Active Administrator 8.7 - User Guide

Installing audit agents

Installing audit agents

To collect data on a computer, you must install and activate the audit agent.

 

IMPORTANT: For Active Administrator Server agents to audit Active Directory events, auditing must be enabled in all domains that will be monitored. Make sure that Windows auditing is enabled on the Default Domain Controller policy. See Setting up auditing on domain controllers.

To install an audit agent

1	Select Auditing & Alerting | Agents.

2	Click Install.

The Welcome page reminds you to enable auditing in Active Directory®. See Setting up auditing on domain controllers.

3	Click Next.

4	In the Domain box, type the domain name; or browse to locate a domain.

5	If necessary, click Find Domain Controllers.

▪	To select all listed domain controllers, click Select all.

▪	To clear all the check boxes, click Clear all.

6	Select the domain controllers from which you want to audit activity.

7	Click Next.

8	Select the options for the install process.

You can install the audit agent on the selected domain controllers themselves or on another computer in the current domain. A single audit agent should be able to monitor activity on up to five domain controllers, depending on the type and frequency of activities being audited.

 

Table 66. Options for the install process

Option	Description
Install on target Domain Controller(s)	By default, the audit agent is installed on the domain controllers you selected on the previous page.
Audit from an agent on the following computer	Select to install the audit agent on a computer in the domain. Type a computer's fully qualified domain name in the box, or browse to locate a computer. NOTE: If you choose to do remote monitoring, the Advanced Agent is not installed on the selected domain controllers.
Start collecting events immediately after installation of the agent	By default, the audit agent is activated and collection begins immediately upon completion of the installation process. Clear the check box if you want to activate the audit agents manually.
Enable agent monitoring and recovery	By default, Active Administrator® monitors the status of the audit agent.

9	Click Next.

10	In the Run as box, type an account with domain administrative rights, or click to locate an account, and then enter the password.

NOTE: The Active Administrator Agent service can also run under a domain user account provided it is a local administrative account, which gives it the rights to log on as a service, log on locally, and manage auditing and security log, or these privileges can be granted individually. This user or service account should also be a member of the AA_Admin group, which by default is located in the Local groups of the server where the ActiveAdministrator database is located. If the group is not found in this location, the settings during the initial database creation were modified and it can be found under the Users container object of Active Directory.

11	To verify the account, click Test Audit Agent Account.

12	Click Next.

13	Review the summary.

14	Click Next.

15	Click Finish.

The Audit Agent page lists the domain controllers you selected, the time and date of the last event collected, the status of the audit agent and the advanced audit agent, the name of server on which Active Administrator is installed, and the version number of the audit agent installed on the domain controller.

 

NOTE: By default, the audit agent is activated upon installation. To change the default setting, click Configuration | Agent Installation Settings. See Setting agent installation options. You can view details about the install in the AuditAgentInstall*.log file, which is located in C:\ProgramData\Quest\Active Administrator\Logs. NOTE: If you experience deactivated audit agents after installing agents in a new domain on a Windows Server 2016, Windows 2019, or Windows 2022 domain controller, clear the security event log and restart the audit agent.

Modifying the audit agent startup account

Modifying the audit agent startup account

 

IMPORTANT: The agent startup account must have the privilege to manage auditing and security logs. Domain administrators have this privilege by default.

To modify the audit agent startup account

1	Select Auditing & Alerting | Agents.

2	Select a domain controller, and select More | Set Startup Account.

3	Change the account used to start the audit agent.

NOTE: A domain administrator account is recommended. The Active Administrator® audit agent service can run under a domain user account if it is a local administrative account, which gives it the rights to log on as a service and log on locally, or an account with these two privileges granted individually. This account should also be a member of the AA_Admin group, which by default is located in the Local groups of the server where the ActiveAdministrator database is located. If the group is not found in this location, the settings during the initially database creation were modified and the group can be found under the Users container object of Active Directory®.

4	Type the password.

5

Click OK.

Modifying the audit agent test account

Modifying the audit agent test account

By default, Active Administrator® monitors the status of the audit agent.

To modify the audit agent test account

1	Select Auditing & Alerting | Agents.

2	Select a domain controller, and select More | Test Startup Account.

3	Change the account used to monitor the status of the audit agent.

4	Type the password.

5

Click OK.

Updating audit agents

Updating audit agents

If you receive an update to the audit agent, use this option to install the update.

To update audit agents

1	Select Auditing & Alerting | Agents.

2	To update selected domain controller(s), select More | Update.

–OR-

To update all listed domain controllers, select More | Update All.

 

NOTE: You may need to refresh the audit agents to correct the display. Click Refresh or select domain controllers, and click Refresh Selected.