Certificate expiry causes Change Auditor event forwarding to On Demand Audit to stop (4225108)

1. The Change Auditor Installation is upgraded to 7.0.3 (or higher) on\after August 7th, 2019
2. Change Auditor is registered with On Demand Audit and begins event forwarding
3. One year passes since the date the upgrade was performed in #1 above
4. Change Auditor event forwarding to On Demand Audit stops and shows ‘Disconnected’ state in On Demand Audit Configuration tab. In Change Auditor client the Configuration shows the ‘Last Event Response’ as “{statusCode = BadRequest. ResponseContent = “Error occurred while sending an event batch to ODA.”}.

1. Run CertLM.msc command from command prompt on coordinator servers in the Installation
2. Expand Personal | Certificates
3. Take note of the Expiration Date on the ‘OnDemandAuditCAIntegration’ certificate. After that date, if the coordinator server is involved in an active subscription to forward events to On Demand Audit then event forwarding will be interrupted until the workaround steps below are taken.

1. Sign-in to On Demand
   
   Note: Take important care at this moment to document the Deployment Region and Organization Name in use
   
2. Navigate to Audit module and then Configuration tab
3. Click the ellipses in the top-right corner of the impacted Change Auditor Installation(s) tile(s) and select 'Remove Installation' option
4. When prompted with the warning, "Remove Installation. Are you sure you want to remove this Change Auditor installation? This will cause events to stop being forwarded from Change Auditor." click OK
5. When prompted with the warning, "Error Removing Installation. We were unable to contact the coordinators associated with this Change Auditor installation. Do you want to remove this installation anyway?" click OK
6. On one of the Change Auditor coordinator servers from the impacted Installation in your environment, find PowerShell ISE, right-click on the application and 'run as Administrator'. Copy/paste the following script into the PowerShell editor:
   
   import-module 'C:\Program Files\Quest\ChangeAuditor\Client\ChangeAuditor.PowerShell.dll'
   import-module 'C:\Program Files\Quest\ChangeAuditor\Client\ChangeAuditor.PowerShell.Internal.dll'
   $connection= Connect-CAClient -InstallationName 'MY_CHANGE_AUDITOR_INSTALLATION_NAME_HERE'-DomainName 'MY_DOMAIN_FQDN_HERE'
   Remove-CAODAConfiguration $connection
   
   Note 1: Replace the following parameters with the respective values from your environment:
   -InstallationName 'MY_CHANGE_AUDITOR_INSTALLATION_NAME_HERE'
   -DomainName 'MY_DOMAIN_FQDN_HERE'
   
   Note 2: The script above assumes Change Auditor client has been installed to the default path. The import-module commands may need to be updated to reflect the Change Auditor client installation path
   
7. Restart the ‘Quest Change Auditor Coordinator’ service on ALL Change Auditor coordinator servers in the impacted Installation
8. Open the Change Auditor client, connect to the impacted Installation and navigate to View | Administration | Configuration | On Demand Audit
9. Click ‘Sign in and Configure’ button and re-configure the Change Auditor Installation with On Demand Audit. Ensure the previously used Deployment Region and Organization Name are selected
10. Event forwarding from Change Auditor will now resume from the last successfully forwarded event time-stamp/position
11. Wait 5-10 minutes and confirm Change Auditor Installation shows "Connected and receiving events" status in Audit Configuration tab

Note: Depending on the duration of the interruption and number of events to be forwarded, it may take some time for the event forwarding to catch-up.