Change Auditor - For Advanced Users 7.1.1

Table 18. How access rules are evaluated
Based on Settings in Template 1:	Based on Settings in Template 2:	Overall Result
User is allowed access	User is allowed access	User is allowed to access protected objects
User is allowed access	User is denied access	User is denied access to protected objects
User is denied access	User is allowed access	User is denied access to protected objects
User is denied access	User is denied access	User is denied access to protected objects

For Exchange Mailbox Protection templates, you can set the Mailbox owner can bypass protection option to allow the object’s owner to access their own mailbox, even if the protection template would normally deny access.

This override flag only affects the evaluation on a template where it is defined. It does not affect the evaluation of other protection templates.


	IMPORTANT: Care should be taken when defining multiple Exchange Mailbox Protection templates. For example, even though you cannot create a duplicate Exchange Mailbox protection template for the same object name, you could be including the same mailbox in multiple templates. That is, if you define templates for the Enterprise object, the top-level domain object, an OU container and several groups, this same mailbox could be a child or member of all these objects. The access to this mailbox is evaluated for each of the templates to which it belongs.


	NOTE: Exchange Mailbox protection is designed to provide protection coverage for a few high-value mailboxes. After monitoring has been enabled or changed, it may take several minutes to complete the configuration process necessary to enable the protection feature on the agent. Protecting a large number of mailboxes slows down the configuration process.


	NOTE: To control memory utilization, each Exchange Mailbox Protection template can have up to 20 users selected as ‘override accounts’ that can bypass the protection feature. This number applies to both allowed and denied user accounts and includes members of groups in the list.

How scheduling and location works with denied access

You can select to have the protection to always run or have it run only during specific times and control when the protection is enabled based on the location.

This section explains how the scheduling and location options affect the user and group accounts that have been denied access to protected objects.

Scheduling option

If you have denied specific users or groups the ability to change the protected objects and you have enabled a protection schedule, those users or groups are denied access only during this time. Anytime outside of when the schedule is set to enabled, these denied accounts will be able to access the protected object.

When the schedule is turned off, all options are turned off with it, including any denied access to the specified users.

The scheduling options override all other protection settings.

Location option

If you have denied specific users or groups access to protected objects, but you have specified locations that can access the protected object, the denied user or group can access the protected objects from these locations.

The location options override all other protection settings.

Database Considerations

•

How to move the Change Auditor database and coordinator to another server

•

How to estimate the required SQL server disk space

•

How SQL Server Autogrow affects Change Auditor

•

How to query an archive database

How to move the Change Auditor database and coordinator to another server


	NOTE: These instructions are for Change Auditor 5.6 (or higher).

To move the database from one SQL server to another:

Determine the current database path

•

Open SQL Server Management Studio.

•

Go to the properties of the Change Auditor database and determine where the database files are located. You need to know this path to copy the files later.

Disable the coordinator

•

Go to the Change Auditor server.

•

Right-click the coordinator system tray icon and select Disable Coordinator.

Detach the database

•

Open SQL Server Management Studio.

•

Locate and right-click the Change Auditor database.

•

Select Tasks | Detach.

•

On the General page of the Detach Database screen, selecKeep and click OK.

Copy the old database to the new SQL server

Copy the files (.mdf and .ldf) to your new SQL Server (most likely to the same location as the other database’s on the new server).

Attach the old database

•

Open or connect to the new SQL Server.

•

Using SQL Server Management Studio, right-click Databases and select Attach.

•

On the General page of the Attach Databases screen, click Add and select the database you copied over.

•

On the warning dialog, click OK.

Point your old Change Auditor coordinator/server to your new SQL Server


	IMPORTANT: Only perform this step on the old Change Auditor server if you do not plan to replace the old coordinator. If you plan to install a new Change Auditor server to replace your old Change Auditor server, proceed to the next step and do not do anything to your old Change Auditor server yet.

•

Go to the Change Auditor server.

•

Right-click the coordinator system tray icon and select Coordinator Configuration.

•

On the Security page of the Coordinator Configuration Tool, enter the following information:

•

SQL Server and instance of the new SQL Server

•

Database name of the original database

•

Credentials to access the new SQL Server