Types of audit comparison

In general, an audit can contain the following types of comparisons, based on the source of the audit:

  • Comparison: An audit based on configuration values from a source server or source snapshot specified at the time the audit is created. The source server or server snapshot is also known as a golden server. For example, you might want to compare file directories or file contents, registry structures, IIS Metabase entries, or user group settings among managed servers. Using a snapshot as the source of an audit, you can compare the snapshot with other servers in your facility.
    Comparison audits can perform the following types of comparisons:
    • Property: Checks the property of a selected object or object configuration. For example, you could check the release version of a patch on a target server or multiple servers, to make sure it matches what you expect to be installed on the targets. You can select this version number based on a source server or snapshot or add your own value.
    • Equivalence: Checks to determine that a target server configuration is the same between the source server or snapshot of the audit. For example, you could check to see if the target of the audit has the same user group as a group you selected from a source server.
    • Non-existence: Checks for the non-existence of an object, to determine if it does not exist on the target server. If the object exists on the target server, then the rule is out of compliance. For example, you could check a server to make sure it does not contain a specific COM+ object. Note that, at runtime, the source server, if any, is not queried.  Also, if a Wildcard rule object is selected, it will only apply to the target server.
  • Value-based (user-defined): An audit based on custom, user-defined values for each server object (file system, windows services, IIS Metabase, users and groups, and so on). These values can be derived from a source server, SA attributes, or custom attributes. This type of audit includes those based on an audit policy. In an audit policy, a policy setter pre-defines values for each configuration object, based on company or industry compliance standards.