Chat now with support
Chat with Support

Change Auditor 7.3 - Whats New

What's New in Change Auditor 7.3 What's New in Change Auditor 7.2 What's New in Change Auditor 7.1.1 What's New in Change Auditor 7.1 What's New in Change Auditor 7.0.4 What's New in Change Auditor 7.0.3 What's New in Change Auditor 7.0.2 What's New in Change Auditor 7.0.1 What's New in Change Auditor 7.0

Foreign forest support

The following is supported in environments where a coordinator does not exist in the foreign forest where agents are deployed:

•
Ability to harvest the foreign forest topology.
•
Ability to deploy agents through the Change Auditor client.
•
Ability to audit logon activity with an agent in the foreign forest.
•
Ability to audit and protect Windows File System with an agent in the foreign forest.
•
Ability to audit and protect Active Directory objects with an agent in the foreign forest.
•
Ability to audit Active Directory attributes with an agent in the foreign forest.
•
Ability to select objects from the foreign forest in object pickers for search queries.
•
Ability to include and exclude objects from the foreign forest in AD queries.

On Demand Audit integration updates

•
Ability to send the Change Auditor version and list of coordinators to On Demand Audit after an upgrade so that On Demand Audit can display the most current Change Auditor information.
•
New events generated when event forwarding to On Demand Audit is suspended due to an error and then resumed:
•
On Demand Audit subscription has suspended
•
On Demand Audit subscription has resumed
•
New events generated when an On Demand administrator makes changes to the Change Auditor event forwarding settings within On Demand Audit:
•
Event sending to On Demand Audit paused
•
Event sending to On Demand Audit resumed
•
On Demand Audit configuration removed
•
New event generated when Change Auditor connects to On Demand Audit:
•
On Demand Audit configuration added

Authentication and Logon activity updates

•
Additional events:
•
User performed a successful NTLM V1 logon is created when a user successfully logged into a server through NTLM V1.
•
User performed a successful NTLM V2 logon is created when a user successfully logged into a server through NTLM V2.
•
User authenticated through NTLM (or User failed to authenticate through NTLM) is created when a user successfully authenticates (or fails to authenticate) to a domain controller using NTLM authentication.
•
Additional built-in searches:
•
All Kerberos Authentication Activity in the past 24 hours
•
All NTLM Authentication Activity in the past 24 hours
•
All NTLM version 1 logons in the last 7 days
•
Ability to search logon events by the failure reason or status code.
•
Ability to set Kerberos ticket lifetime in agent configuration and detect possible golden ticket use. When a Kerberos ticket lifetime that exceeds the value specified in the agent configuration is detected, the “Kerberos user ticket that exceeds the maximum lifetime detected” domain controller authentication event is generated. A valid Change Auditor Logon Activity User license is required.

Additional platform support

The following support has been added:

•
Windows Server Core 1909 (Active Directory, Windows File System, Registry, Services, and Local User and Group auditing only)
•
Microsoft Exchange Server 2016 CU15
•
Microsoft Exchange Server 2019 CU4
•
Microsoft SQL Server 2019 CU2 (coordinator database, SQL and SQL DLA auditing)
•
.NET Framework 4.6.2 for the agent
•
NetApp 9.7
•
Defender 5.9.6
•
GPOADmin 5.14
•
Active Roles Server 7.4.2
•
Fluid File System 6.0.3

The following support has been removed:

•
Microsoft Exchange Server 2010 is no longer supported for auditing or protection
•
Windows Server 2008 R2 is no longer supported for agent installations
•
Windows server 2008 SP2 is no longer supported for legacy agent installations
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating