Overview
Auditing can be used to track changes in the LabTech system and notify technicians of significant events such as the creation or modification of client scripts, groups, script schedules, alert templates, maintenance windows, blacklist items, etc.
Most of the actions that can be performed in the LabTech system can be audited. Each action that can be audited is assigned an audit level from 0-5 (0= Nothing, 1=Critical, 2=Significant, 3=Informational, 4=Normal and 5=Everything). When an action occurs, the audit action level is compared to the auditing level of the user. If the level set for the user is greater than or equal to the audit action level, it will be added to the audit trail.
For example, if Technician A has an auditing level of '1' and adds a client, it will not be audited because the audit action level for 'Client Add' is 3. However, if Technician B has an auditing level of '4' and adds a client, it will be audited because his audit level is greater than the audit action level.
 |
NOTE: To edit a LabTech user's auditing level, expand Admin > Users in the Navigation Tree and double-click on a user. Select the Permissions tab and choose an Auditing Level from the drop-down. The Auditing Level drop-down defaults to 'None'. (0= Nothing, 1=Critical, 2=Significant, 3=Informational, 4=Normal and 5=Everything). For more information about users in LabTech, refer to the User Access documentation. |
Figure 1: User - Permissions Tab
To access the Auditing screen:
- From the Control Center, select Dashboard > Management > Auditing.
Figure 2: Auditing Screen
![Figure 2: Auditing Screen]()
Table 1: Auditing Actions List
| Action | Default Level | Description |
| All Actions | Displays the history of all auditable actions in the LabTech system. | |
| Additional Field Modify | 1 | Displays extra data fields that have been added or edited in Dashboard > Config > Configurations > Additional Fields). |
| Additional Field Data Delete | 1 | Displays extra data fields where the data has been deleted using the Delete All Values or Delete Values on Tab option. |
| Additional Field Delete | 1 | Displays extra data fields that have been deleted in Dashboard > Config > Configurations > Additional Fields. |
| Backup Config Altered | 1 | Displays any instances of editing the remote backup on the computer or location. |
| Blacklist Config Altered | 1 | Displays the entries on the application blacklist that have been altered in Dashboard > Config > Configurations > App Blacklist. |
| Change Mobile Device Client | 1 | Displays any instances of where the client has been changed on mobile devices. |
| Change Mobile Device Contact | 1 | Displays any instances of where the contact has been changed on mobile devices. |
| Change Mobile Device Location | 1 | Displays any instances of where the location has been changed on mobile devices. |
| Clear Alerts | 3 | Displays each instance that an alert has been cleared or deleted. |
| Clear Maintenance Mode | 1 | Displays each instance where a maintenance mode has been cleared. |
| Client Add | 3 | Displays each instance where a client has been added and includes the new client name. |
| Client Delete | 1 | Displays the clients that have been deleted. This action is reversible. Removals that have been made can be undone, by clicking the Undo button. |
| Client Modify | 2 | Displays each instance where changes were made to the client. This action is reversible. Modifications that were made can be undone, by clicking the Undo button. |
| Client Permission Changed | 1 | Displays each instance where the client permissions have been changed. Includes the client name. |
| Closed Ticket Wizard | 5 | Displays each instance where the Ticket Wizard was closed without the ticket being saved. |
| Command Attempt | 4 | Displays any instances of a command being sent to a computer. |
| Contact Add | 3 | Displays each instance where a contact has been added. |
| Contact Delete | 1 | Displays each instance of a contact being deleted. This action is reversible. Removals that have been made can be undone by clicking the Undo button. |
| Contact Modify | 2 | Displays each instance where changes were made to a contact. This action is reversible. Changes that have been made can be undone by clicking the Undo button. |
| Control Center Config Altered | 1 | Displays each instance where changes were made to the Dashboard > Config > Control Center. |
| Create Item | 2 | Displays each instance where an item has been created (e.g., client, location, project, etc.). |
| Custom Command Config Altered | 1 | Displays each instance where a custom command has been added or edited. |
| Custom Report Config Altered | 1 | No longer in use. |
| Delete Command | 5 | Display each instance where the Remove Command option has been used. |
| Delete Item | 1 | Displays each instance where an item has been deleted (computers, clients, locations, etc.). |
| Delete Mobile Configuration Class | 1 | Displays each instance where a mobile configuration class has been deleted. |
