How to deploy the new Quest ChangeAuditor scripting module for use with ActiveRoles Server when upgrading from a much earlier version (4237812)

How to deploy the new Quest ChangeAuditor Dynamic Directory Control (DDC) scripting module for use with ActiveRoles Server, when upgrading from a much earlier version.

The previous ChangeAuditor scripting module for ActiveRoles Server (version 5.x and 6.x) had several limitations related (but not limited) to ARS over-ride accounts, deprovisioning processes and event timing issues for ChangeAuditor alert-enabled searches.

These steps assume ActiveRoles Server (ARS) and ChangeAuditor, along with the ARS integration scripts are currently deployed and you have upgraded from a 5.x or 6.x version:

1. After upgrading ChangeAuditor (including all Domain Controller Agents), open the ChangeAuditor Client Select View | Deployment. Highlight the server where ARS is installed. Select Advanced Options with the arrow | ActiveRoles Integration and select which script deployment option required.
2. Once the script is deployed, open the ActiveRoles Console select Configuration | Scripting Modules | Administration

Now three scripts that show "Change Auditor XXXX Script" will be observed. The one WITHOUT the installation name is the new DDC script. If you do not see the other scripts, and you only see the new one without the installation name, the remainder of the steps are not needed.

3.  Select Policies | Administration and see two policies. Right click the policy that has the installation name | Select Policy Scope and remove the scopes. This will ensure only the new DDC Script will be used to forward event data to ChangeAuditor
4. Within the ChangeAuditor client select View | Administration | Agent | Configurations (make sure to select the Domain Controller Agent that ActiveRoles Server points to. Refresh the Agent configuration. This will force the agent(s) to check in and update the ARS EventSource and SID information.

Note: This is not required but highly recommended, doing so will force the agent to pull the changes now vs the polling interval (every 15 minutes)

Deployment considerations:

1. Some Operating Systems require setting the execution policy to "unrestricted" on the ARS server before deploying scripts
2. Following the changes to the configuration reboot of the ActiveRoles Server server (not just the service) to clear the cache of all of the changes made may be required.
3. Restart of the ChangeAuditor Agent on the Domain Controller the ARS server is pointed to may be required or can be used as alternative option to step 4 described above.

Common Issues:

- The user account specified in the CA deployment settings is not an ActiveRoles Server administator
- The ActiveRoles Server service account is not a member of the ChangeAuditor administrator group