<form script="ms_ad_obj_audit_report.js" stylesheet="ms_ad_obj_lkp_view.css" version="1.1">
  <label>AD Objects - Group - Group Member - Lookup</label>
  <init>
    <unset token="tokshowinputs"></unset>
    <unset token="tok_domain"></unset>
    <unset token="tokshowinptype"></unset>
    <unset token="tokshowinptime"></unset>
    <unset token="tok_show_tabs"></unset>
    <unset token="tok_obj_search"></unset>
    <unset token="tok_group_search"></unset>
    <set token="tok_g_chg_cnt">Pending</set>
    <set token="tok_g_chg_color">orange</set>
    <set token="tok_gm_chg_cnt">Pending</set>
    <set token="tok_gm_chg_color">orange</set>
    <set token="tab_active_desc">AD Group Details Description for</set>
  </init>
<!-- Base Domain List Search -->
  <search id="base_domain_search">
    <query>| `ms_obj_domain_list`</query>
    <done>
      <condition match="$job.resultCount$ == 0">
        <unset token="show_inputs"></unset>
        <set token="show_domain_warn">True</set>
      </condition>
      <condition>
        <unset token="show_domain_warn"></unset>
        <set token="show_inputs">True</set>
      </condition>
    </done>
  </search>
  <!-- Get Lookup Names for Selected Domain Search -->
  <search base="base_domain_search" id="dom_lkp_vals">
    <query>search domain="$tok_domain$"</query>
    <done>
      <condition match="$job.resultCount$ == 0">
        <set token="tok_user_lkp">AD_Obj_Group</set>
        <set token="tok_group_lkp">AD_Obj_Group</set>
        <set token="tok_computer_lkp">AD_Obj_Computer</set>
        <set token="tok_kv_suffix"></set>
        <set token="tok_dc_val">*</set>
      </condition>
      <condition>
        <set token="tok_user_lkp">$result.user_lookup$</set>
        <set token="tok_group_lkp">$result.group_lookup$</set>
        <set token="tok_computer_lkp">$result.computer_lookup$</set>
        <set token="tok_kv_suffix">$result.kv_suffix$</set>
        <set token="tok_dc_val">$result.dc_val$</set>
      </condition>
    </done>
  </search>
  <search id="base_tk_build">
    <query>| makeresults
| eval reset_trigger="$tok_reset$"
| eval group_search=if(reset_trigger=="ByGroup","TRUE","FALSE")
| eval obj_search=if(reset_trigger=="ByMember" OR reset_trigger=="User" OR reset_trigger=="Group" OR reset_trigger=="Computer","TRUE","FALSE")
| eval audit_lnk=case(reset_trigger=="ByGroup","group_obj_lkp",reset_trigger=="ByMember" OR reset_trigger=="User" OR reset_trigger=="Group" OR reset_trigger=="Computer","member_obj_lkp")
| eval audit_id_lnk=case(reset_trigger=="ByGroup" OR reset_trigger=="Group","lookup_grp",reset_trigger=="ByMember","FALSE",reset_trigger=="User","lookup_usr",reset_trigger=="Computer","lookup_cmp")
| eval target_object_list=case(reset_trigger=="User","$tok_user_lkp$",reset_trigger=="Group" OR reset_trigger=="ByGroup","$tok_group_lkp$",reset_trigger=="Computer","$tok_computer_lkp$",reset_trigger=="ByMember","FALSE")
| table obj_search,group_search,audit_lnk,audit_id_lnk,showinpmembtype,showinputs,target_object_list
</query>
    <done>
      <condition match="$job.resultCount$ == 0">
          <unset token="tok_audit_value"></unset>
          <unset token="tok_trg_chg_srch"></unset>
          <unset token="tok_show_tabs"></unset>
          <unset token="form.tok_group">sel</unset>
          <unset token="tok_group"></unset>
          <unset token="tok_audit_value_label"></unset>
          <unset token="tok_obj"></unset>
          <unset token="tok_group_search"></unset>
          <unset token="tok_audit_id_lnk"></unset>
          <unset token="tokshowinputs"></unset>
          <unset token="target_object_list"></unset>
          <unset token="tab_active_desc"></unset>
      </condition>
      <condition>
          <unset token="tok_audit_value"></unset>
          <unset token="tok_trg_chg_srch"></unset>
          <unset token="tok_show_tabs"></unset>
          <unset token="tok_audit_value_label"></unset>
          <eval token="tok_group_search">if($result.group_search$=="FALSE",NULL,"TRUE")</eval>
          <eval token="tok_obj_search">if($result.obj_search$=="FALSE",NULL,"TRUE")</eval>
          <eval token="tok_audit_id_lnk">if($result.audit_id_lnk$=="FALSE",NULL,$result.audit_id_lnk$)</eval>
          <set token="tokshowinputs">TRUE</set>
          <eval token="target_object_list">if($result.target_object_list$=="FALSE",NULL,$result.target_object_list$)</eval>
          <set token="tok_audit_lnk">$result.audit_lnk$</set>
      </condition>
    </done>
  </search>
  <search id="base_ad_search_objects">
    <query>| inputlookup $target_object_list$ WHERE domain="$tok_domain$"</query>
    <earliest>0</earliest>
    <latest></latest>
  </search>
  <search id="audit_query" base="base_ad_search_objects">
    <query>search dn="$tok_audit_value$"
| lookup $tok_group_lkp$ member AS dn OUTPUT dn AS memberOf
| lookup $tok_group_lkp$ primaryGroupToken AS primaryGroupID OUTPUT dn AS p_memberOf
| eval memberOf=if(isnull(memberOf),p_memberOf,mvappend(memberOf,p_memberOf))
| makemv delim="|" objectClass
| makemv delim="####" dSCorePropagationData    
| makemv delim=" " userAccountControl</query>
  </search>
  <search base="audit_query" id="base_basic_info">
