How to exclude the Public Key Infrastructure (PKI) changes from being reported?
For example:
- ms-PKI-AccountCredentials
- ms-PKI-Certificate-Application-Policy
- ms-PKI-Certificate-Name-Flag
- ms-PKI-Certificate-Policy
- ms-PKI-Cert-Template-OID
- ms-PKI-Credential-Roaming-Tokens
- ms-PKI-DPAPIMasterKeys
- ms-PKI-Enrollment-Flag
- ms-PKI-Enrollment-Servers
- ms-PKI-Minimal-Key-Size
- ms-PKI-OID-Attribute
- ms-PKI-OID-CPS
- ms-PKI-OID-LocalizedName
- ms-PKI-OID-User-Notice
- ms-PKI-Private-Key-Flag
- ms-PKI-RA-Application-Policies
- ms-PKI-RA-Policies
- ms-PKI-RA-Signature
- ms-PKI-RoamingTimeStamp
- ms-PKI-Site-Name
- ms-PKI-Supersede-Templates
- ms-PKI-Template-Minor-Revision
- ms-PKI-Template-Schema-Version
In order to exclude changes to these attributes from being reported, do the following:
- Navigate to the Netwrix Auditor installation directory.
- Add the following lines to the omitproplist.txt file:
*.msPKIAccountCredentials
*.msPKIDPAPIMasterKeys
*.msPKIRoamingTimeStamp
etc..