Return
-
Title
Can Change Auditor audit Certificate Authority changes? -
Description
Can Change Auditor audit events generated by a Certificate Authority? -
Cause
Change Auditor does not parse or scrape the Windows Event logs. The CA agent injects dlls and hooks into the processes it is licensed to audit.
For example, when an agent is installed on a DC and the Change Auditor for AD License is applied, the agent will inject hooks into the LSASS process to audit changes made to AD objects.
-
Resolution
Change Auditor does not have a module for auditing Certificate Authority audit data. You can audit the following on member servers, depending on the licenses you have:1. Changes to the Registry - Need to configure a Registry Audit template (Any license allows to audit Registry)2. Changes to Services - Need to configure a Services Audit template (Any license allows to audit Services)3. Changes to local Users and Groups (Any license allows to audit Local users and groups)4. File System changes - Need to configure a File System Audit template (Requires the CA for Windows File System license)