Auditor Help: Fact-Finding Reports

Fact-Finding Report definitions are templates, they create the structure of the report, but do not contain the actual content from your environment. Each Ecora Auditor Professional module comes with a collection of built-in report definitions, designed by Systems Engineers, to solve common problems or project needs. While these report definitions cannot be deleted, they can be used as the basis for any custom reports that you may need. If, for example, the security report contains 90% of the information you would like, it is a simple process to copy the Security report and add your additional desired attributes to the pre-defined report definition and then save your changes as a template for future use.

This document is designed to outline the Fact Finding Report definition options, available to you, from running and editing existing definitions to custom creating your own definitions.

Warning:None of the reports can provide a thorough analysis if you do not document ALL systems in your infrastructure. A security-oriented report, for example, will necessarily have "blind spots" where systems that have not been documented may have vulnerabilities.

I. Generating Fact Finding Reports Using Pre-defined templates

A. To generate a Fact-Finding Report:

  1. Click on the Reports menu item and select the Fact-Finding Report option. Alternately, you can click the Fact Finding button on the menu bar.
  2. Expand the Database folder in the tree on the left hand side of the Select a Fact Finding Report Definition dialog.
  3. Browse through the folders on the left hand side of the dialog to select a Fact Finding report that you wish to run.
  4. Highlight the report in the right hand frame of the dialog and either double-click the report name, or use the Next> button to launch the Fact Finding Report dialog.
  5. Select the Output Format for the report template.
    • a.Enabling HTML/DOC Report checkbox allows creating the report as xml and doc files.
    • b.Enabling Export to CSV file allows creating the report in comma delimited (CSV) format.
  6. Select the Report Criteria time frame for the report template to use in querying the database.
    • a. Relative Time Range will limit the query to any data collected within the specified time range. ie: the past 3 hours, days, weeks, months, years.
    • b. Exact Time Range will limit the query to any data collected between 2 specific dates.
    • c. Select Dataset will limit the query to any data collected within a specific data collection job.
  7. Click the Generate > button.
  8. Use the Save Report To.. dialog to specify where you wish to save your Fact Finding report to and what you wish to call your report.
    • a. Browsebutton: use the Browse button to select the folder where you wish to store your finished Fact Finding report. The corresponding dialog that opens when you click the Browse button allows you to save the report to any drive available to the system that Ecora is installed on, as well as create additional folders. It is recommended that you store reports within the Ecora directory that is specified in File…Settings, on the Preferences tab, from the main interface.
    • b. Save Report To: editable field: use this field to specify a report name to save your Fact Finding report to. The default naming convention is date and time in the format of Month_day_year_hour_minute_second. It is recommended that you give your Fact Finding report a name that notes what is actually in the report.
  9. Click OK to generate your Fact Finding Report.
  10. When the report is finished, click View to open and review the report.
    NOTE: To open any generated Fact Finding report from the Ecora Auditor Professional interface, browse to the folder where you have stored your Fact Finding report within the Ecora Auditor Professional interface, highlight the report you wish to view and double click on either the HTML or DOC format report on the right hand side of the Ecora Auditor Professional software interface to launch your report.

