Change Auditor 7.3 - Installation Guide

Permissions

User account performing the coordinator installation:

The user account installing the coordinator needs permission to perform the following tasks on the target server:

The user account performing the installation, must be a member of the Domain Admins group in the domain where the coordinator is being installed.

Service account running the coordinator service (LocalSystem by default):

By default, the Coordinator service runs as LocalSystem. To run the Change Auditor service as a Domain User or service account other than Local System, the Change Auditor SPN (Service Connection Point) must be removed from the Coordinator computer (local system) account and added to the Domain Account used to run the Coordinator service.

To do so, open a command prompt on a Domain Controller and perform the following:

SQL Server database access account specified during installation:

An account must be created to be used by the coordinator service on an ongoing basis for access to the SQL Server database. This account must have a SQL Login and be assigned the following SQL permissions:

The Agent Deployment wizard runs under the security context of the currently logged on user account. Therefore, you must have administrative authority to install software on every target machine. This means you must be a Domain Admin in every domain that contains servers that you are targeting for installation.

If you are targeting domain controllers only, membership in the Enterprise Admins group will grant you authority to all domain controllers in the forest.

All users responsible for deploying agents must also be a member of the ChangeAuditor Administrators group in the specified Change Auditor installation. If you are not a member of this security group for this installation, you will get an access denied error.

The user account used to install the agent by running the Windows Installer directly on the domain controller or member server or workgroup server or workstation needs permissions to perform the following tasks on the server:

Other installation notes

Certain MMC modules disrupt or hinder the addition or removal of services, therefore, MMC modules can not be running (directly on the server or in a Terminal Services session) when installing or uninstalling Change Auditor. Stop the MMC files before installing or uninstalling Change Auditor.

Before installing or upgrading the coordinators or server agents, Quest recommends to close all Event Log Viewers. If a user has an Event Viewer open and opens a Change Auditor event log to load and display a message, the Windows EventLog locks the event message DLL which can cause the Windows Installer Restart Manager to restart dependent services.

If you try to install these components on a computer with an earlier version, the installation fails and you are notified that a newer version is required. To verify that you are running the appropriate version of Microsoft’s .NET framework, use Add or Remove Programs.

NOTE: Links to the .NET framework are available in Change Auditor’s Autorun.exe redistributables.

Quest recommends installing the Change Auditor components in the following order:

NOTE: The database name must not include embedded spaces, special characters, or supplementary characters are also not allowed. For more details, see Microsoft’s database identifier documentation.

TIP: Quest recommends that you install the first coordinator and client, but do not deploy agents until after you have installed all of the additional coordinators required. When deploying agents you can select which installation is to be used for each of the agents.

NOTE: During the coordinator installation, you can add the current user to the ChangeAuditor Administrators security group. If you selected not to add the current user during the installation process or want to add additional user accounts to the Change Auditor security groups, you need to add them prior to launching the Change Auditor client. Quest also recommends that you then add these security groups to the appropriate SQL database role (i.e., ChangeAuditor Administrators - <InstallationName> group to the ChangeAuditor_Administrators role and ChangeAuditor Operators - <InstallationName> group to the ChangeAuditor_Operators role). See Add Users to Change Auditor Security Groups in the Change Auditor Installation Guide.

For a complete and comprehensive Active Directory change auditing solution, Quest recommends deploying agents to every server in the forest.

For best results in capturing Group Policy changes, Quest recommends installing an agent on the domain’s PDC operations master role holder.

During the coordinator installation, three installation-specific security groups are created in the domain where the member server hosting a coordinator resides.

Where <InstallationName> is a unique name selected during the coordinator installation to isolate your components from any other Change Auditor installation in your Active Directory forest.

Add your user account to either the ChangeAuditor Administrators or ChangeAuditor Operators group before running the client. If multiple coordinators are installed in a mixed mode environment, to connect to each coordinator, add your user account to one of these groups on each of the member servers where a coordinator resides.

In addition, users responsible for deploying agents must also be a member of the ChangeAuditor Administrators group in the specified Change Auditor installation.

During the coordinator installation, you are presented with the option to add the current user to the ChangeAuditor Administrators security group. If you selected not to do this during the coordinator installation process or you want to add more user accounts, add your user account (and any other appropriate user accounts) to one of the Change Auditor security groups before running the client.

