| KB ID: | 10022 |
| Last Revision: | November 26, 2006 |
| Version: | 1.0 |
Search: Find the events when a specific user has made changes to any object.
The advantage of using Log Fidelity's solutions is that it takes all the need for Event IDs out of your hands. There are edits to an object that are logged with their respective IDs but majority of edits (along with reads and listing of properties) to objects in Active Directory is logged as one ID (ID: 566). This makes it impossible to find any logs where the ID isn't specifically assigned to that type of edit. With Log Fidelity's solution, we take away the need for the ID all together, and let you search by the type of information you would have in a real life scenario.
PREREQUISITES
The name of the user that has modified objects.
ESTIMATED QUERY TIME
2-3 seconds.
METHOD 1 (Quick Search)
1. Enter the name of the user in the Quick Search field and click Go.
METHOD 2 (Advanced Search)
1. Enter the user of the object in the Client Name field and click Submit.
LIKELY SCENARIOS IT APPLIES TO
- A user has been making unwanted edits to some objects in your domain and you want all the logs of all the edits that the user has been doing.
- The user credentials of an account with elevated privileges has been compromised and you want to find all the events generated by the user.
FINE TUNE YOUR SEARCH
If you know the time scope, domain of the edited objects, or want to restrict your searches to users in a specific domain you can fine tune your search.