II. Using Pre-defined Templates to Create Your Own Customized Report Templates

A. Creating a Custom Template Using a Pre-defined Template During the Report Generation Process:

  1. Click on the Reports menu item and select the Fact-Finding Report option. Alternately, you can click the Fact Finding button on the menu bar.
  2. Expand the Database folder in the tree on the left hand side of the Select a Fact Finding Report Definition dialog.
  3. Browse through the folders on the left hand side of the dialog to select a Fact Finding report that you wish to run.
  4. Highlight the report in the right hand frame of the dialog and either double-click the report name, or use the Next> button to launch the Fact Finding Report dialog.
  5. Editing the report definition:
    • a. Adding Attributes:
      1. Using the attribute tree on the upper left side of the dialog, expand and browse the available nodes to locate the type of attribute that you wish to add to the existing report. ie: OS Name and Service Pack Level from the Servers Node:
      2. Right click on the attributes, in the Available Settings portion of the dialog, that you wish to add and choose the table that you wish to add them to.
      NOTE: use Shift or Control to multi-select attributes to add.
    • b.Editing Attribute Criteria, Order, and Sort Functionality
      1. Click on the Edit button next to the table that you wish to edit. Alternately, if working with a multi table report, highlight the table you wish to edit and click the Edit Table button. This will launch the Database Definition Table for editing.
  6. Determine the order in which you would like to sort and display the data columns and adjust the Output Column numbering as desired. To change a value, double click next to the number to be changed, backspace over the number and replace it with the new column number that the output is to be displayed in.
  7. Determine how you would like to sort the data that is to be output. ie: Ascending or Descending order, Merge to clean up white space.
    • a. Ascending: Sorts the data alphanumerically from A-Z or 0-9.
    • b. Descending: Sorts the data alphanumerically from Z-A or 9-0.
    • c. Merge Only: Cleans up duplicate lines of repetitive values when more than one row is required to display values for a single attribute. ie: Group Membership and User attributes would require Group Membership to be displayed 1 time for each user in the specific group, resulting in multiple listings of the same group name. The Merge Only option, used here, causes the Group Name to be displayed 1 time only at the top of a column with the User Names displayed next to this column.
    • d. Merge and Ascend: Merges duplicate copies of a value while sorting alphanumerically from A-Z or 0-9 when there are more than one item to display in that column.
    • e. Merge and Descend: Merges duplicate copies of a value while sorting alphanumerically from Z-A or 9-0 when there are more than one item to display in that column.
  8. Determine if you would like to search for a specific attribute value within the report. ie: a specific Computer Name, Installed Application Name, or Service Pack Level. Double click on the Criteria field in the column that you are going to specify search criteria for(white box with 3 black dots in it). ie; to sort for a specific Application name, double click in the criteria box under the header Installed App Name. This will launch the Filter Criterion dialog, allowing you to specify your search criteria and MS SQL operators.


  9. NOTE: For a full explanation of available MS SQL operators and their effect on the report, see section: VII
  10. Edit the Description and Table Name fields if desired and click the Save button.
  11. Select the Output Format for the report template.
    • a. Enabling HTML/DOC Report checkbox allows creating the report as xml and doc files.
    • b. Enabling Export to CSV file allows creating the report in comma delimited (CSV) format.
  12. Select the Report Criteria time frame for the report template to use in querying the database.
    • a. Relative Time Range will limit the query to any data collected within the specified time range. ie: the past 3 hours, days, weeks, months, years.
    • b. Exact Time Range will limit the query to any data collected between 2 specific dates.
    • c. Select Dataset will limit the query to any data collected within a specific data collection job.
  13. Click the Generate button.
  14. You will be prompted with a dialog to save the changes that you just made to the pre-defined report. Click Yes.


  15. This launches the Report Definition dialog that allows you to name your report template, use the Browse button to specify which folder to save your edited report template to, and create new folders to save your report template to. Click OK.
  16. Use the Save Report To.. dialog to specify where you wish to save your Fact Finding report to and what you wish to call your report.
    • a. Browse button: use the Browse button to select the folder where you wish to store your finished Fact Finding report. The corresponding dialog that opens when you click the Browse button allows you to save the report to any drive available to the system that Ecora is installed on, as well as create additional folders. It is recommended that you store reports within the Ecora directory that is specified in File…Settings, on the Preferences tab, from the main interface.
    • b. Save Report To: editable field: use this field to specify a report name to save your Fact Finding report to. The default naming convention is date and time in the format of Month_day_year_hour_minute_second. It is recommended that you give your Fact Finding report a name that notes what is actually in the report.

  17. Click OK to generate your Fact Finding Report.
  18. When the report is finished, click View to open and review the report.
    NOTE: To open any generated Fact Finding report from the Ecora Auditor Professional interface, browse to the folder where you have stored your Fact Finding report within the Ecora Auditor Professional interface, highlight the report you wish to view and double click on either the HTML or DOC format report on the right hand side of the Ecora Auditor Professional software interface to launch your report.

B. Creating a Customized Report Template by Copying and Editing a Pre-defined Report Template.

  1. Click on the Edit menu item and select the Fact-Finding Report Definitions option.
  2. Browse through the folders on the left hand side of the Fact-Finding Report Definitions dialog and select a report template that you wish to edit. Use the Copy button to create a copy of the report template.

