Netwrix Auditor
for File Servers
Quick-Start Guide
Version: 7.0
7/7/2015
features or functionality not applicable to the product release or version you are using. Netwrix makes no representations or warranties about the Software beyond what is provided in the License Agreement.
Netwrix Corporation assumes no responsibility or liability for the accuracy of the information presented, which is subject to change without notice. If you believe there is an error in this publication, please report it to us in writing.
Netwrix is a registered trademark of Netwrix Corporation. The Netwrix logo and all other Netwrix product or service names and slogans are registered trademarks or trademarks of Netwrix Corporation.
Active Directory is a trademark of Microsoft Corporation. All other trademarks and registered trademarks are property of their respective owners.
Disclaimers
This document may contain information regarding the use and installation of non-Netwrix products.
Please note that this information is provided as a courtesy to assist you. While Netwrix tries to ensure that this information accurately reflects the information provided by the supplier, please refer to the materials provided with any non-Netwrix product and contact the supplier for confirmation. Netwrix Corporation assumes no responsibility or liability for incorrect or incomplete information provided about non-Netwrix products.
© 2015 Netwrix Corporation.
All rights reserved.
Table of Contents
1. Introduction 4
1.1. Netwrix Auditor Overview 4
2. System Requirements 6
2.1. Requirements for Audited System 6
2.2. Requirements to Install Netwrix Auditor 6
2.2.1. Hardware Requirements 6
2.2.2. Software Requirements 7
3. Install the Product 8
4. Configure Windows File Servers for Auditing 10
4.1. Configure Object-Level Access Auditing 10
4.2. Configure Audit Object Access Policy 19
4.3. Configure Event Log Size and Retention Settings 20
4.4. Enable Remote Registry Service 22
5. Create Managed Object to Audit File Servers 24
6. Launch Initial Data Collection 27
7. Make Test Changes 28
8. See How Netwrix Auditor Enables Complete Visibility 29
8.1. Review a Change Summary 30
8.2. Browse Data with AuditIntelligence Search 31
8.3. Review File Servers Overview 33
8.4. Review the All File Servers Activity Report 34
9. Related Documentation 36
1. Introduction
This guide is intended for the first-time users of Netwrix Auditor for File Servers. It can be used for evaluation purposes, therefore, it is recommended to read it sequentially, and follow the instructions in the order they are provided. After reading this guide you will be able to:
l Install and configure Netwrix Auditor
l Create a Managed Object to start auditing a Windows file server
l Launch data collection
l See how Netwrix Auditor brings real AuditIntelligence into your IT infrastructure and enables its complete visibility
NOTE:This guide only covers the basic configuration and usage options for auditing Windows file servers with Netwrix Auditor. For advanced installation scenarios and configuration options, as well as for information on various reporting possibilities and other product features, refer to:
l Netwrix Auditor Installation and Configuration Guide
l Netwrix Auditor Administrator's Guide
l Netwrix Auditor User Guide
1.1. Netwrix Auditor Overview
Netwrix Auditor is a change and configuration auditing platform that streamlines compliance, strengthens security and simplifies root cause analysis across the entire IT infrastructure.
Netwrix Auditor enables complete visibility into both security configuration and data access by providing actionable audit data about who did what, when, and where, and who has access to what. Netwrix Auditor helps prevent security breaches caused by insider attacks, pass audits and minimize compliance costs or just keep tabs on what privileged users are doing in the environment and why.
With over 6,000 customers from 28 industries and more than 70 industry awards, Netwrix Auditor is the only platform that combines both security configuration management and data access governance across the broadest variety of IT systems, including Active Directory, Exchange, File Servers, SharePoint, SQL Server, VMware, Windows Server and others. It also supports privileged user activity monitoring on all other systems, even if they do not produce any logs, via user activity video recording with the ability to search and replay.
Netwrix Auditor brings AuditIntelligence™ with:
l Change and access auditing: determine who changed what, when, and where.
l AuditIntelligence search: browse audit data, investigate incidents and keep track of changes.
1. Introduction
l Configuration assessment: analyze current and past configurations with the state–in–time reports.
l Predefined reports: pass audits with a variety of out–of–the–box reports and stay compliant with international standards.
Netwrix Auditor employs AuditAssurance™, a patent– pending technology that does not have the disadvantages of native auditing or SIEM (Security Information and Event Management) solutions that rely on a single source of audit data. Netwrix Auditor utilizes an efficient, enterprise– grade architecture that consolidates audit data from multiple independent sources and scalable two– tiered Audit Archive (file–
based local Long–Term Archive and short-term SQL-based Audit Database) holding consolidated audit data for 10 years or more.