    <query>fillnull value="Not Defined" cn,domain,distinguishedName,description,displayName,IsDeleted,IsRecycled,objectSid,sAMAccountName,whenChanged,whenCreated
| fields cn,dn,domain,distinguishedName,description,displayName,IsDeleted,IsRecycled,objectSid,sAMAccountName,whenChanged,whenCreated</query>
    <progress>
      <set token="tok_desc_cn">$result.cn$</set>
      <set token="tok_desc_domain">$result.domain$</set>
      <set token="tok_desc_distinguishedName">$result.distinguishedName$</set>
      <set token="tok_desc_description">$result.description$</set>
      <set token="tok_desc_displayName">$result.displayName$</set>
      <set token="tok_desc_IsDeleted">$result.IsDeleted$</set>
      <set token="tok_desc_IsRecycled">$result.IsRecycled$</set>
      <set token="tok_desc_objectSid">$result.objectSid$</set>
      <set token="tok_desc_sAMAccountName">$result.sAMAccountName$</set>
      <set token="tok_desc_whenChanged">$result.whenChanged$</set>
      <set token="tok_desc_whenCreated">$result.whenCreated$</set>
    </progress>
  </search>
  <search base="audit_query" id="sub_user_membership">
    <query>fields memberOf
| mvexpand memberOf
| lookup $tok_group_lkp$ dn AS memberOf OUTPUT sAMAccountName AS g_sAMAccountName,dn AS g_dn,cn AS g_cn,domain AS g_domain
| table memberOf,g_sAMAccountName,g_dn,g_cn,g_domain</query>
  </search>  
  <search base="audit_query" id="sub_group_members">
    <query>fields member
| mvexpand member
| lookup $tok_user_lkp$ dn AS member OUTPUT sAMAccountName AS u_sAMAccountName,dn AS u_dn,cn AS u_cn,domain AS u_domain
| lookup $tok_group_lkp$ dn AS member OUTPUT sAMAccountName AS g_sAMAccountName,dn AS g_dn,cn AS g_cn,domain AS g_domain
| lookup $tok_computer_lkp$ dn AS member OUTPUT sAMAccountName AS c_sAMAccountName,dn AS c_dn,cn AS c_cn,domain AS c_domain
| table member,u_sAMAccountName,g_sAMAccountName,c_sAMAccountName,u_dn,g_dn,c_dn,u_cn,g_cn,c_cn,u_domain,g_domain,c_domain</query>
  </search>
  <search base="sub_group_members" id="filt_u_members">
    <query>fields u_sAMAccountName,u_dn,u_cn,u_domain
| search u_sAMAccountName=*
| sort u_domain,u_cn, u_sAMAccountName
| table u_domain,u_cn, u_sAMAccountName</query>
    <done>
      <condition match=" 'job.resultCount' == 0">
        <set token="show_user_member_msg">True</set>
        <unset token="show_user_member_table"></unset>
      </condition>
      <condition>
        <set token="show_user_member_table">True</set>
        <unset token="show_user_member_msg"></unset>
      </condition>
    </done>
  </search>  
  <search base="sub_group_members" id="filt_g_members">
    <query>fields g_sAMAccountName,g_dn,g_cn,g_domain
| search g_sAMAccountName=*
| sort g_domain,g_cn, g_sAMAccountName
| table g_domain,g_cn, g_sAMAccountName</query>
    <done>
      <condition match=" 'job.resultCount' == 0">
        <set token="show_group_member_msg">True</set>
        <unset token="show_group_member_table"></unset>
      </condition>
      <condition>
        <set token="show_group_member_table">True</set>
        <unset token="show_group_member_msg"></unset>
      </condition>
    </done>
  </search>
  <search base="sub_group_members" id="filt_c_members">
    <query>fields c_sAMAccountName,c_dn,c_cn,c_domain
| search c_sAMAccountName=*
| sort c_domain,c_cn, c_sAMAccountName
| table c_domain,c_cn, c_sAMAccountName</query>
    <done>
      <condition match=" 'job.resultCount' == 0">
        <set token="show_computer_member_msg">True</set>
        <unset token="show_computer_member_table"></unset>
      </condition>
      <condition>
        <set token="show_computer_member_table">True</set>
        <unset token="show_computer_member_msg"></unset>
      </condition>
    </done>
  </search>
  <!-- Base Windows Change Events Search -->
  <search id="base_group_changes" depends="$tok_trg_chg_srch$">
    <query>`ms_obj_changes_base_cat("Group")` (src_nt_domain=$tok_domain$ OR dest_nt_domain=$tok_domain$) ([|`ms_obj_ss_filt_raw_link("$tok_audit_value$","$tok_audit_id_lnk$","$target_object_list$","$tok_domain$","$tok_audit_value$","cn,sAMAccountName,dn","raw_txt")`])
| `ms_obj_md_group_change_cmb("$tok_group_lkp$")`
| search $tok_audit_lnk$ IN([|`ms_obj_ss_filt_raw_link("$tok_audit_value$","$tok_audit_id_lnk$","$target_object_list$","$tok_domain$","$tok_audit_value$","cn,sAMAccountName,dn,userPrincipalName","link")`])
| eval trigger="$tok_trg_chg_srch$"
| table time_group,adminuser,group,msad_action,Correlation_IDs,Change_Actions,Change_Summary,Change_Details,group_obj_lkp,member_obj_lkp</query>
    <earliest>$Timefilter.earliest$</earliest>
    <latest>$Timefilter.latest$</latest>
    <progress>
      <eval token="tok_g_chg_cnt">$job.dispatchState$</eval>
      <set token="tok_g_chg_color">blue</set>
      <unset token="show_g_win_results"></unset>
      <unset token="show_g_win_results_msg"></unset>
      <unset token="show_g_win_results_warn"></unset>
      <set token="show_g_win_results_run">True</set>
    </progress>
    <done>
      <condition match=" 'job.resultCount' == 0">
        <set token="tok_g_chg_cnt">0</set>
        <set token="tok_g_chg_color">red</set>
        <unset token="show_g_win_results_run"></unset>
        <unset token="show_g_win_results"></unset>
        <unset token="show_g_obj_filter"></unset>
        <unset token="show_g_win_results_msg"></unset>