| Delete Mobile Device | 1 | Displays each instance where a mobile device has been removed from the Mobile Device Manager. |
| Delete Mobile Group | 1 | Displays each instance where a mobile group has been deleted. |
| Device Delete | 1 | Displays each instance where a network device has been deleted. This action is reversible. Removals that have been made can be undone by clicking the Undo button. |
| Device Modify | 2 | Displays each instance where a network device's information has been modified. This action is reversible. Modifications that have been made can be undone by clicking the Undo button. |
| Disk Cleanup Config Altered | 1 | Displays modifications to the disk cleanup list in Dashboard > Config > Configurations > Disk Cleanup. |
| Document Added | 3 | Displays each instance where a new document has been added to the client. Original path to document is included. |
| Document Deleted | 0 | Displays each instance where a document has been deleted from the client. This is not reversible. |
| Document Modified | 2 | Displays each instance where a document that is associated with a client has been modified. This is not reversible. |
| Edit Group Internal Monitors | 1 | Displays the internal monitors that have been enabled or disabled inside of a group (Groups > Group > Internal Monitors). |
| Edit Group Patch Settings | 1 | Displays the patches that have been approved or removed inside of a group (Groups > Group > Patches). |
| Edit Group Remote Monitors | 1 | Displays the remote monitors that have been added, deleted or modified inside of a group (Groups > Group > Remote Monitors). |
| Edit Group Script | 1 | Displays the scripts that have been added or deleted from inside of a group (Groups > Group > Scripts). |
| Edit Mobile Configuration Class | 1 | Displays any instances where the mobile configuration class has been modified. |
| Edit Mobile Configuration Class | 1 | Displays the mobile configuration classes that have been changed. |
| Edit Mobile Group | 1 | Displays the mobile groups that have been changed. |
| Edit Mobile Group Permissions | 1 | Displays the mobile permissions that have been changed. |
| Edit Mobile Schedule | 1 | Displays the mobile schedules that have been changed. |
| Edit Mobile Single Device Config | 1 | Displays any instances where a mobile device's configuration has been modified. |
| Edit Mobile System Info | 1 | Displays the mobile system information that has been changed. |
| Edit Mobile Template | 1 | Displays the mobile templates that have been changed. |
| Event Blacklist Config Altered | 1 | Displays the event blacklist (Dashboard > Config > Configurations > Event Blacklist) entries that have been deleted. |
| Extra Field Config Altered | 1 | Displays any instances where an extra data field configuration has been modified. |
| Group Add | 3 | Displays the groups that have been added. To add a group, right-click Groups in the Navigation Tree and select Add Group. |
| Group Delete | 1 | Displays the groups that have been deleted. To delete a group, expand Groups in the Navigation Tree and select an existing group. Right-click and select Delete Group. |
| Group Modify | 2 | Displays the groups that have been modified. To modify a group, expand Groups in the Navigation Tree and double-click an existing group. |
| Group Permission Changed | 1 | Displays the group class permissions (Groups > Group > Main) that have been changed. |
| Information Category Config Al | 1 | Displays the information base categories (Dashboard > Config > Configurations > Information Base Categories) that have been added or edited. |
| Internal Monitor Add | 3 | Displays any instances where an internal monitor has been added to the system. |
| Internal Monitor Modify | 2 | Displays the internal monitors that have been modified. To modify an internal monitor, click the Monitors button in the Control Center and select the Internal Monitors tab. Double-click a monitor to modify it. |
| License Add | 3 | Displays the licenses that have been added to clients. To add licenses, navigate to Clients > Client > License Management and right-click in the window and select Add Licensed App. |
| License Delete | 1 | Displays the licenses that have been deleted from clients. To delete licenses, navigate to Clients > Client > License Management and right-click an existing license and select Delete Licensed App. |
| License Modify | 2 | Displays the licenses that have been modified. To modify a license, navigate to Clients > Client > License Management and right-click an existing license and select Edit License. |
| Location Add | 3 | Displays the locations that have been added. To add a location, expand Clients and right-click a client. Select Locations > Add New Location. |
| Location Delete | 1 | Displays the locations that have been deleted. To delete a location, navigate to Clients > Client and right-click an existing location. Select Locations > Delete Location. |