  3. Click on the Edit button to launch the Fact-Finding Report Definition Editorb to begin editing the selected report template.
  4. Editing the report definition:
    • a.Adding Attributes:
      • i.Using the attribute tree on the upper left side of the dialog, expand and browse the available nodes to locate the type of attribute that you wish to add to the existing report. ie: Domain Type from the Domain Node:
      • ii.Right click on the attributes, in the Available Settings portion of the dialog, that you wish to add and choose the table that you wish to add them to.
        NOTE: use Shift or Control to multi-select attributes.

    • b.Editing Attribute Criteria, Order, and Sort Functionality
      • i. Click on the Edit button next to the table that you wish to edit. Alternately, if working with a multi table report, highlight the table you wish to edit and click the Edit Table button. This will launch the Database Definition Table for editing.
      • ii. Determine the order in which you would like to sort and display the data columns and Adjust the Output Column numbering as desired. To change a value, double click next to the number to be changed, backspace over the number and replace it with the new column number that the output is to be displayed in.

      • iii. Determine how you would like to sort the data that is to be output. ie: Ascending or Descending order, Merge to clean up white space.
        • a. Ascending: Sorts the data alphanumerically from A-Z or 0-9.
        • b. Descending: Sorts the data alphanumerically from Z-A or 9-0.
        • c. Merge Only: Cleans up duplicate lines of repetitive values when more than one row is required to display values for a single attribute. ie: Group Membership and User attributes would require Group Membership to be displayed 1 time for each user in the specific group, resulting in multiple listings of the same group name. The Merge Only option, used here, causes the Group Name to be displayed 1 time only at the top of a column with the User Names displayed next to this column.
        • d. Merge and Ascend: Merges duplicate copies of a value while sorting alphanumerically from A-Z or 0-9 when there are more than one item to display in that column.
        • e. Merge and Descend: Merges duplicate copies of a value while sorting alphanumerically from Z-A or 9-0 when there are more than one item to display in that column.
      • iv. Determine if you would like to search for a specific attribute value within the report. ie: a specific Domain Name, Computer Name, or Password Age. Double click on the Criteria field in the column that you are going to specify search criteria for(white box with 3 black dots in it). ie; to define a password age, double click in the criteria box under the header User Password Age in Days. This will launch the Filter Criterion dialog, allowing you to specify your search criteria and MS SQL operators.

      • NOTE: For a full explanation of available MS SQL operators and their effect on the report, see section: VII
      • v. Edit the Description and Table Name fields if desired and click the Save button.

  5. Select the Output Format for the report template.
    • a. Enabling HTML/DOC Report checkbox allows creating the report as xml and doc files.
    • b. Enabling Export to CSV file allows creating the report in comma delimited (CSV) format.
  6. Select the Report Criteria time frame for the report template to use in querying the database.
    • a. Relative Time Range will limit the query to any data collected within the specified time range. ie: the past 3 hours, days, weeks, months, years.
    • b. Exact Time Range will limit the query to any data collected between 2 specific dates.
    • c. Select Dataset will limit the query to any data collected within a specific data collection job.

  7. Click Generate to create the report template.
  8. Use the Save Report To.. dialog to specify where you wish to save your Fact Finding report to and what you wish to call your report.
    • a. Browsebutton: use the Browse button to select the folder where you wish to store your finished Fact Finding report. The corresponding dialog that opens when you click the Browse button allows you to save the report to any drive available to the system that Ecora is installed on, as well as create additional folders. It is recommended that you store reports within the Ecora directory that is specified in File…Settings, on the Preferences tab, from the main interface.
    • b. Save Report To: editable field: use this field to specify a report name to save your Fact Finding report to. The default naming convention is date and time in the format of Month_day_year_hour_minute_second. It is recommended that you give your Fact Finding report a name that notes what is actually in the report.
  9. Click OK to generate your Fact Finding Report.
  10. When the report is finished, click View to open and review the report.
  11. Follow steps 4-6 to make any required adjustments to your custom report template. Once your report reflects the data that you wish to see, use the Save button to save your custom report template.


