Hello,
I have Change Auditor (release 6.8) auditing an ISILON, and I able to get an alert when a permission or access is changed over an SMB shared folder.
The problem is that the report not show de old value. The value FROM is empty, so I can't know what change or what was the value before the change. Example of event reported:
Action: Modify Attribute
From:
To: Permission Allow (CASA\C00056) Full Control This file only Inherited Permission Allow (CASA\TAdmin) Full Control This file only Inherited Permission Allow (CASA\h03046) Full Control This file only Inherited Permission Allow (CASA\Usuarios_SI) Full Control This file only Inherited Permission Allow (CASA\DELLISILON) List Folder / Read Data + Read Attributes + Read Extended Attributes + Read Permissions This file only
Result: Success
I see at https://support.quest.com/technical-documents/change-auditor-for-active-directory/6.9.1/user-guide/14#TOPIC-638044, the following note:
From | To |
Displays the old value that was assigned to the object and the new value that is now assigned |