| Location Modify | 2 | Displays the locations that have been modified. To modify a location, navigate to Clients > Client and double-click an existing location. Alternatively, right-click an existing location and select Locations > Modify Location. |
| Login | 1 | Displays the agent machines that have logged in to the LabTech server. |
| Logout | 1 | Displays the logout dates of agent machines. |
| Menu Config Altered | 1 | Displays the menus (Dashboard > Config > Configurations > Menus) that have been created or edited. |
| Mobile Command | 1 | Displays the mobile commands that have been issued by LabTech. |
| Modify Alert Template | 1 | Displays the alert templates (Dashboard > Management > Alert Templates) that have been modified. |
| Modify Maintenance Window | 1 | Displays the maintenance windows (Dashboard > Management > Maintenance Windows) that have been added, modified or deleted. |
| Monitor Add | 2 | Displays the monitors that have been added. To add a monitor, navigate to Clients > Client > Location and right-click an agent machine. Select Monitors > Add New Monitor. |
| Monitor Delete | 1 | Displays the monitors that have been deleted. To delete a monitor, navigate to Clients > Client > Location > Agent Machine > Monitors and right-click a monitor. Select Monitors > Delete Monitor. |
| Monitor Modify | 2 | Displays the monitors that have been modified. To modify a monitor, navigate to Clients > Client > Location > Agent Machine > Monitors and right-click a monitor. Select Monitors > Modify Monitor. |
| New Mobile Configuration Class | 1 | Displays the new mobile configuration classes that have been created. |
| New Mobile Group | 1 | Displays any instances where a new mobile group has been created. |
| New Mobile Template | 1 | Displays the mobile templates that have been created. |
| Open Item | 5 | Displays all of the windows that have been opened in the Control Center. |
| Password Add | 3 | Displays all of the passwords that have been added to clients. To add a password, navigate to Clients > Client > Passwords and right-click. Select Add Entry. |
| Password Delete | 1 | Displays all of the passwords that have been deleted from clients. To delete a password, navigate to Clients > Client > Passwords and right-click an existing password. Select Delete Entry. |
| Password Modify | 2 | Displays all of the passwords that have been modified. To modify a password, navigate to Clients > Client > Passwords and right-click an existing password. Select Edit Entry. |
| Process Config Altered | 1 | Displays the process list (Dashboard > Config > Configurations > Process List) entries that have been added or edited. |
| Product Key Add | 3 | Displays all of the product keys that have been added to clients. To add a product key, navigate to Clients > Client > Product Keys and right-click. Select Add Product Key. |
| Product Key Delete | 1 | Displays all of the product keys that have been deleted. |
| Product Key Modify | 2 | Displays all of the product keys that have been modified. To modify a product key, navigate to Clients > Client > Product Keys and double-click an existing product key. Alternatively, right-click an existing product key and select Edit Product Key. |
| Property Config Altered | 1 | Displays the properties (Dashboard > Config > Configurations > Properties) that have been added or edited. |
| Quotes Add | 3 | Displays all instances where a quote request has been added to a ticket. |
| Quotes Delete | 1 | Not in use at this time. |
| Quotes Modify | 2 | Displays all instances where a quote request has been modified. |
| Redirected App Config Altered | 1 | Displays the redirected applications (Dashboard > Config > Configurations > Redirected Apps) that have been added or edited. |
| Region Config Altered | 1 | Displays the regions (Dashboard > Config > Configurations > Regions) that have been added or edited. |
| Report Add | 3 | Displays the reports added to LabTech from external files. To add a report, navigate to Admin > Reports in the Navigation Tree. Right-click and select Reports > Add Report. Select a report type from the drop-down and click Add New to add a report. |
| Report Delete | 1 | Displays the reports deleted from LabTech. To delete a report, navigate to Admin > Reports in the Navigation Tree. Select a report on the screen and right-click and select Delete to delete the report. The report file (e.g., ClientReport.rpt) must still be manually deleted from L:\Reports. |
| Report Run | 3 | Displays any instances where a report was run via the navigation tree or Report Manager. |
| Retired Asset Add | 3 | Displays all of the agent machines that have been added to the Retired Assets section of the Navigation Tree. To retire an agent machine, navigate to Clients > Client > Location and right-click an agent machine. Select Delete PC. |