  12. You will be presented with the Report Definition dialog where you can name and describe your report template, use the Browse button to specify which folder to save your edited report template to, and create new folders to save your report template to. Click OK.
  13. When done customizing your report template, use the Finish button to return to the Fact-Finding Report Definitions dialog and create another custom report.
  14. NOTE: To open any generated Fact Finding report from the Ecora Auditor Professional interface, browse to the folder where you have stored your Fact Finding report within the Ecora Auditor Professional interface, highlight the report you wish to view and double click on either the HTML or DOC format report on the right hand side of the Ecora Auditor Professional software interface to launch your report.

    III. Creating a New Fact-Finding Report Template From a Blank Template

    1. Click on the Edit menu item and select the Fact-Finding Report Definitions option.
    2. Use the New button in the Fact-Finding Report Definitions dialog to launch the Fact-Finding Report Definition Editor dialog.
    3. Note: For the following example, we will create a multi-table Fact-Finding Report template that displays the configuration of the Windows Event Logs.

    4. Use the New Table button to add 2 new tables to the blank Fact-Finding report template. Name these new tables by double clicking on the Table Name space for each table and typing in a name. In this example: Application Log, Security Log, System Log
    5. Use the directory tree in the upper left hand side of the Fact-Finding Report Definition Editor to select the settings that you wish to collect on. In this example, expand the Servers node and browse to the System node, expand this, browse to the Event Logs node and expand this. Highlight each of the Event Log nodes individually and choose the settings that you wish to add to the tables. Repeat step for each table.




    6. Edit the tables by either highlighting a table and clicking the Edit Table button or by clicking on the Edit button next to the desired table.


    7. The Database Definition Table may be edited in the following areas:
      • i. Heading – This item may be changed by double clicking and adding or changing text.
        Any changes here will be reflected in the Fact-Finding report as the heading.
      • ii. Sort - Allows you to specify sort criteria to control the output order of data in each column.
        • a. Ascending: Sorts the data alphanumerically from A-Z or 0-9.
        • b. Descending: Sorts the data alphanumerically from Z-A or 9-0.
        • c. Merge Only: Cleans up duplicate lines of repetitive values when more than one row is required to display values for a single attribute. ie: Group Membership and User attributes would require Group Membership to be displayed 1 time for each user in the specific group, resulting in multiple listings of the same group name. The Merge Only option, used here, causes the Group Name to be displayed 1 time only at the top of a column with the User Names displayed next to this column.
        • d. Merge and Ascend: Merges duplicate copies of a value while sorting alphanumerically from A-Z or 0-9 when there are more than one item to display in that column.
        • e. Merge and Descend: Merges duplicate copies of a value while sorting alphanumerically from Z-A or 9-0 when there are more than one item to display in that column.
      • iii. Output Column - Allows you to specify the column order in which you want the data data displayed. To change output column, double click next to the number that you wish to change, backspace over it, and type in the new number.
      • iv. Criteria - Allows you to specify variable criteria that you wish to search for. For example; Domain Name, Server Name, Installed Application Name, Password Age, Amount of Physical Memory, etc.

      • NOTE: For information on specific MS SQL operators, see section: VII
      • v. - Allows you to add additional Criteria fields using the OR, AND, or NOT operators.

    8. In this example, the Heading under Max Size has been edited to read Maximum Size, the Criteria has been set to sort for any systems with an event log size of less than (<) 512MB, and an additional search Criteria has been set to search for only information about the Application event log.