Netwrix Auditor for File Servers detects and reports on all changes made to Windows– based file servers, EMC storages and NetApp Filer appliances, including modifications of files, folders, shares and permissions, as well as failed and successful access attempts.
2. System Requirements
This section lists the requirements for the systems that are going to be audited with Netwrix Auditor, and for the computer where the product is going to be installed.
2.1. Requirements for Audited System
The table below provides the requirements for the systems that can be audited with Netwrix Auditor for File Servers:
Audited System Supported Versions
File Servers l Windows Desktop OS: Windows Vista SP2 (32 and 64-bit) and above
l Windows Server OS: Windows Server 2008 SP2 (32 and 64-bit) and above
2.2. Requirements to Install Netwrix Auditor
This section provides the requirements for the computer where Netwrix Auditor is going to be installed.
Refer to the following sections for detailed information:
l Hardware Requirements
l Software Requirements
2.2.1. Hardware Requirements
Before installing Netwrix Auditor, make sure that your hardware meets the following requirements:
Hardware Component
Minimum Recommended
Processor Intel or AMD 32 bit, 2 GHz Intel Core 2 Duo 2x 64 bit, 3 GHz
RAM 2 GB 8 GB
Disk space l 500 MB physical disk space for the product installation
l 30 GB for file-based Long-Term Archive
l 500 MB for SQL Server-based Audit Database where audit data is going to be stored
2. System Requirements
Hardware Component
Minimum Recommended
NOTE:These are rough estimations, calculated for evaluation of Netwrix Auditor for File Servers. Refer toNetwrix Auditor Installation and Configuration Guidefor complete information on the Netwrix Auditor disk space requirements.
Screen resolution 1280 x 1024 1920 x 1080 and higher
2.2.2. Software Requirements
The table below lists the minimum software requirements for the Netwrix Auditor installation:
Component Requirements
Operating system l Desktop OS: Windows 7 SP1 (64-bit) and above
l Server OS: Windows Server 2008 R2 SP1 and above
NOTE:32-bit operating systems are not supported.
Framework l .Net Framework 3.5 SP1
Additional software l Windows Installer 3.1and above
3. Install the Product
To install Netwrix Auditor
1. DownloadNetwrix Auditor 7.0.
2. Unpack the installation package. The following window will be displayed on successful operation completion:
3. Follow the instructions of the setup wizard. When prompted, accept the license agreement.
4. On the Select Installation Type step, select Full installation.
5. On the Destination Folder step, specify the installation folder.
6. Click Install. After a successful installation, Netwrix Auditor shortcuts will be added to the Start
3. Install the Product
menu/screen and Netwrix Auditor Administrator Console will open.
4. Configure Windows File Servers
for Auditing
Before configuring the audit settings, consider that if you have multiple file shares frequently accessed by a significant number of users, it is reasonable to audit objects modification only. Tracking all access events may result in too much data written to the audit logs, whereas only some part of it may be of any interest.
Note that audit flags must be set on every file share you want to audit.
If you are going to audit an entire file server, consider the following:
l If you specify a single computer name, Netwrix Auditor will audit all shared folders on this computer.
Note that Netwrix Auditor does not track content changes on folders whose name ends with the $ symbol (which are either hidden or administrative/system folders). In order for the report functionality to work properly, you need to configure audit settings for each share folder on the computer separately. Otherwise, reports will contain limited data and warning messages.
l For your convenience, if your file shares are stored within one folder (or disk drive), you can configure audit settings for this folder only. As a result, you will receive reports on all required access types applied to all file shares within this folder. It is not recommended to configure audit settings for system disks.
To configure audit settings for Windows file servers, perform the following procedures:
l Configure Object-Level Access Auditing
l Configure Audit Object Access Policy
l Configure Event Log Size and Retention Settings
l Enable Remote Registry Service
4.1. Configure Object-Level Access Auditing
Perform one of the following procedures depending on the OS:
l To configure Object-level access auditing on pre-Windows Server 2012 versions
l To configure Object-level access auditing on Windows Server 2012 and above
To configure Object-level access auditing on pre-Windows Server 2012 versions
1. Navigate to the target file share, right-click it and select Properties.
2. In the <Share_Name> Properties dialog, select the Security tab and click Advanced.
3. In the Advanced Security Settings for <Share_Name> dialog, navigate to the Auditing tab, click
4. Configure Windows File Servers for Auditing
Edit.
