Change Auditor 7.3 - Quick Start Guide


	NOTE: If you have purchased multiple Change Auditor products, download one instance of Change Auditor only. The code is the same for all and the license keys determine what features are enabled or disabled.

•

Review the system requirements

•

Review the complete installation process

•

Review Installation Notes and Best Practices in the Change Auditor Installation Guide

•

Read the Release Notes for updated information

•

Ensure that you have the appropriate license files to enable Change Auditor auditing modules. (A separate license file is required to enable the functionality of each of the Change Auditor auditing modules.)


	NOTE: Change Auditor prompts you for a valid license during the coordinator installation. You cannot proceed with an invalid or expired license.

Installation overview

Quest recommends installing the Change Auditor components in the following order:

•

Database (SQL Server) — Ensure the SQL server is available and the installation account has SQL Server role as dbcreator. To host the Change Auditor database on a SQL instance other than the default instance of the selected SQL Server, create the instance before running the installer.


	NOTE: The database name must not include embedded spaces, special characters, or supplementary characters. For more details, see Microsoft’s database identifier documentation.

•

Coordinator — When prompted, specify the SQL server to use and the installation account. The Change Auditor database is created remotely on this server during the installation.


	NOTE: During the coordinator installation, you are have the option of adding the current user to the Change Auditor Administrators security group. If you did not add the current user during the installation process or want to add extra user accounts to the Change Auditor security groups, add them before running the client. We also recommend that you then add these security groups to the appropriate SQL database role (that is, Change Auditor Administrators — <InstallationName> group to the Change Auditor_Administrators role and ChangeAuditor Operators — <InstallationName> group to the ChangeAuditor_Operators role). See Add Users to Change Auditor Security Groups in the Change Auditor Installation Guide for more information.

•

Client — After you have confirmed that the coordinator is functioning correctly, install the client.


	TIP: Quest recommends that you install the first coordinator and client, but do not deploy agents until after you have installed required coordinators. When deploying agents, you can select which installation to use for each of the agents.

•

Agents — Open the client to deploy agents to your domain controllers and member servers. Also, if you have Change Auditor for Logon Activity Workstation licensed, deploy agents to the domain to monitor for logon activity.

•

Web client — Optionally, install the web client on the IIS web server.

Step 1: Install a coordinator

IMPORTANT: Minimum permissions

User account installing the coordinator:

The user account that is installing the coordinator must have permission to perform the following tasks on the target server:

•

Windows permissions to create and modify registry values.

•

Windows administrative permissions to install software and stop or start services.

The user account must also be a member of the Domain Admins group in the domain where the coordinator is being installed.

Service account running the coordinator service (LocalSystem by default):

•

Active Directory permissions to create and modify SCP (Service Connection Point) objects under the computer object that is running a Change Auditor coordinator.

•

Local Administrator permissions on the coordinator server.

If you are running the coordinator under a service account (instead of LocalSystem), define a Manual connection profile where you can specify the IP address of the server hosting the coordinator. You can specify and select connection profiles whenever you open the Change Auditor client. See the Change Auditor User Guide or online help for more information about defining and selecting a connection profile.

SQL Server database access account specified during installation:

Create an account that the coordinator service can use on an ongoing basis for access to the SQL Server database. This account must have a SQL Login and be assigned the following SQL permissions:

•

Must be assigned the db_owner role on the Change Auditor database

•

Must be assigned the SQL Server role of dbcreator

To install a coordinator:

Verify that the user account used to run the coordinator installation is at least a Domain Admin in the domain to which the coordinator server belongs.


	NOTE: Membership in the Enterprise Admins group is not required, but can make agent deployment to domain controllers in multiple domains easier. Deploying agents to member servers requires that you must be a Domain Admin in every domain that contains servers that you are targeting for installation.

Use an existing account or create a user account that Change Auditor will use to access the SQL Server.

Create a SQL Login for this user account and assign the following permissions to this login: Server role: dbcreator

From the member server, insert the Change Auditor DVD or if you downloaded the product from the Quest website, run the autorun.exe file.

Click Install for the Install Change Auditor Coordinator option to open the Change Auditor Coordinator Setup wizard.

Enter the information requested in the Coordinator Setup wizard.

Review the table for additional information. This table only covers unfamiliar information. It does not include all the wizard screens or field descriptions.