    9. A Table Name and Description should be specified. These fields will be inserted into the finished report. Click the Save button to save your changes and return to the Fact-Finding Report Definition Editor to test and save your customized report template.
    10. Select the Report Criteria time frame for the report template to use in querying the database.
      • a. Relative Time Range will limit the query to any data collected within the specified time range. ie: the past 3 hours, days, weeks, months, years.
      • b. Exact Time Range will limit the query to any data collected between 2 specific dates.
      • c. Select Dataset will limit the query to any data collected within a specific data collection job.
    11. Click Generate to create the report template
    12. Use the New Report.. dialog to specify where you wish to save your Fact Finding report to and what you wish to call your report.
      • a. Browsebutton: use the Browse button to select the folder where you wish to store your finished Fact Finding report. The corresponding dialog that opens when you click the Browse button allows you to save the report to any drive available to the system that Ecora is installed on, as well as create additional folders. It is recommended that you store reports within the Ecora directory that is specified in File…Settings, on the Preferences tab, from the main interface.
      • b. Save Report To: editable field: use this field to specify a report name to save your Fact Finding report to. The default naming convention is date and time in the format of Month_day_year_hour_minute_second. It is recommended that you give your Fact Finding report a name that notes what is actually in the report.
    13. Click OK to generate your Fact Finding Report.
    14. When the report is finished, click View to open and review the report.
    15. Follow steps 4-6 to make any required adjustments to your custom report template. Once your report reflects the data that you wish to see, use the Save button to save your custom report template.

    16. You will be presented with the Report Definition dialog where you can name and describe your report template, use the Browse button to specify which folder to save your edited report template to, and create new folders to save your report template to. Click OK.

    17. When done customizing your report template, use the Finish button to return to the Fact-Finding Report Definitions dialog and create another custom report.

    IV. Creating Custom Folders to Store Your Fact-Finding Report Templates and Fact-Finding Reports

    A. Creating Custom Folders to Store Finished Fact-Finding Reports

    1. Launch the Ecora Auditor Professional software and browse the tree structure on the left hand side of the main interface. The default storage location for Fact-Finding Reports is the Fact-Finding Reports folder under the module folder. In this example – Windows Reports folder.
    2. Highlight the Fact-Finding Reports folder and right click, choosing the New Folder option. Alternately you may highlight the Fact-Finding Reports folder, click the File menu item and choose the New Folder option.
    3. Name your new folder. Folders may also be created under sub folders. It is recommended that you create a folder structure that allows you to store your Fact-Finding Reports for easy retrieval.
    4. In the above diagram, a Security folder has been created under the Fact-Finding Reports folder with 2 sub-folders; System Security ad User Security. When running reports manually or scheduling reports to run regularly, remember to save your reports to their custom created folders.

      NOTE: Alternately you can create custom folders for storing your finished Fact-Finding reports by opening a Windows Explorer browser and creating new folders within the Ecora directory. The default install and storage directory for Fact-Finding reports created by the Ecora Auditor Professional is: C:/Program Files/Ecora/Auditor40/Windows/Views/Fact-Finding Reports. Simply create new folders and subfolders within the Fact-Finding Reports folder.

    B. Creating Custom Folders to Store Custom Fact-Finding report templates

    1. From the main software interface, click on the Edit menu item and select the Fact-Finding Report Definitions option
    2. Expand the Database folder on the left hand side of the Fact-Finding Report Definitions dialog.
    3. You can create a new folder in any existing folder. Highlight the folder where you wish to create your new folder and right click, choosing the New option. Name your new folder. The most common location to create a custom folder is directly in the Database folder. However, once you have created a new folder, you can create sub-folders within that folder.
    4. This example displays a sub-folder being created within a custom folder.

      NOTE: From within the Fact-Finding Report Definition Editor, you may create a new folder at any time by using the Save or Finish button. The Report Definition dialog allows you to use the Browse button to launch the Select a Category dialog where you can use the New button to create a new Category (folder).

    V. Scheduling Your Fact-Finding Reports to Run Regularly

    1. Go to the Scheduled Tasks tab, click the New task…button to launch the New Task dialog.
    2. Select Fact-Finding Report as the task type that you would like to run and click OK.
    3. Use the Task Name field to name the task.

    4. Click OK to launch the Select a Fact-Finding Report Definition dialog. Similar to running a Fact-Finding report manually, you will browse through the tree structure on the left hand side of the dialog, select the report that you wish to run, and click Next> to launch the Fact-Finding report:
    5. Note: When selecting the Report Criteria, take into consideration the frequency that you will be running this report. If you are running your report on a weekly basis, choose a 1 week time frame. If you are running your report on a daily basis, choose a 1 day time frame. Be sure to select the Most Recent checkbox and then click the Next> button.


