Chatta subito con l'assistenza
Chat con il supporto

Change Auditor 7.3 - User Guide

Change Auditor Overview Agent Deployment Change Auditor Client Overview Overview Page Searches Search Results and Event Details Custom Searches and Search Properties Enable Alert Notifications Administration Tasks Agent Configurations Coordinator Configuration Purging and Archiving your Change Auditor Database Disable Private Alerts and Reports Generate and Schedule Reports SQL Reporting Services Configuration Change Auditor User Interface Authorization Client Authentication Certificate authentication for client coordinator communication Integrating with On Demand Audit Enable/Disable Event Auditing Account Exclusion Registry Auditing Service Auditing Agent Statistics and Logs Coordinator Statistics and Logs Change Auditor Commands Change Auditor Email Tags

Installation settings

The default Change Auditor installation includes the following configuration:

•
Windows authentication for the connection between the Windows client and the coordinator.
•
Coordinator and agent services run with the local system computer account.

In environments with stringent security requirements, administrators can:

•
Restrict NTLM in their Active Directory domains by enabling and changing one or more of the following group policy settings:
•
Network security: Restrict NTLM: Incoming NTLM traffic.
•
Network security: Restrict NTLM: NTLM authentication in this domain.
•
Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers.
•
Configure the coordinator to run with an alternate service account.

When these security options are in place, the default Windows authentication cannot be used for client - coordinator communication; instead certificate authentication can be used.

Deployment

Certificates are required for both the coordinators and the clients that connect to them. In a default deployment, administrators can use:

•
Domain Certificate Services with default templates for user and computer certificates that manage deployment details such as certificate properties, deployment requests, and the certificate stores and folders.
•
Manual certificate deployment and manually-created self-signed certificates are also supported for evaluation or other low-security purposes.

When using certificate authentication, the following must be in place:

•
Each server that hosts a coordinator must have a valid, trusted certificate with at least the “Server authentication” and “Client authentication” purposes located in the Local Machine\Personal certificate store. The certificate must include the private key. The trust chain of the certificate must evaluate to a trusted root CA certificate in the “Trusted Root Certification Authorities” Certificates folder of the coordinator host and all client hosts. Peer (“Trusted People”) trusts are not supported.
•
Each client must have a valid, trusted certificate with at least the “Client authentication” purpose located in the User\Personal certificate store. The certificate must include the private key. The trust chain of the certificate must evaluate to a trusted root CA certificate in the “Trusted Root Certificate Authorities” Certificates folder of the client host and all coordinator hosts. Peer trusts are not supported. Active Directory or IIS certificate identity mapping of client certificates is not required, and is not used by Change Auditor if provided.
•
When self-signed certificates are used, Certificate Revocation List checking must be disabled as described in Coordinator configuration.

Coordinator configuration

To configure certificate authentication on a coordinator:
1
Ensure a valid Server authentication certificate is deployed on the host server.
2
Install the Change Auditor coordinator as described in the Change Auditor Installation Guide.
* 
NOTE: When specifying the Coordinator SQL Server information, connections using Windows authentication may fail if NTLM restrictions are in place and the SQL server specified is not excepted from the restrictions. In this case the use of SQL authentication is recommended.
3
Stop the coordinator, if it is running.
4
In the Coordinator installation folder (located by default in Program files\Quest\ChangeAuditor\Service). Make a backup copy of the ChangeAuditor.Service.exe.config file, then open the file using a text editor such as Notepad.exe.
5
Under the <configuration> <appSettings file=””> nodes, locate the <add key="WcfAuth" value="Windows" /> node and change the value from “Windows” to “Certificate”.
If you are using self-signed certificates (without Certificate Revocation List information), locate the <add key="DisableCrlCheck" value="false" /> node and change the value from “false” to “true”.
By default a suitable service certificate is selected from the Local Machine\Personal certificate store automatically. If an alternate certificate in the Local Machine\Personal certificate store is required, locate the <add key="ServiceCertificate" value="" /> node and change the value from “” (empty string) to the thumbprint string copied from a certificate found in the certlm.msc Certificate Manager for Local Machine applet in the User\Personal certificate store. Ensure that the certificate is trusted, is not expired, has a private key and at least the “Server Authentication” (“Ensures the identity of a remote computer”) purpose.
6
Save the changes to the file and restart the coordinator.

Windows client configuration

* 
NOTE:  
•
Before starting, ensure that a valid client authentication certificate is deployed to the client host computer if any coordinator is configured for certificate authentication.

You can manage the connection profile for coordinators configured for certificate authentication by selecting Manage on the Connection screen. The following information and options are available:

•
The Connection Profiles displays Yes in the Certificate Auth column if the coordinator is configured for certificate authentication; and No if configured for the default Windows authentication. From here, you can also see the current certificate subject field and expiration date.
•
When the Override automatic client certificate selection for the current user option is enabled, users can specify an alternate certificate from the Current User’s Personal certificate store.
•
When you select to add or edit a manual connection, you will have the option to Use WCF Certificate Authentication and Disable Certificate Revocation List Check. When specifying the coordinator service properties, these check boxes must reflect the options for which the coordinator is configured.
* 
NOTE: These options do not apply to the Forest, Global Catalog and Database Direct connection methods.
•
When using a connection profile for the first time, or one for which credentials have not been saved with the “Remember Me” option, the user is prompted for the credentials of a domain user with the Change Auditor security group membership appropriate to the user’s role (such as Operator or Administrator).

 

 

Related Documents

The document was helpful.

Seleziona valutazione

I easily found the information I needed.

Seleziona valutazione