Chat now with support
Chat with Support

Change Auditor 7.4 - User Guide

Change Auditor Overview Agent Deployment Change Auditor Client Overview Overview Page Searches Search Results and Event Details Custom Searches and Search Properties Enable Alert Notifications Administration Tasks Agent Configurations Coordinator Configuration Purging and Archiving your Change Auditor Database Disable Private Alerts and Reports Generate and Schedule Reports SQL Reporting Services Configuration Change Auditor User Interface Authorization Client Authentication Certificate authentication for client coordinator communication Integrating with On Demand Audit Enable/Disable Event Auditing Account Exclusion Registry Auditing Service Auditing Agent Statistics and Logs Coordinator Statistics and Logs Change Auditor Commands Change Auditor Email Tags

Using group Managed Service Accounts (gMSA)

When using a group Managed Service Account for your agent deployment:

For information on group Managed Service Account implementations and requirements, refer to Microsoft documentation.

Deploy agents

Agents deployed to servers (domain controllers and member servers) track changes in real time. When a change is made on a server, the agent captures the change information (audit event), batches and forwards the information to the coordinator, which then inserts the event details into the Change Auditor database.

NOTE:  
1
Verify that the user account used to deploy agents is at least a Domain Admin in every domain that contains servers and workstations where agents are to be deployed.
4
From this list, select an entry and select Credentials | Set to enter the proper user credentials for installing agents on the selected domain.
On the Domain Credentials dialog, select the domain from the list and click Set. On the Logon Credentials dialog enter the credentials of a user with administrator rights on the selected domain.
5
After entering the proper credentials, select the entry back on the Deployment page and select Credentials | Test. If you get a Valid Creds status in the Deployment Result column, you can start deploying agents to that domain.
If you get a Logon Failure status in the Deployment Result column, use the Credentials | Set command to reenter the proper credentials for installing agents.
If you select the When option, enter the date and time when you want the deployment task to be initiated. Click OK to initiate or schedule the deployment task.
Back on the Deployment page, the Agent Status column will display ‘Pending’ and the When column will display the date and time specified.
NOTE: To cancel a pending deployment task, select the server and workstation and then click Install or Upgrade. On the Install or Upgrade dialog, click Clear Pending.
9
As agents are successfully connected to the coordinator, the corresponding Deployment Result cell displays ‘Success’, the Agent Status cell displays ‘Active’ and a desktop notification is displayed in the lower right-hand corner of your screen.
NOTE: To deactivate these desktop notifications, select Action | Agent Notifications.

Connect to a different foreign forest/update credentials

Once an agent is installed, you can select to use a different coordinator in another forest or update the credentials.

1
Select the Deployment tab.
NOTE:  
5
Click OK to initiate or schedule the credential update task.

 

If User Account Control is enabled, you may need to authorize the Coordinator Credential Configurator to use the required elevated permissions by right-clicking on the tool and selecting 'Run as administrator' option.

Change the agent installation location and system tray option

By default, the Change Auditor agent folders (Agent, Systray) is installed to %ProgramFiles%\Quest\ChangeAuditor\. You can, however, change the location of the installation folder by selecting Advanced Options on the Deployment page.

NOTE: The other option available under Advanced Options are discussed in the Active Roles Integration section in the Change Auditor Installation Guide.
2
To change the installation folder, check the Specify Agent Installation Location check box and enter the location to use for the agent installation folder.
4
By default, the system share (ADMIN$) is used; however, you can use a different share by selecting the Specify a Custom Share on the Remote Server option and entering the share to use.
5
Use the Launch ServiceStatusTray on startup options to indicate whether you would like to run/install the Change Auditor agent system tray icon when the agent is started.
Yes - launch the ServiceStatusTray on startup
No - do not launch the ServiceStatusTray on startup
Do not change - do not change the ServiceStatusTray launch option (default)
NOTE: The agent system tray icon (and the LaunchServiceStatusTray on startup setting) applies only to server agents. For more information about this icon, see Agent system tray icon.
6
Use the Restart Agent on failure options to indicate whether to restart an agent if it fails to start.
Yes - restart agent on failure.
No - do not restart agent on failure
Do not change - do not change the restart agent option (default)
NOTE: When you select Yes, the agent is restarted if a main Change Auditor service goes offline due to a crash, failure or unknown exception; however, if the agent is gracefully shut down, the service will not be restarted.
7
Optionally, select Save as Default to save the current advanced deployment settings as the default for future agent deployments.
You can select Restore to Default to restore all the advanced deployment settings to the factory default or last saved defaults.
8
Click OK to save your selections and close the dialog. These deployment settings apply to all the agents selected on the Deployment page.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating