Hello.
I have the Change Auditor for AD Queries module. I'd like to create a search that would return all AD queries which touched a particular AD attribute on user objects in an OU and all child OUs.
The searches I have created return some results, but not everything.
Here is what I tried.
Created a new search then under the what type used the AD -> Subsystem -> AD Query
In the "Add Active Directory Container" window under Scope I picked "This object and all child objects", in the attributes field I typed in the attribute I'm interested in. In the object picker I selected an OU which contains other OUs and the user objects I'm interested in, I then clicked Add. When I run the search I don't get any results.
I created a different search which did return some results.
In the "Add Active Directory Container" window under Scope I picked "This object and all child objects", in the attributes field I typed in the attribute I'm interested in. In the object picker I selected an OU which contains other OUs and the user objects I'm interested in, then I selected all the user objects and added those directly to the search criteria. After doing this the search criteria contained hundreds of user objects, and no OUs. When I run that search I do get some results, but I have a feeling some stuff is still missing.
Is there a way to build a search that allows me to specify an OU (rather then individual user objects) and an AD attribute and see all queries against that attribute for all child objects of the OU?
Any help would be appreciated.
Craig