• ポータルについて詳しく知る
• ダウンロード
• 印刷
• MY ダウンロード ()

• サポート
• 技術文書
• Change Auditor 7.1.1
• Change Auditor 7.1.1 - Installation Guide

Change Auditor 7.1.1 - Installation Guide

コンテンツのナビゲーション  

Installation Overview

Before you begin System requirements System statistics and facilities System overview Installation overview

Install Change Auditor

Installation workflow Install the first coordinator Install the client Install multiple coordinators

Add Users to Change Auditor Security Groups

Introducing Change Auditor security groups Add accounts to security groups Add accounts to ChangeAuditor database role

Connecting to the Clients

Connect to the client Open the web client Access product information

Deploy Change Auditor Agents

Change Auditor agents Deploy agents

Upgrade Change Auditor

Pre-upgrade considerations Upgrade Change Auditor

Step 1: Upgrade all coordinators (and database schema) Step 2: Upgrade all clients Step 3: Upgrade the agents

Post upgrade considerations

Installation Notes and Best Practices

Licensing Change Auditor products Permissions Other installation notes Change Auditor for Windows File Servers Change Auditor for Exchange Change Auditor for Authentication Services Change Auditor for SharePoint

Agent deployment

Backup notes Agent behavior notes Client notes ADAM (AD LDS) auditing Change Auditor for SQL Server — SQL auditing

Multi-Forest Deployments

Multi-forest deployment requirements Installation example Configuration

Audit and protection configuration flow Event flow Reports and queries from the client

Foreign Forest Agent Deployment

Supported functionality Deploying foreign forest agents Requirements

Workflow Harvesting the Foreign Forest Topology Deploying agents to a foreign forest Installing agents in a foreign forest Connecting to a different foreign forest/updating credentials Example deployment scenario

Workstation Agent Deployment

Recommendations and deployment requirements Manual workstation agent deployment Deploying workgroup agents (non-domain workstations)

Agent Comparison Install an agent to audit ADAM (AD LDS) on workgroup servers Active Roles Integration

Requirements Deploying Change Auditor/Active Roles integration scripts Client components added to Change Auditor Removing deployed Change Auditor/Active Roles integration scripts Troubleshooting Tips

Quest GPOADmin Integration

Requirements GPOADmin and Change Auditor integration process Client components added to Change Auditor Troubleshooting tips

Windows Installer Command Line Options

Agent options Coordinator options Web Client options

• Viewing Topics 65 - 68 of 81

×

Agent Comparison

There are a few client features that are not available for workstation agents. The following table displays the agent-related features that are available for server and workstation agents.

 

Table 6. Agent comparison

Page and Feature	Available for server agents?	Available for workstation agents?
Deployment Page The Deployment page does not display non-member objects, such as ADAM workgroup servers or non-Active Directory workstations, because agents cannot be deployed to non-member objects using the Deployment tab.
Included in topology harvest	Yes	Yes
Install or Upgrade (deploy agent)	Yes	Yes
Advanced Options | Specify Agent Installation Location	Yes	Yes
Advanced Options | Specify a Custom Share on the Remote Server	Yes	Yes
Advanced Options | Launch ServiceStatusTray on startup	Yes	No
Advanced Options | Restart Agent on failure	Yes	Yes
New Servers | Enable Auto Deployment on New Servers	Yes	No
Overview Page
Agent Status Pane • Enterprise View (member objects) • Workstation View (member objects) • Other View (non-member objects) • <Domain> (member and non-member objects)	Yes No Yes Yes	No Yes Yes Yes
Count of Events Pane • Location (member and non-member objects)	Yes	Yes
Top Agent Activity Pane • All (member and non-member objects) • DCs (member objects) • Servers (member objects) • Workstations (member objects) • Others (non-member objects)	Yes Yes Yes No Yes	Yes No No Yes Yes
Search Properties Tabs
Where Tab	Yes	Yes
Origin Tab	Yes	Yes
Agent Statistics Page
Included in Agent Statistics page	Yes	Yes
Start | Stop | Restart agent (member objects)	Yes	Yes
Start | Stop | Restart agent (non-member objects)	No	No
Set Agent Uninstalled	Yes	Yes
Hide | Show Uninstalled agents	Yes	Yes
View agent logs	Yes	Yes (See Note below)
View resource properties	Yes	Yes
Administration Tasks Page — Agent Configuration
Included in Agent Configuration page	Yes	No
Assign agent configurations	Yes	No (Uses Default Configuration)
Configuration Setup dialog | System Settings	Yes	Yes (From Default Configuration)
Configuration Setup dialog | File System settings (Change Auditor for Windows File Servers, Change Auditor for EMC or Change Auditor for NetApp)	Yes	No
Configuration Setup dialog | AD Query settings (Change Auditor for Active Directory Queries)	Yes	No
Configuration Setup dialog | Exchange settings (Change Auditor for Exchange)	Yes	No
Configuration Setup dialog | VMware settings	Yes	No
Agent system tray icon	Yes	No

 

 

NOTE: For workstation log management (such as Get Logs and View Agent Logs), the following must be enabled on the workstation: • Windows Management Instrumentation (WMI) in the firewall rule set (usually domain) on the workstation • Network Discovery and File Sharing • Remote Registry Service set to ‘Start Automatically’. By default, this service is stopped and set to ‘Manual’ for Windows 8.1 and 10.

Install an agent to audit ADAM (AD LDS) on workgroup servers

Change Auditor audits Active Directory Application Mode (ADAM) or Active Directory Lightweight Directory Services (AD LDS) events. This section provides information regarding the agent installation necessary for auditing ADAM (AD LDS) instances on workgroup servers.