    6. Use the Save Report To.. dialog to specify where you wish to save your Fact Finding report to and what you wish to call your report.
      • a. Browse button: use the Browse button to select the folder where you wish to store your finished Fact Finding report. The corresponding dialog that opens when you click the Browse button allows you to save the report to any drive available to the system that Ecora is installed on, as well as create additional folders. It is recommended that you store reports within the Ecora directory that is specified in File…Settings, on the Preferences tab, from the main interface.
      • b. Save Report To: editable field: use this field to specify a report name to save your Fact Finding report to. The default naming convention is date and time in the format of Month_day_year_hour_minute_second. It is recommended that you give your Fact Finding report a name that notes what is actually in the report. You may store historical Fact-Finding reports by choosing to use the %date in front of your report name. This will attach the current date to the front of the report name. Alternately, you may choose a static name for your Fact-Finding reports. In this case, the newly generated report will overwrite the previously generated report, each time the report runs. Click OK.

      Note: To set up the software with the ability to overwrite named reports, click on File…Settings from the main interface and choose the Preferences tab. Check the box labeled Overwrite existing datasets and reports on name conflicts.

    7. Use the Schedule tab in the dialog that opens (part of the Windows Task Scheduler) to specify when you would like the task to run. Click the New button to enable the selectable options of this dialog. Choose frequency of task, time of day, and click the Apply button to apply these settings and launch the Set Account Information dialog:

    8. Using the Set Account Information dialog, input the credentials that will launch the scheduled job on the Ecora system. Microsoft Windows requires that you have Administrative rights to the system that you are setting up the scheduled job on (the same system Ecora is installed on). Click OK twice to return to the Tasks dialog and set up another task.

    9. Go to the Scheduled Task tab to see the scheduled tasks.

    VI. Using Ecora Generated SQL Queries With the SQL Query Analyzer to Output Data in CSV Format That Can be Viewed With Excel.

    1. You may use either a pre-defined or custom created Fact-Finding report template to extract an SQL query from. Click the Fact-Finding button from the main interface menu bar. Alternately, you may click Reports and choose Fact-Finding Report.
    2. Within the Select a Fact-Finding Report Definition dialog, select the report that you wish to run by browsing through the tree structure on the left hand side of the dialog, selecting the report that you wish to run on the right, and clicking Next> to launch the Fact-Finding report:
    3. Click the Edit button in the Fact-Finding Report dialog to launch the Database Definition Table. Alternately, highlight the table that you wish to open and click the Edit Table button.
    4. In the Database Definition Table click the View SQL button to display the SQL query used to generate the Fact-Finding report:

    5. Right-click to Select All text in the SQL dialog and then to Copy the SQL query. You will need to run the SQL query in Query Analyzer on a system that has the MS SQL Client tools installed. This may be the Ecora system if you have installed the tools there or it may be an MS SQL server. If you need to run the SQL query on another system, save it to a text file so that it can be moved to the other system.
    6. Launch the MS SQL Query Analyzer. Default location is Start….. Programs……Microsoft SQL Server…. Query Analyzer. You will need to connect to the SQL server that hosts the EcoraAuditor35DB. Type in the name of the SQL server or click the button with the 3 black dots to search for the SQL server name. Next select the authentication method that you will connect with. Either Windows Authentication or SQL Authentication. If using SQL Authentication, you will need to enter a username and password. Click OK to connect to the SQL Server:

    7. Paste the saved SQL query into the SQL Query Analyzer in the empty box on the right hand side of the dialog. Select the database to query from the drop down dialog in the middle top of the dialog. The default name of the database is EcoraAuditorDB40:
    8. From the Tools menu item, choose Options. Choose the Results tab.
      Default Results target: Set to Results to File
      Results Output format: Set to Comma Delimited (CSV)
      Check thePrint Column Headers checkbox and click OK.
    9. Click on Query on the menu bar and choose Execute to run the SQL query. Alternately you may click on the green arrow on the menu bar.


    10. When prompted with the Save Results dialog, choose the location that you would like to save the output to, select All Files from the Save As type drop down, and name your file, including .CSV at the end of the file name. Click Save.

