Change Auditor 7.1.1 - Release Notes

About Quest Change Auditor 7.1 New features Important information Resolved issues Known issues System requirements

Change Auditor coordinator (Server-side component) Change Auditor client (Client-side component) Change Auditor agent (Server-side component) Change Auditor workstation agent (optional component) Change Auditor web client (optional component) IT Security Search requirements

Auditing and permission requirements

Exchange Server auditing SQL Server Data Level auditing Authentication Services auditing Defender auditing EMC auditing NetApp auditing VMware auditing SharePoint auditing Logon Activity auditing Skype for Business auditing Office 365 auditing Fluid File System auditing Azure Active Directory auditing Product licensing

Getting started with Change Auditor 7.1 Upgrade and compatibility

Additional resources

Globalization

About us

Authentication Services auditing

Table 23. Authentication Services auditing requirements
Component	Supported Versions
Change Auditor	Change Auditor for Authentication Services
Authentication Services -Latest supported version	Authentication Services 4.2
For more information	See the Change Auditor for Authentication Services User Guide.

Defender auditing

Table 24. Defender auditing requirements
Components	Supported Versions
Change Auditor	Change Auditor for Defender
Defender — Latest supported version	Defender 5.9.6
For more information	See the Change Auditor for Defender User Guide.

EMC auditing

Table 25. EMC auditing requirements

Component

Supported Version

Change Auditor

Change Auditor for EMC

NOTE: Change Auditor for EMC 6.5 (or higher) is required for EMC Isilon auditing.

EMC Celerra/VNX - Supported up to the following versions

EMC Common Event Enabler (CEE) Framework up to 8.7.0

NOTE: CEE requires .NET Framework 3.5 for EMC auditing. Ensure that it is installed on the computer where you have installed CEE.

EMC Celerra Event Enabler (CEE) Framework 4.6.7

EMC VNX Event Enabled (VEE) Framework 4.8.5 (through 5.1)

NOTE: VNXe is NOT supported. VNXe does not support CEPA currently and therefore Change Auditor for EMC does not run successfully in VNXe environments.

NOTE: Starting with release 6.0.0.0, the VNX Event Enabler (VEE) is called the Common Event Enabler (CEE).

EMC Isilon - Supported up to the following versions

EMC Common Event Enabler (CEE) Framework up to 8.7.0

NOTE: CEE requires .NET Framework 3.5 for EMC auditing. Ensure that it is installed on the computer where you have installed CEE.

NOTE: Isilon Server pre-configured for auditing. See the EMC User Guide for more information.

EMC Unity - Supported up to the following versions

EMC Unity 5.0.0

EMC Common Event Enabler (CEE) Framework up to 8.7.0

To enable auditing, you must configure CEE using EMC Unisphere:

•

Select STORAGE | File | NAS Servers. Open the server properties and select Event Publishing. Select to Enabling Common Event Publishing. Add the CEPA Server where the CEE is installed, select All Events, and save the settings.

•

Select File System you want to audit and choose the Advanced tab. Under the Events Notifications, select Enable SMB Events publishing.

NOTE: When auditing EMC Unity using an agent on Windows Server 2019, the lowest supported version is EMC Unity 4.4.1.

Agent

Locate the Change Auditor agent near the EMC device (use fastest connection type available).

•

Quest recommends to have 1 Gbps network connectivity (or faster connection type) between the monitored EMC device and the computer where the Change Auditor agent service is running. Use a direct or one-switch connection.

Use multiple CPU hosts for Change Auditor agent service (at least 2 CPUs or 2 CPU core).

Rights and permissions

•

Administrative rights on the EMC Control Station to create or modify the cepp.conf file on the EMC file server (CIFS).

•

The computer account where the Change Auditor agent is running must have permissions on the EMC Virus Checking policy.

For more information

See the Change Auditor for EMC User Guide for detailed information about installing, configuring, and using Change Auditor for EMC.

NetApp auditing

Table 26. NetApp auditing requirements

Component

Supported Versions

Change Auditor

Change Auditor for NetApp

NetApp Filer

NetApp Filer with Data ONTAP 7.2 to 9.7

Cluster mode is supported as of version 8.2.1

NOTE: NetApp events initiated through the NFS protocol are not supported.

Agent

•

Locate a Change Auditor agent close to the NetApp filer (use fastest connection type available).

•

Quest recommends to have 1 Gbps network connectivity (or faster connection type) between the monitored NetApp filer and the computer where the Change Auditor agent service is running. Use a direct or one-switch connection.

•

Use a multiple CPU host for Change Auditor agent service (at least 2 CPUs or 2 CPU core).

•

In order for the NetApp filer to properly send events to the Change Auditor agent, reverse DNS zone must be configured for the Change Auditor agent server’s IP address. This can be configured in the Reverse Lookup Zone of the DNS server used by the NetApp filer. To verify you can look up a Change Auditor agent using its IP address, use the nslookup command as illustrated below:

•

If Windows Firewall is enabled on the server hosting the Change Auditor agent responsible for capturing the NetApp events, it must be configured to allow ‘File sharing’.

Required rights and permissions

NetApp running in 7-mode

The provided credentials must have local Administrator rights on the monitored NetApp filer.

You can specify these credentials in one of two ways for the Change Auditor agents assigned to the NetApp Auditing template which defines what to audit on the selected NetApp filer:

•

Add the Change Auditor agent service account to the local Administrators group on the NetApp filer.

•

Use the Set Credentials button on the NetApp Auditing template to specify the NetApp filer credentials to be used by the selected Change Auditor agent. If you use this method, the specified account must be an Active Directory user that is a member of the local Administrators group of the NetApp filer.

NOTE: Enable TLS communication on the filer to allow secure communication with the Change Auditor client using the following command: options tls.enable on

Rights and permissions

NetApp running in cluster mode

Use the Set Credentials button on the NetApp Auditing template. The account should be an Active Directory user that is a member of the local Administrators group of the NetApp filer.

To grant ONTAPI access for the NetApp cluster for an Active Directory user, run the following command on the cluster console:

security login create –vserver <vservername> -username <domain\username> -application ontapi -authmethod domain -role <rolename>

Optionally, you can use the default role “vsadmin” as the rolename which has the administrator permissions of the NetApp filer.

To create a new role and assign the minimum required rights, run the following commands:

security login role create -vserver <vservername> -role <rolename> -cmddirname "version" -access all

security login role create -vserver <vservername> -role <rolename> -cmddirname "volume" -access readonly

security login role create -vserver <vservername> -role <rolename> -cmddirname "vserver fpolicy" -access all

NOTE: domain\username and password are case-sensitive, so the credentials used with the NetApp auditing template must match.

See the NetApp user guide for more details on enabling Active Directory domain users access to the cluster.

To add a new account to a NetApp filer’s local Administrators group:

Open Active Directory Users and Computers MMC snap-in.

Select the domain where the NetApp filer is located.