What's new for Change Auditor

Please refer to the Support Portal knowledge base article 4381587 for additional information and instructions on implementing.

Report Properties can not setting "Send to a mailbox" , the option is grey out

After installing the Microsoft February 2026 Patch (KB5075904), the events that have an initiator integration with Active Roles Server (ARS...

How to find how many seats installed ChangeAuditor licenses are good for.

Can Change Auditor track/monitor print queues on a print server?

The File server has Change Auditor agent installed on it. Trying to access user share via VSS causes File server to crash with BSOD

What integration is available for Change Auditor with InTrust.

A coordinator server is being decommissioned or removed. Would like to remove all Quest software beforehand to ensure agents connect to new or...

Can the Coordinator log be used to determine if the Coordinator no longer has a connection to the database?

Service will not start with active Firewall between SQL Server and Coordinator, even though TCP Port 1433 is open.

Can an alert be created to allow Change Auditor to alert when the passwd_notreqd flag is set on a user account?

Does Change Auditor support Azure SQL DB?

Restore Value option on events will not work when Users are added or removed from an Active Directory Group using Powershell script such as...

Need to audit events from specific group which are not like containing certain characters

Need to monitor Scheduled Tasks for changes

It is supported to host the Change Auditor database on Microsoft SQL server installed on an Linux server?

When a new subnet is created in AD, no event is generated to show which site it's been added to in CA

How to exclude computer account initiated changes from auditing via Excluded Accounts wizard.

In some cases, Change Auditor is showing a an incorrect source computer for a Locked Out Event

Auditing of  DNS PTR Record added or deleted events does not provide the Who and Origin

When searching for logon activity only 'User failed to authenticate through Kerberos' events are visible. There are not any successful 'User...

Time in seconds does not show in the 'Time Detected' column of the ChangeAuditor Client in any search results.

Permissions need for services auditing template

When selecting the search section, the error message mentioned in the below screenshot is displayed. This error is displayed when loading searches...

The ChangeAuditor Coordinator is receiving new EMC events from a Change Auditor agent configured for EMC Isilon, but the events appear to be...

The design of Change Auditor does not allow traditional hotfixes or patches to be applied. This build is cumulative, meaning if version 7.6.1...

What are the steps to either enable or disable some of the Audit events?

How can we enable an alert on Change Auditor so that when someone grants "Mailbox Delegation -> Full Access" we are notified who did it and to...

Is there a way in ChangeAuditor to have Alerts (Searches) send only one event per email rather than having events batch together?  

There is limited space on drive C:, or other reasons that the agent needs to be installed to a different path.

ChangeAuditor for Active Directory Object Protection does not appear to be working/protecting objects as expected.

How to configure syslog subscription in Change Auditor

How can a report be created and produced in Change Auditor?

The Change Auditor Agent  v7.5, 7.6, 7.6.1 will not start after successful installation

An administrator is upgrading some Exchange server and plans to temporary disable the Exchange Scripting Agent, he needs to know how this will...

How to alert on SQL SA account password reset.

Administrators may want to filter Events recorded by Change Auditor to view only events that have a specific result.

Can the Change Auditor agent run alongside the Google 'GAPS' agent with no issues? 

At times, there may be issues with the current Change Auditor database (corruption, size, permissions, etc), and the current database may need...

Purge data maintenance job does not run when scheduled if the Purge monthly option is selected. The schedule shows the next or first run time to be...

An agent database that contains events that need to be processed.

The following error is returned when attempting to connect to the Change Auditor client: Cannot connect to the ChangeAuditor Client.  "Database...

What types of authentication can ChangeAuditor use for SQL?

Some customers might require to use SQL ALIAS as part of their setup for different reasons as shown in the present article

Is there a search that would show AzureAD MFA registration events?

When attempting to create a new Active Directory Protection Template or edit an existing Active Directory Protection Template, an " Access Denied...

When an active directory group's membership is modified, the change auditor alert's initiator filed is blank if the source if Change Auditor.

Can Change Auditor monitor able to monitor VPN logon activity?