| Retired Asset Delete | 1 | Displays all of the agent machines that have been removed from the Retired Assets section of the Navigation Tree. To un-retire an agent machine, navigate to Clients > Client > Location > Retired Assets. Right-click an existing retired asset and select Restore Agent. |
| Run Report | 1 | Displays all of the reports run in the LabTech system. |
| Save Config | 1 | Displays the date that the system configuration was saved. |
| Save Data | 2 | Displays any instances of data being saved throughout system (e.g. client, location, etc.). |
| Schedule Add | 3 | Displays the schedules that have been added. To add a schedule, navigate to Admin > Schedules in the Navigation Tree. Right-click and select Schedules > Add Schedule to create a new schedule. |
| Schedule Delete | 1 | Displays the schedules that have been deleted. To delete a schedule, navigate to Admin > Schedules in the Navigation Tree and select an existing schedule. Right-click and select Schedules > Delete Schedule to delete the schedule. |
| Schedule Modify | 2 | Displays the schedules that have been modified. To modify a schedule, navigate to Admin > Schedules and select an existing schedule. Right-click and select Schedules > Modify Schedules to edit a schedule. |
| Schedule Script | 1 | Displays all of the scripts scheduled by the user. To schedule a script, right-click a client, location, agent machine, group or search and select the script within the Scripts menu. Select the Start Date and Time and the schedule for the task and click Create. |
| Script Add | 3 | Displays all of the scripts that have been added. To add a script, expand Scripts in the Navigation Tree and right-click a script folder. Select Scripts > Add New Script. |
| Script Delete | 1 | Displays all of the scripts that have been deleted. To delete a script, navigate to Scripts > Script Folder and right-click an existing script. Select Scripts > Delete Script. |
| Script Modify | 2 | Displays all of the scripts that have been modified. To modify a script, navigate to Scripts > Script Folder and right-click an existing script. Select Scripts > Modify Script. |
| Scripting Config Altered | 1 | Displays any instances where the scripting configuration has been modified. |
| Search Add | 3 | Displays all of the searches that have been added. To add a search, click the Search button in the Control Center and select the Advanced tab. Create a new search, enter a name and click the Save button. |
| Search Delete | 1 | Displays any instances where a search has been deleted. |
| Send Command | 3 | Displays all of the commands (Computer Management > Commands) that have been sent to agent machines. |
| Send Mobile Device Script | 1 | Not in use at this time. |
| Set Maintenance Mode | 1 | Displays any instances where a maintenance mode has been set. |
| Set Mobile Device Status | 1 | Displays the dates that mobile devices have had their statuses set on. |
| Smart Config Altered | 1 | Displays the SMART attributes (Dashboard > Config > Configurations > Smart Attributes) that have been created or edited. |
| Startup Config Altered | 1 | Displays the startup scan (Dashboard > Config > Configurations > Startup Scan) entries that have been added or edited. |
| System Config Altered | 1 | Displays any instances where the system configuration has been altered (Dashboard > Config > System). |
| Template Add | 3 | Displays the templates that have been added. To add a template, expand Admin in the Navigation Tree and right-click Templates. Select Templates > Add New Template. |
| Template Delete | 1 | Displays the templates that have been deleted. To delete a template, navigate to Admin > Templates and right-click an existing template. Select Templates > Delete Template. |
| Template Modify | 2 | Displays the templates that have been modified. To modify a template, navigate to Admin > Templates and right-click an existing template. Select Templates > Modify Template. |
| Ticket Deleted | 2 | Displays all of the tickets that have been deleted. To delete a ticket, click the Tickets button in the Control Center. Right-click on an existing ticket and select Tickets > Delete. |
| Ticket Finished | 2 | Displays all instances of tickets that have been marked as 'finished'. |
| Ticket Opened | 2 | Displays all of the tickets that have been opened. To open a ticket, click the Tickets button in the Control Center. Right-click on an existing ticket and select Tickets > Open\Take. |
| Ticket Stalled | 2 | Displays all instances of tickets that have been marked as 'stalled'. |
| Ticket Updated | 2 | Displays all of the tickets that have been updated. To update a ticket, click the Tickets button in the Control Center. Right-click on an existing ticket and select Tickets > View Ticket. |
| Time Category Config Altered | 1 | Displays the time category (Dashboard > Config > Configurations > Time Category) entries that have been added or edited. |
| Timer Started | 5 | Displays all instances of timers being started on tickets. |
| Timeslip Created | 2 | Displays all instances of timeslips being created. |
