Navigation:  Monitoring with EventSentry > Compliance Tracking >

Policy Change Tracking

Policy Change Tracking intercepts various events related to policy changes, such as the change of a domain password policy or the assignment of a user right.

Policy Changes

Tracks all policy changes, including:

User Rights Changes

Tracks when user rights are assigned to or removed from user accounts, e.g. the "Create a pagefile" right.

Logon Rights Changes

Tracks when logon rights are granted or removed from user accounts, e.g. the "Logon as a service" right.

Trust Relationship Changes

Tracks all changes to trust relationships, including the creation, modification and removal of trust relationships.

Retrieve Source IP Address and Computer Name

When the logon id contained in the monitored event can be linked (correlated) to an earlier logon session, then EventSentry will include the IP address and/or host name. In the case that only the host name or IP address are available, a DNS (reverse) lookup will be performed to gather the missing information.

Due to the nature of DNS lookups, this information should be used with caution and might not be 100% accurate.