TCP port 445 outbound activity from Change Auditor Coordinator (4375064)

Return

Feedback Submitted

Did this article solve an issue for you?

Select Rating

Title

TCP port 445 outbound activity from Change Auditor Coordinator
Description

Explanation regarding TCP port 445 activity
Cause

If the topology scan is prevented from running, the coordinator will use the "TCP 445" polling method to collect up-to-date topology information about hosts that are involved in change events. This topology data is important to have correct for the audit event record.
Resolution
"Is Administrator" is a new feature that was added to Change Auditor 7.x, which checks to verify if the user account in the "Who" is the "Administrator" account or if it is directly or indirectly a member of "builtin\administrators", "domain admins", or "enterprise admins". The verification of group membership can cause increased network traffic or increased processing on the Domain Controller in some environments. "Is Administrator" data is primarily used for the Change Auditor Threat Detection module

Administrators can prevent the Change Auditor agent from collecting "Is Administrator" data by setting the feature flag "DisableIsAdministratorLookups"
To disable the collection "Is Administrator" data, take the following steps:
1. Update the required agent configuration(s) via the Set-CAAgentConfigurationSetting script
2. Use the following setting name and setting value when prompted:
  - SettingName: DisableIsAdministratorLookups
  - SettingValue: 0 - Do not disable (default)
  - SettingValue: 1 – Disable the collection of "Is Administrator" data
Additional Information

To disable or modify the frequency of the Coordinator Topology Task, you have to perform the steps mentioned in the link below: https://support.quest.com/kb/4233514

Feedback Submitted

Did this article solve an issue for you?

Select Rating

Request a KB Article

TCP port 445 outbound activity from Change Auditor Coordinator (4375064)

Title

Description

Cause

Resolution

Additional Information

Leave a Comment