| Timeslip Delete | 1 | Displays all of the time slips that have been deleted. |
| Timeslip Modify | 2 | Displays all instances where timeslips have been modified. |
| Tool Add | 3 | Displays all of the tools that have been added. To add tools, expand Admin and right-click Tools and Tweaks. Select Add New Tool. |
| Tool Delete | 1 | Displays all of the tools that have been deleted. To delete a tool, navigate to Admin > Tools and Tweaks and right-click a tool. Select Tools > Delete Tool. |
| Tool Modify | 2 | Displays all of the tools that have been modified. To modify a tool, navigate to Admin > Tools and Tweaks and right-click a tool. Select Tools > Modify Tool. |
| Tunnel Connect | 1 | Displays all of the tunnel connections that have been created. |
| Upload MDM Certificate | 1 | Displays the MDM certificates that have been created. |
| User Add | 1 | Displays all of the users that have been added. To add a user, expand Admin and right-click Users. Select Users > Add New User. |
| User Class Permission Changed | 1 | Displays the user class permissions (Users > User > Permissions) that have been added or edited. |
| User Delete | 1 | Displays all of the users that have been removed. To delete a user, navigate to Admin > Users and right-click a user. Select Users > Delete User. |
| User Modify | 1 | Displays all of the users that have been modified. To modify a user, navigate to Admin > Users and double-click on a user. Alternatively, right-click a user and select Users > Modify User. |
| Virus Config Altered | 1 | Displays the virus scan (Dashboard > Config > Configurations > Virus Scan) entries that have been added or edited. |
| Whitelist Config Altered | 1 | Displays all of the entries to the application whitelist (Dashboard > Config > Configurations > App Whitelist) that have been modified. |
Table 2: Auditing Screen Field Descriptions
| Field | Description |
| Auditing Action | Lists all of the available actions and their respective auditing levels. Auditing levels are used in conjunction with the user's personal auditing level to determine what will be audited. To edit the auditing level, right-click the action and select a level (0-5). |
| Results | Displays the results of the audit including the action, the date the action occurred, action ID, information about the action and if the action is reversible. |
| Users | Lists all of the available technicians in the LabTech system. Select a technician to view their auditing history or select All Users to view the auditing history for all of the technicians. |
| From/To | Select the From and To dates to filter the auditing history by date or the dates can be entered manually. |
| Undo | Does not function. |
| Refresh | Refreshes the page. |
| Limit Results to Last 500 Records | Select this option to limit the number of records to 500. |
Right-clicking anywhere in the Auditing Action, Results or Users sections will display a menu with additional options.
Table 3: Right-Click Menu Options
| Option | Description |
| Set Level | Only available in the Auditing Action section. |
| Refresh List | Refreshes the list. Only available in the Auditing Action section. |
| Copy Text | Copies only the contents of the cell your mouse is pointed to. To copy all of the information for multiple rows, select more than one row by holding down the [Shift] key or by using the [Ctrl] key and right-click and select Copy Text from the menu. The information will be copied to the clipboard. |
| Search List | Opens the Search window, which allows you to search for a specific item. Enter a full or partial keyword to return results. The results will be highlighted on the screen. |
| Print List | Opens the Print window. Choose the desired print settings and click OK to print. You can select multiple items by holding down the [Shift] key or by using the [Ctrl] key or print the entire list by leaving all of the items unselected. |
| Export to Excel | Exports the selected items to Microsoft Excel. You can select multiple items by holding down the [Shift] key or by using the [Ctrl] key. You must have Microsoft Excel installed to export any information. |
Editing the Auditing Action Level
To edit the auditing level of an action:
- Select the desired action in the Auditing Action section and right-click it. Choose a new auditing level number from the menu. The screen will instantly update with the new auditing level.
Figure 3: Right-Click Menu![Figure 3: Right-Click Menu]()
Auditing a User
Auditing can be used to investigate suspicious activity and to monitor and gather data about specific actions that have been performed.
To audit a user:
- Select an action from the Auditing Action section (e.g., Password Modify).
- Select a user from the Users section (e.g., John Smith).
- Track the user's actions in the Results section. Any suspicious records can be printed or exported to Microsoft Excel by right-clicking on the result and selecting the desired option.
Document Revision History
| Date | Notes |
| 08/23/2012 | New Document |