        <set token="show_g_win_results_warn">True</set>
        <set token="tok_obj_raw_g_src_url">`ms_obj_changes_base_cat_act("Group","*")` (src_nt_domain=$tok_domain$ OR dest_nt_domain=$tok_domain$) ([|`ms_obj_ss_filt_raw_link("$tok_audit_value$","$tok_audit_id_lnk$","$target_object_list$","$tok_domain$","$tok_audit_value$","cn,sAMAccountName,dn","raw_txt")`])
| search $tok_audit_lnk$ IN([|`ms_obj_ss_filt_raw_link("$tok_audit_value$","$tok_audit_id_lnk$","$target_object_list$","$tok_domain$","$tok_audit_value$","cn,sAMAccountName,dn,userPrincipalName","link")`])</set>
      </condition>
      <condition>
        <eval token="tok_g_chg_cnt">toString($job.resultCount$,"commas")</eval>
        <set token="tok_g_chg_color">green</set>
        <unset token="show_g_win_results_run"></unset>
        <set token="show_g_win_results">True</set>
        <set token="show_g_obj_filter">True</set>
        <unset token="show_g_win_results_warn"></unset>
        <set token="show_g_win_results_msg">True</set>
        <set token="tok_obj_raw_g_src_url">`ms_obj_changes_base_cat_act("Group","*")` (src_nt_domain=$tok_domain$ OR dest_nt_domain=$tok_domain$) ([|`ms_obj_ss_filt_raw_link("$tok_audit_value$","$tok_audit_id_lnk$","$target_object_list$","$tok_domain$","$tok_audit_value$","cn,sAMAccountName,dn","raw_txt")`])
| search $tok_audit_lnk$ IN([|`ms_obj_ss_filt_raw_link("$tok_audit_value$","$tok_audit_id_lnk$","$target_object_list$","$tok_domain$","$tok_audit_value$","cn,sAMAccountName,dn,userPrincipalName","link")`])</set>
      </condition>
    </done>
  </search>
  <!-- Sub Drilldown Windows Change Events -->sub_g_dd_obj_search
  <search base="base_group_changes" id="sub_g_dd_obj_search">
    <query>search msad_action=$tok_g_msad_action$</query>
    <done>
      <condition match="$job.resultCount$ == 0">
        <unset token="show_g_dd_msg"></unset>
        <unset token="show_g_dd_tbl"></unset>
        <set token="show_g_dd_warn">True</set>
      </condition>
      <condition>
        <set token="show_g_dd_msg">True</set>
        <set token="show_g_dd_tbl">True</set>
        <unset token="show_g_dd_warn"></unset>
      </condition>
    </done>
  </search>

    <!-- Base Windows Change Events Search -->
  <search id="base_groupm_changes">
    <query>`ms_obj_changes_base_cat("Group Membership")` (src_nt_domain=$tok_domain$ OR dest_nt_domain=$tok_domain$) ([|`ms_obj_ss_filt_raw_link("$tok_audit_value$","$tok_audit_id_lnk$","$target_object_list$","$tok_domain$","$tok_audit_value$","cn,sAMAccountName,dn","raw_txt")`])
| `ms_obj_md_group_change_cmb("$tok_group_lkp$")`
| search member_obj_lkp!="" $tok_audit_lnk$ IN([|`ms_obj_ss_filt_raw_link("$tok_audit_value$","$tok_audit_id_lnk$","$target_object_list$","$tok_domain$","$tok_audit_value$","cn,sAMAccountName,dn,userPrincipalName","link")`])
| eval trigger="$tok_trg_chg_srch$"
| table time_group,adminuser,group,msad_action,Correlation_IDs,Change_Actions,Change_Summary,Change_Details,group_obj_lkp,member_obj_lkp</query>
    <earliest>$Timefilter.earliest$</earliest>
    <latest>$Timefilter.latest$</latest>
    <progress>
      <eval token="tok_gm_chg_cnt">$job.dispatchState$</eval>
      <set token="tok_gm_chg_color">blue</set>
      <unset token="show_gm_win_results"></unset>
      <unset token="show_gm_win_results_msg"></unset>
      <unset token="show_gm_win_results_warn"></unset>
      <set token="show_gm_win_results_run">True</set>
    </progress>
    <done>
      <condition match=" 'job.resultCount' == 0">
        <set token="tok_gm_chg_cnt">0</set>
        <set token="tok_gm_chg_color">red</set>
        <unset token="show_gm_win_results_run"></unset>
        <unset token="show_gm_win_results"></unset>
        <unset token="show_gm_obj_filter"></unset>
        <set token="show_gm_message">True</set>
        <unset token="show_gm_win_results_msg"></unset>
        <set token="show_gm_win_results_warn">True</set>
        <set token="tok_obj_raw_gm_src_url">`ms_obj_changes_base_cat_act("Group Membership","*")` (src_nt_domain=$tok_domain$ OR dest_nt_domain=$tok_domain$) ([|`ms_obj_ss_filt_raw_link("$tok_audit_value$","$tok_audit_id_lnk$","$target_object_list$","$tok_domain$","$tok_audit_value$","cn,sAMAccountName,dn","raw_txt")`])
| search $tok_audit_lnk$ IN([|`ms_obj_ss_filt_raw_link("$tok_audit_value$","$tok_audit_id_lnk$","$target_object_list$","$tok_domain$","$tok_audit_value$","cn,sAMAccountName,dn,userPrincipalName","link")`])</set>
      </condition>
      <condition>
        <eval token="tok_gm_chg_cnt">toString($job.resultCount$,"commas")</eval>
        <set token="tok_gm_chg_color">green</set>
        <unset token="show_gm_win_results_run"></unset>
        <set token="show_gm_win_results">True</set>
        <set token="show_gm_message">True</set>
        <set token="show_gm_obj_filter">True</set>
        <unset token="show_gm_win_results_warn"></unset>
        <set token="show_gm_win_results_msg">True</set>
        <set token="tok_obj_raw_gm_src_url">`ms_obj_changes_base_cat_act("Group Membership","*")` (src_nt_domain=$tok_domain$ OR dest_nt_domain=$tok_domain$) ([|`ms_obj_ss_filt_raw_link("$tok_audit_value$","$tok_audit_id_lnk$","$target_object_list$","$tok_domain$","$tok_audit_value$","cn,sAMAccountName,dn","raw_txt")`])
