Chat now with support
Chat with Support

Change Auditor 7.3 - Whats New

What's New in Change Auditor 7.3 What's New in Change Auditor 7.2 What's New in Change Auditor 7.1.1 What's New in Change Auditor 7.1 What's New in Change Auditor 7.0.4 What's New in Change Auditor 7.0.3 What's New in Change Auditor 7.0.2 What's New in Change Auditor 7.0.1 What's New in Change Auditor 7.0

Additional platform support

The following support has been added:

•
Microsoft Exchange Server 2016 CU23
•
Microsoft Exchange Server 2019 CU12
•
Microsoft SQL Server 2016 SP3
•
Windows Server 2022 for auditing on all subsystems
•
Windows 10 Enterprise for Virtual Desktops for workstation agents
•
Active Roles 7.5.1, 7.6, and 8.0
•
NetApp ONTAP 9.9 and 9.10
•
GPOADmin 5.17
•
EMC Common Event Enabler (CEE) Framework 8.9.7.1

The following support has been removed:

•
SQL Server 2012 for the coordinator and auditing
•
Internet Explorer 11
•
Ability to publish to the Quest Knowledge portal

Miscellaneous features and enhancements

•
Ability to ignore GPOADmin working copies in Group Policy protection templates and the addition of the following associated internal events:
•
Do not enforce protection for GPOADmin working copy option disabled.
•
Do not enforce protection for GPOADmin working copy option enabled.
•
Ability to globally protect all GPO links unless change comes from an override account.
•
Additional internal events generated when a coordinator is unable to send events to a SIEM subscription:
•
Event forwarding subscription disabled due to webhook receiver error.
•
Event forwarding suspended due to webhook error.
•
Event forwarding has resumed.
•
Additional logging when a foreign agent is unable to connect to the coordinator.
•
Additional support in the Windows client for accessibility tools such as screen readers.
•
Updated import and export functionality to support certificate authentication in Office 365 templates.
•
Performance improvements to the purge process.
•
Delete events are recorded for each object contained in an OU when the "Use Delete Subtree server control" option is selected when deleting an OU.

What's New in Change Auditor 7.2

What’s New in Change Auditor 7.2

As a result of ongoing research and development, and in response to customer feedback, the following enhancements have been made in this release of Quest Change Auditor.

•
Cyber security enhancements
•
Certificate authentication for Office 365
•
Active Directory Federation Services auditing enhancements
•
Foreign forest support
•
Additional events
•
Additional platform support
•
Miscellaneous features and enhancements

Cyber security enhancements

Additional Active Directory events and built-in searches that can be used as indicators of possible cyber security attacks.

•
The following events have been added:
•
Different domain SID added to user object sIDHistory
•
Different domain SID removed from user object sIDHistory
•
Well-known SID added to user object sIDHistory
•
Well-known SID removed from user object sIDHistory
•
Same domain SID added to user object sIDHistory
•
Same domain SID removed from user object sIDHistory
•
Different domain SID added to group object sIDHistory
•
Different domain SID removed from group object sIDHistory
•
Well-known SID added to group object sIDHistory
•
Well-known SID removed from group object sIDHistory
•
Same domain SID added to group object sIDHistory
•
Same domain SID removed from group object sIDHistory
•
adminCount attribute changed on Computer object
•
adminCount attribute changed on User object
•
adminCount attribute changed on Group object
•
ServicePrincipalName removed from user object
•
ServicePrincipalName added to user object
•
Irregular domain controller registration activity detected. This event could identify a possible DCShadow threat. DCShadow is a command within Mimikatz that simulates the behavior of a domain controller to push changes to an Active Directory domain through replication, bypassing most of the common security controls.
•
The following searches have been added:
•
Users SIDHistory changed in the last 30 days search
•
Users high severity SIDHistory changed in the last 30 days search
•
Group SIDHistory changed in the last 30 days search
•
Group high severity SIDHistory changed in the last 30 days search
•
AdminCount changed on user in the last 30 days search
•
AdminCount changed on group in the last 30 days search
•
AdminCount changed on computer in the last 30 days search
•
Users servicePrincipalName changed in the last 30 days search
•
All Irregular Domain Controller Registration events in the last 7 days search
•
Ability to create an Active Directory protection template and select a root domain object to prevent users from linking GPOs.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating