Custom Reports

Custom reports feature in ADAudit Plus, is in addition to the already available 200+ pre-configured reports. Users can now create numerous "exact" audit reports to suit their organization's need. The custom reporting ensures there is room for functionality and curtails reporting limitations; users can select preferred event filters from the all-encompassing reporting categories (7) with sub modules (30+) and event filtering options (50+) to choose from. These reports can be e-mailed as a compressed zip file, a link or as an attachment in any of the listed formats - pdf, xls, csv or html.

How To Create a Custom Report
How To View a Custom Report
How To Edit a Custom Report
How To Delete a Custom Report

The various functionalities that help you create a precise custom report

Create Custom Report	The very first step of creating a custom report, wherein you enter the report name, description & domain name.
Select Report Type	Select a report view type from Tabular, Graphical, Summary & Pivot (Matrix) view.
Select Category	Users can select from the 7 reporting categories which has 30+ sub modules and a further 50+ event filtering options to choose from.
Columns to be Displayed	Users can choose from a host of columns, to view the required audit data in the reports.
Filters	Numerous event filters (equals & not equals) conditions can be added here for the selected columns.
Charts	After choosing the report view type above, now select the chart type to suit your audit report type or your organization's preferred style.
Scheduler	The "Custom Report" can be scheduled on a 'Hourly', 'Daily', 'Weekly' or 'Monthly' basis. The scheduled report can be e-mailed to any email-id(s).
Privacy	An user can restrict, other from viewing the "Custom Reports" it can be set to just the administrator (creator) or everyone.

Create Custom Report

Click on the "Reports" Tab > "Custom Reports" on the right side > "Create Custom Report".
Enter the "Report Name" and the "Description" in the respective Text boxes.
Select the "Domain Name" from the Drop Down.

Select Report Type

ADAudit Plus allows you to select the default reports along with user defined reports and schedule it to be run at a specific time.

Tabular View: Tabular view provides you a way to list your values in a simple tabular format (Graph optional).
Graphical View: Graphical view allows you to create a graphical view using different types of charts.
Summary View: Summary view allows you to view data with grouping and subtotals.
Pivot(Matrix) View: Pivot view allows you to view data summarized in a grid both in horizontal and vertical columns.

Select Category

Shown below are the 7 custom reporting categories and their sub modules options, along with the 50+ report options.

Category	Sub Module(s)	Reports
Logon Activity	Logon Success \| Logon Failures	Logon Failures Bad user name \| Bad password \| Password has expired \| New computer account has not replicated yet or computer is pre-w2k \| Workstation/logon time restriction \| Account disabled, expired, or locked out \| Time in workstation is not in sync with the time in DCs \| Administrator should reset the password on the account
File Activity	Files Created \| Files Deleted \| Files Modified \| Files Read \| File Move \| Files Copy \| Permission Changes \| SACL Changes
AD Objects	User Management \| Group Management \| Computer Management \| OU Management \| GPO Management \| Contacts Management \| Container Management \| Password Settings Changes	User Mangement Users Created \| Users Deleted \| Users Enabled \| Disabled Users \| Locked out Users \| Unlocked Users \| Password Changed Users \| Password Reset Users \| Password Never Expired Users \| Modified Users \| User Attributes Changes \| User Attribute New and Old Value \| User Moved Group Management Security Group Created \| Security Group Deleted \| Member Added to Security Group \| Member Removed from Security Group \| Distribution Group Created \| Distribution group Deleted \| Member Added to Distribution Group \| Member Removed from Distribution Group \| Group Attributes New and old Value \| Group Attributes Changes \| Group Modified \| Group Moved Computer Management Computer Created \| Computer Deleted \| Computer Modified \| Computers Enabled \| Disabled Computers \| Computer Attributes Changes \| Computer Attribute New and Old Value \| Computer Moved OU Management OU Created \| OU Deleted \| OU Modified \| OU Attributes Changes \| User Moved GPO Management GPO Created \| GPO Deleted \| GPO Modified \| GPO Link Changes Contacts Management Contacts Created \| Contacts Deleted \| Contacts Modified Container Management Container Created \| Deleted Container \| Container Modified \| Container Permission Changes Password Settings Changes
DNS	DNS Node Added \| DNS Node Deleted \| DNS Node Modified \| DNS Zone Added \| DNS Zone Deleted \| DNS Zone Modified \| DNS Permission Changes
GPO	GPO Created \| GPO Deleted \| GPO Modified \| GPO Link Changes
Others	Schema Changes \| Schema Permission Changes \| Configuration Changes \| Configuration Permission Changes \| Site Changes
Local Logon Logoff	Local Logon Success \| Local Logon Failures \| Logoff \| Other Local Logon	Local Logon Success Interactive Logon success \| Network Logon success \| Unlock the System \| Remote Interactive Logon Success \| CachedInteractive Logon Success Local Logon Failures Interactive Logon Failure \| Network Logon Failure \| Logon Failure when Unlock the machine \| Remote Interactive Logon Failure \| CachedInteractive Logon Failure Logoff Other Local Logon Session disconnected from winstation \| Session reconnected to winstation \| The workstation was locked \| The workstation was unlocked \| The screen saver was invoked \| The screen saver was dismissed