| search $tok_audit_lnk$ IN([|`ms_obj_ss_filt_raw_link("$tok_audit_value$","$tok_audit_id_lnk$","$target_object_list$","$tok_domain$","$tok_audit_value$","cn,sAMAccountName,dn,userPrincipalName","link")`])</set>
      </condition>
    </done>
  </search>
  <!-- Sub Drilldown Windows Change Events -->
  <search base="base_groupm_changes" id="sub_gm_dd_obj_search">
    <query>search msad_action=$tok_gm_msad_action$</query>
    <done>
      <condition match="$job.resultCount$ == 0">
        <unset token="show_gm_dd_msg"></unset>
        <unset token="show_gm_dd_tbl"></unset>
        <set token="show_gm_dd_warn">True</set>
      </condition>
      <condition>
        <set token="show_gm_dd_msg">True</set>
        <set token="show_gm_dd_tbl">True</set>
        <unset token="show_gm_dd_warn"></unset>
      </condition>
    </done>
  </search>
  <fieldset submitButton="false">
  </fieldset>
  <row>
    <panel id="pan_initial_inputs">
      <input type="dropdown" token="input_tok_domain" searchWhenChanged="true">
        <label>1. Select Domain</label>
        <choice value="sel">Select Domain</choice>
        <search base="base_domain_search">
          <query>table domain | sort domain</query>
        </search>
        <fieldForLabel>domain</fieldForLabel>
        <fieldForValue>domain</fieldForValue>
        <default>sel</default>
        <initialValue>sel</initialValue>
        <change>
          <condition value="sel">
            <unset token="tok_domain"></unset>
            <unset token="tokshowinptype"></unset>
            <unset token="tokshowinptime"></unset>
            <unset token="tok_show_tabs"></unset>
            <unset token="tok_obj_search"></unset>
            <unset token="tok_group_search"></unset>
            <unset token="tok_reset"></unset>            
          </condition>
          <condition>
            <unset token="tok_reset"></unset>    
            <unset token="tokshowinptime"></unset>
            <set token="tokshowinptype">true</set>
            <set token="tok_domain">$value$</set>
            <unset token="tok_show_tabs"></unset>
            <unset token="tok_obj_search"></unset>
            <unset token="tok_group_search"></unset>
          </condition>
        </change>
      </input>
    <input id="input_tgt_type" type="radio" token="inp_search_type" searchWhenChanged="false" depends="$tokshowinptype$">
      <label>2. Search by Group Or Group Member</label>
      <choice value="group_search">By Group</choice>
      <choice value="memb_search">By Member</choice>
      <default></default>
      <initialValue></initialValue>
      <change>
        <condition value="group_search">
          <set token="tok_reset">ByGroup</set>
          <unset token="tokshowinpmembtype"></unset>
          <unset token="tok_show_member_inp"></unset>
          <set token="tok_member_type"></set>
          <set token="form.tok_member_type"></set>
          <set token="tok_group">sel</set>
          <set token="form.tok_group">sel</set>
          <set token="tok_obj">sel</set>
          <set token="form.tok_obj">sel</set>
          <set token="tokshowinptime">true</set>
        </condition>
        <condition value="memb_search">
          <set token="tok_member_type"></set>
          <set token="form.tok_member_type"></set>
          <set token="tok_reset">ByMember</set>
          <set token="tok_obj_search">TRUE</set>
          <set token="tokshowinpmembtype">TRUE</set>
          <set token="tok_group">sel</set>
          <set token="form.tok_group">sel</set>
          <set token="tok_obj">sel</set>
          <set token="form.tok_obj">sel</set>
          <set token="tokshowinptime">true</set>
        </condition>
      </change>
    </input>
    <input type="dropdown" token="tok_group_type" searchWhenChanged="true" depends="$tokshowinputs$,$tok_group_search$">
      <label>3. Select Group Type</label>
      <choice value="*">All</choice>
      <search base="base_ad_search_objects">
        <query>stats count by groupType_Name | sort groupType_Name</query>
      </search>
      <fieldForLabel>groupType_Name</fieldForLabel>
      <fieldForValue>groupType_Name</fieldForValue>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>
    <input type="text" token="inp_group_filter" searchWhenChanged="true" depends="$tokshowinputs$,$tok_group_search$">
      <label>4. Filter Group List</label>
      <default>a*</default>
      <initialValue>a*</initialValue>
      <change>
          <condition match="len($value$)&gt;0">
            <set token="tok_group_filter">| search lookup_grp="$value$"</set>
            <set token="tok_reset">ByGroup</set>
          </condition>
          <condition>
            <set token="tok_group_filter"></set>
            <set token="tok_reset">ByGroup</set>
          </condition>
      </change>
    </input>    
    <input type="dropdown" token="tok_group" searchWhenChanged="true" depends="$tokshowinputs$,$tok_group_search$">
      <label>5. Select Group (MemberCount)</label>
      <choice value="sel">Select Group...</choice>
      <search base="base_ad_search_objects" id="input_group_list">
        <query>search groupType_Name="$tok_group_type$" $tok_group_filter$
| eval cn=cn." (".membercount.")"
