Chat now with support
Chat with Support

Change Auditor - For Advanced Users 7.0.2 - Technical Insight Guide

Change Auditor Services Change Auditor licensing processes Change Auditor network communications Coordinator internal tasks Registry Settings Change Auditor built-in fault tolerance Change Auditor protection Database Considerations Account exclusions best practices

Client to coordinator connection

Client to coordinator connection
1
When the client is started, it searches Active Directory for the Service Connection Point (SCP) objects to retrieve connection information for the coordinator such as host name, listening port, and other authentication information.
2
The client connects to the coordinator using Windows Communication Foundation (WCF) using Kerberos authenticated connections.Ports are dynamically assigned, but can be statically set.
3
The coordinator encrypts protected data using Microsoft RSACryptoServiceProvider (PROV_RSA_FULL) APIs.
4
The client decrypts the protected data using Microsoft RSACryptoServiceProvider (PROV_RSA_FULL) APIs.

Legacy (5.x) agent to coordinator connection

1
When an agent is started, it searches Active Directory for the SCP objects to retrieve connection information for the coordinator such as host name, listening port, and other authentication information.
2
The legacy (5.x) agent connects to the coordinator using TCP/IP using Kerberos authenticated connections. Ports are dynamically assigned, but can be statically set.
3
For encrypted communications between legacy agents and the coordinator service, Change Auditor uses SSPI from http://technet.microsoft.com/en-us/library/bb742535.aspx.
•
SSPI selects a security provider based on a user-specified list of providers. Change Auditor negotiates authentication encryption, but favors Kerberos, if present, from http://msdn.microsoft.com/en-us/library/aa375385(VS.85).aspx.
•
Change Auditor uses SSPI with a key length equal to the length of the session key. This encryption is symmetric. This encryption is automatically enabled. This encryption cannot be used outside of Change Auditor.
•
Change Auditor also supports NTLM from http://msdn.microsoft.com/en-us/library/aa375388(VS.85).aspx.
•
Change Auditor uses NTLM with a key length equal to the length of the session key. This encryption is symmetric. This encryption is automatically enabled. This encryption cannot be used outside of Change Auditor.

Agent to coordinator connection (version 6.x and 7.0.1)

Change Auditor 6.x (and above) agents also search Active Directory for the SCP for connection information to the coordinator; however, they now connect to the coordinator using WCF as described here.

1
The Change Auditor 6.x (and above) agent connects to a coordinator using WCF using Kerberos authenticated connections. Ports are dynamically assigned, but can be statically set.
2
The coordinator encrypts protected data using Microsoft RSACryptoServiceProvider (PROV_RSA_FULL) APIs.
3
The agent decrypts the protected data using Microsoft RSACryptoServiceProvider (PROV_RSA_FULL) APIs.

Agent to coordinator connection (version 7.0.2)

Change Auditor 7.0.2 agents connect in the same way as 6.x agents, however encryption and decryption for database storage and communications are upgraded to meet the requirements of FIPS 140-2 and its annexes.

1
The Change Auditor 7.0.2 agent connects to a coordinator using WCF with Windows authentication and TCP transport security, which negotiates Kerberos for both authentication and encryption. Only Kerberos encryption algorithms allowed by the “Network security: Configure encryption types allowed for Kerberos” group policy.
2
The coordinator encrypts and decrypts protected data in database storage using the “Microsoft Enhanced Cryptographic Provider v1.0” (CNG or Crypto Next Generation) provider with a provider type of PROV_RSA_FULL and the new storage scheme described under Secure password storage.
3
The agent decrypts protected data in configuration data from the coordinator using the “Microsoft Enhanced Cryptographic Provider v1.0” (CNG or Crypto Next Generation) provider with a provider type of PROV_RSA_FULL.
4
Security for data sent from the coordinator to the agent and from agent to coordinator is provided by WCF TCP transport security using the “Microsoft Enhanced Cryptographic Provider v1.0”.
5
The Change Auditor 7.0.2 agent cannot connect to a coordinator version 7.0.1 or earlier.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating