Change Auditor 7.6 - Installation Guide

Change Auditor for Exchange

High volume Exchange Servers. Agent processing of large Exchange auditing and protection configurations may slow down initial user login access or cause timeouts if many user logins are occurring at the same time. To avoid this issue, Quest recommends that the following actions be performed during maintenance intervals or other periods of low user mailbox activity:

Before the system returns to a normal load, one user should log in to Outlook Web Access (OWA), Outlook, and Exchange Web Services (EWS, Outlook for Mac) clients. This triggers the Change Auditor agent to process Exchange Mailbox auditing and protection configuration changes when the fewest logins are occurring.

Exchange 2016. Exchange 2016 stores its configuration data in Active Directory, and installing Change Auditor agents on the domain controller captures all these change actions. However, Microsoft changed how they process configuration changes. Therefore, in order for Change Auditor for Exchange to retrieve the correct ‘who’ information for these Active Directory based events it now audits Windows PowerShell. So you can:

To capture Exchange mailbox access events:

Deploy agents to all Exchange Servers. When a Change Auditor 5.6 (or higher) agent is deployed on Exchange Server, it automatically enables the scripting extension in Active Directory. This is a forest-wide setting and applies to all Exchange servers in the Exchange organization. This extension requires that the ScriptingAgentConfig.xml file be present in the Exchange Server folder; otherwise, Exchange management tools display error messages each time the Scripting Agent cmdlet runs. The Change Auditor 5.6 (or higher) agent automatically creates the required ScriptingAgentConfig.xml file in the Exchange Server folder if one is not already present. Therefore, it is highly recommended that an agent be installed on all Exchange servers to ensure that all servers are using the same scripting agent.

NOTE: If the scripting agent was not enabled on your Exchange servers before deploying agents, you should perform backups of your Exchange servers in accordance with your company’s disaster recovery plan once you have successfully deployed agents to all your Exchange servers. If you need to restore your Exchange servers and they were NOT backed up after you deployed agents that enabled the scripting agent, you will need to disable the CmdletExtensionAgent BEFORE recovering your Exchange 2016 servers.

If Change Auditor cannot be installed on all your Exchange servers, use the following procedure on all Exchange servers where an agent is not yet deployed:

Exchange cluster node servers. When deploying or upgrading agents on Exchange cluster node servers, use the following recommended procedure:

Exchange 2003, 2007, and 2010 are no longer supported. For supported versions, see the Change Auditor Release Notes.

Exchange denies authentication to all well-known accounts, including ‘Administrator’. Use Hub Transport servers to allow SMTP email to go through. This references the setting for My Server Requires Authentication on the SMTP Configuration pane on the Coordinator Configuration page (Administration Tasks tab) in the Change Auditor client. It may also be necessary to configure more Transport settings (authentication and permissions) to allow email relay from the Change Auditor coordinator machine to receive SMTP alerts.

Change Auditor for Exchange does not support Microsoft Outlook 2000 or 2002.

For improved performance, Outlook offers an option to ‘cache’ requests to Exchange Server. This option is enabled by default when you configure an email account for Exchange Server. To disable this setting, select the Outlook Tools | Account Settings menu command, open the E-mail tab and click Change, and then clear the Use Cached Exchange Mode check box on the Microsoft Exchange Settings dialog.

While Change Auditor Exchange monitoring events closely track user input in non-cached Outlook and Outlook Web Access clients, this is not the case with cached-mode Outlook.

User activity in cached-mode Outlook can provide complex results with Change Auditor Exchange monitoring; the timing and order of Exchange requests is not obvious or intuitive.

A few of the effects you will see when monitoring an Outlook cached connection to Exchange Server include:

You will still receive all notifications of critical non-owner events from cached-mode Outlook clients, but the timing and sequence may not be obvious. Understanding the effect that cached-mode Outlook has on your Change Auditor Exchange monitoring will give you confidence that the results you are seeing are accurate.

Change Auditor for Authentication Services

Change Auditor for Authentication Services requires agents deployed on all Active Directory domain controllers in the forest to capture modifications to the Authentication Services configuration container.

Change Auditor for SharePoint

The Microsoft SharePoint requirements must be met. Change Auditor for SharePoint does not need any additional requirements.

See the Change Auditor for SharePoint User Guide for information about installing, configuring, and using Change Auditor for SharePoint.

Agent deployment

You need deploy an agent on one of the SharePoint servers in the SharePoint farm that you want to monitor.

The agent selected to connect to and collect events from the SharePoint farm must have the following permissions:

For proper auditing of the sites within the MySite Site Collection or Web Application, add the account Change Auditor uses to access the SharePoint database as a Site Collection Administrator (primary or secondary) or to the User Web Policy for the MySite host. Depending on how your MySite host is initially set up, use the Central Administration website to verify, and if necessary add, this account.

For Change Auditor to capture some of the SharePoint events, the following settings must be enabled:

NOTE: Log trimming is off by default. Enable log trimming to meet your policies. If the Change Auditor agent is offline or is otherwise unable to retrieve event information from the SharePoint database for a period longer than the trim period, events could be lost.

See the Change Auditor for SharePoint User Guide or Event Reference Guide for a list of the events that require these additional settings.