Table 1. Coordinator Setup wizard

Product Licensing screen

Licenses

Click Open License Dialog to locate and apply a license.

NOTE: Change Auditor 7.0 requires a new license for all modules.

Installation Name screen

After licensing the product, the setup wizard prompts you to enter a unique installation name to identify the database to which the coordinator will connect.

ChangeAuditor Installation Name

Enter a unique Change Auditor installation name that identifies the current installation within your Active Directory environment. An installation name is required; has a limit of 22 characters; can only contain alphanumeric characters and underscores; and is converted to all caps.

NOTE: Quest recommends that you use the default (DEFAULT) installation name.

NOTE: If you entered an existing installation name, confirm that you want to join this component to an existing installation. Click Yes to proceed or No to reenter a unique installation name.

SQL Server Information screen

SQL Server and Instance

Enter the server name or IP address (member server running the SQL instance) and the SQL instance name for the Change Auditor coordinator database such as, <FQDN of the SQL server>\<instance name> or browse your Active Directory network to locate the required instance.

Azure SQL Managed Instance:

•

For a private endpoint, specify the managed instance host name in the following format: MyHostName.dns_zone.database.windows.net

For private endpoint with default port, port specification is not explicitly required. For example: MyHostName.b1b2a3d4e5f7.database.windows.net

MyHostName.b1b2a3d4e5f7.database.windows.net,1433

•

For a public endpoint, specify the managed instance host name and port in the following format: MyHostName.public.dns_zone.database.windows.net,3342

For public endpoint, port specification is required. For example: MyHostName.public.b1b2a3d4e5f7.database.windows.net,3342

NOTE: Performance may vary depending on network configuration, topology, and Azure SQL Managed Instance configuration.

NOTE: Azure SQL Managed Instance (PaaS) is supported using SQL authentication or Azure Active Directory Authentication with an encrypted connection. Windows authentication is not supported.

NOTE: Single User Mode is not supported during installation or upgrade when using Azure SQL Managed Instance. Ensure that all SQL connections to the Change Auditor database are closed before and during the upgrade.

NOTE: Azure SQL Managed Instance (HA) high availability is supported using the read-write listener endpoint.

NOTE: If you are using Windows security to access your SQL Server, ensure that the domain user is granted access to the SQL Server.

Name of database catalog

Enter the name to assign to the Change Auditor database.

NOTE: If an existing Change Auditor database is present, you should provide a unique name for the Change Auditor database. If a database with the name entered is found, a warning message explains the need to provide a unique name for your new Change Auditor database. On this warning dialog, click Cancel to specify a different database name. Clicking OK proceeds to the Ready to Install the Program screen.

Authentication/ Credentials

Use the authentication section to specify whether to use Windows authentication or SQL authentication when communicating with the SQL database instance. (The authentication method is set up when SQL is installed.)

NOTE: If Windows Authentication is used to access the designated SQL instance, a verification screen is displayed. Verify that the server name, SQL instance name, and credentials are correct before proceeding. Incorrect entries cause the Change Auditor coordinator service to fail on startup.

NOTE: If you are using a group Managed Service Account, ensure that the account ends with '$' and the password is left blank.

NOTE: For Azure SQL Managed Instance (PaaS), SQL authentication or Azure Active Directory Authentication with an encrypted connection must be used.

ChangeAuditor Administrators screen

Add the current user to the “ChangeAuditor Administrators - <InstallationName>” security group

This check box is selected by default and adds the current user to the ChangeAuditor Administrators — <InstallationName> group.

Any user that is running a Change Auditor client must be added to either this security group or the ChangeAuditor Operators security group.

In addition, users responsible for deploying Change Auditor agents must be a member of the ChangeAuditor Administrators group in the specified ChangeAuditor installation.

See the Change Auditor Installation Guide for more information about these security groups and how to add more user accounts.

Specify Port Information screen

By default Change Auditor dynamically assigns communication ports to use to communicate with each installed coordinator. However, using the port settings on this screen you can specify static SCP listening ports to use instead.

NOTE: A zero (0) indicates that a dynamic port is being used. These port assignments can also be set using the Coordinator Configuration Tool which is accessed by right-clicking the Change Auditor coordinator system tray icon.

Client Port