4. In a separate Advanced Security Settings for <Share_Name> dialog, click Add to add a principal.
You can also select Everyone (or another user-defined group containing users that are granted special permissions) and click Edit.
NOTE:You can specify any other user group, but in this case Netwrix Auditor will send emails with warnings on incorrect audit configuration. This will not affect the reports or data searches performed in the Netwrix Auditor client and the product will only audit user accounts that belong to the selected group.
5. Apply settings to your Auditing Entries depending on the access types that you want to audit. If you want to audit all access types (successful reads, modifications as well as failed reads and modifications attempts), you need to add three separate Auditing Entries for each file share.
Otherwise, reports will contain limited data and warning messages.
Auditing Entry Successful reads
The Auditing Entry below shows Advanced Permissions for auditing successful reads only:
Auditing Entry
l Apply onto—Select "Files only"
l Access type—Select "Successful"
l Advanced permissions—Select "List folder / read data"
l Make sure that the Apply these auditing entries to objects and/or containers within this container only checkbox is cleared.
Successful modifications
The Auditing Entry below shows Advanced Permissions for auditing successful modifications only:
4. Configure Windows File Servers for Auditing
Auditing Entry
l Apply onto—Select "This folder, subfolders and files"
l Access type—Select "Successful"
l Advanced permissions:
l Create files / write data
l Create folders / append data
l Write attributes
l Write extended attributes
l Delete subfolders and files
l Delete
l Change permissions
l Take ownership
l Make sure that the Apply these auditing entries to objects and/or containers within this
Auditing Entry container only checkbox is cleared.
Failed read and modification attempts
The Auditing Entry below shows Advanced Permissions for auditing failed read and modifications attempts:
l Apply onto—Select "This folder, subfolders and files"
l Access type—Select "Failed"
l Advanced permissions:
l List folder / read data
l Create files / write data
l Create folders / append data
l Write attributes
l Write extended attributes
4. Configure Windows File Servers for Auditing
Auditing Entry
l Delete subfolders and files
l Delete
l Change permissions
l Take ownership
l Make sure that the Apply these auditing entries to objects and/or containers within this container only checkbox is cleared.
NOTE: If no data is present in reports, or the Who field contains the "system" value, refer to Netwrix Knowledge Base articles.
To configure Object-level access auditing on Windows Server 2012 and above
1. Navigate to the target file share, right-click it and select Properties.
2. In the <Share_Name> Properties dialog, select the Security tab and click Advanced.
3. In the Advanced Security Settings for <Share_Name> dialog, navigate to the Auditing tab.
4. Click Add to add a new principal. You can also select Everyone (or another user-defined group containing users that are granted special permissions) and click Edit.
5. In the Auditing Entry for <Folder_Name> dialog, click the Select a principal link and specify Everyone.
NOTE:You can specify any other user group, but in this case Netwrix Auditor will send emails with warnings on incorrect audit configuration. The product will audit only user accounts that belong to the selected group.
6. Apply settings to your Auditing Entries depending on the access types that you want to audit. If you want to audit all access types (successful reads, modification as well as failed reads and modifications attempts), you need to add three separate Auditing Entries for each file share. Otherwise, reports will contain limited data and warning messages.
Auditing Entry Successful reads
The Auditing Entry below shows Advanced Permissions for auditing successful reads only:
l Type—Set to "Success".
l Applies to—Select "Files only".
l Advanced permissions—Select "List folder / read data".
l Make sure that the Only apply these auditing settings to objects and/or containers within this container checkbox is cleared.
4. Configure Windows File Servers for Auditing
Auditing Entry Successful modifications
The Auditing Entry below shows Advanced Permissions for auditing successful modifications only:
l Type—Set to "Success".
l Applies to—Select "This folder, subfolders and files".
l Advanced permissions:
l Create files / write data
l Create folders / append data
l Write attributes
l Write extended attributes
l Delete subfolders and files
l Delete
l Change permissions
l Take ownership
l Make sure that the Only apply these auditing settings to objects and/or containers within this container checkbox is cleared.
Auditing Entry
Failed read and modification attempts
The Auditing Entry below shows Advanced Permissions for auditing failed read and modifications attempts:
l Type—Set to "Fail"
l Applies to—Select "This folder, subfolders and files"
l Advanced permissions:
l List folder / read data
l Create files / write data
l Create folders / append data
l Write attributes
l Write extended attributes
l Delete subfolders and files
l Delete
l Change permissions
l Take ownership
l Make sure that the Only apply these auditing settings to objects and/or containers within this container checkbox is cleared.
