Cancelling an Active Remediate Audit Results Job

In the SA Client, you can terminate an active remediate audit results job. An active remediate audit results job is one that has already started and is running.

The terminate action on an active remediate audit results job is known as a soft-cancel. A soft-cancel is the activity where a job was partially run and then stopped when you clicked End Job in the Job Status step in the Remediate Audit results wizard. Soft-cancel applies only to an active remediate audit results job that you want to stop.

You must have permissions to cancel a remediate audit results job that is in progress. In general, if you have permission to start a remediate audit results job, you will also be able to stop a remediate audit results job that is running. In addition, if you have the Edit or Cancel Any Job permission, you will be able to soft-cancel a running remediate audit results job. For more information on audit-related permissions, seet he SA 10.50 Administration Guide. To obtain these permissions, contact your SA administrator.

To stop an active remediate audit results job:

1. In the Job Status pane, click End Job.
   
   This button is enabled only when the job is in progress.
2. The End Job dialog will display. This dialog briefly describes how job termination works:
   • The job will not initiate work on any additional servers.
   • If work has started on a server, the job will cancel any steps that can be skipped.
   • The Job Status will indicate the steps that were completed or skipped.
3. If the job ends successfully, the final job status will display as Terminated.
4. Click OK to confirm that you want to terminate the job. The Job Status window displays the progress of the termination action.
   
   The job status will be Terminated. The server status will be Cancelled. The task statuses will be Succeeded or Skipped.
5. When the termination is complete, you can also view the job in the SA Client Job Log.
   In the SA Client navigation pane, select Jobs and Sessions. The Job Logs view displays your job with a Terminated status.
   

Viewing and Remediating Object Differences

For many server objects, such as Users and Groups, IIS Metabase, Windows Registry, and so on, when there are differences between the source object and the target object, you can view differences in object properties side by side. Each server object will show different windows, depending on the object and if the audit rule set was comparison-based (comparison between source and target) or value-based (comparison between user-defined audit rule and target).

For some value-based audit rules, you can remediate the values on the target server.

To view the contents of two objects that differ:

1. In the navigation pane select Library > By Type > Audit and Remediation > Audits.
2. Select an audit.
3. In the details pane below the audit list, you see all audit results associated with the selected audit.
4. Select an audit result, right-click, and select Open.
5. In the Views pane, expand one of the target servers and select a result.
6. In the Views pane, select an object.
7. In the content pane, select the On Both but Different tab.
8. In the content pane, select an object, right-click, and select Open. You will see a window that shows the differences between the object as defined the audit and the object on the target server.
   
   The example in the following figure displays the audit Result differences, showing an attribute of the object that exists on the server but does not exist on the source server.
   
   Comparison-Based Audit Results Difference
   
   
   For a value-based rule, the difference window will be slightly different and will also include a Remediate option, if remediation is possible. This difference window displays the audit rule, including the policy value and the actual value found on the target server. The example in the following figure shows the permissions differences for a value-based Windows Registry rule.
   
   Rule-Based Audit Results: Permissions Differences
   
9. To remediate the differences, select the Remediate check mark next to each rule.
10. From the Actions menu, select Remediate.
11. In the Remediate window, follow the steps to run or schedule the remediation. For more information on remediating audit results, see Viewing and remediating audit results differences.