    11. Browse to the location where you stored your CSV file and launch it to view the output in CSV format.

      NOTE:You may also choose to set the default file output type to CSV by clicking on Tools, choosing Options, and typing *.csv in the Result File Extension box.

    VII. Overview of SQL Operators Used in Creating Custom Fact-Finding Reports

    1. = (Equals) - allows you to specify an exact string match. For example: in an Event Logs report, you can specify the logfile = security to view only items in the security log. NOTE: Equals will not always work with Text entries.
    2. > (Greater Than) – Allows you to specify a numerical value as the lower limit of your search. For example: in a User Password age report, you can specify >45 to view only users whose passwords are greater than 45 days old. Anyone with a password that is exactly 45 days old would not show up in the list.
    3. < (Less Than) - Allows you to specify a numerical value as the upper limit of your search. For example: in a User Password age report, you can specify <5 to view only users whose passwords are less than 5 days old. Anyone with a password that is exactly 5 days old would not show up in the list.
    4. >= (Greater Than or Equal To) – Allows you to specify a numerical value as the lower or matching limit of your search. For example: in a User Password age report, you can specify >=45 to view only users whose passwords are greater than or equal to 45 days old. Anyone with a password that is exactly 45 days old will show up in the list.
    5. <= (Less Than or Equal To) – Allows you to specify a numerical value as the upper or matching limit of your search. For example: in a User Password age report, you can specify <=5 to view only users whose passwords are less than or equal to 5 days old. Anyone with a password that is exactly 5 days old will show up in the list.
    6. != (Not Equal To) – Allows you to specify a string value that you want excluded from the report. For example: specifying !=512 under total memory in a Memory and CPU report will display all systems whose memory is not equal to 512.
    7. !< (Not Less Than) – Allows you to specify a numerical value as the lower limit of your search. For example: specifying !<512 under total memory in a Memory and CPU report will display all systems whose memory is not less than 512.
    8. !> (Not Greater Than) – Allows you to specify a numerical value as the upper limit of your search. For example: specifying !>512 under total memory in a Memory and CPU report will display all systems whose memory is not greater than 512.
    9. BETWEEN – Allows you to search for a value that is within the specified range (greater than the first value, less than the second). For example: specifying Between 511 and Between 513 under total memory in a Memory and CPU report will display all systems whose memory is 512. Using the Between criteria requires that you type in the value and click the Add button for each value you wish to enter. In this example, both 511 and 513 are typed in, clicking Add after each value to add it to the list.
    10. NOT BETWEEN - Allows you to search for a value that is not within the specified range (less than the lower value, more than the greater value). For example: specifying Not Between 256 and Not Between 512 under total memory in a Memory and CPU report will display all systems whose memory is less than 256 and greater than 512. Using the Not Between criteria requires that you type in the value and click the Add button for each value you wish to enter. In this example, both 256 and 512 are typed in, clicking Add after each value to add it to the list.
    11. IN – Allows you to search for multiple exact values or strings. For example: specifying In 256 and In 512 under total memory in a Memory and CPU report will display only systems that have exactly 256 or exactly 512 memory. No other systems will be displayed. No systems will be displayed if there is not an exact match to either 256 or 512. This item also allows you to specify named items such as multiple named installed applications. Specifying IN DeviceLock and IN Ecora Auditor 3.5 for Windows will output only systems that have either of these exactly named applications installed. Using the IN criteria requires that you type in (or copy and paste) the value or string and click the Add button for each value or string you wish to enter. In this example, both DeviceLock and Ecora Auditor 3.5 for Windows is typed or pasted in, clicking the Add button after each item.
    12. NOT IN – Allows you to search for systems that do not match the multiple exact string values specified. For example: specifying NOT IN 512 under total memory in a memory and CPU report will display only systems that do not have 512MB of memory. Systems with 512MB of memory will not be displayed. This item also allows you to specify named items such as multiple named installed applications. Specifying NOT IN DeviceLock and NOT IN Ecora Auditor 3.5 for Windows will output only installed applications that do not match these named applications. Using the NOT IN criteria requires that you type in (or copy and paste) the value or string and click the Add button for each value or string you wish to enter. In this example, both DeviceLock and Ecora Auditor 3.5 for Windows is typed or pasted in, clicking the Add button after each item.