Steps to select the above sub modules and the reports therein

Select a "Category" from the following options: Logon Activity | File Activity | AD Objects | DNS | GPO | Others | Local Logon Logoff
Every category will have a set of sub-modules and thereupon clicking ´>´ a set of reports will appear.
Then, users can choose the change events to be audited in the particular domain.

Columns to be Displayed

After choosing the audit report category & the reports to track the desired ´change events´, it is time to select the columns that display the crucial audit data. By default ´Selected Columns´ section will display the recommended colums; user can de-select & add columns of preference.

Category	Available Columns
Logon Activity	User Name \| Client IP Address \| Client Host Name \| Where \| Logon Time \| Event Type \| Failure Reason \| Domain \| Remarks \| Logon Service \| SID \| Event Number \| Event Code \| Failure Code \| Record Number
File Activity	Where \| File Folder Name \| Location \| UNC Name \| Time Accessed \| User Name \| Process Name \| Remarks \| Absolute Name \| Accesses \| Access Mask \| Client Domain \| Client Login ID \| Client User Name \| Domain \| Event Number \| Event Type \| Handle ID
AD Objects	Account Name \| Account Domain \| Account SID \| Caller user name \| Caller user domain \| Caller Logon Id \| When \| Event Number \| Message \| Where \| Remarks \| Record Number \| Caller User SID \| Event Code \| Object Name \| Modified Attributes \| Target Object Class \| New value
DNS	Object Name \| Modified Time \| Where \| Remarks \| Message \| Modified Attributes \| Target Object Class \| Event Number \| Event Type Code \| Caller User SID \| Record Number \| New value \| Old Value \| Permission Changes \| Domain \| Account Name \| Caller Logon Id \| Caller user domain
GPO	Object Name \| Modified Time \| Where \| Remarks \| Message \| Modified Attributes \| Target Object Class \| Event Number \| Event Type Code \| Caller User SID \| Record Number \| Old Value \| New value \| Client Domain \| Permission Changes \| New GPO Name \| Parent Object \| New GPO Distinguished Name

Filters

Set time duration based "Equals & Not Equals" event filters based on the above columns.

You can also group filters based on a "And", "Or" pattern.

Charts

ADAudit Plus displays the graphical part of the audit data as graphs and the user can chose the chart type for the custom reports, which they thinkwill suit their audit report format.

Scheduler

The custom report can be sent to the email-id(s) entered in the text box "specify email address" on providing a check against "Email this scheduled report".

