Elevation Activity Report
This report allows you to track which rules were used to elevate processes during a period of time on managed client computers. With this report, you can see when users have run privileged processes and on which computers.
Each privilege Elevation event reported contains these details:
- Type: The privilege Elevation rule type.
- Elevated Item: The path to the elevated application or command with the argument (if any).
- Rule Name: The privilege Elevation rule name.
- Rule GUID: The privilege Elevation rule globally unique identifier (GUID).
- User (Domain\Name\OU): The user, domain name, and OU.
- Computer (Domain\Name\OU\Class\OS): The computer, domain name, OU, class, and OS.
- Elevation Time: The time of the privilege Elevation on the client computer.
To learn how to create this type of report and manage the data, see Generating and using reports.
Blacklist Activity Report
This report allows you to track which rules were used to Blacklist processes during a period of time on managed client computers. With this report, you can see when users have attempted to run blacklisted processes and on which computers.
Each Blacklist event reported contains these details:
- Type: The privilege Elevation rule type.
- Blacklisted Item: The path to the blacklisted application or command with the argument (if any).
- Rule Name: The privilege Elevation rule name.
- Rule GUID: The privilege Elevation rule globally unique identifier (GUID).
- User (Domain\Name\OU): The user, domain name, and OU.
- Computer (Domain\Name\OU\Class\OS): The computer, domain name, OU, class, and OS.
- Blacklisted Time: The time of the blacklisted event on the client computer.
To learn how to create this type of report and manage the data, see Generating and using reports.
Rule Deployment Report
This report tracks the overall usage of privilege Elevation rules across a domain. The report lists each rule, showing how many clients it has been deployed to and how many times it is used.
Each record about a deployed rule contains these details:
- Rule Name: The privilege Elevation rule name.
- Rule GUID: The privilege Elevation rule globally unique identifier (GUID).
- For a Summary report:
- # Comp: The number of client computers on which the rule is deployed.
- # Used: The number of times the rule has been enforced.
- For a Details report:
- User (Domain\Name\OU): The user, domain name, and OU.
- Computer (Domain\Name\OU\Class\OS): The computer, domain name, OU, class, and OS.
- Deployed Date: The date the rule was deployed on the client computer.
To learn how to create this type of report and manage the data, see Generating and using reports.
Instant Elevation Report
This report allows you to track Instant Elevation activity during a period of time on managed client computers. With this report, you can see when users have been granted Instant Elevation privileges and on which computers.
Each privilege Elevation event reported contains these details:
- Type: The privilege Elevation rule type.
- Elevated Item: The path to the elevated application or command with the argument (if any).
- Rule Name: The privilege Elevation rule name.
- Rule GUID: The privilege Elevation rule globally unique identifier (GUID).
- User (Domain\Name\OU): The user, domain name, and OU.
- Computer (Domain\Name\OU\Class\OS): The computer, domain name, OU, class, and OS.
- Elevation Time: The time of the privilege Elevation on the client computer.
To learn how to create this type of report and manage the data, see Generating and using reports.
