Computer Audit Interface

The Computer Audit interface is opened by searching for a particular computer. See the Search Features topic for additional information. It contains three panes in all audit interfaces: Reports, Results, and Group Membership.

The computer being audited is identified at the top of the interface as part of the interface breadcrumb. See the Computer Reports topic for additional information.

Computer Reports

Computer reports are accessed through the Computer Audit interface. You can access Computer reports by searching for computer objects on the Home page. See the Search Features topic for additional information. The computer object being reviewed is identified in the upper-left corner. The data within these reports is collected by the Enterprise Auditor solutions which provide data to the Resource reports. See the desired solution topic in the Netwrix Enterprise Auditor Documentation for additional information.

Computer reports identify the following information as scanned from the targeted environments:

• Everywhere a particular computer has access
• What is that computer doing with the access
• What Active Directory permissions are applied to the computer object

The Computer Audit interface resembles the Resource Audit Interface but lacks the Resources pane. The computer object being reviewed is identified in the upper-left corner. See the Resource Audit Interface topic for additional information.

Activity reports display information for a selected date range. Some of the reports also include Trend graphs. Trend graphs provide a visual representation of the activity that occurred over the selected date range. See the Activity Report Results Pane Features topic for instructions on selecting a date range and filtering the Trend graphs. Activity reports display local time stamps. Activity information is represented in two ways:

• Activity Statistics – Statistics reports show the count of operation events performed for the selected resource within the selected date range. These events are normalized into the operations of Reads, Writes, Deletes, and Manages. See the Activity Statistics Report topic for additional information.
• Activity Details – Details reports show the specific operation events that occurred for the selected resource within the selected date range. See the Activity Details Report topic for additional information.

Activity Details Report

The Activity Details report for a computer object provides details on every activity event logged by the audited computer during the selected date range. This report includes a Permission Changes table.

This report is comprised of the following columns:

• Collector – Refers to the collection source for the permission (for example, FileSystem for the Enterprise Auditor File System Solution, SharePoint for the Enterprise Auditor SharePoint Solution, and so on)
• Server Name – Name of the file system server or SharePoint farm/instance where the activity event occurred
• Access Time – Date and timestamp for when the operation occurred
• Resource – Resource type being accessed
• Operation – Name of operation logged
• Access – Whether the trustee was granted access to execute the operation: Allowed or Denied
• Path – Original location where the operation occurred
• Target Path – New location if changed by the operation. Blank if the operation does not result in a new path.
• Process Name – Name of the process which performed the operation
• Originating Address – IP Address of the NAS host from where the activity event originated. Blank if the operation originated on a Windows host.

There is one table at the bottom displaying Permission Changes for the selected event. It contains details on the trustee whose permissions were updated, added, or removed. This table is comprised of the following columns:

• Trustee Name – Trustee whose permissions were modified

• Trustee Account – Active Directory account associated with the trustee

• ObjectSid – Security ID of the object

• Change Type – Type of change that occurred:

  • Add – Permission added to trustee
  • Remove – Permission removed from trustee
  • Update – Permission modified for trustee

• Ace Type – Whether or not the right assigned is allowed or denied

• Inheritance – Whether or not the Ace is inherited

• Ace Flags – Inheritance flag description

• Access Rights – Type of right assigned

Activity Statistics Report

The Activity Statistics report for a computer object provides statistical activity event information for the audited computer during the selected date range. This report includes a line graph for Traffic Trend.

This report is comprised of the following columns:

• Collector – Refers to the collection source for the permission (for example, FileSystem for the Enterprise Auditor File System Solution, SharePoint for the Enterprise Auditor SharePoint Solution, and so on)
• Server Name – Name of the file system server or SharePoint farm/instanceS where the activity event occurred
• Path – Location of the resource where the activity event occurred
• Reads – Count of view/read operations on resource
• Writes – Count of edit/modify operations on resource
• Manages – Count of permission change operations on resource
• Deletes – Count of delete operations on resource

The table data grid functions the same way as other table grids. See the Data Grid Features topic for additional information.

There is one line graph at the bottom displaying the Traffic Trend for the audited computer. It provides a visual representation of the number of operations events that occurred by operation type over the selected date range. It indicates what volume of operations occurred per day. Each operation type is provided with a different color, as indicated by the legend. See the Activity Report Results Pane Features topic for instructions on filtering the Trend graph.

