Chatta subito con l'assistenza
Chat con il supporto

Change Auditor 7.1.1 - Installation Guide

Installation Overview Install Change Auditor Add Users to Change Auditor Security Groups Connecting to the Clients Deploy Change Auditor Agents Upgrade Change Auditor Installation Notes and Best Practices Multi-Forest Deployments Foreign Forest Agent Deployment Workstation Agent Deployment Agent Comparison Install an agent to audit ADAM (AD LDS) on workgroup servers Active Roles Integration Quest GPOADmin Integration Windows Installer Command Line Options

Deploying agents to a foreign forest

Deploying agents to a foreign forest
To deploy agents to a foreign forest from the client:
1
From the Change Auditor client, select the Deployment tab.
The Deployment page is populated with the servers (domain controllers and member servers) and workstations in your Active Directory environment.
* 
NOTE: The Deployment page may initially be empty until the current forest’s server topology has completed. The topology scan takes a long time when the environment contains many workstations. This page is automatically refreshed after this task has completed.
2
From this list, select an entry and select Credentials | Set to enter the proper user credentials for installing agents on the selected domain.
3
Select one or more servers or workstations on the Deployment page and click Install or Upgrade.
4
On the Install or Upgrade dialog select one of the following options to schedule the deployment task:
•
Now (default)
•
When
If you select the When option, enter the date and time when you want the deployment task to initiate. Click OK to initiate or schedule the deployment task.
5
Enter the Active Directory credential information to allow the agent to connect to the coordinator in the remote forest, and click OK.
•
Name of Active Directory Root Domain (domain.com): Enter the DNS name (domain.com) of the root domain of Active Directory.
•
Account Name (domain\user) : Enter the name of the user (domain\user) that can find and connect to a coordinator in the Active Directory forest.
•
Account Password : Enter the password associated with the previously entered user account.
•
Account Type: Select the account type of the previously supplied user account.
* 
NOTE: If you select Group Managed Service Account, the account must be a valid group Managed Service Account from the Agent forest and correctly installed on the Agent server. Ensure that the password is left blank.
•
Add this user to the “ChangeAuditor Agents - <InstallationName>” domain local security group: This is selected by default indicating that the specified user account will be added to the ChangeAuditor Agents security group in the supplied Active Directory domain. User accounts must be added to this security group to properly authenticate.
* 
NOTE: You may need to pre-stage\create the "ChangeAuditor Agents – <InstallationName>" domain local security group and manually add the configured user account to the security group in additional domains within the forest where coordinators reside. If using a group Managed Service Account this step is required and must be performed manually.
You can add the domain user account to the ChangeAuditor Agents – <InstallationName> security group, if appropriate LDAP and network protocol access is available.
Back on the Deployment page, the Agent Status column displays ‘Pending’ and the When column displays the date and time specified.
* 
NOTE: To cancel a pending deployment task, select the server or workstation and then click Install or Upgrade. On the Install or Upgrade dialog, click Clear Pending.
As agents are successfully connected to the coordinator, the corresponding Deployment Result cell displays ‘Success’, the Agent Status cell displays ‘Active’ and a desktop notification displays in the lower right-hand corner of your screen.
* 
NOTE: To deactivate these desktop notifications, select Action | Agent Notifications.
Once agents are deployed and you open the client, the Overview page opens and provides a real-time stream of events based on a ‘favorite’ search definition and other summary information.

Installing agents in a foreign forest

To manually install an agent in a foreign forest:
1
Copy the appropriate agent installer package from the Change Auditor service installation directory to the required computers.
2
Run the installer file to open the Change Auditor Agent Setup wizard which steps you through the installation.
3
Accept the license agreement and click Next.
4
Select This agent connects to a coordinator in a foreign forest.
5
Enter the Active Directory credential information to locate the Change Auditor Installation and allow the agent to connect to the coordinator in the remote forest.
•
Name of Active Directory Root Domain (domain.com): Enter the DNS name (domain.com) of the root domain of Active Directory.
•
Account Name (domain\user) : Enter the name of the user (domain\user) that can find and connect to a coordinator in the Active Directory forest.
•
Account Password : Enter the password associated with the previously entered user account.
•
Account Type: Select the account type of the previously supplied user account.
* 
NOTE: If you select Group Managed Service Account, the account must be a valid group Managed Service Account from the Agent forest and correctly installed on the Agent server. Ensure that the password is left blank.
•
Add this user to the “ChangeAuditor Agents - <InstallationName>” security group : This is selected by default indicating that the specified user account will be added to the ChangeAuditor Agents security group in the forest where the coordinator is located. User accounts must be added to this security group to properly authenticate.
* 
NOTE: You may need to pre-stage\create the "ChangeAuditor Agents – <InstallationName>" domain local security group and manually add the configured user account to the security group in additional domains within the forest where coordinators reside. If using a group Managed Service Account this step is required and must be performed manually.
You can add the domain user account to the ChangeAuditor Agents – <InstallationName> security group, if appropriate LDAP and network protocol access is available.
6
The Installation Name screen prompts you to enter the installation name to identify the database where the coordinator is located. Click Browse to select the required installation
7
Choose the destination folder and click Next.
8
Click Next to begin the installation.
Once the agent starts and connects to coordinator, the foreign forest computers will be available in the Deployment tab.

Connecting to a different foreign forest/updating credentials

Once the agent is installed, you can select to use a different coordinator in another domain or update the credentials

* 
IMPORTANT: The agent must be restarted once a change has been made.

You can update the domain and required credentials:

•
Right-clicking the agent SysTray and selecting Coordinator Credential Configurator.
•
Running the CoordinatorCredentialConfigurator.exe file in the agent installation folder on the agent server. By default, this is located under %ProgramFiles%\Quest\ChangeAuditor\Agent.

Example deployment scenario

The following diagram shows two separate forests where Change Auditor will be deployed. Forest A is deployed first and then Forest B is added.

Forest A installation
1
Install the coordinator on a member server in Forest A. In this example, Coordinator.ForestA.com is used as the coordinator server.
While installing the first coordinator, make note of the “Installation name”. The same installation name is required when deploying agents to Forest B.
2
Install the client on either a workstation or member server. In this example, CAClient1.ForestA.com is used as the client computer.
3
Using the client, connect to the coordinator in Forest A to deploy agents to computers in Forest A. See Deploy Change Auditor Agents for more details about deploying agents.
At this point, Change Auditor should be fully deployed to the first forest in the organization (ForestA.com in this example).
Forest B installation

Option 1: Deploying agents to a foreign forest through the Change Auditor client

1
Using the client, connect to the coordinator in Forest A.
2
Deploy agents to the required computers in Forest B. (See Deploying agents to a foreign forest for details.)

Option 2: Installing agents manually in a foreign forest

1
Run the appropriate Agent MSI on the required computers in Forest B where the installation is required. The MSI should be launched from an elevated command prompt.
2
When prompted, select the This agent connects to a coordinator in a foreign forest option.
3
Enter the Active Directory root domain name of the remote forest where the agent will connect.
4
Enter a domain administrator user account from a domain where the coordinator is located and click Next.
5
Enter the Installation Name that the agent needs to join and click Next.
6
Click Install.
The agent will now connect to the coordinator in Forest A and the computer will be available in the Deployment tab of the Change Auditor client.
Related Documents

The document was helpful.

Seleziona valutazione

I easily found the information I needed.

Seleziona valutazione