NetIQ adds monitoring, auditing to directory tools

NetIQ last week released software that tracks changes in Active Directory. The tool is intended to provide corporate users with another weapon for handling compliance regulations.

WithChange Guardian for Active Directory, users can audit and monitor directory changes in real time. Unauthorized or misconfigured changes can lead to users getting inappropriate access or to the opening up of security vulnerabilities. The tool plugs into NetIQ's Security Manager software or is available as a management pack for Microsoft Operations Manager.

"I am getting the ability to use a microscope and look at exactly what I want to look at," says David Valcik, vice president of information technologies at Beverly Enterprises in Fort Smith, Ark., which provides healthcare services to the elderly. Today the company uses NetIQ's Security Manager to audit the directory, which supports 45,000 users and 52,000 objects, but the software forces Valcik's staff to manually sift through log files.

"Anytime we can provide a tool to reduce the cost of auditing, and we can put some controls in place to leverage the tool - that is a win-win situation. If our auditors [internal and external] get comfortable that these tools are solid, it just helps us meet our requirements for Sarbanes-Oxley," Valcik says.

Change Guardian breaks down directory changes into three categories: managed, unmanaged and high-profile. Users can adapt this model to the current tools and procedures they use to manage Active Directory.

The managed-change category includes every change - such as the addition and deletion of users - that is made through the authorized interfaces defined by a company's policies, such as having NetIQ Directory and Resource Administrator as its Active Directory management tool.

Anything not going through an authorized interface - for example, an administrator using native Active Directory tools to add or delete users - is categorized as unmanaged change. This allows users to identify and investigate when changes are made outside normal operational procedures.