How do I install ChangeAuditor to a Multi-Forest infrastructure? (4255602)

Return

Feedback Submitted

Did this article solve an issue for you?

Select Rating

Title

How do I install ChangeAuditor to a Multi-Forest infrastructure?
Description

EventNeed to configure Change Auditor to audit domain events across multiple domains/forests.
Cause

N/A

Resolution

Change Auditor Coordinators installed across non-trusted Forests are designed to write events to the same database (using SQL Authentication). This allows Reporting, Searching, and Alerting on events that occur in each Forest in the environment, from a single management console.

Please review "Multi-Forest Deployments" in the ChangeAuditor Install Guide.pdf which is part of the Documents folder included with your ChangeAuditor download or online here:

https://support.quest.com/technical-documents/change-auditor/installation-guide/12

Requirements

The following must be in place for multi-forest deployments:

•	Network connectivity between each monitored forest.

Coordinators in all forests connect directly to the SQL server that is hosting the Change Auditor audit database.

Coordinators must resolve the host name of the SQL server or must be configured to use the IP address of the SQL server.

•	At least one coordinator deployed in each forest.

The coordinator collects and maintains the topology information for each forest. This includes domains, sites, domain controllers, and member servers. The coordinator is also responsible for:

•	Sending alerts by email, SMNP, or WMI

•	Sending agent configuration settings, auditing and protection templates

•	License enforcement

•	Agent status updates

•	Agent installation and upgrade

•	Auto deployment

•	Event statistics

•	Group membership expansion

•	Change Auditor groups created in each forest.

To connect to coordinators in other forests, users must be added to either the ‘ChangeAuditor Administrators — <InstallationName>’ OR ‘ChangeAuditor Operators — <InstallationName>’ in the forest where the coordinator is joined.

•	Credentials for the Microsoft SQL server backend.

Depending on whether the Active Directory forests have a trust in place, you need to configure Change Auditor to use the appropriate SQL credentials.

Scenario A — One or more of the forests do not have a valid trust in place.

The coordinator that is not part of the same forest where the SQL server is joined to, must be configured to use a SQL user account or a Domain Account from the forest where the SQL server resides.

Scenario B — All forests have a valid trust in place.

Each of the coordinators may be configured to use either authentication type. Both Windows or SQL user accounts may be used in each of the forests.

Example deployment scenario

The following diagram shows two separate forests where Change Auditor will be deployed. Forest A is deployed first and the Forest B is added.

Forest A installation

ForestAB

1	Install the coordinator on a member server in Forest A. In this example, Coordinator1.ForestA.com is used as the coordinator server.

•	While installing the first coordinator, make note of the “Installation name”. The same installation name is used to deploy the coordinator in Forest B (ForestB.net).

•	Also take note of the SQL Server host and credential information. This server and account will also be used in the second forest. The required information is as follows:

•	SQL Server host name or IP address AND Instance name if applicable

•	Database or Catalog name

•	User name, password, and domain if applicable

2	Install the client on either a workstation or member server. In this example, CAClient1.ForestA.com is used as the client computer.

3	Using the client, connect to the coordinator in Forest A to deploy Change Auditor agents on to the domain controllers and/or member servers in Forest A. See Deploy Change Auditor Agents for more details about deploying agents.

4	At this point, Change Auditor should be fully deployed to the first forest in the organization (ForestA.com in this example).

Forest B installation

5	Install the coordinator on a member server in Forest B. In this example, Coordinator2.ForestB.net is used as the coordinator server.

•	While installing the second coordinator, you must use the ‘Installation name’ that was selected in the first forest.

•	During the installation of the second coordinator, use the same SQL server and database name used in the first coordinator’s installation. The Windows or SQL user account may be different than the account used in the first installation.

•	Quest recommends that the same database access account used in the first forest is also used in the second forest. If a different user account for database access is used in the second coordinator's installation, the following permissions must be granted before the installation is started:

•	db_owner database role on the Change Auditor database

•	dbcreator server role

6	Install the client on either a workstation or member server. In this example, CAClient2.ForestB.net is used as the client computer.

7	Using any client, connect to the coordinator in Forest B to deploy agents on to the domain controllers and/or member servers in Forest B.

8	Change Auditor is now fully configured to collect audit data from both forests into a single database. Reports and alerts can be run from any client to return data related to one or all the deployed forests.

9	You can deploy more forests by following steps 5 through 8.

Configuration

•	Audit and protection configuration flow

•	Event flow

•	Reports and queries from the client

Audit and protection configuration flow

Audit and protection configurations are maintained using the client that is installed on either workstations or member servers. Configuration changes are stored in the SQL database by the coordinator service.

The following configurations can be shared across forests regardless of the forest trust level:

•	Active Directory Auditing — Object Class\Attributes

•	ADAM\AD (LDS) Auditing — Object Class\Attributes

•	Excluded Accounts templates

•	File System Auditing templates

•	Registry Auditing templates

•	Service Auditing templates

•	SQL Auditing templates

•	Audit Event configurations (for example, enabled or disabled, severity level)

The following configurations can be shared when a two-way trust exists:

•	Active Directory Protection templates

•	ADAM\AD (LDS) Protection templates

•	Exchange Protection templates

•	File System Protection templates

•	Group Policy Protection templates


	NOTE: A trust is required to view the Active Directory accounts in the other forest for protection account exclusions.

ConfiqFlow

Event flow

ConfiqFlow

Recorded audit events are first queued in a local database on each agent computer. Events are then batched and forwarded to a coordinator. The coordinator checks for new events every 10 seconds and does a bulk insert of the event details to the SQL database.

Reports and queries from the client

Change Auditor clients do not connect directly to the SQL database. Instead, the coordinator to which the client is connected processes search results and change requests. Clients can connect to any coordinator if the logged on user is a member of either the ChangeAuditor Administrators — <InstallationName> or the ChangeAuditor Operators — <InstallationName> group in the respective forest.

By default, user-configured alerts (SMTP, SNMP, and WMI) are generated and sent from the first installed coordinator in the Change Auditor installation.

ReportQueries

For licensing considerations, refer to the following KB article:

https://support.quest.com/kb/4254797

Feedback Submitted

Did this article solve an issue for you?

Select Rating

Request a KB Article

How do I install ChangeAuditor to a Multi-Forest infrastructure? (4255602)

Title

Description

Cause

Resolution

Requirements

Example deployment scenario

Configuration

Leave a Comment