Audit and remediation rules

When you create an audit or a snapshot specification, you must configure Audit and Remediation rules. These rules define:

  • The type of server object to snapshot or audit and compare. These are objects such as the server’s file system, hardware information, application configurations, installed patches or software, users and user groups, and so on.
  • Information about the object to audit or snapshot. For example, for a server’s file system, you can capture Windows NT file’s Access Control Levels. For an application, you can capture the application configuration values you want to snapshot or audit, plus any remediation values that specify whether differences are discovered between the rule and the actual value that is on the target server.

Note For ESXi servers, you can only configure rules for two objects: compliance checks and custom scripts.

A rule can contain a custom script that determines whether all passwords stored in a file match a certain character length. A rule can also include a check to determine whether a particular Windows Service is running or disabled on a server. For some rules, you can also specify the remediation value for the server object if the value defined in the audit or snapshot differs from the server’s value after the audit has run. For example, if a Windows Service is disabled, you can specify that the remediation value should restart the service. Remediation values are implemented manually, after the audit has run, from the Audit Result window. For more details, see Audit results .