Change Auditor 7.1.1 - Installation Guide


	NOTE: If you have not added the appropriate user accounts to either the ChangeAuditor Administrators or ChangeAuditor Operators group, you are denied access to the coordinator when you open the client. See Add Users to Change Auditor Security Groups for more information about these security groups and SQL database roles.

Quest recommends that you deploy a server agent to all servers (domain controllers and member servers) to track configuration changes in real time. For workstations, deploy a workstation agent to only those that you want to monitor for login activity. See Agent behavior notes for information about how the different types of agents connect to the coordinators in your environment and the limits set for agent connections.

When a change is made on a server running an agent, the change information (audited event) is captured and forwarded to the specified database.


	NOTE: The agent database supports up to 3 GB. After the database size reaches this limit, no new events are audited and the ‘Agent service has reached a critical load’ event is generated. This typically occurs when an agent is disconnected from a coordinator for an extended period.


	NOTE: See the Installation Notes and Best Practices for notes on deploying agents for Change Auditor for Exchange and Change Auditor for Authentication Services.


	NOTE: To install Change Auditor agents to monitor ADAM (AD LDS) instances on workgroup servers, run the agent installer package (Quest Change Auditor Agent 6 (x64)).msi. See Install an agent to audit ADAM (AD LDS) on workgroup servers for details.


	NOTE: When you are using Active Roles, there is an extra integration step that you can take to capture the user who initiated the change. See Active Roles Integration.

The Deployment page in the client displays all the servers and workstations discovered in your Active Directory environment. From here, you specify the servers (and workstations) to host an agent. For a description of the Deployment page, see the Change Auditor User Guide.


	NOTE: The Deployment page does not display nonmember objects, such as ADAM workgroup servers or nondomain workstations, because agents cannot be deployed to non-member objects using the Deployment tab. See Install an agent to audit ADAM (AD LDS) on workgroup servers for more information about manually installing agents to workgroup servers. See Workstation Agent Deployment for more information about manually installing agents to non-domain workstations.

Deploy agents

Starting with Change Auditor 7.0.2, you cannot install an agent on Windows 2008 SP2 operating system. During an agent install, if this operating system is detected, the latest version of the agent that supports the operating system is installed.

For example, when you install an agent on a Windows 2012 server, the latest 7.x agent is deployed. When you deploy an agent on a Windows 2008 SP2 server, the latest 6.8 agent is installed.

The following procedures step you through the process of deploying agents. See the Change Auditor User Guide for procedures on using the advanced options and setting up auto deployment of new servers.

To deploy agents:


	NOTE: If required, agents running on a domain-joined server or domain controller can connect to coordinators in a foreign Active Directory forest. For details, see Foreign Forest Agent Deployment.

Verify that the agent deployment account has at least administrator permissions in every domain that contains servers or workstations where agents will be deployed.

Verify that the logged on user account is a member of the Change Auditor Administrators group in the specified Change Auditor installation.

Open the client. If agents have not yet been deployed, select the Deployment tab. Otherwise, use View | Deployment.

The Deployment page is populated with the servers (domain controllers and member servers) and workstations in your Active Directory environment.


	NOTE: The Deployment page may initially be empty until the current forest’s server topology has been initially harvested. Topology scan takes a long time when the environment contains many workstations. This page is automatically refreshed after this task has completed.

From this list, select an entry and select Credentials | Set to enter the proper user credentials for installing agents on the selected domain.

On the Domain Credentials dialog, select the domain from the list and click Set. On the Logon Credentials dialog, enter the credentials of a user with administrator rights on the selected domain.


	NOTE: If you are using a group Managed Service Account, ensure that the account ends with '$' and the password is left blank.

After entering the proper credentials, select the entry back on the Deployment page and select Credentials | Test. If you get a Valid Creds status in the Deployment Result column, you can start deploying agents to that domain.

If you get a Logon Failure status in the Deployment Result column, use the Credentials | Set command to enter the proper credentials for installing agents.

By default, the Change Auditor agent folders (Agent, Systray) are installed to %ProgramFiles%\Quest\ChangeAuditor\. You can, however, change the location of the installation folder by clicking Advanced Options.

Select one or more servers or workstations on the Deployment page and click Install or Upgrade.

On the Install or Upgrade dialog select one of the following options to schedule the deployment task:

•

Now (default)

•

When

If you select the When option, enter the date and time when you want the deployment task to initiate. Click OK to initiate or schedule the deployment task.

Back on the Deployment page, the Agent Status column displays ‘Pending’ and the When column displays the date and time specified.


	NOTE: To cancel a pending deployment task, select the server or workstation and then click Install or Upgrade. On the Install or Upgrade dialog, click Clear Pending.

As agents are successfully connected to the coordinator, the corresponding Deployment Result cell displays ‘Success’, the Agent Status cell displays ‘Active’ and a desktop notification displays in the lower right-hand corner of your screen.


	NOTE: To deactivate these desktop notifications, select Action \| Agent Notifications.

Once agents are deployed and you open the client, the Overview page opens and provides a real-time stream of events based on a ‘favorite’ search definition and other summary information.


	NOTE: After the deployment, the Version cell might display a previous version of an agent if you installed the agent on an unsupported platform.

Upgrade Change Auditor

This section contains information about upgrading Change Auditor. Before proceeding with an upgrade, read the following information carefully and consider all steps that apply to your deployment.


	NOTE: The Change Auditor 7.0.2 and higher agent cannot connect to a coordinator version 7.0.1 or earlier. When upgrading the Change Auditor agent to 7.0.2 and higher, ensure the Change Auditor coordinator has also been upgraded to 7.0.2 and higher.

You can upgrade to Change Auditor 7.1 from the following upgrade paths.

Table 4. Available upgrade paths
Upgrade from...	Details
Change Auditor 6.0, 6.5, 6.6, 6.7, 6.8, 6.9, 7.0	You can upgrade directly to version 7.1. If the upgrade cannot proceed because 5.x events are still present in the database, upgrade to 6.8 first to complete the upgrade of the 5.x events, then upgrade to 7.1. Ensure that upgrade of the 5.x events has fully completed before you upgrade.
Change Auditor 5.9 or below	You cannot upgrade directly to version 7.1. You must upgrade to 6.8 first.