See Add Users to Change Auditor Security Groups for more detailed information about the security groups that are created when the coordinator is installed.

NOTE: When the first foreign workstation agent is manually installed, a ChangeAuditor Agents - <InstallationName> security group is created. User accounts must be added to this security group to properly authenticate.

Change Auditor for Windows File Servers

Change Auditor for Windows File Server agents may fail to provide origin information if remote users are already connected when the agent is initialized or started. Therefore, it is suggested that you restart the server as soon as possible after an agent installation or upgrade.

Change Auditor for Exchange

High volume Exchange Servers. Agent processing of large Exchange auditing and protection configurations may slow down initial user login access or cause timeouts if many user logins are occurring at the same time. To avoid this issue, Quest recommends that the following actions be performed during maintenance intervals or other periods of low user mailbox activity:

Before the system returns to a normal load, one user should log in to Outlook Web Access (OWA), Outlook, and Exchange Web Services (EWS, Outlook for Mac) clients. This triggers the Change Auditor agent to process Exchange Mailbox auditing and protection configuration changes when the fewest logins are occurring.

Exchange 2013/2016. Exchange 2013/2016 stores its configuration data in Active Directory, and installing Change Auditor agents on the domain controller captures all these change actions. However, Microsoft changed how they process configuration changes. Therefore, in order for Change Auditor for Exchange to retrieve the correct ‘who’ information for these Active Directory based events it now audits Windows PowerShell. So you can:

To capture Exchange mailbox access events:

Deploy agents to all Exchange Servers. When a Change Auditor 5.6 (or higher) agent is deployed on Exchange Server, it automatically enables the scripting extension in Active Directory. This is a forest-wide setting and applies to all Exchange servers in the Exchange organization. This extension requires that the ScriptingAgentConfig.xml file be present in the Exchange Server folder; otherwise, Exchange management tools display error messages each time the Scripting Agent cmdlet runs. The Change Auditor 5.6 (or higher) agent automatically creates the required ScriptingAgentConfig.xml file in the Exchange Server folder if one is not already present. Therefore, it is highly recommended that an agent be installed on all Exchange servers to ensure that all servers are using the same scripting agent.

NOTE: If the scripting agent was not enabled on your Exchange servers before deploying agents, you should perform backups of your Exchange servers in accordance with your company’s disaster recovery plan once you have successfully deployed agents to all your Exchange servers. If you need to restore your Exchange servers and they were NOT backed up after you deployed agents that enabled the scripting agent, you will need to disable the CmdletExtensionAgent BEFORE recovering your Exchange 2013/2016 servers.

If Change Auditor cannot be installed on all your Exchange servers, use the following procedure on all Exchange servers where an agent is not yet deployed:

Exchange cluster node servers. When deploying or upgrading agents on Exchange cluster node servers, use the following recommended procedure:

Exchange 2003, 2007, and 2010 are no longer supported. For supported versions, see the Change Auditor Release Notes.

Exchange denies authentication to all well-known accounts, including ‘Administrator’. Use Hub Transport servers to allow SMTP email to go through. This references the setting for My Server Requires Authentication on the SMTP Configuration pane on the Coordinator Configuration page (Administration Tasks tab) in the Change Auditor client. It may also be necessary to configure more Transport settings (authentication and permissions) to allow email relay from the Change Auditor coordinator machine to receive SMTP alerts.

Change Auditor for Exchange does not support Microsoft Outlook 2000 or 2002.

For improved performance, Outlook offers an option to ‘cache’ requests to Exchange Server. This option is enabled by default when you configure an email account for Exchange Server. To disable this setting, select the Outlook Tools | Account Settings menu command, open the E-mail tab and click Change, and then clear the Use Cached Exchange Mode check box on the Microsoft Exchange Settings dialog.

While Change Auditor Exchange monitoring events closely track user input in non-cached Outlook and Outlook Web Access clients, this is not the case with cached-mode Outlook.

User activity in cached-mode Outlook can provide complex results with Change Auditor Exchange monitoring; the timing and order of Exchange requests is not obvious or intuitive.

A few of the effects you will see when monitoring an Outlook cached connection to Exchange Server include:

You will still receive all notifications of critical non-owner events from cached-mode Outlook clients, but the timing and sequence may not be obvious. Understanding the effect that cached-mode Outlook has on your Change Auditor Exchange monitoring will give you confidence that the results you are seeing are accurate.