Chatta subito con l'assistenza
Chat con il supporto

Change Auditor 7.6 - Installation Guide

Installation Overview Install Change Auditor Add Users to Change Auditor Security Groups Connecting to the Clients Deploy Change Auditor Agents Upgrade Change Auditor Installation Notes and Best Practices Deployment Options Workstation Agent Deployment Agent Comparison Install an agent to audit ADAM (AD LDS) on workgroup servers Windows Installer Command Line Options

Upgrade Change Auditor

This section contains information about upgrading Change Auditor. Before proceeding with an upgrade, read the following information carefully and consider all steps that apply to your deployment.

* 
NOTE: The Change Auditor 7.0.2 and higher agent cannot connect to a coordinator version 7.0.1 or earlier. When upgrading the Change Auditor agent to 7.0.2 and higher, ensure the Change Auditor coordinator has also been upgraded to 7.0.2 and higher.

You can upgrade from the following upgrade paths.

Table 4. Available upgrade paths
Upgrade from...
Details

Change Auditor 6.x through 7.x

You can upgrade directly to the latest version.

If the upgrade cannot proceed because 5.x events are still present in the database, upgrade to 6.8 first to complete the upgrade of the 5.x events, then upgrade to the latest version. Ensure that upgrade of the 5.x events has fully completed before you upgrade.

Change Auditor 5.9 or below

You cannot upgrade directly to the latest version. You must upgrade to 6.8 first.

•
Pre-upgrade considerations
•
Upgrade Change Auditor
•
Post upgrade considerations

Pre-upgrade considerations

* 
IMPORTANT: Agent upgrade

As of Change Auditor 7.5, Change Auditor has upgraded to SQL Server 2022 LocalDB for the agent's local event storage. Events that are stored locally and waiting to be sent to the coordinator will be lost on agent upgrade because the existing agent database will be deleted and replaced with the new SQL Server LocalDB. We suggest that you upgrade servers during a time when there is the least amount of event traffic.

Note the following when upgrading to version 7.5:

•
The agent will install SQL Server LocalDB 2022 (16.0) version if it is not currently installed.
•
The agent will install Microsoft VC++ redistributable 2015-2022 if it is not currently installed.
•
After an upgrade, a reboot may be needed.

More information can be found on the Quest Software Support Portal.

Review these special considerations before running an upgrade.

Coordinator upgrades

Coordinator upgrades may take longer than expected due to additions to the Changes Auditor database schema. The duration of the upgrade is dependent on the number of events generated in the last 45 days prior to the upgrade. The estimated time is approximately 1 minute for 1 million events.

Larger, more active environments should prepare for coordinator downtime of several hours during the upgrade process. You can view the upgrade progress in the coordinator logs or by connecting the upgraded client to the coordinator.

Upgrading a coordinator that is using Azure SQL Managed Instance for the database configuration

Single User Mode is not supported during installation or upgrade when using Azure SQL Managed Instance.

* 
NOTE: Do not open a connection to the SQL database while upgrading.

Upgrading a coordinator that is using SQL AlwaysOn Availability Groups for the database configuration

When upgrading Change Auditor databases that are part of a SQL AlwaysOn Availability Group, the upgrade can be performed while connected to the availability group listener. The upgrade will take place on the primary database and SQL will replicate any changes to the other databases in the availability group. Ensure that all SQL connections to the primary database are closed before and during the upgrade.

Services using Change Auditor SDK

Stop any services that use the Change Auditor SDK, such as Active Roles or GPOADmin, before starting the upgrade process.

Server collation differences

Starting with Change Auditor 6.0, on the coordinator startup the database collation is checked against SQL server collation. If they are different, the coordinator stops and logs the “Database collation differs from server collation” warning. If it is not possible to update collation of the SQL server, use the AllowCollationSwitch registry key to allow proceeding with rebuilding Change Auditor database according to the new collation. However, using this in environment with large number of events in the database significantly increases the load on SQL server. See the Change Auditor Technical Insight Guide for more information about setting this registry key.

Upgrading Change Auditor agents on high volume Exchange servers

It is critical that Change Auditor for Exchange agent upgrades be scheduled for maintenance intervals or other periods of low user mailbox activity for any configuration of Exchange Server. Change Auditor for Exchange agent upgrades should not be attempted on an active Exchange Server cluster node in any case.

To eliminate the possibility of unscheduled Exchange Server downtime, perform agent upgrades to Exchange Servers during periods of low or no mailbox activity. When upgrading agents on busy Exchange Servers, it is also recommended that you manually stop the agent before upgrading to avoid a possible timeout on the stop command. Verify that the Change Auditor agent service is stopped on the Exchange Server before proceeding with the agent upgrade.

NetApp Auditing

HTTP application access must be assigned to all accounts that are assigned to agents for NetApp auditing templates prior to upgrading to 7.5 or later. See system requirements in Release Notes for additional details.

Alert Configuration (Evaluation Frequency)

This setting is no longer available. If you want to reduce the amount of email produced from alert-enabled searches, you must set the "AlertScanPeriod" registry key setting on the coordinator computer:

HKLM\SOFTWARE\Quest\ChangeAuditor\Coordinator

Value: AlertScanPeriod
Type: DWORD
Default value: 60 seconds
Description: Specifies the time interval between generating alerts.

Upgrade Change Auditor

To ensure success, upgrade the Change Auditor components in the following order:

•
Step 1: Upgrade all coordinators (and database schema)
•
Step 2: Upgrade all clients
•
Step 3: Upgrade the agents

Step 1: Upgrade all coordinators (and database schema)

During an upgrade of the first coordinator, the Change Auditor database is upgraded. Before proceeding with the coordinator upgrade, backup the database.

* 
NOTE: Change Auditor 7.0 and above requires a new license for all modules.
* 
IMPORTANT: As of Change Auditor version 7.0.4, Microsoft Graph API permissions are required for the web application to audit Microsoft Entra ID and Microsoft 365. Due to this, any existing Microsoft Entra ID and Microsoft 365 templates must be updated.

Microsoft Entra ID and Microsoft 365 auditing will not occur if the permission requirements are not met.

See the Microsoft 365 and Microsoft Entra ID auditing User Guide for details on updating the templates and the required permission.
To upgrade all coordinators (and database schema):
1
Stop all coordinators.
2
Log on to the coordinator server to upgrade and browse to the folder where the Change Auditor package was downloaded, and run the Quest Change Auditor Coordinator (x64).msi file to open the Change Auditor Coordinator Setup wizard.
3
Follow the Change Auditor Coordinator Setup wizard.
4
After the Change Auditor Coordinator Setup wizard has successfully finished, wait until the coordinator goes from an ‘Initializing’ status to a ‘Running’ status. To determine the coordinator’s status, right-click the Change Auditor coordinator system tray icon and select the Coordinator Status option.
5
Continue to upgrade the remaining coordinators one at a time following steps 2 to 4.
Related Documents

The document was helpful.

Seleziona valutazione

I easily found the information I needed.

Seleziona valutazione