| stats count by cn,dn 
| table cn,dn 
| sort cn</query>
      </search>
      <fieldForLabel>cn</fieldForLabel>
      <fieldForValue>dn</fieldForValue>
      <default>sel</default>
      <initialValue>sel</initialValue>
      <change>
        <condition value="sel">
          <set token="tok_type">group</set>
        </condition>
        <condition>
          <set token="tok_audit_value">$value$</set>
          <set token="tok_group_name">$label$</set>
          <set token="tok_group_dn">$value$</set>
          <set token="tok_audit_value_label">$label$</set>
          <set token="tok_trg_chg_srch">$value$</set>
          <set token="tokshowinptime">true</set>
          <set token="tok_show_tabs">True</set>
          <set token="tok_tab_1">active</set>
          <unset token="tok_tab_2"></unset>
          <unset token="tok_tab_3"></unset>
          <unset token="tok_tab_4"></unset>
          <unset token="tok_tab_5"></unset>
          <unset token="tok_tab_6"></unset>
        </condition>
      </change>
    </input>
    <input id="input_tgt_member" type="radio" token="tok_member_type" searchWhenChanged="false" depends="$tok_obj_search$,$tokshowinpmembtype$">
      <label>3. Member Type</label>
      <choice value="User">User</choice>
      <choice value="Computer">Computer</choice>
      <choice value="Group">Group</choice>
      <change>
        <condition value="User">
          <set token="form.tok_obj">sel</set>
          <set token="tok_obj">sel</set>
          <set token="tok_reset">User</set>
          <set token="tok_show_member_inp">True</set>
          <set token="tokshowinptime">True</set>          
        </condition>
        <condition value="Computer">
          <set token="form.tok_obj">sel</set>
          <set token="tok_obj">sel</set>
          <set token="tok_reset">Computer</set>
          <set token="tok_show_member_inp">True</set>
          <set token="tokshowinptime">True</set> 
        </condition>
        <condition value="Group">
          <set token="form.tok_obj">sel</set>
          <set token="tok_obj">sel</set>
          <set token="tok_reset">Group</set>
          <set token="tok_show_member_inp">True</set>
          <set token="tokshowinptime">True</set> 
        </condition>
      </change>
    </input>
    <input type="text" token="inp_obj_filter" searchWhenChanged="false" depends="$tok_obj_search$,$tok_show_member_inp$">
      <label>4. Filter $tok_member_type$ List</label>
      <default>a*</default>
      <initialValue>a*</initialValue>
      <change>
          <condition match="len($value$)&gt;0">
            <set token="tok_obj_filter">$value$</set>
          </condition>
          <condition>
            <set token="tok_obj_filter">*</set>
          </condition>
      </change>
    </input>
    <input type="dropdown" token="tok_obj" searchWhenChanged="true" depends="$tok_obj_search$,$tok_show_member_inp$">
      <label>5. Select $tok_member_type$</label>
      <choice value="sel">Select Member...</choice>
      <default>sel</default>
      <initialValue>sel</initialValue>
      <search base="base_ad_search_objects" id="member_list">
        <query>search $tok_audit_id_lnk$="$tok_obj_filter$"  | stats count by cn,dn | table cn,dn | sort cn</query>
      </search>
      <fieldForLabel>cn</fieldForLabel>
      <fieldForValue>dn</fieldForValue>
      <change>
        <condition value="sel">
          <set token="tok_type">Select member</set>
        </condition>
        <condition>
          <set token="tok_type">Select $value$</set>
          <set token="tok_audit_value">$value$</set>
          <set token="tok_obj_name">$label$</set>
          <set token="tok_audit_value_label">$label$</set>
          <set token="tok_trg_chg_srch">$value$</set>      
          <set token="tok_show_tabs">True</set>
          <set token="tok_tab_1">active</set>
          <unset token="tok_tab_2"></unset>
          <unset token="tok_tab_3"></unset>
          <unset token="tok_tab_4"></unset>
          <unset token="tok_tab_5"></unset>
          <unset token="tok_tab_6"></unset>
        </condition>
      </change>
    </input>
      <input type="time" token="Timefilter" searchWhenChanged="true" depends="$tokshowinptime$">
        <label>Set Change Time Range</label>
        <default>
          <earliest>@d</earliest>
          <latest>now</latest>
        </default>
        <change>
          <condition>
            <eval token="set_time_from">strftime(relative_time(now(),'earliest'),"%m/%d/%y %I:%M %p")</eval>
            <eval token="set_time_to">strftime(relative_time(now(),'latest'),"%m/%d/%y %I:%M %p")</eval>
          </condition>
        </change>
      </input>       
    </panel>
  </row>
  <row id="tabs_row" depends="$tok_show_tabs$">
    <panel>
      <html>
        <ul id="tabs" class="nav nav-tabs">
          <li>
            <img src="/static/app/ms_windows_ad_objects/ms_windows_ad_objects_icon.png" id="img_vj_mgmt_icon" style="height: 30px !important;width: 30px !important;padding-right:5px !important;"/>
          </li>
          <li class="$tok_tab_1$">
            <a href="#tab_description" class="toggle-tab" data-token-json="{&quot;tok_tab_1&quot;:&quot;active&quot;,&quot;tok_tab_2&quot;:&quot;undefined&quot;,&quot;tok_tab_3&quot;:&quot;undefined&quot;,&quot;tok_tab_4&quot;:&quot;undefined&quot;,&quot;tok_tab_5&quot;:&quot;undefined&quot;,&quot;tok_tab_6&quot;:&quot;undefined&quot;}">View Description</a>
          </li>             
          <li class="$tok_tab_2$">
            <a href="#tab_membership_details" class="toggle-tab" data-token-json="{&quot;tok_tab_2&quot;:&quot;active&quot;,&quot;tok_tab_1&quot;:&quot;undefined&quot;,&quot;tok_tab_3&quot;:&quot;undefined&quot;,&quot;tok_tab_4&quot;:&quot;undefined&quot;,&quot;tok_tab_5&quot;:&quot;undefined&quot;,&quot;tok_tab_6&quot;:&quot;undefined&quot;}">Membership Details</a>
