Configuring the Windows/UNIX users and groups rule

The Windows or UNIX Users and Groups rule allows you to access local users and groups information from Windows and UNIX servers.

To configure the users and groups rule:

1. Create the new audit using one of the methods in Creating an audit . (If you want to create this rule for a snapshot specification, see Creating a snapshot specification .)
2. Select an Audit Source: Server, Snapshot, Snapshot Specification, or No Source. (Some audit rules, such as Application Configuration and Windows User’s and Groups, must have a source.)
3. In the Audit window, from the Views pane, select Rules > Windows/UNIX Users and Groups.
4. In the content pane of the Audit window, expand the top level node in the Available for Audit section and select a Users and Groups rule that you want to create a rule from.
5. Click the right arrow button to move the rule object into the Selected for Audit section. All Users and Groups rules that you configure will be audited on the target servers or snapshot specification.
6. For each rule, select one of the following check types:
   • Property Values: A values-based check that checks individual properties of the target object. For this type of check, each object requires that you build an expression that defines properties related to the object using the drop down lists at the bottom of the rule window. You can specify a unique operator which, depending on the type of object, can be a String, a Number (integer or float), Boolean (comparing values of ‘true’ and ‘false’), Date (a date compare, not a time of day compare), or an Array. For some property types you can select the values from the ‘value selector box’.
   • Equivalent to source: A comparison check that performs a one to one comparison between the object on the source vs. the target servers. In this type of check, the values of each property selected from both the source and target servers must match exactly for the object to be compliant.
   • Non-existence: Checks for the non-existence of an object, to determine if it does not exist on the target server. If the object exists on the target server, then the rule is out of compliance. Note that, at runtime, the source server, if any, is not queried.  Also, if a Wildcard rule object is selected, it will only apply to the target server.
7. You can also configure a rule based on a wildcard search by selecting the Wildcard rule object .
   
   When you select this object, a Name field displays in the rule configuration section at the bottom of the window. Enter a name (primary key) that will be searched on the target server.
   
   For example, you could enter an asterisk (*) that would match everything on the target. P* would match all objects that begin with a capital P, while *P would match all users with name ending with uppercase character 'P'.
   
   After you enter a name or wildcard string, you can configure the rule parameters as you did in step 6.
   
   It is important to notice that when using wildcard, all matching objects are restricted by the rule configuration. This type of audit rule is considered compliant if all found objects match the rule parameters.
8. To finish configuring the audit, set the target servers, any rule exceptions, the schedule, and the notification for the audit.
9. To save the audit, from the File menu, select Save. You can also save the Audit as a policy. See Saving an audit or a snapshot specification as an audit policy.
10. To run the audit, from the Actions menu, select Run Audit. See Running an audit .