audit files

Question

howdy!

is there a nicer way to view changes within the system besides the logging option in the console or the .db3 file on the system?

Thanks!

Comments

Hello,

What do you mean by a 'nicer way'? If you can supply some examples on what you'd like to do, we will think on some examples/solutions that will suit your needs. :)

---

maybe I should ask what app would best allow me to read the .db3? My colleague suggested sqllite but wanted to know if you can suggest something better.
I tried excel and MS access but it was unreadable.
I'm thinking maybe in a report form...

Answer 1

Hello,

Actually, your colleague was right. A local Adaxes logging database (the DB3 file) is an SQLite database, so if you want to extract log records from there, you can use SQLite. However, the log records can also be accessed with the help of Adaxes ADSI provider. You can use PowerShell scripts to access the log records you need with the help of Adaxes ADSI Provider and build HTML reports that can be sent by e-mail, for example. For more information, take a look at Accessing Log Records in our SDK. Also, take a look at Example 4 under Script Examples for information on how to generate and email an HTML report with a script.

If you need assistance with the scripts, we can help you.

Comments

ok great, thanks!

---

hello!

I tried to use SQLlite but I couldn't get it to work.

I tested example #4 http://www.adaxes.com/sdk/ServerSideScr ... ptExamples and I got errors.
FYI - I ran it via Powershell ISE
I wanted to see how the reports will look.

error #1 - You cannot call a method on a null-valued expression.
At line:6 char:35
+ $domain = $Context.GetObjectDomain <<<< ($baseDN)
+ CategoryInfo : InvalidOperation: (GetObjectDomain:String) [], RuntimeException
+ FullyQualifiedErrorId : InvokeMethodOnNull

Capacity MaxCapacity Length
-------- ----------- ------
16 2147483647 12
90 2147483647 90
180 2147483647 96
180 2147483647 138
180 2147483647 170
180 2147483647 174
360 2147483647 232
360 2147483647 237
Search-AdmAccount : Cannot validate argument on parameter 'Server'. The argument is null or empty. Supply an argument that
is not null or empty and then try the command again.
At line:35 char:12
+ -Server <<<< $domain -AdaxesService localhost
+ CategoryInfo : InvalidData: (:) [Search-AdmAccount], ParameterBindingValidationException
+ FullyQualifiedErrorId : ParameterArgumentValidationError,Softerra.Adaxes.PowerShellModule.Commands.SearchAdmAccount
Command

360 2147483647 245
360 2147483647 259
You cannot call a method on a null-valued expression.
At line:55 char:18
+ $Context.SendMail <<<< ($email, "[AD Report] Inactive Users", $NULL,
+ CategoryInfo : InvalidOperation: (SendMail:String) [], RuntimeException
+ FullyQualifiedErrorId : InvokeMethodOnNull

I also ran the report to see general log and received the below. Ultimately, what's being logged via Logging in the console, I'd like in a report form.

error #2 -
GAC Version Location
--- ------- --------
True v2.0.50727 C:\Windows\assembly\GAC_MSIL\Softerra.Adaxes.Adsi\3.5.9329.0__43a637781bd9a3c2\Softerra.Adaxes.Adsi.dll
Property 'StartDateTime' cannot be found on this object; make sure it exists and is settable.
At line:15 char:16
+ $generalLog. <<<< StartDateTime = (Get-Date).AddDays(-$numDays)
+ CategoryInfo : InvalidOperation: (StartDateTime:String) [], RuntimeException
+ FullyQualifiedErrorId : PropertyNotFound

Property 'EndDateTime' cannot be found on this object; make sure it exists and is settable.
At line:16 char:16
+ $generalLog. <<<< EndDateTime = Get-Date
+ CategoryInfo : InvalidOperation: (EndDateTime:String) [], RuntimeException
+ FullyQualifiedErrorId : PropertyNotFound

You cannot call a method on a null-valued expression.
At line:21 char:24
+ $records = $log.GetPage <<<< (0)
+ CategoryInfo : InvalidOperation: (GetPage:String) [], RuntimeException
+ FullyQualifiedErrorId : InvokeMethodOnNull

Start Time:
Completion Time:
Initiator:
Target Object:
Target Object Type:
Operation:

---

Hello,

FYI - I ran it via Powershell ISE

That's the main rason why the script didn't work. All scripts in Server-Side Scripting are intended to be launched from Custom Commands, Scheduled Tasks and Business Rules, because the article deals with server-side scripting, that is, scripting on the side of Adaxes service. However, these are just samples, and it is, of course, possible to create scripts that can be launched from PowerShell ISE / PowerShell Console or as scripts in PS1 files.

To be able to launch the sample script, you need to create a Scheduled Task or a Custom Command that can be launched on a domain object, and launch the script using the Scheduled Task / Custom Command. To create such a Scheduled Task:

1. Create a new Scheduled Task.
2. On the 3rd step of the Create Scheduled Task wizard, select Show all object types.
3. Select the Domain-DNS object type. Assigning a Task on a domain allows to perform the actions defined for the Task only once per a Task run.
   
4. On the 4th step, add the Run a program or PowerShell script action and paste the PowerShell script from the sample in the Script field.
   
5. On the 5th step, assign the Task over any of your AD domains.

I also ran the report to see general log and received the below. Ultimately, what's being logged via Logging in the console, I'd like in a report form.

The errors occur because you are launching the script with credentials of a user who does not have sufficient permissions to view log records. By default, only service administrators have sufficient permissions. To resolve the issue, you can use any of the following 3 options:

• Launch the script using the credentials of a user who has sufficient permissions to view Adfaxes Service Log.

• Provide sufficient permissions to the account the credentials of which you are using to launch the script. For information on how to grant such permissions, see Delegating Permissions to View General Service Log.

• Modify the script and provide the credentials of a user with sufficient permissions directly in the script. To do this:

  1. Find the following line in the script:

      ```powershell
      $serviceLog = $admService.OpenObject($path.ToString(), $NULL, $NULL, 0)
      ```
     
      Modify it as follows:   
     
      ```powershell
      $serviceLog = $admService.OpenObject($path.ToString(), "DOMAIN\username", "p@$$w0rd", 0)
      ```
     
      where:   
     
      - **DOMAIN\\username** - the username of a user with sufficient permissions to view Adaxes Service Log,
      - **p@$$w0rd** - password for the user's account.