cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Highlighted
Level 10
Report Inappropriate Content
Message 1 of 5

EE 6.1.x User Password Change Audit?

Someone may have already posted on this topic (I couldn’t find anything when I searched the forum). I cannot find a way to generate a query for EE Users which shows when a user has changed his or her password. Is this possible using the existing selection of EE query fields? Also, is there any way to generate a query which will prompt for a username when first run (like the "Runtime Parameters" option when creating a report), so you don’t have to edit the report to filter down to a single user account?

Thanks,

Message was edited by: rmmiles on 10/17/11 3:20:33 PM CDT

Message was edited by: rmmiles on 10/17/11 3:22:50 PM CDT
4 Replies
Highlighted
Level 12
Report Inappropriate Content
Message 2 of 5

Re: EE 6.1.x User Password Change Audit?

Hi,

There will be an entry in the epo user management audit log, as it is performed by the an ePO user.  So login into ePO:

  • Click on Menu
  • Select User Management
  • Select Audit Log

Rpcrt4.lib EpeGSoapLib.lib EpeClientUtilsLib.lib EpeFsFat32lib.lib EpePcSystemLib.lib EpeUtilsLib.lib MfeBaseLib.lib MfeUtilsLib.lib MfePlatformLib.lib Zlib.lib MfeWin32Cryptocme.lib MfeCryptoLib.lib LibPng.lib MfeIntegrityLib.lib EpeDiskBiosLib.lib EpeAlgsLib.Lib

Then look for the an action with the text of 'EE - Change User Password' (this will be localized).

Hope this helps.

Highlighted
Level 10
Report Inappropriate Content
Message 3 of 5

Re: EE 6.1.x User Password Change Audit?

Thanks!  I didn't think to look in the local ePO audit log. Looks like I can get the same information from; Queries & Reports > New > Logging > Audit Log Entries. I wish there was a way to do Runtime Parameters on queries.

So to get the entire picture (or reconstruct all the information we had in v5) for EE Users, you need to pull data from the local ePO audit log (filtered on "Action" starts with "EE - ") and the client events (filtered on "Product Code" equals "EEADMIN_1000")..?

on 10/18/11 9:50:48 AM CDT
Highlighted

Re: EE 6.1.x User Password Change Audit?

Yeah, this a pain rather than selecting a user or machine and looking at the event log specific for it.  I wish that Mcafee would make a better interface for Encryption in EPO.  it seems to do anyhting you have to jump all over and do lots of filtering.  One spot for encryption stuff like managing users, computers, event would be nice.

Highlighted
Level 10
Report Inappropriate Content
Message 5 of 5

Re: EE 6.1.x User Password Change Audit?

I agree -- the stock queries for EE are not all that useful on their own. I’ve found myself creating custom queries, and still can't find a good way to blend the data together into a cohesive user audit. For instance, I would like to filter down on a user and see what computers that user has logged into. Does anyone know of a way to do that?

Dvanmeter wrote:

Yeah, this a pain rather than selecting a user or machine and looking at the event log specific for it.  I wish that Mcafee would make a better interface for Encryption in EPO.  it seems to do anyhting you have to jump all over and do lots of filtering.  One spot for encryption stuff like managing users, computers, event would be nice.

on 10/18/11 1:56:16 PM CDT

on 10/18/11 1:56:51 PM CDT
You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community