Alert notification for group membership changes

Question

Hi, 
 I am looking for an assistance in quest intrust. 
 Whenever AD group membership changes occurs particular group owner should get email notifications. 
 I have tried in quest change auditor but no results. 
 Please assist me on this. 
 
 Regards 
 P. Balasubramaniam

Igor.Ilyin · Accepted Answer

Hi mcsebala, This can be achieved if you have InTrust 11.3.1 or later, with little customization efforts. In case you have an older version, need to upgrade to 11.3.1 or later . Find the InTrustPDOImport.exe tool in InTrust installation folder or on DVD and run the following commands on InTrust server box under InTrust admin account: InTrustPDOImport.exe -import "Group's Manager Address Discovery.xml" InTrustPDOImport.exe -import "Group's Manager.xml" Group's Manager.xml {A7B4859C-DFB4-43C1-9868-9516BEB7CF3E} {D7FFB57E-D7CB-42C4-B49B-9135D26D7E84} {CCD38DDB-5F5E-466E-B9FC-33E9D84F0438}

01000000000000000000000000000000

{0E9BDFCB-7463-499A-A52C-C663CB9FFFC8} {AFD650D9-E6E2-4134-B253-4EF173987722}

0100000000000000

{F4F57A86-AADE-4BF2-9181-EB4CB5905310} {777B357E-4C5C-4029-8CBF-F89BEAC34178}

01000000260000007B00460041003700370035003500350030002D0039004100420034002D0034004400320043002D0038004400340045002D003500440030004100450032003300350045004300370038007D0021000000470072006F00750070002700730020004D0061006E00610067006500720020004100640064007200650073007300200044006900730063006F007600650072007900

{BD5388DC-BCD8-423D-97A8-81B18CAE935B} Group's Manager Address Discovery.xml {FA775550-9AB4-4D2C-8D4E-5D0AE235EC78} {832BD5B4-61BE-487D-BFA0-96C6BD7E8F89} Discovers the email address of the user which is specified in ManagedBy attribute of the Group. Can be used with Group Membership events only. Search Scope {5C58B8F8-1D8D-4928-8C72-625B3A00C2A4} 2 0-base, 1-one level, 2-subtree Need Deep Search {EB4CD1AA-055C-4585-B200-6B1200D67A32} 1 Lookup the attribute in domains if not found in a Global Catalog. 1-yes, 0-no After that, open InTrust Manager anew and observe the new objects, "Configuration|Personnel|Operators|Group's Manager" and "Configuration|Advanced|Scripts|Group's Manager Address Discovery". "Group's Manager" operator can be used instead of (or along with) standard Operator in the monitoring policy that includes the predefined rules "Group member added by unauthorized personnel" and "Group member removed by unauthorized personnel" or the rules that are based on these two. Note that email address will not be resolved if you try to use "Group's Manager" operator in the policy with other rules e.g. "Group created by unauthorized personnel". This is because "Group's Manager Address Discovery" script relies on certain string numbers of the certain group membership management event IDs. To cover the latter scenario, need to create another script and another operator.