Installation guide

6
Auditing Security Changes in Your
Environment
Auditing Security Changes in Your
Environment
The VCM Auditing capability tracks all changes in the security aspects of VCM. Security-related events are
written to the Windows Event Log, which is stored on the Collector, and is independent of the VCM
application. The format of the event log prohibits any modifications to the recorded entries, which makes
it a secure and tamper-proof auditing record of changes in security.
When you perform an action in VCM that affects security, and the auditing setting that corresponds to
that change is enabled, the event is written to the event log.
Examples of VCM actions that cause events to be written to the event log include user log on and log off,
session timeouts, changes in managing users, changes to passwords and administration settings, changes
in network accounts and authority, collection requests, and service and registry changes.
VCM supports the ability to create numerous audit records.
Figure 6–1. VCM Auditing
Prerequisites
Log in as a user who has the Admin role assigned.
VMware, Inc.
85