Attribute Changes Report

The Attribute Changes report for a computer object provides specific details for every attribute change to the audited computer that was logged during the selected date range.

This report is comprised of the following columns:

• Scan Time – Date and timestamp of the Enterprise Auditor scan that identified the change
• Attribute – Active Directory attribute changed for the computer
• Old – Original attribute value
• New – New attribute value

Effective Access Report

The Effective Access report for a computer object provides insight into every resource the audited computer has access to and what level of access has been granted. Effective access is a calculation based on several variables according to the type of resource. This report includes a Permission Source table.

See the Effective Access Report topic for File Systems for additional information on the effective access calculations for file system resources. See the Effective Access Report topic for SharePoint for additional information on the effective access calculations for SharePoint resources.

This report contains a list of all resources the audited computer has the ability to access within the targeted environments. When this report is opened, the Access Information Center begins analyzing all of the collected data available for all access points. While the report data is loading, there is a status bar in the upper-right corner of the Reports pane that indicates the data loading progress. After the data has loaded, the number of rows is displayed.

NOTE: This report continues to load while other reports are being opened and viewed. As long as the Access Information Center user remains logged into the Access Information Center, it continues to load until all data has been analyzed for the audited user.

The scoping options allow Access Information Center users to specifying what collected data should be analyzed in order to generate this report. Unlike other filter options, this may impact the loading time depending on the scoping options selected. See the Scope an Effective Access Report topic for instructions on using this feature.

This report is comprised of the following columns:

• Collector – Refers to the collection source for the permission (for example, FileSystem for the Enterprise Auditor File System Solution, SharePoint for the Enterprise Auditor SharePoint Solution, and so on)
• Server Name – Name of the file system server or SharePoint farm/instance where the permission is set
• Type – Type of resource where the permission is set
• Path – Location of the resource where the permission is set
• Open Access – True or False to indicate if access is granted through a high-risk trustee (for example, Everyone, Authenticated Users, or Domain Users)

The following rights are a normalized representation of the permissions granted to the computer:

• List – Right to view list of resources
• Read – Right to view/read resources
• Write – Right to add or modify resources
• Delete – Right to delete resources
• Manage – Equivalent to full control over resources

There is one table at the bottom displaying Permission Source for the select resource. It contains all of the ways the audited computer has been granted rights to the selected resource.

The number of rows for this table indicates the number of ways the audited computer has been granted access to selected resource. This table is comprised of the following columns:

• Source Path – Location for which the audited object was granted rights to the selected resource, which can be represented two ways:

  • Directly Applied – Rights granted directly to the audited object
  • Access through another trustee, path starts with trustee assigned the direct rights and shows all nested groups leading to the audited object

• Source Type – Source of the permission (for example, Share, Folder, Site Permission, Web Application Policy, and so on)

• Source Name – Name of the resource where the permission is assigned

The following rights are a normalized representation of the permissions granted to the computer:

• List – Right to view list of resources
• Read – Right to view/read resources
• Write – Right to add or modify resources
• Delete – Right to delete resources
• Manage – Equivalent to full control over resources

The following columns display the combined direct and inherited rights:

• Allow Mask – Bitmask corresponding to Windows ACE permission bits for combined direct and inherited allow rights
• Deny Mask – Bitmask corresponding to Windows ACE permission bits for combined direct inherited deny rights

Member Of Report

The Member Of report for a computer object provides a list of all groups of which the audited computer is a member. This report includes a Membership Paths table.

This report is comprised of the following columns:

• Group Account – Account associated with the group

• Group Mail – Group’s email account as read from Active Directory, if applicable

• Group ObjectSid – Security ID of the group object

• Domain Name – Name of the domain

• Group Scope – Scope of the group object: Domain Local, Global, or Universall

• Group Target – Type of the group object: Distribution or Security

• Membership – Type of membership the audited object has to the selected group

  • Direct – Object is specifically assigned to this group
  • Nested – Object is a member of a group which has membership in this group

• Description – Description of this group from Active Directory

• DistinguishedName – Distinguished name for the trustee account

• Created – Date Active Directory object was created

• Changed – Date and timestamp from last change as tracked by Active Directory (whenChanged attribute)

• ManagedBy Name – Name of manager for the group from Active Directory

• ManagedBy Logon – Trustee account for the group’s manager

• ManagedBy Department – Department of the group’s manager

• ManagedBy Mail – Email address for the group’s manager

Since this report is a list of groups, the Group Membership pane displays the group membership, including nested groups.