If you create an AD Protection template for a group and then try to modify the memberOf attribute, the modification is successful and the...

In a Multi-Forest Configuration, an administrator observed, alerts being sent from Coordination(s) in a different Forest where SMTP access is not...

After successfully reaching https://quest-on-demand.com/ and entering the correct credentials, the "All regions are down at the moment" webpage...

What is the correct CSV format for doing a bulk import of users in to a Protection. Also what fields are available to use.

Change Auditor Client console access denied despite the user AD group membership.

Can Change Auditor collect events related to the internal configuration of Active Roles like templates or such?

"Change Auditor has encountered an error processing this request." When attempting to setup a template for the first time.

How can I find which Coordinators my Agents will connect to even in the case of Windows  Core Server Agents ?

In the video below we go over the steps to setup auditing for Windows File Servers

An administrator changed the Active Directory password for the account used by the Coordinator to access the database and needed to know how...

When a Public Search is Modified, a "The Public User search <search_name> was modified on <server_name>”  event is created but there are no details...

When displaying the results in a shared overview the Time Detected sort shows the results oldest to newest rather than oldest to newest.

Consider the scenario where a protection template locks down an Organizational Unit. Does protecting an OU prevent the creation of subordinate...

Does Change Auditor support auditing EMC VNXe?

Running the search that an alert is associated with does return results, however email alerts, that did work previously, are no longer being sent.

What browsers are supported by the ChangeAuditor WebClient?

When running Azure and/or Office 365 auditing on a domain controller in a hybrid environment, you may receive Azure AD and O365 events, but not on...

A report runs an hour earlier or an hour later than scheduled, and this occurs following Daylight Savings Time starting or ending .

During deployment from ChangeAuditor console for unknown reason the installation may fail on the remote server. The Coordinator may not receive...

When using Scheduled Reports and having them sent as a csv file, for example, the data headers do not match what is displayed in the client.

When running a search for "User Account Locked" events, it is noticed that a few of them have a blank origin.

An administrator need to exclude a specific file when configuring a search on a target sub-folder.

The Change Auditor Client and ChangeAuditor Agents automatically detect where the Coordinator is installed. How is this done?

Administrators may want to install the ChangeAuditor agent on a computer which will be cloned within Active Directory. Will the ChangeAuditor agent...

This document provides the steps on how to create a File System events search for file that contains a specific string in their name. The example...

Can an OU be added to the Search Properties to return the Logon Activity against all of the Computers in that OU?

When creating Alerts in Change Auditor , what variables are available for the TO field?

After running some of the Built-in searches, or custom created searches, 0 results are returned

A user wishes to search and report on changes to an Active Directory user attribute called msExchHideFromAddressLists. 

What is needed to use a gMSA with the Foreign Forest Agent?

When creating a template, the client crashes after attempting to add the template (clicking Finish). The un-handled exception ' Object already...

Office 365 audit events are not searchable in Change Auditor for hours after the changes take place.

need to add un-monitored attributes to a schema class, but when selecting the schema class (any) ChangeAuditor client throws the error Access...

There are multiple issues that may occur should there be stale Coordinator SCPs in the environment. For example, Agents may continue to attempt...

Need to find out how to restore the default searches.

After upgrade to 7.0.2 : Coordinator service is running and events are coming in. Client fails to connect to Coordinator with error...

If we have the Change Auditor for Active Directory Queries license, can we audit AD changes as well?  If we have the Change Auditor for Active...

Steps to manually install an agent in a foreign forest

Azure Office 365, Share Point and OneDrive seems to collect logs of the last 7 days, is it possible to collect earlier logs?

Steps to deploy Change Auditor Agent from the Change Auditor Client

Can the Latency time and Polling intervals for Azure AD Auditing be changed?

Have a need to monitor and alert on a local group (administrators) on member servers.

Does Change Auditor File System Auditing support SAN environments?

CA is auditing on created and removed root level DNS zones, but would like to audit creation of DNS subzones. Even though all DNS service and DNS...

When using two Remote Agents and two Coordinators for HA purpose, on EMC and NetApp, duplicate events are found in the logs.