          </li>
          <li class="$tok_tab_3$">
            <a href="#tab_ldap" class="toggle-tab" data-token-json="{&quot;tok_tab_3&quot;:&quot;active&quot;,&quot;tok_tab_1&quot;:&quot;undefined&quot;,&quot;tok_tab_2&quot;:&quot;undefined&quot;,&quot;tok_tab_4&quot;:&quot;undefined&quot;,&quot;tok_tab_5&quot;:&quot;undefined&quot;,&quot;tok_tab_6&quot;:&quot;undefined&quot;}">LDAP View</a>
          </li>      
          <li class="$tok_tab_4$">
            <a href="#tab_changes" class="toggle-tab" data-token-json="{&quot;tok_tab_4&quot;:&quot;active&quot;,&quot;tok_tab_1&quot;:&quot;undefined&quot;,&quot;tok_tab_2&quot;:&quot;undefined&quot;,&quot;tok_tab_3&quot;:&quot;undefined&quot;,&quot;tok_tab_5&quot;:&quot;undefined&quot;,&quot;tok_tab_6&quot;:&quot;undefined&quot;}">Group Change History (<b style="color:$tok_g_chg_color$;">$tok_g_chg_cnt$</b>)</a>
          </li>
          <li class="$tok_tab_5$">
            <a href="#tab_changes" class="toggle-tab" data-token-json="{&quot;tok_tab_5&quot;:&quot;active&quot;,&quot;tok_tab_1&quot;:&quot;undefined&quot;,&quot;tok_tab_2&quot;:&quot;undefined&quot;,&quot;tok_tab_3&quot;:&quot;undefined&quot;,&quot;tok_tab_4&quot;:&quot;undefined&quot;,&quot;tok_tab_6&quot;:&quot;undefined&quot;}">Member Change History (<b style="color:$tok_gm_chg_color$;">$tok_gm_chg_cnt$</b>)</a>
          </li>
          <li class="$tok_tab_6$">
            <a href="#tab_lookup" class="toggle-tab" data-token-json="{&quot;tok_tab_6&quot;:&quot;active&quot;,&quot;tok_tab_1&quot;:&quot;undefined&quot;,&quot;tok_tab_2&quot;:&quot;undefined&quot;,&quot;tok_tab_3&quot;:&quot;undefined&quot;,&quot;tok_tab_4&quot;:&quot;undefined&quot;,&quot;tok_tab_5&quot;:&quot;undefined&quot;}">Lookup Details</a>
          </li>
		 </ul>
      </html>
    </panel>
  </row>
  <row id="tab_description" depends="$tok_show_tabs$,$tok_tab_1$">
    <panel id="result_single_pan_obj_det" depends="$tok_audit_value_label$">
      <html>
              <h2>$tab_active_desc$ - <b>
            <i>$tok_audit_value_label$</i>
          </b>
        </h2>
        	<p>
              <i>Use the Tabbed views to analyze the Group Membership, AD Attributes, and Group Change history for - <b>$tok_audit_value_label$</b>.</i>
        </p>     
      </html>
      <table>
        <search base="audit_query">
          <query>fillnull value="Not Defined" cn,domain,distinguishedName,description,displayName,IsDeleted,IsRecycled,objectSid,sAMAccountName,whenChanged,whenCreated
| table cn,domain,distinguishedName,description,displayName,IsDeleted,IsRecycled,objectSid,sAMAccountName,whenChanged,whenCreated
| rename cn AS "Common Name", domain AS "Domain", distinguishedName AS "Distinguished Name", description AS "Description:", displayName AS "Display Name:", IsDeleted AS "Is Deleted:", IsRecycled AS "Is Recycled:" , objectSid AS "Object SID:", sAMAccountName AS "User Account:", whenChanged AS "When Changed:", whenCreated AS "When Created:"
| transpose
| sort column
| rename column AS "AD Field", "row 1" AS "Value"</query>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="drilldown">row</option>
        <option name="dataOverlayMode">none</option>
        <option name="count">11</option>
      </table>
    </panel>
  </row>
  <row id="tab_membership_details" depends="$tok_show_tabs$,$tok_tab_2$">
    <panel id="result_split3_pan_umemb"  depends="$tok_group$,$tok_group_search$">
      <html depends="$show_user_member_msg$">
        <center><h3>No User Accounts are Members of the Group $tok_group_name$</h3></center>
      </html>
      <html rejects="$show_user_member_msg$">
        <center><h3>Group $tok_group_name$ - Group Membership - User Accounts</h3></center>
      </html>
      <table>
        <search base="filt_u_members">
          <query>rename u_domain AS "Member Domain",u_cn AS Member, u_sAMAccountName AS "Member Account"</query>
        </search>        
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">10</option>
      </table>
    </panel>
    <panel id="result_split3_pan_gmemb" depends="$tok_group$,$tok_group_search$">
      <html depends="$show_group_member_msg$">
        <center><h3>No Embedded Groups are Members of the Group $tok_group_name$</h3></center>
      </html>
      <html rejects="$show_group_member_msg$">
        <center><h3>Group $tok_group_name$ - Group Membership - Embedded Groups</h3></center>
      </html>
      <table>
        <search base="filt_g_members">
          <query>rename g_domain AS "Member Domain",g_cn AS Member, g_sAMAccountName AS "Member Account"</query>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">10</option>
      </table>
    </panel>
    <panel id="result_split3_pan_cmemb" depends="$tok_group$,$tok_group_search$">
      <html depends="$show_computer_member_msg$">
        <center><h3>No Computer Accounts are Members of the Group $tok_group_name$</h3></center>
      </html>
      <html rejects="$show_computer_member_msg$">
        <center><h3>Group $tok_group_name$ - Group Membership - Computers</h3></center>
      </html>
      <table depends="$show_computer_member_table$">
        <search base="filt_c_members">
          <query>rename c_domain AS "Member Domain",c_cn AS Member, c_sAMAccountName AS "Member Account"</query>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">10</option>
      </table>
    </panel>
    <panel id="result_single_pan_obj_memb" depends="$tok_obj$,$tok_obj_search$">
      <table>
        <title>Group Membership for $tok_obj_name$</title>
        <search base="audit_query">
          <query>fields memberOf
| lookup $tok_group_lkp$ dn AS memberOf OUTPUT cn AS gm_cn,description AS gm_description,sAMAccountName AS gm_sAMAccountName
| sort gm_cn
| table memberOf,gm_cn,gm_sAMAccountName,gm_description