4. Configure Windows File Servers for Auditing
NOTE:If no data is present in reports, or the Who field contains the "system" value, refer toNetwrix Knowledge Base articles.
4.2. Configure Audit Object Access Policy
1. Open the Group Policy Management console on any domain controller in the target domain:
navigate to Start→Administrative Tools→Group Policy Management.
2. In the left pane, navigate to Forest: <domain_name> → Domains, right-click <domain_name>
and select Create a GPO in this domain and Link it here.
3. Enter the name for the new GPO.
4. Right-click the newly created GPO and select Edit.
5. In the Group Policy Management Editor dialog, expand the Computer Configuration node on the left and navigate to Policies→Windows Settings→Security Settings→Local Policies→Audit Policy.
6. In the right pane, double-click Audit object access and select all checkboxes in the Audit object access Properties dialog.
Refer to the Windows Server TechCenter article for more information: Create a new Group Policy object:
Group Policy. If you want to use a local policy, refer for instructions in the following Windows Server TechCenter article:Define or modify auditing policy settings for an event category: Auditing.
NOTE: You can configure Advanced audit policy to narrow the range of events tracked and recorded by the product, thus preventing your local Long- Term Archive and the Security event log from overfilling. SeeNetwrix Auditor Installation and Configuration Guidefor more information.
4.3. Configure Event Log Size and Retention Settings
The procedure below describes one of the possible ways to adjust event log settings. If you have multiple target computers, you need to perform this procedure on each of them.
NOTE:If you move security log files from the default system folder to a non-default one, you must reboot your target server for the reports and search functionality to work properly.
1. On a target server, navigate to Start→Programs→Administrative Tools→Event Viewer.
2. Navigate to Event Viewer tree→Windows Logs, right-click Security and select Properties.
4. Configure Windows File Servers for Auditing
3. Make sure Enable logging is selected.
4. In the Maximum log size field specify the size—4GB.
5. Make sure Do not overwrite events (Clear logs manually) is cleared. If this option is selected, change the retention method by selecting another option: Overwrite events as needed (oldest events first).
4.4. Enable Remote Registry Service
To enable the Remote Registry service
1. Navigate to Start→Administrative Tools→Services.
2. In the Services dialog, locate the Remote Registry service, right-click it and select Properties.
3. In the Remote Registry Properties dialog, make sure that the Startup type parameter is set to
"Automatic" and click Start.
4. Configure Windows File Servers for Auditing
4. In the Services dialog, ensure that Remote Registry has the "Started" (on pre-Windows Server 2012 versions) or the "Running" (on Windows Server 2012 and above) status.
5. Create Managed Object to Audit
File Servers
To start auditing your IT Infrastructure with Netwrix Auditor, you must create a Managed Object. A Managed Object is a container within Netwrix Auditor that stores information on the auditing scope, the Data Processing Account used for data collection, AuditIntelligence settings, etc.
To create a Managed Object to audit file servers
1. On the main Netwrix Auditor Administrator Console page, click the File Servers tile to launch the New Managed Object wizard.
2. On the Select Managed Object Type step, select Computer Collection as a Managed Object type.
3. On the Specify Default Data Processing Account step, click Specify Account.
Enter the default Data Processing Account (in the DOMAIN\user format) that will be used by Netwrix Auditor for data collection. For a full list of the rights and permissions required for the Data Processing Account, and instructions on how to configure them, refer toNetwrix Auditor Installation and Configuration Guide.
4. On the Specify Email Settings step, specify the email settings that will be used for Change Summaries, reports and real-time alerts delivery:
Setting Description
SMTP server Enter your SMTP server name.
Port Specify your SMTP server port number.
Sender address Enter the address that will appear in the From field.
NOTE: It is recommended to click Verify. The system will send a test message to the specified email address and inform you if any problems are detected.
SMTP Authentication Select this checkbox if your mail server requires the SMTP authentication.
User name Enter a user name for the SMTP authentication.
Password Enter a password for the SMTP authentication.
5. Create Managed Object to Audit File Servers
Setting Description
Confirm password Confirm the password.
Use Secure Sockets Layer encrypted connection (SSL)
Select this checkbox if your SMTP server requires SSL to be enabled.
Implicit SSL connection mode
Select this checkbox if the implicit SSL mode is used, which means that an SSL connection is established before any meaningful data is sent.