Agent installation

NOTE: An agent must be installed on the server where the ADAM (AD LDS) instance to audit resides.

To install agents to audit ADAM (AD LDS) on workgroup servers:

NOTE: A workgroup agent requires NetBIOS over TCP enabled and access to the following ports inbound to the domain controllers: • UDP port 137 (name services) • UDP port 138 (datagram services) • TCP port 139 (session services)

1	Copy the appropriate agent installer package from the Change Auditor service installation directory to the workgroup server to monitor. The default directory is %ProgramFiles%\Quest\ChangeAuditor\Service\ Change Auditor Agent (x64).msi.

2	Run the installer file on the workgroup server to open the Change Auditor Agent wizard which steps you through the installation.

3	Review the following table for additional requested information in this wizard. This table only covers unfamiliar information. It does not include all the wizard screens or field descriptions.

Table 7. Change Auditor Agent wizard

Active Directory Information screen On the Active Directory Information screen, enter the Active Directory information required for the agent to establish a coordinator connection.
Name of Active Directory Root Domain (domain.com)	Enter the DNS name (domain.com) of the root domain of Active Directory.
Account Name (domain\user)	Enter the name of the user (domain\user) that can find and connect to a Change Auditor coordinator in the Active Directory forest.
Account Password	Enter the password associated with the previously entered user account.
Installation Name screen The Installation Name screen prompts you to enter the installation name to identify the database to which the coordinator is to be connected. A workgroup agent must join an existing Change Auditor installation.
ChangeAuditor Installation Name	Enter an existing Change Auditor installation or click Browse to select from a list of existing installations.

Active Roles Integration

Active Roles uses a proxy account (service account) to connect and change Active Directory objects and group policies. Change Auditor can deploy to an Active Roles server which signals it to retrieve and send the name of the user that was logged in to the Active Roles console to Change Auditor. This additional information is then displayed in the Change Auditor client for events initiated using Active Roles.

NOTE: Change Auditor audits changes made through Active Roles workflow that are initiated by the Active Roles service account.

NOTE: As of Active Roles version 7.3.3, you can monitor a single server from multiple installations of Change Auditor. To ensure that the Active Roles server EventSource is created and registered in the Change Auditor database, you need to deploy the Active Roles integration script from each Change Auditor installation. See Deploying Change Auditor/Active Roles integration scripts.

This section covers the following topics for Active Roles integrations:

•	Requirements

•	Deploying Change Auditor/Active Roles integration scripts

•	Client components added to Change Auditor

•	Removing deployed Change Auditor/Active Roles integration scripts

•	Troubleshooting Tips

Requirements

Active Roles

•	Active Roles 6.9 through 7.4.2

NOTE: To capture the additional events and initiator account information available with the latest integration scripts, you must be running Active Roles 6.9 (or higher) with Change Auditor for Active Directory 6.0 (or higher).

NOTE: To work with Active Roles 7.0, you must have installed: hotfix 7.0.2 SOL188024 for Active Roles and at a minimum Change Auditor 6.7.1539, Change Auditor 6.8.1474, or Change Auditor 6.9. NOTE: If both Active Roles versions 6.x and 7.0.2 SOL188024 are installed on the same server as a side-by-side deployment, Change Auditor installs integration scripts to both.

•	Microsoft .NET Framework 4.5 (or higher) must be installed and enabled on the target Active Roles server

•	PowerShell 2.0 must be installed on the target Active Roles server

•	PowerShell Execution policy must be set to ‘AllSigned’, ‘RemoteSigned’ or ‘Unrestricted’ on the target Active Roles server. (For more information, see https://technet.microsoft.com/en-us/library/ee176961.aspx.)

•	Active Roles administrator right is required to deploy the integration scripts.

•	The Active Roles service account (or the override account) must be authorized to access the Change Auditor SDK. That is, add the Active Roles server service account to the ChangeAuditor Administrators security group.

NOTE: If you use a role with the minimum permissions, use the Application User Interface page on the Administration Tasks tab to define a role that contains the ‘Add Sdk’ and ‘View Sdk’ operations. For more information about using the Application User Interface page to define a new role, see the Change Auditor User Guide.

Change Auditor for Active Directory

•	Change Auditor for Active Directory 5.6 (or higher)

NOTE: To capture the additional events and initiator account information available with the latest integration scripts, you must be running Active Roles 6.9 (or higher) with Change Auditor for Active Directory 6.0 (or higher). To deploy Active Roles 7.0, you must have installed at a minimum, Change Auditor 6.7.1539, Change Auditor 6.8.1474, or Change Auditor 6.9.

•	The integration scripts must be deployed to a server running Active Roles.

NOTE: If Active Roles replication is configured correctly, you only need to deploy the integration script to one Active Roles server.

•	The Change Auditor agents must be installed on all domain controllers in the environment to ensure that the Active Directory changes are picked up.

•  前回
• Viewing Topics 65 - 68 of 81
• 次へ 

この文書を検索 この製品バージョンに対応するすべての文書を検索 この製品に対応するすべての文書を検索 すべての文書を検索

×

 サポートへようこそ

Quest *product*のオンラインサポートヘルプは、関連会社のサポートサイトで参照できます。「Continue（続行）」をクリックすると、*product*の適切なサポートコンテンツとアシスタンスへ移動します。

関連ドキュメント

The document was helpful.

評価を選択

I easily found the information I needed.

評価を選択

© 2024 Quest Software Inc. ALL RIGHTS RESERVED. 利用規約 プライバシー Cookie Preference Center