Category	Reports
Hourly	If you want to schedule this report to run every hour, enter the time after which this report has to run every one hour.
Daily	If you want to schedule this report to run everyday, enter the time at which this report has to run every day. With the data being fetched 24 hours from time of schedule (or) The previous day (0:00 hours to 23:59 hours).
Weekly	If you want to schedule this report to run every week, enter the day and time at which this report has to run every week. With the data being fetched 7 days from day of schedule (or) The previous week (Sunday to Saturday).
Monthly	If you want to schedule this report to run every month, enter the day and time at which this report has to run every month. With the data being fetched 30 days from day of schedule (or) The previous month (Day 1 to Day 30).
Business Hour	This option enables the administrator to set the business hours for reports to filter the results based on: All Hours\| Business Hours \| Non Business Hours

Provided below are the steps to schedule an hourly report

The "Schedule" will be scheduled to run once every hour.

Select the "Hourly" Radio option under "Schedule Report Frequency"
Enter the Starting time for the Schedule. This schedule will be run on a Hourly basis from the start time selected.

Previous Hour - When a user selects the "Previous Hour" option from the drop down. The data will be fetched once everytime the clock ticks a valid hour. Eg. (9:00 o' clock, 10:00 o' clock etc.,)
Last 60 minutes - This depends on the start time selected. The data will be fetched exactly 1 hour (60 minutes) from the time selected as start time.

Email Notification requires

Configuring the "Message Settings"
Emailing the Scheduled Report

Message Settings

The "Message Settings" need to be configured to define the text message and the format (link or attachment) in which the scheduled report will be delivered to users email ids.

To configure the "Message Settings"

Click on the "Message Settings" link under Email Notification
Select the options of your choice from the pop-up menu that is displayed.
Enter the Mail content Entering the " Subject" and "Message" in their respective boxes provided.
Click on OK.

Options selected to email or publish a scheduled report

Email Reports as an attachment	Reports are emailed as an attachment. The format of choice is selected under "Schedule Report Format" and could be any of the slected formats pdf, csv, html or xls.
Email Reports as a Zip File	The selected reports are compressed to a zip format and emailed.
Publish the report and email the link alone	Selecting this option the reports are published and the published link alone is emailed to users.
Email Empty Reports	Selecting this option will ensure, irrespective of the event occurrence, an empty report email will be sent.

Emailing a Scheduled Report

To notify a scheduled report by email:

Provide a check against "Email this scheduled report" under Email Notification section.
Specify email address in the Text box that is displayed.
Click on save.

This will email the scheduled report in the desired format (selected under "Message Settings") to all the entered email addresses.

Privacy

The custom report privacy can be set to "Everyone (Public)" & "Just me (Private)". The user can chose the folder where the reports can be saved. By default, the custom reports will be saved under "My Reports"

The Scheduled Reports can be stored in 'pdf', 'xls', 'html', or 'csv' formats by selecting the format of choice from the drop down. They are stored in the "File Storage Path" entered by clicking on the "File Storage Path" link.

The default "File Storage Path" is ' <Installation Folder>\webapps\adap\schedule-reports\ '. The user can enter any desired storage path for the scheduled reports.
The "File Server Path" is ' \\fileserver\auditing\scheduled-reports\ '
On a different drive it is 'D:\Auditing\Reports\ '

How To View a Custom Report

Click on the "Reports" Tab > "Custom Reports" on the right side.
Select the Domain from the drop down box, to view the respective custom reports.
Click on the "View Reports" link on the right.

Also, the custom reports can be viewed from Reports > My Reports.

How To Edit a Custom Report

Click on the "Reports" Tab > "Custom Reports" on the right side.
Select the Domain from the drop down box, to view the respective custom reports.
Click on the "Customize" link on the right.
Modify the required settings and click on Update.

How To Delete a Custom Report

Click on the "Reports" Tab > "Custom Reports" on the right side.
Select the Domain from the drop down box, to view the respective custom reports.
Click on the "Delete" link on the right.

Also, the custom reports can be deleted from Reports > My Reports. Click on the icon.

ManageEngine