Viewing and remediating audit results differences

For some objects in an audit result, you can view those differences between object that exist on both the target and the source and that have differences between them. You can also see what is different about them and remediate them, if necessary.

For some audit rules, you can view general differences, such as a service’s status, the release number for a patch, a registry key’s value, and so on. For other server objects, such as files, you can view the differences of the file’s contents.

For some rules, such as file system, you can view differences between files side by side and line by line. You can see lines that were added, deleted, or modified.

To view and remediate contents of two files that differ in an audit:

1. In the navigation pane select Library > By Type > Audit and Remediation > Audits.
2. Select an audit.
3. In the details pane below the audit list, you see all audit results associated with the selected audit.
4. Select an audit result, right-click, and select Open.
5. In the Views pane of the Audit Result window, expand one of the target servers and select a result.
6. In the content pane, expand a target server and select one of the results.
7. Next, in the content pane, select the On Both but Different tab.
8. Select a file, right-click, and select View Differences.

9. In the Comparison window, select an item from the Encoding drop-down list to specify the character encoding of the data displayed.

   Note If the file in question exceeds 2MB in file size, Audit and Remediation cannot display the file differences.

10. Click the arrows to find the first, next, previous, or last lines that were added, deleted, or modified. Differences are highlighted according to the following color scheme:
    • Green: This content was added.
    • Blue: This content was modified.
    • Red: This content was deleted.
    • Black: No changes were made to this content.
11. Click Close to close this window.
12. To remediate file differences, from inside the Audit Result window, select either the Only On Source tab or On Both But Different tab, select a file, right-click and select Remediate.
13. In the Select Server window, select a server you want to copy the file from the source to, and then click OK.