| rename memberOf AS "Group DN",gm_cn AS Group,gm_description AS "Group Description",gm_sAMAccountName AS "Group Account"</query>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">10</option>
      </table>
    </panel>
  </row>
  <row depends="$tok_show_tabs$,$tok_tab_2$">
    <panel id="result_single_pan_obj_ememb" depends="$tok_group$,$tok_group_search$">
      <html depends="$show_group_memberOf_msg$">
        <center><h3>Group ($tok_group_name$) is not Embedded in another Group</h3></center>
      </html>   
      <html rejects="$show_group_memberOf_msg$">
        <center><h3>Groups that the Group $tok_group_name$ are a memberOf</h3></center>
      </html>  
      <table rejects="$show_group_memberOf_msg$">
        <search base="audit_query">
          <query>fields memberOf
| stats count by memberOf
| lookup $tok_group_lkp$ dn AS memberOf OUTPUT cn AS gm_cn,description AS gm_description,sAMAccountName AS gm_sAMAccountName
| sort gm_cn          
| table memberOf,gm_cn,gm_description,gm_sAMAccountName
| rename memberOf AS "Group DN",gm_cn AS Group,gm_description AS "Group Description",gm_sAMAccountName AS "Group Account"</query>
          <done>
            <condition match=" 'job.resultCount' == 0">
              <set token="show_group_memberOf_msg">True</set>
              <unset token="show_group_memberOf_table"></unset>
            </condition>
            <condition>
              <set token="show_group_memberOf_table">True</set>
              <unset token="show_group_memberOf_msg"></unset>
            </condition>
          </done>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">10</option>
      </table>      
    </panel>
  </row>
  <row id="tab_ldap" depends="$tok_show_tabs$,$tok_tab_3$">
    <panel id="result_details_pan_ldap" depends="$tok_audit_value$">
      <title>AD Object LDAP View</title>
      <html>
        	<div id="audit_report"/>
      	</html>
    </panel>
  </row>
  <row depends="$tok_show_tabs$,$tok_tab_4$" id="result_rw_single_gchg">
    <panel>
      <title>Windows-Security - Group Changes - (From: $set_time_from$ To: $set_time_to$)</title>
      <input type="dropdown" token="tok_g_evt_chg_type" searchWhenChanged="true" depends="$show_g_win_results$">
        <label>Select Event Change Type</label>
        <choice value="all">All</choice>
        <default>all</default>
        <initialValue>all</initialValue>
        <search base="base_group_changes" id="sub_g_change_actions">
          <query>|stats count by msad_action
| eval label=case(msad_action="enabled","Enabled",msad_action="created","Created",msad_action="disabled","Disabled",msad_action="modified" OR msad_action="changed","Modified",msad_action="deleted","Deleted",msad_action="moved","Moved")
| eval label=if(isnull(label),msad_action,label)
| table msad_action,label 
| sort msad_action</query>
        </search>
        <fieldForLabel>label</fieldForLabel>
        <fieldForValue>msad_action</fieldForValue>
        <change>
          <condition value="all">
            <set token="tok_g_msad_action">*</set>
          </condition>
          <condition>
            <set token="tok_g_msad_action">$value$</set>
          </condition>
        </change>
      </input>
      <input id="input_res_field_type" type="radio" token="input_tbl_res_flds" searchWhenChanged="true" depends="$show_g_win_results$">
        <label>Event Result Type</label>
        <choice value="Change_Summary">WinEvent Summary</choice>
        <choice value="Change_Details">WinEvent Details</choice>
        <default>Change_Summary</default>
        <initialValue>Change_Summary</initialValue>
        <change>
          <condition value="Change_Summary">
            <set token="show_g_dd_details">True</set>
            <set token="tok_g_tbl_res_flds">Change_Summary</set>
          </condition>
          <condition value="Change_Details">
            <set token="show_g_dd_details">True</set>
            <set token="tok_g_tbl_res_flds">Change_Details</set>
          </condition>
        </change>
      </input>
      <html depends="$show_g_win_results_run$">
        <center>
          <h3>
            <img class="run_spin run_spin_dom_chk hidden" style="height:20px;width:20px;" src="/static/app/ms_windows_ad_objects/loader_green_on_grey.gif"/> Searching for Windows Change Events</h3>
        </center>
      </html>
      <table id="result_details_tbl_dd" depends="$show_g_win_results$">
        <search base="sub_g_dd_obj_search">
          <query>table time_group,adminuser,group,Change_Actions,$tok_g_tbl_res_flds$
| rename time_group AS Time_Minute_Group,adminuser as "Administrator",group AS "Target_Group",Change_Details as "Change Details",Change_Summary as "Change Summary"</query>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">5</option>
        <drilldown target="_blank">
          <link>
            <![CDATA[
                 /app/ms_windows_ad_objects/search?q=search%20$tok_obj_raw_dd_src_url|u$&earliest=$field3.earliest$&latest=$field3.latest$
                  ]]>
          </link>
        </drilldown>
      </table>
      <html id="aaa_details_msg_dd" depends="$show_g_win_results_msg$">
        <center>
          <a href="/app/ms_windows_ad_objects/search?q=search%20$tok_obj_raw_g_src_url|u$&amp;earliest=$Timefilter.earliest$&amp;latest=$Timefilter.latest$" class="btn mini sp-btn-gradient" target="_blank">
            <i class="icon-search" style="font-size:12px;color:white;"/> View Raw Events</a> - <p style="font-size:8;" id="rep_msg_p_dd">Click to open a new window with raw events for <b>All Windows Change</b> activities within Time Period (From: $set_time_from$ To: $set_time_to$)</p>
        </center>
      </html>
      <html id="aaa_obj_chg_g_details" depends="$show_g_win_results_warn$">
        <center>
          <h3>
            <i class="icon-warning" style="font-size:20px;color:red;">Warning: No Windows Group Change Events found within Time Period (From: $set_time_from$ To: $set_time_to$)</i>
