4 Replies Latest reply on Oct 18, 2011 1:56 PM by rmmiles

    EE 6.1.x User Password Change Audit?

    rmmiles

      Someone may have already posted on this topic (I couldn’t find anything when I searched the forum). I cannot find a way to generate a query for EE Users which shows when a user has changed his or her password. Is this possible using the existing selection of EE query fields? Also, is there any way to generate a query which will prompt for a username when first run (like the "Runtime Parameters" option when creating a report), so you don’t have to edit the report to filter down to a single user account?

       

      Thanks,

       

      Message was edited by: rmmiles on 10/17/11 3:20:33 PM CDT

       

      Message was edited by: rmmiles on 10/17/11 3:22:50 PM CDT
        • 1. Re: EE 6.1.x User Password Change Audit?
          whgibbo

          Hi,

          There will be an entry in the epo user management audit log, as it is performed by the an ePO user.  So login into ePO:

          • Click on Menu
          • Select User Management
          • Select Audit Log

           

          Rpcrt4.lib EpeGSoapLib.lib EpeClientUtilsLib.lib EpeFsFat32lib.lib EpePcSystemLib.lib EpeUtilsLib.lib MfeBaseLib.lib MfeUtilsLib.lib MfePlatformLib.lib Zlib.lib MfeWin32Cryptocme.lib MfeCryptoLib.lib LibPng.lib MfeIntegrityLib.lib EpeDiskBiosLib.lib EpeAlgsLib.Lib

          Then look for the an action with the text of 'EE - Change User Password' (this will be localized).

           

          Hope this helps.

          1 of 1 people found this helpful
          • 2. Re: EE 6.1.x User Password Change Audit?
            rmmiles

            Thanks!  I didn't think to look in the local ePO audit log. Looks like I can get the same information from; Queries & Reports > New > Logging > Audit Log Entries. I wish there was a way to do Runtime Parameters on queries.

             

            So to get the entire picture (or reconstruct all the information we had in v5) for EE Users, you need to pull data from the local ePO audit log (filtered on "Action" starts with "EE - ") and the client events (filtered on "Product Code" equals "EEADMIN_1000")..?

             

            on 10/18/11 9:50:48 AM CDT
            • 3. Re: EE 6.1.x User Password Change Audit?
              Dvanmeter

              Yeah, this a pain rather than selecting a user or machine and looking at the event log specific for it.  I wish that Mcafee would make a better interface for Encryption in EPO.  it seems to do anyhting you have to jump all over and do lots of filtering.  One spot for encryption stuff like managing users, computers, event would be nice.

              • 4. Re: EE 6.1.x User Password Change Audit?
                rmmiles

                I agree -- the stock queries for EE are not all that useful on their own. I’ve found myself creating custom queries, and still can't find a good way to blend the data together into a cohesive user audit. For instance, I would like to filter down on a user and see what computers that user has logged into. Does anyone know of a way to do that?

                 

                Dvanmeter wrote:

                 

                Yeah, this a pain rather than selecting a user or machine and looking at the event log specific for it.  I wish that Mcafee would make a better interface for Encryption in EPO.  it seems to do anyhting you have to jump all over and do lots of filtering.  One spot for encryption stuff like managing users, computers, event would be nice.

                 

                on 10/18/11 1:56:16 PM CDT

                 

                on 10/18/11 1:56:51 PM CDT