5. On the Specify Computer Collection Name step, enter the computer collection name.
6. On the AuditIntelligence Settings step, make sure that the Make audit data available via summary emails only checkbox is cleared. By default, Audit Database is created automatically and is used to store collected audit data.
Select one of the following:
l Automatically install and configure a new instance of SQL Server Express Edition to automatically install and configure SQL Server 2012 Express with Advanced Services.
l Use an existing SQL Server instance with SQL Server Reporting Services to use an already installed SQL Server instance.
Complete the following fields:
Option Description
SQL Server Settings
SQL Server instance Specify the name of the SQL Server instance to store audit data.
Authentication Select the authentication type you want to use to connect to the SQL Server instance:
l Windows authentication
l SQL Server authentication
User name Specify the account to be used to connect to the SQL Server instance.
NOTE:This account must be granted the database owner (db_
owner) role and the dbcreator server role. See Netwrix Auditor Installation and Configuration Guidefor more information.
Option Description
Password Enter a password.
SQL Server Reporting Services Settings
Report Server URL Specify the Report Server URL. Make sure that the resource is reachable.
Report Manager URL Specify the Report Manager URL. Make sure that the resource is reachable.
User name Specify the account to be used to connect to SSRS.
Password Enter a password.
7. On the State-in-Time Reports step, you can enable or disable State-in-Time Reports. This feature allows generating reports on your system's configuration state at a specific moment of time in addition to change reports. If enabled, snapshots will be created daily and written to the audit database. This option is unavailable if the AuditIntelligence settings are not configured.
8. On the Add Items to Computer Collection step, click Add to select items that you want to audit.
You can add several items to collection. In the dialog that opens, select the Windows File Share item type and provide a path to a shared resource.
9. On the Select Data Collection Method step, enable the Use Lightweight Agents option. If enabled, an agent will be installed automatically on the audited computer, collect and prefilter data, and return it in a highly compressed format. This significantly improves data transfer and minimizes the impact on the target computers' performance.
10. On the Configure File Server Auditing Settings step, enter your email and specify types of access you want to track.
11. On the last step, review your Managed Object settings and click Finish to exit the wizard. The newly created Managed Object will appear under the Managed Objects node.
6. Launch Initial Data Collection
6. Launch Initial Data Collection
When a new Managed Object is created, Netwrix Auditor starts collecting data from the audited IT infrastructure. The first data collection gathers information on the audited system's current configuration state. Netwrix Auditor uses this information as a benchmark to collect data on changes. After the first data collection has finished, an email notification is sent to your email stating that the analysis has completed.
In order not to wait until a scheduled data collection, launch it manually.
To launch data collection manually
1. In the Netwrix Auditor Administrator Console, navigate to Managed Objects→your_Managed_
Object_name.
2. In the right pane, click Run.
3. Check your mailbox for an email notification and make sure that the data collection has completed successfully.
7. Make Test Changes
Now that the product has collected a snapshot of the audited system's current configuration state, you can make test changes to see how they will be reported by Netwrix Auditor.
For example, make the following test changes:
l Create a new file/folder in your file share
l Delete a file from your file share
l Modify a file in your file share
NOTE: Before making any test changes to your environment, ensure that you have the sufficient rights, and that the changes conform to your security policy.
8. See How Netwrix Auditor Enables Complete Visibility
8. See How Netwrix Auditor
Enables Complete Visibility
After you have made test changes to the audited environment, you can see how Netwrix Auditor brings real AuditIntelligence into your IT infrastructure and enables its complete visibility. This section explains how to review your test changes in the Netwrix Auditor client and Change Summary.
To launch the Netwrix Auditor client
l Navigate to Start→ Netwrix Auditor.
Review the following for additional information:
l Review a Change Summary
l Browse Data with AuditIntelligence Search
l Review File Servers Overview
l Review the All File Servers Activity Report
In order not to wait until a scheduled data collection and a Change Summary generation, launch data collection manually. SeeLaunch Initial Data Collectionfor more information.
8.1. Review a Change Summary
A Change Summary is email that lists all changes that occurred since the last Change Summary delivery. By default, a Change Summary is generated daily at 3:00 AM and delivered to the specified recipients. You can also launch data collection and a Change Summary generation manually.
After the data collection has completed, check your mailbox for a Change Summary and see how your test changes are reported:
The example Change Summary provides the following information:
Column Description
Action Shows the type of action that was performed on the object.
l Added
l Removed
l Modified
Object Type Shows the type of the object.
8. See How Netwrix Auditor Enables Complete Visibility
Column Description
What Shows the name of the changed object or its path.
Where Shows the name of the server where the change occurred.
