We’ve all been there, a patch run has been kicked off and the associated Change Tracker Planned Change was not configured – disaster, and possibly a couple of hundred thousand unplanned changes to boot!

Aside from reviewing what Change Tracker’s API integration with your change management solution can offer for future patching, here’s a few ways that you can easily convert multiple unplanned changes to a planned change state.

First Example: Configure the Events page to display 1000 events, check select all and use the Action button to acknowledge, create or extend a planned change.


This approach is workable for changes numbering less than a few thousand, but will however quickly become tedious for changes that exceed a few hundred thousand.

Enter the little know and yet powerful ‘Re-evaluate Events’ option! Each configured Change Tracker planned change has a re-evaluate events button which when pressed, will crunch through all events for the past 7 days, converting & matching unplanned changes, into planned.

Configuration is relatively simple, if we continue with our patch run scenario, the first step is to review the changes and confirm they were caused by the patching activity. Change Tracker provides a number of export options to enable the event list to be reviewed including CSV, PDF, and Excel.

Here in our example, I’m interested in re-evaluating the unplanned changes which the Windows group experienced on the 12th April.


Step 1, create a Change Tracker planned change which matches the activity on the 12th April. Move to Settings > Planned Changes and hit the Schedule a Planned Change button. The start point is to enter the time frame and groups which were involved. So for my change, that’s the 12th April and the Windows 2012 and 2012 R2 groups.


Once the planned change is created click the Rules button.


Create the rule or rules necessary to match the changes. Be as accurate as you can with the rule creation and do not leave options marked as *(Any), this will increase the load on the Change Tracker system as it analyses the unplanned changes. If you are attempted to match file changes then set the ‘Tracker’ to filesystemtracker and the ‘Item Type’ to file. In the example, I’m matching all unplanned file changes, identified by the filesystemtracker and which start with the path c:\program files (x86).


With all the rules created, head into the Planned Change area (the large brown square on the button bar) and press the ‘Show Out-of-Schedule’ button to find the newly created planned change. With the planned change located click to highlight. You’ll see the page populate with blank graphs and under ‘Planned Change Events – Last 7 days’, the Re-evaluate Events button.


Click this button to begin the process of reassessing the events. This process will take some time, the more events the longer it will take so grab a coffee and let Change Tracker simmer!

Once completed, all the unplanned changes will have morphed to a planned change state and everything will be right in the world once more J

We hope that this is all fairly straightforward but if you are at all confused please don’t hesitate to grab your nearest friendly NNT support team to assist – that’s what we do




NNT has a range of training and managed service offerings to help you get the most of your solution.
Call (844) 898-8362 or click here to request more information.

Contact Us

Corporate Headquarters

6160 Warren Parkway, Suite 100
Frisco, Texas, 75034

Phone 1: 1-949-407-5125

Phone 2: 888-638-9749 (toll-free)

[email protected]

United Kingdom

5 New Street Square
London EC4A 3TW

Phone: +44 (0) 203 588 3023

 [email protected]
SC Magazine Cybersecurity 500 CSGEA Winners 2021 CIS benchmarking SEWP Now Certified IBM Security
Copyright 2024, New Net Technologies LLC. All rights reserved. 
NNT and Change Tracker are registered trademarks of New Net Technologies LLC.
All other product, company names and trademarks are the property of their respective owners.