            <hr/>
          </h3>
          <a href="/app/ms_windows_ad_objects/search?q=search%20$tok_obj_raw_g_dd_src_url|u$&amp;earliest=$Time.earliest$&amp;latest=$Time.latest$" class="btn mini sp-btn-gradient" target="_blank">
            <i class="icon-search" style="font-size:12px;color:white;"/> Search Raw Events</a> 
          <h4 style="font-size:15px;color:red;" id="rep_msg_p_dd_warn">Click to search for <b>All Windows Change</b> activities</h4>
        </center>
      </html>
    </panel>
  </row>
  <row depends="$tok_show_tabs$,$tok_tab_5$" id="result_rw_single_gmchg">
    <panel>
      <title>Windows-Security - Group Membership Changes - (From: $set_time_from$ To: $set_time_to$)</title>
      <input type="dropdown" token="tok_evt_gm_chg_type" searchWhenChanged="true" depends="$show_gm_win_results$">
        <label>Select Event Change Type</label>
        <choice value="all">All</choice>
        <default>all</default>
        <initialValue>all</initialValue>
        <search base="base_groupm_changes" id="sub_gm_change_actions">
          <query>|stats count by msad_action
| eval label=case(msad_action="enabled","Enabled",msad_action="created","Created",msad_action="disabled","Disabled",msad_action="modified" OR msad_action="changed","Modified",msad_action="deleted","Deleted",msad_action="moved","Moved")
| eval label=if(isnull(label),msad_action,label)
| table msad_action,label 
| sort msad_action</query>
        </search>
        <fieldForLabel>label</fieldForLabel>
        <fieldForValue>msad_action</fieldForValue>
        <change>
          <condition value="all">
            <set token="tok_gm_msad_action">*</set>
          </condition>
          <condition>
            <set token="tok_gm_msad_action">$value$</set>
          </condition>
        </change>
      </input>
      <input id="input_res_field_type_gm" type="radio" token="input_gm_tbl_res_flds" searchWhenChanged="true" depends="$show_gm_win_results$">
        <label>Event Result Type</label>
        <choice value="Change_Summary">WinEvent Summary</choice>
        <choice value="Change_Details">WinEvent Details</choice>
        <default>Change_Summary</default>
        <initialValue>Change_Summary</initialValue>
        <change>
          <condition value="Change_Summary">
            <set token="show_gm_dd_details">True</set>
            <set token="tok_gm_tbl_res_flds">Change_Summary</set>
          </condition>
          <condition value="Change_Details">
            <set token="show_gm_dd_details">True</set>
            <set token="tok_gm_tbl_res_flds">Change_Details</set>
          </condition>
        </change>
      </input>
      <html depends="$show_gm_win_results_run$">
        <center>
          <h3>
            <img class="run_spin run_spin_dom_chk hidden" style="height:20px;width:20px;" src="/static/app/ms_windows_ad_objects/loader_green_on_grey.gif"/> Searching for Windows Group Membership Change Events</h3>
        </center>
      </html>
      <table depends="$show_gm_win_results$">
        <search base="sub_gm_dd_obj_search">
          <query>table time_group,adminuser,group,Change_Actions,$tok_gm_tbl_res_flds$
| rename time_group AS Time_Minute_Group,adminuser as "Administrator",group AS "Target_Group",Change_Details as "Change Details",Change_Summary as "Change Summary"</query>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">5</option>
        <drilldown target="_blank">
          <link>
            <![CDATA[
                 /app/ms_windows_ad_objects/search?q=search%20$tok_obj_raw_dd_src_url|u$&earliest=$field3.earliest$&latest=$field3.latest$
                  ]]>
          </link>
        </drilldown>
      </table>
      <html depends="$show_gm_win_results_msg$">
        <center>
          <a href="/app/ms_windows_ad_objects/search?q=search%20$tok_obj_raw_gm_src_url|u$&amp;earliest=$Timefilter.earliest$&amp;latest=$Timefilter.latest$" class="btn mini sp-btn-gradient" target="_blank">
            <i class="icon-search" style="font-size:12px;color:white;"/> View Raw Events</a> - <p style="font-size:8;" id="rep_msg_p_dd">Click to open a new window with raw events for <b>All Windows Change</b> activities within Time Period (From: $set_time_from$ To: $set_time_to$)</p>
        </center>
      </html>
      <html depends="$show_gm_win_results_warn$">
        <center>
          <h3>
            <i class="icon-warning" style="font-size:20px;color:red;">Warning: No Windows Group Membership Change Events found within Time Period (From: $set_time_from$ To: $set_time_to$)</i>
            <hr/>
          </h3>
          <a href="/app/ms_windows_ad_objects/search?q=search%20$tok_obj_raw_gm_dd_src_url|u$&amp;earliest=$Time.earliest$&amp;latest=$Time.latest$" class="btn mini sp-btn-gradient" target="_blank">
            <i class="icon-search" style="font-size:12px;color:white;"/> Search Raw Events</a> 
          <h4 style="font-size:15px;color:red;" id="rep_msg_p_dd_warn">Click to search for <b>All Windows Change</b> activities</h4>
        </center>
      </html>
    </panel>
  </row>
  <row id="tab_lookup" depends="$tok_show_tabs$,$tok_tab_6$">
    <panel id="result_single_pan_lkp_g" depends="$tok_group$,$tok_group_search$">
      <table>
        <title>Group Lookup Details</title>
        <search base="audit_query">
          <query>makemv delim="####" dSCorePropagationData  | table *</query>
        </search>
      </table>
    </panel>
    <panel id="result_single_pan_lkp_o"  depends="$tok_obj$,$tok_obj_search$">
      <table>
        <title>Member Lookup Details for $tok_obj_name$</title>
        <search base="audit_query">
          <query>makemv delim="####" dSCorePropagationData  | table *</query>
        </search>
      </table>
    </panel>
  </row>
</form>