There is one table at the bottom displaying Membership Paths for the select group. It contains all of the ways the audited computer has been granted membership to the selected group.

• Type – Type of membership the audited object has to the selected group

  • Direct – Object is specifically assigned to this group
  • Nested – Object is a member of a group which has membership in this group

• Membership Path – Displays location for the audited object’s membership to the selected group, starts with group and ends with computer

  • For Direct Membership – Path is [Group Name] > [Computer Name]
  • For Nested Membership – Path is [Group Name] > [Name of Nested Group] > [Computer Name]

• Nested Level – Count of groups nested between the selected group and the audited object’s direct membership

Object Permissions Report

The Object Permissions report for a computer object provides details on Active Directory permissions to the object.

The data within this report is collected by the Enterprise Auditor Active Directory Permissions Analyzer solution. See the Active Directory Permissions Analyzer Solution topic of the Netwrix Enterprise Auditor Documentation for additional information.

This report is comprised of the following columns:

• Trustee Type – Type of the trustee
• Trustee Name – Trustee with permissions to the object
• Trustee Account – Active Directory account associated with the trustee
• Department – Department to which the trustee account belongs
• Title – Trustee’s title as read from Active Directory
• Mail – Trustee’s email account as read from Active Directory
• EmployeeId – Corporate ID for the employee as read from Active Directory
• Description – Description of the trustee object as read from Active Directory
• DistinguishedName – Distinguished name for the trustee account
• ObjectSid – Security ID of the object
• Disabled – True or False if trustee account is disabled
• Deleted – True or False if trustee account is deleted
• Stale – True or False if trustee account is stale (according to the length of inactive time used by the Enterprise Auditor data collection and analysis configuration to identify stale accounts)
• Source – Direct or Inherited permission type
• Type – Type of resource where the permission is set

The following rights are a normalized representation of the permissions granted to the trustee:

• List – Right to view list of objects
• Read – Right to view/read objects
• Write – Right to add or modify objects
• Delete – Right to delete objects
• Manage – Equivalent to full control over objects

The following columns display the combined direct and inherited rights:

• Allow Mask – Bitmask corresponding to Windows ACE permission bits for combined direct and inherited allow rights
• Deny Mask – Bitmask corresponding to Windows ACE permission bits for combined direct inherited deny rights

Permissions Report

The Permissions report for a computer object provides a list of all resources where the audited computer has been assigned permissions. The Include Inherited filter option is active by default, which means the report displays both direct and inherited permissions unless modified by the Access Information Center user. See the Results Pane topic for information on filter options.

This report is comprised of the following columns:

• Collector – Refers to the collection source for the permission (for example, FileSystem for the Enterprise Auditor File System Solution, SharePoint for the Enterprise Auditor SharePoint Solution, and so on)
• Server Name – Name of the file system server or SharePoint farm/instance where the permission is set
• Type – Type of resource where the permission is set
• Source – Direct or Inherited permission type
• Path – Location of the resource where the permission is set
• Allow Mask – Bitmask corresponding to Windows ACE permission bits for combined direct and inherited allow rights
• Deny Mask – Bitmask corresponding to Windows ACE permission bits for combined direct inherited deny rights

The following rights are a normalized representation of the permissions granted to the trustee:

• List – Right to view list of resources
• Read – Right to view/read resources
• Write – Right to add or modify resources
• Delete – Right to delete resources
• Manage – Equivalent to full control over resources

The table data grid functions the same way as other table grids. See the Data Grid Features topic for additional information.

Computer Reports Quick Reference Guide

The following reports are available for selection within the Computer Audit interface:

Report	Description
Activity Details Report	Provides details on every activity event logged by the audited computer during the selected date range. This report includes a Permission Changes table.
Activity Statistics Report	Provides statistical activity event information for the audited computer during the selected date range. This report includes a line graph for Traffic Trend.
Attribute Changes Report	Provides specific details for every attribute change to the audited computer that was logged during the selected date range.
Effective Access Report	Provides insight into every resource the audited computer has access to and what level of access has been granted. Effective access is a calculation based on several variables according to the type of resource. This report includes a Permission Source table.
Member Of Report	Provides a list of all groups of which the audited computer is a member. This report includes a Membership Paths table.
Object Permissions Report	Provides details on Active Directory permissions to the object.
Permissions Report	Provides a list of all resources where the audited computer has been assigned permissions.