Who Shows the name of the account under which the change was made.
When Shows the exact time when the change occurred.
Details Shows the before and after values of the modified object, object attributes, etc.
8.2. Browse Data with AuditIntelligence Search
Netwrix Auditor brings real AuditIntelligence into your IT infrastructure and enables its complete visibility.
Netwrix Auditor provides a convenient search interface for investigating incidents and browsing audit data collected across the entire IT infrastructure. When running a search in Netwrix Auditor you are not limited to a certain audited system, change type or object name. Netwrix Auditor allows creating flexible searches in order to get precise results on who changed what, when, and where.
After you have launched the initial data collection, made test changes to your environment and run data collection again, you can take advantage of audit search.
To browse your audit data and see you test changes
1. On the main Netwrix Auditor page, navigate to Search.
2. Add search filters to your search by clicking on a corresponding icon and providing a value. By default, all entries that contain this filter value are shown. For exact match, use quotation marks.
Filters are used to limit your search results. Netwrix Auditor allows you to create a unique set of filters:
l Add different filters to your search. Search results will be sorted by all selected filters as they work as logical conjunction (Who: Administrator AND Action: Added).
l Specify several values in the same filter to search for any of them (e.g. Action: Modified OR Action: Removed). To do it, select a filter again and specify a new value.
For example, consider adding these filters:
Filter Value
Specify your account name, as you performed test changes.
Specify your file server name.
NOTE:Refer toNetwrix Auditor User Guidefor detailed instructions on how to apply filters and change match types.
As a result, you will see the following filters in the Search field:
3. Click Search.
4. Now, you can limit your search and modify it right from the search results. Double-click on any entry that contains excess data, select Exclude from search and specify a filter, e.g. Action: Read to leave information on modifications and removals only.
8. See How Netwrix Auditor Enables Complete Visibility
Your Search field will be updated, the Action not filter will be added. Make sure to click Search again to update your search results.
5. Having reviewed your search results, navigate to Tools.
l Click Export data to save your search results as a *.pdf or *.csv file.
l Click Save search to save the selected set of filters. This search will be added to Saved Searches section on the main Netwrix Auditor page so that you will be able to access it instantly. Refer toNetwrix Auditor User Guidefor detailed instructions on how to create data searches.
8.3. Review File Servers Overview
Enterprise Overview provide a high-level overview of activity trends by date, user, server, object type or audited system in your IT infrastructure. The Enterprise diagram aggregates data on all Managed Objects and all audited systems, while system-specific diagrams provide quick access to important statistics within one audited system.
After you have launched the initial data collection, made test changes to your environment and run data collection again, you can take advantage of the File Servers Overview.
To see how your changes are reported with File Servers Overview
1. On the main Netwrix Auditor page, navigate to the Enterprise Overview section.
2. Click the File Servers tile to open it.
3. Review your changes.
4. Click on any chart to jump to a table report with the corresponding grouping and filtering of data.
8.4. Review the All File Servers Activity Report
Netwrix Auditor allows generating audit reports based on Microsoft SQL Server Reporting Services (SSRS).
The Netwrix Auditor client provides a wide variety of predefined reports that aggregate data from the entire audited IT infrastructure, an individual system, or a Managed Object.
Change reports can be found under the Reports→File Servers→ File Servers Activity and provide a narrower insight into what is going on in the audited infrastructure and help you stay compliant with various standards and regulations (FISMA, HIPAA, PCI, SOX, etc.).
8. See How Netwrix Auditor Enables Complete Visibility
After you have launched the initial data collection, made test changes to your environment and run data collection again, you can take advantage of the reports functionality.
To see how your changes are listed in the report
1. In the Netwrix Auditor client, navigate to Reports→ File Servers→File Servers Activity.
2. Select the All File Servers Activity report.
3. Click View to open the report.
9. Related Documentation
The table below lists all documents available to support Netwrix Auditor for File Servers:
Document Description
Netwrix Auditor Installation and Configuration Guide
Provides detailed instructions on how to install Netwrix Auditor, and explains how to configure your environment for auditing.
Netwrix Auditor Administrator's Guide
Provides a detailed explanation of the Netwrix Auditor features and step-by-step instructions on how to configure and use the product.
Netwrix Auditor User Guide Provides detailed instruction on how to enable complete visibility with AuditIntelligence provided by Netwrix Auditor.
Netwrix Auditor Release Notes
Contains a list of the known issues that customers may experience with Netwrix Auditor 7.0, and suggests workarounds for these issues.
