Security

Reply
TQ
Occasional Contributor I

How to see who changed guest account and when ?

Hello,

Is there a way i can see who changed guest acount (expiry time) and when? Do i have to look for it in "Event Viewer" ? I think i can only go back 3 days by default.

 

Cheers

Guru Elite

Re: How to see who changed guest account and when ?

You should see this info in Audit Viewer in CPPM and also in the application log in Guest.


Tim Cappalli | Aruba Security TME
@timcappalli | timcappalli.me | ACMX #367 / ACCX #480
TQ
Occasional Contributor I

Re: How to see who changed guest account and when ?

Thanks Tim for the quick reply.

 

I have checked Audit Viewer and found entry for the guest account but i don't know how to read it. Can you please help me with that, i have attached a screenshot. How do i find out when was it changed (expiry) and by whom ?

 

Secondly, do i have to check for logs in configured external Syslog server or i can see logs within CPPM somewhere ?

Guru Elite

Re: How to see who changed guest account and when ?

Here's your screenshot with overlaid comments:
guest-audit-changeaccount.png

These logs can also be sent to a SIEM via syslog.

 

Y\ou can also see the changes in the Application Log on the guest side.


Tim Cappalli | Aruba Security TME
@timcappalli | timcappalli.me | ACMX #367 / ACCX #480
TQ
Occasional Contributor I

Re: How to see who changed guest account and when ?

Thanks Tim, it's now clear to me :)

 

Last question:

Application Log on the guest side ??? Is there a way i can see it ? or it's only guest who would have got this information/log ?

Guru Elite

Re: How to see who changed guest account and when ?

Yes, you can. It's an administrative view. See screenshot below:

cpg-application-log.PNG


Tim Cappalli | Aruba Security TME
@timcappalli | timcappalli.me | ACMX #367 / ACCX #480
TQ
Occasional Contributor I

Re: How to see who changed guest account and when ?

Thanks Tim,

 

I only see top entry in Application Log, perhaps it keeps records for lesser period as compared to Audit Viewer. Do i check timers in Cluster Wide Paramaters (attached) ?

Search Airheads
cancel
Showing results for 
Search instead for 
Did you mean: