Chat now with support
Chat mit Support

Change Auditor 7.3 - Installation Guide

Installation Overview Install Change Auditor Add Users to Change Auditor Security Groups Connecting to the Clients Deploy Change Auditor Agents Upgrade Change Auditor Installation Notes and Best Practices Deployment Options Workstation Agent Deployment Agent Comparison Install an agent to audit ADAM (AD LDS) on workgroup servers Windows Installer Command Line Options

Installation workflow

Quest recommends installing the Change Auditor components in the following order:

•
Database (SQL Server) — Ensure the SQL server is available and the installation account has SQL Server role as dbcreator. To host the Change Auditor database on a SQL instance other than the default instance of the selected SQL Server, create the instance before running the installer.
* 
NOTE: The database name must not include embedded spaces, special characters, or supplementary characters. For more details, see Microsoft’s database identifier documentation.
•
Coordinator — When prompted, specify the SQL server to use and the installation account. The Change Auditor database is created remotely on this server during the installation.
* 
NOTE: During the coordinator installation, you are have the option of adding the current user to the Change Auditor Administrators security group. If you did not add the current user during the installation process or want to add extra user accounts to the Change Auditor security groups, add them before running the client.

Quest also recommends that you add these security groups to the appropriate SQL database role (that is, Change Auditor Administrators — <InstallationName> group to the Change Auditor_Administrators role and ChangeAuditor Operators — <InstallationName> group to the ChangeAuditor_Operators role). See Add Users to Change Auditor Security Groups.
•
Client — After you have confirmed that the coordinator is functioning correctly, install the client.
* 
TIP: Quest recommends that you install the first coordinator and client, but do not deploy agents until you have installed required coordinators. When deploying agents, you can select which installation to use for each of the agents.
•
Agents — Open the client to deploy agents to your domain controllers and member servers. Also, if you have Change Auditor for Logon Activity Workstation licensed, deploy agents to the domain to monitor for logon activity.
•
Web client — Optionally, install the web client on the IIS web server.

 

Install the first coordinator

The coordinator fulfills client and agent requests and generates alerts. You can install multiple coordinators in a single forest to provide fault tolerance of the Change Auditor service tier. See Install the client.

* 
NOTE:  
•
You cannot use an existing database. The database must be created by the coordinator installation.
•
UDP port 389 must be open on initial installs and upgrades for the coordinator to start.

The coordinator installation creates the following components:

•
The coordinator
•
A coordinator system tray icon, where you can enable or disable the coordinator, display the status of the coordinator installed on the current computer, change the database instance or service accounts used to access the database, or specify a static port to use to communicate with the coordinator.
* 
NOTE: See the Change Auditor User Guide for more information about the Change Auditor coordinator system tray icon.
•
Three installation-specific Active Directory security groups to enable access to the Change Auditor client and shared overviews distributed using the Change Auditor web client.
•
ChangeAuditor Administrators — <InstallationName>
•
ChangeAuditor Operators — <InstallationName>
•
ChangeAuditor Web Shared Overview Users — <InstallationName>
Where <InstallationName> is a unique name selected during the coordinator installation to isolate your components from any other Change Auditor installation in your Active Directory forest.
* 
NOTE: See the Change Auditor Web Client User Guide for more information about the ChangeAuditor Web Shared Overview Users security group.
•
Two SQL database roles (ChangeAuditor_Administrators and ChangeAuditor_Operators). These roles are added to the Change Auditor database to facilitate database connections from an untrusted forest with the least amount of privileges. The two roles allow administrators to control access to the Change Auditor database through SQL security.
Required permissions
* 
IMPORTANT: Minimum permissions

User account installing the coordinator:

The user account that is installing the coordinator must have permission to perform the following tasks on the target server:

•
Windows permissions to create and modify registry values.
•
Windows administrative permissions to install software and stop or start services.

The user account must also be a member of the Domain Admins group in the domain where the coordinator is being installed.

Service account running the coordinator service (LocalSystem by default):

•
Active Directory permissions to create and modify SCP (Service Connection Point) objects under the computer object that is running a Change Auditor coordinator.
•
Local Administrator permissions on the coordinator server.

By default, the Coordinator service runs as LocalSystem. To run the Change Auditor service as a Domain User or service account other than Local System, the Change Auditor SPN (Service Connection Point) must be removed from the Coordinator computer (local system) account and added to the Domain Account used to run the Coordinator service.

To do so, open a command prompt on a Domain Controller and perform the following:

1
Remove the SPN from the computer object by entering:
setspn -D NPRepository4(INSTALLATION_NAME)/SERVER.DOMAIN.TLD SERVERNAME
2
Add the SPN to the service account by entering:
setspn -A NPRepository4(INSTALLATION_NAME)/SERVER.DOMAIN.TLD USERNAME
INSTALLATION_NAME = Change Auditor Installation (Default name is DEFAULT)
SERVER.DOMAIN.TLD = FQDN of the coordinator server
SERVERNAME = Short name of the coordinator server
USERNAME = SAM account name of the service account
3
Update the Coordinator service to run under the user name context in question.
4
Restart the Coordinator service.

SQL Server database access account specified during installation:

Create an account that the coordinator service can use on an ongoing basis for access to the SQL Server database. This account must have a SQL Login and be assigned the following SQL permissions:

•
Must be assigned the db_owner role on the Change Auditor database
•
Must be assigned the SQL Server role of dbcreator
To install the first coordinator:
* 
NOTE:  
•
You should have received separate licenses from Quest to enable the Change Auditor products you purchased. Before you begin the installation, copy the appropriate license to the local hard drive where you are installing Change Auditor.
•
You cannot use an existing database. The database must be created by the coordinator installation.
1
Verify that the user account used to run the coordinator installation is at least a Domain Admin in the domain to which the coordinator server belongs.
2
Use an existing account or create a user account that Change Auditor will use to access the SQL Server.
3
Create a SQL Login for this user account and assign the following permissions to this login: Server role: dbcreator
4
From the member server, insert the Change Auditor DVD or if you downloaded the product from the Quest website, run the autorun.exe file.
5
Click Install for the Install Change Auditor Coordinator option to open the Change Auditor Coordinator Setup wizard.
6
Enter the information requested in the Coordinator Setup wizard.
Review the table for additional information. This table only covers unfamiliar information. It does not include all the wizard screens or field descriptions. 
 
Table 2. Coordinator Setup wizard — installing first coordinator
Product Licensing screen

Licenses

Click Open License Dialog to locate and apply a license.

NOTE: As of Change Auditor 7.0 a new license is required for all modules.
Installation Name screen

After licensing the product, the setup wizard prompts you to enter a unique installation name to identify the database to which the coordinator will connect.

NOTE: If you plan on installing multiple coordinators, see Install the client for more details regarding the ChangeAuditor installation name.

ChangeAuditor Installation Name

Enter a unique Change Auditor installation name that identifies the current installation within your Active Directory environment. An installation name is required; has a limit of 22 characters; can only contain alphanumeric characters and underscores; and is converted to all caps.

NOTE: Quest recommends that you use the default (DEFAULT) installation name.
NOTE: If you entered an existing installation name, confirm that you want to join this component to an existing installation. Click Yes to proceed or No to reenter a unique installation name.
SQL Server Information screen

SQL Server and Instance

Enter the server name or IP address (member server running the SQL instance) and the SQL instance name for the Change Auditor coordinator database such as, <FQDN of the SQL server>\<instance name> or browse your Active Directory network to locate the required instance.

Azure SQL Managed Instance:

•
For a private endpoint, specify the managed instance host name in the following format: MyHostName.dns_zone.database.windows.net
For private endpoint with default port, port specification is not explicitly required. For example: MyHostName.b1b2a3d4e5f7.database.windows.net
or
MyHostName.b1b2a3d4e5f7.database.windows.net,1433
•
For a public endpoint, specify the managed instance host name and port in the following format: MyHostName.public.dns_zone.database.windows.net,3342
For public endpoint, port specification is required. For example: MyHostName.public.b1b2a3d4e5f7.database.windows.net,3342
NOTE: Visit the support portal knowledge base for more information about migrating from SQL on-premises to SQL Managed Instance.
NOTE: Performance may vary depending on network configuration, topology, and Azure SQL Managed Instance configuration.
NOTE: Azure SQL Managed Instance (PaaS) is supported using SQL authentication or Azure Active Directory Authentication with an encrypted connection. Windows authentication is not supported.
NOTE: Single User Mode is not supported during installation or upgrade when using Azure SQL Managed Instance. Ensure that all SQL connections to the Change Auditor database are closed before and during the upgrade.
NOTE: Azure SQL Managed Instance (HA) high availability is supported using the read-write listener endpoint.
NOTE: If you are using Windows security to access your SQL Server, ensure that the domain user is granted access to the SQL Server.
NOTE: If you plan to add the Change Auditor database to a SQL AlwaysOn Availability Group, ensure that the availability group has already been configured and then specify the name of the availability group listener for SQL server name.

Name of database catalog

Enter the name to assign to the Change Auditor database.

NOTE: If an existing Change Auditor database is present, you should provide a unique name for the Change Auditor database. If a database with the name entered is found, a warning message explains the need to provide a unique name for your new Change Auditor database. On this warning dialog, click Cancel to specify a different database name. Clicking OK proceeds to the Ready to Install the Program screen.

Authentication/ Credentials

Use the authentication section to specify whether to use Windows authentication or SQL authentication when communicating with the SQL database instance. (The authentication method is set up when SQL is installed.)

NOTE: If Windows Authentication is used to access the designated SQL instance, a verification screen is displayed. Verify that the server name, SQL instance name, and credentials are correct before proceeding. Incorrect entries cause the Change Auditor coordinator service to fail on startup.
NOTE: If you are using a group Managed Service Account, ensure that the account ends with '$' and the password is left blank.
NOTE: For Azure SQL Managed Instance (PaaS), SQL authentication or Azure Active Directory Authentication with an encrypted connection must be used.

Encrypt connection

Select to use SSL encryption for all data sent between the coordinator and the SQL server. To use this option, the SQL server must have a certificate installed and the format of the SQL server name specified must be an exact match to the name format used in the certificate (for example FQDN or NetBios).

ChangeAuditor Administrators screen

Add the current user to the “ChangeAuditor Administrators - <InstallationName>” security group

This check box is selected by default and adds the current user to the ChangeAuditor Administrators — <InstallationName> group.

Any user that is running a Change Auditor client must be added to either this security group or the ChangeAuditor Operators security group.

In addition, users responsible for deploying Change Auditor agents must be a member of the ChangeAuditor Administrators group in the specified ChangeAuditor installation.

See Add Users to Change Auditor Security Groups for more information about these security groups and how to add more user accounts.

Specify Port Information screen

By default Change Auditor dynamically assigns communication ports to use to communicate with each installed coordinator. However, using the port settings on this screen you can specify static SCP listening ports to use instead.

NOTE: A zero (0) indicates that a dynamic port is being used. These port assignments can also be set using the Coordinator Configuration Tool which is accessed by right-clicking the Change Auditor coordinator system tray icon.

Client Port

Enter the static port number for the Change Auditor client to communicate with the coordinator.

TIP: If you are planning on installing the Change Auditor web client, enter a static client port.

Public SDK Port

Enter the static port number for external applications to access the coordinator.

Agent Port (Legacy)

Enter the static port number for legacy (5.x) Change Auditor agents to communicate with the coordinator.

Agent Port

Enter the static port number for Change Auditor agents to communicate with the coordinator.

7
After you have entered all the requested information, click Install to start the installation process.
8
After the coordinator is installed, you can use the Quest Change Auditor autorun to install the client.
* 
NOTE: Reboot the server if you have any other Quest solutions installed on this server.
9
If you are using the SQL AlwaysOn Availability Groups functionality, you now need to put the database in an SQL availability group.
a
Stop the coordinator.
b
Put the database is in full recovery mode.
c
Backup the database.
d
Move the database to a previously configured availability group.
e
Allow database replication to complete.
f
Start the coordinator.

Install the client

The client connects directly to the coordinator or to an archive database and is the user interface that provides immediate access to key configuration change information.

To install the client:
1
On a workstation, laptop or member server, insert the Change Auditor DVD or run the autorun.exe file.
2
Select Install Change Auditor Client to open the Client Setup wizard.
* 
NOTE: If Microsoft .NET 4.6.1 is not installed on the computer, an extra screen is displayed explaining that this application was not found and the install cannot continue. Click Close to stop the client install. Download and install the required .NET version. After .NET is successfully installed, restart the client installation.
3
Read and accept the license agreement and click Next.
4
Select the installation directory and click Next.
5
Select your shortcut options and click Next.
6
Click Install.
7
After the coordinator and client are installed, close the autorun program.
If you are installing multiple coordinators, install your additional coordinators now.

Install multiple coordinators

When installing multiple coordinators in your Active Directory forest, the Change Auditor installation name entered during the coordinator installation determines if they connect to the same SQL database or to different database installation. That is,

•
If you use an existing installation name for each coordinator, these coordinators all connect to the same SQL database installation.
•
If you enter a unique installation name for each coordinator, these coordinators connect to different SQL database installations.

A unique installation name allows you to isolate your installation of Change Auditor from any other installations of Change Auditor in your Active Directory forest. When all Change Auditor installations are upgraded in the forest, the installation name:

•
Allows all coordinators to use your central SQL database, while ensuring no other installation’s coordinators use your SQL database.
•
Ensures that only agents in your installation connect to your coordinator. See Deploy Change Auditor Agents.
•
Ensures only users in your installation’s security groups can use the Change Auditor client to manipulate your configuration and view your data.
* 
TIP: Quest recommends that you install the first coordinator and client, but do not deploy agents until after you have installed all additional coordinators required. When deploying agents, you can select which installation to use for each of the agents.
To install more coordinators:
1
Run the autorun program (autorun.exe) on the individual member servers that are to host a coordinator.
2
On the Install page of the autorun, select the Install Change Auditor Coordinator option. Enter the information requested in the Coordinator Setup wizard.
Review the following table for additional information. This table only covers information regarding multiple coordinator installations. It does not include all the wizard screens or field descriptions.
Table 3. Coordinator Setup wizard — installing multiple coordinators
Product Licensing screen

Licenses

Use the same license files used for the first coordinator.

NOTE: If you have installed or licensed multiple auditing modules, apply the appropriate license for each of the installed auditing modules.
Installation Name screen

Change Auditor Installation Name

Enter a unique installation name to use a different database. Enter an existing installation name or browse to connect to an existing Change Auditor installation.

NOTE: By selecting an existing Change Auditor installation, you are joining this component to the specified installation. (For example multiple coordinators will be connected to the same database and agents can connect to any of the coordinators in this installation).
NOTE: If you entered an existing installation name, confirm that you want to join this component to an existing installation. Click Yes to proceed or No to enter a unique installation name.
NOTE: If the Change Auditor database is in a SQL availability group, specify the name of the availability group listener for the SQL server name.
Specify Port Information screen

By default Change Auditor dynamically assigns communication ports used to communicate with each installed coordinator. However, using the port settings on this screen you can specify static SCP listening ports to use.

NOTE: A zero (0) indicates that a dynamic port is being used. These port assignments can also be set using the Coordinator Configuration Tool which is accessed by right-clicking the Change Auditor coordinator system tray icon.

Client Port

Enter the static port number for the client to communicate with the coordinator.

Public SDK Port

Enter the static port number for external applications to access the coordinator.

Agent Port (Legacy)

Enter the static port number to for legacy (5.x) agents to communicate with the coordinator.

Agent Port

Enter the static port number for Change Auditor agents to communicate with the coordinator.

Verwandte Dokumente

The document was helpful.

Bewertung auswählen

I easily found the information I needed.

Bewertung auswählen