` days — Select this option to notify users three times, and specify the number of days before the expiration date for each of three notifications. - Provider name — Specify provider name. - Property name — Specify the name of the Active Directory User Property that contains the recipient's phone number. Pager is the default property. If the Pager property of an AD User contains a full email address, Password Expiration Notifier ignores the Provider Name value. | **Step 6 –** Navigate to the **Notifications** tab and complete the following fields: | Option | Description | | --------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| Use Netwrix Auditor notification settings | Select this option if you want to use modern authentication. Please note that modern authentication must already be configured in the monitoring plan you are going to use. If you select this option, the fields below are not needed. | +| Use Netwrix Auditor notification settings | Select this option if you want to use modern authentication. You must already have configured modern authentication in the monitoring plan you are going to use. If you select this option, you don't need to complete the remaining fields. | | SMTP server | Enter your SMTP server address. It can be your company's Exchange server or any public mail server (e.g., Gmail, Yahoo). | | Port number | Specify your SMTP server port number. | -| Sender address | Enter the address that will appear in the From field. **_RECOMMENDED:_** click **Send Test Email**. The system will send a test message to the specified email address and inform you if any problems are detected. | +| Sender address | Enter the address that will appear in the From field. **_RECOMMENDED:_** click **Send Test Email**. The system will send a test message to the specified email address and inform you if it detects any problems. | | SMTP authentication | Select this checkbox if your mail server requires the SMTP authentication. | | User name | Enter a user name for the SMTP authentication. | | Password | Enter a password for SMTP authentication. | -| Use Secure Sockets Layer encrypted connection (SSL) | Select this checkbox if your SMTP server requires SSL to be enabled. | -| Use implicit SSL | Select this checkbox if the implicit SSL mode is used, which means that an SSL connection is established before any meaningful data is sent. | -| Enforce certificate validation to ensure security | Select this checkbox if you want to verify security certificate on every email transmission. The option is not available for auditing User Activity as well Netwrix Auditor tools. | -| Display the following From address in email notifications | Enter the address that will appear in the "_From_" field in email notifications. This option does not affect notifications sent to users' managers and administrators. Before configuring the "_From_" field for user email notifications, make sure that your Exchange supports this option. | +| Use Secure Sockets Layer encrypted connection (SSL) | Select this checkbox if your SMTP server requires SSL. | +| Use implicit SSL | Select this checkbox if your server uses the implicit SSL mode, which means that the server establishes an SSL connection before sending any meaningful data. | +| Enforce certificate validation to ensure security | Select this checkbox if you want to verify security certificate on every email transmission. The option isn't available for auditing User Activity as well Netwrix Auditor tools. | +| Display the following From address in email notifications | Enter the address that will appear in the "_From_" field in email notifications. This option doesn't affect notifications sent to users' managers and administrators. Before configuring the "_From_" field for user email notifications, ensure that your Exchange supports this option. | **Step 7 –** Navigate to the **Advanced** tab and complete the following fields: @@ -90,12 +91,12 @@ new monitoring plan. | Attach reports as a CSV files | Select this option to receive reports attached to emails as CSV files. | | Ignore users who must change password at next logon | Select this option to exclude users who must change password at next logon from reports. | | Ignore users with the "_Password never expires_" option enabled | Select this option to exclude users with the "_Password never expires_" option enabled from reports. | -| Ignore users who do not have email accounts | Select this option to exclude users who do not have email accounts from reports. | +| Ignore users who don't have email accounts | Select this option to exclude users who don't have email accounts from reports. | | Ignore users whose passwords have already expired | Select this option to exclude users whose passwords have already expired from reports. | -| Include data on expiring accounts | Select this option to include data on expiring domain accounts further to expiring passwords information. | -| Only report on users with fine-grained password policies applied | Select this option to include in reports only users who have fine-grained policies applied. | +| Include data on expiring accounts | Select this option to include data on expiring domain accounts in addition to expiring passwords information. | +| Only report on users with fine-grained password policies applied | Select this option to include in reports only users who have fine-grained password policies. | -**Step 8 –** If you want to save your current configuration, click Save. +**Step 8 –** To save your current configuration, click Save. To review Password Expiration Report diff --git a/static/images/auditor/10.9/addon/connectwise/integrations_thumb_0_0.webp b/static/images/auditor/10.9/addon/connectwise/integrations_thumb_0_0.webp index 6aecc482f6..030473eb4a 100644 Binary files a/static/images/auditor/10.9/addon/connectwise/integrations_thumb_0_0.webp and b/static/images/auditor/10.9/addon/connectwise/integrations_thumb_0_0.webp differ diff --git a/static/images/auditor/10.9/admin/monitoringplans/useractivity/monitored-computers-details1.webp b/static/images/auditor/10.9/admin/monitoringplans/useractivity/monitored-computers-details1.webp new file mode 100644 index 0000000000..4b5c27c47c Binary files /dev/null and b/static/images/auditor/10.9/admin/monitoringplans/useractivity/monitored-computers-details1.webp differ diff --git a/static/images/auditor/10.9/admin/monitoringplans/useractivity/monitored-computers-filter.webp b/static/images/auditor/10.9/admin/monitoringplans/useractivity/monitored-computers-filter.webp new file mode 100644 index 0000000000..6917641303 Binary files /dev/null and b/static/images/auditor/10.9/admin/monitoringplans/useractivity/monitored-computers-filter.webp differ