Chatta subito con l'assistenza

Ottieni assistenza in tempo reale
Completa la registrazione

Accedi

Richiedi prezzo

Contatta il supporto vendite

Change Auditor - For Advanced Users 7.1.1 - Technical Insight Guide

Table of Contents

Change Auditor Services

Quest Change Auditor Coordinator Quest Change Auditor Workstation Agent Quest Change Auditor Agent Change Auditor for EMC

Change Auditor licensing processes

License check process Component licensing User counts

Component Start-up Considerations

Start up delays

Change Auditor network communications

Service Connection Points

CN=ChangeAuditor.Coordinator

Ports and protocols Network encryption

Secure password storage Client to coordinator connection Agent to coordinator connection (version 6.x and 7.0.1) Agent to coordinator connection (version 7.0.2) Coordinator to SQL Server connection

Coordinator internal tasks

Forest topology collection Group expansion Alert processing License check Remote deployment Agent heartbeat check Refresh coordinator statistics Event aggregator SQL upgrade monitor Open handle Scheduled purge job Scheduled archive job Scheduled report job

Registry Settings

Force agent WCF port Force client port Force SDK port Use predefined GC for name resolution Allow collation switch Report zip limit SQL command timeout Enable ChangeAuditor Agent service to start with the Microsoft security update (KB2264107) Adjust memory dumps settings

Change Auditor built-in fault tolerance Change Auditor protection

Using multiple protection templates

How access rules are evaluated How scheduling and location works with denied access

Database Considerations

How to move the Change Auditor database and coordinator to another server How to estimate the required SQL server disk space How SQL Server Autogrow affects Change Auditor How to query an archive database

Account exclusions best practices

Coordinator to SQL Server connection

1

Coordinators read the encrypted database connection string from the ChangeAuditor.Service.exe.config file which includes the SQL Server name \ Instance, User name, Password, and Domain if Windows authentication is selected.

This can be configured using the Security page on the Coordinator Configuration Tool, which is accessed by right-clicking the coordinator system tray icon and selecting Coordinator Configuration.

2

By default, connections to the SQL server are not encrypted; however to encrypt all data transmitted between an application computer and a computer running a SQL server instance, you can use the Secure Sockets Layer (SSL).

For more details on configuring client network protocols, see the following Microsoft article: http://msdn2.microsoft.com/en-us/library/ms190425.aspx.

Coordinator internal tasks

The following table lists the internal scheduled tasks that the coordinator performs, including when the task initially starts and how often the task is repeated. This section also provides a description of each of these tasks, and if configurable the page of the client used to configure it.

Table 8. Coordinator internal tasks
Task name	Initial Start Time	Default Run Frequency	Configurable
Forest topology collection	30 seconds after startup	Every 3 hours	No
Group expansion	3 hours after startup	Every 6 hours	Yes
Alert processing – Send SMTP	30 seconds after startup	Every 60 seconds	No
Alert processing – Send SNMP	45 seconds after startup	Every 30 seconds	No
Alert processing – Send WMI	30 seconds after startup	Every 30 seconds	No
License check	30 seconds after startup	Every 5 minutes	No
Remote deployment	1 minute after startup	Every 5 minutes	No
Agent heartbeat check	10 minutes after startup	Every 5 minute	No
Refresh coordinator statistics	At startup	Every 15 seconds	No
Event aggregator	10 seconds after startup	Every 10 seconds	No
SQL upgrade monitor	15 seconds after startup	Every 15 seconds	No
Open handle	300 seconds after startup	Every 300 seconds	No
Scheduled purge job	60 seconds after startup	Every 5 minutes	No
Scheduled archive job	60 seconds after startup	Every 5 minutes	No
Scheduled report job	60 seconds after startup	Every 5 minutes	No

Forest topology collection

Change Auditor maintains a view of Active Directory in the database. Each event that Change Auditor captures is linked with a forest, domain, or server (or workgroup server) found in the topology collection. When the coordinator service starts, the topology collection begins. The following Active Directory objects are collected and stored:

•

Domain Objects (crossref objects) found in CN=Partitions,CN=Configuration,<Forest Root Distinguished Name>

•

Site Objects (site objects) found in CN=Sites,CN=Configuration,<Forest Root Distinguished Name>

•

Exchange Servers (msExchExchangeServer objects) found in CN=Microsoft Exchange,CN=Services,CN=Configuration, <Forest Root Distinguished Name>

•

Server Objects (computer objects) – For each domain found, Change Auditor searches the domain for the following types of server objects:

•

Exchange servers found in the following groups:

•

Exchange Install Domain Servers

•

Exchange Servers

•

All computer objects found using the following filter:

•

(&(objectCategory=computer)(|(operatingSystem=*Windows*))


	NOTE: If the operatingSystem field contains ‘server’, the computer is a server object. If the operatingSystem field does not contain ‘server’, the computer is a workstation object.

Group expansion

The group expansion scheduled task is for expanding nested membership of Active Directory groups that are referenced in searches (Who search criteria) or groups that are defined in the Member of Group feature. Group membership is recursively enumerated in order to determine nested group membership.

The refresh frequency can be configured using the Group Membership Expansion pane on the Coordinator Configuration page (Administration Tasks tab) of the client.

Related Documents

The document was helpful.

Seleziona valutazione

I easily found the information I needed.

Seleziona valutazione

© ALL RIGHTS RESERVED. Termini di utilizzo Privacy Cookie Preference Center