Administrators may create a report to monitor objects whose specific attributes were changed. Is there a way to exclude certain users from being...

How to import the Change Auditor PowerShell module?

Do I need to have ChangeAuditor Agents on every Domain Controller in a particular domain to monitor for Active Directory changes?

Manually decommissioned a Domain Controller and still shows in the Deployment tab or Agent Statistics page in the Change Auditor client console.

how does CA identify 'Critical groups' over group CN name or sam account name?

How to set up Azure AD auditing in Change Auditor.

Change Auditor may show high severity event " The DACL was changed for the group <object DN> " as Active Roles the source.

We have integrated our Change Auditor (CA) instance into the Splunk SIEM System applying the "Event Subscription" approach. Now it seems that the...

The Change Auditor Agent is capable of storing unsent events locally, so that in the event that the Change Auditor Coordinator server is offline...

Does Change Auditor for Active Directory capture the same event details that shows in Windows Event Viewer Security logs or will it provide more?

Is it possible to change/rename the Change Auditor group names?

Searches ran from the Web Client complete quicker than when the same search is run in the Win32 client.

Does Quest offer a module for monitoring Panzura devices in Change Auditor?

Does Change Auditor has the capability to auto install agents every time a new workstation machine is added to AD(Domain), CA server(Coordinator...

Does Change Auditor have the ability protect DACLs on groups?

The Change Auditor Coordinator Service will not start after upgrade. The following error is recorded in the Change Auditor Coordinator log: 2015...

DBA would like to enable SQL data compression on several tables in ChangeAuditor archive databases.  Example syntax: ALTER TABLE Event REBUILD...

How to alter the Change Auditor Agent retry interval

Administrators may want to create a Search that contains Active Directory (AD) objects (such as OU or User) from two Active Directory Forests...

Agent cannot connect from DMZ. Error, "Error binding to rootDSE: 8007203a"

After installing and configuring Change Auditor, events are being generated successfully.  After a period of time, some events no longer are being...

Is ASLR supported in the NPSrvHost.exe process either for version 7.3 or 7.6.1?

The following error is displayed when SharePoint auditing template creation fails at scanning topology: "Failed to scan SharePoint topology...

Looking to be able to create a search for files that have changed with an Azure Information Protection Label. Is there a way to do this in Quest...

ChangeAuditor is installed in a child domain and is unable to enumerate attributes from other domains.

How to publish a ChangeAuditor search to SQL Reporting Services.

After configuring Change Auditor protection on a user object, the user is unable to update their password manually or when prompted by Windows.

The request came from our Audit team and the auditors are looking for attest from the quest that the customer can not access or manipulate the...

How does one change the default Agent installation location from the ChangeAuditor Client?

When connecting to the Web Client after entering credentials receiving Sorry. error processing the request is received and you are returned to the...

DNS A and DNS PTR records not being tracked

Are there any concerns or recommendations when using AD Protection templates to protect user objects?

Is it possible to protect one attribute from being edited on all users? All users have this attribute, and it should be impossible for anyone to...

Can Change Auditor show what has changed when the contents of a file changes?

Which URLs must Change Auditor have access  to for cloud auditing?

It would be nice to be able to display which searches are currently being run by users as well as which users are running them for assessment and...

How to search for events for accounts that all match a certain naming convention

When running search the Client is reporting the following error "Stream was too long" and never completes/hangs  and has to be ended to get it back.

Is there a way to disable or control the frequency of the Topology Task executed by the Coordinator?

This document provides the recommended sequence for upgrading Change Auditor components.

An administrator needs to configure a Group Membership Changed report so the results only returns when members are successfully added or removed...

Need to exclude a single Active Directory account form logging a single or several events.

An administrator notices that there were no Folder Deleted events showing in any of his file system reports although he included that Event Class...

After running any the Built-In AD Query searches, then dragging any column header to group the results, attempting to click on the arrow next to...

Customer adds a user to the BTGM group from the exchange console and removes the same user from the AD console. In ChangeAuditor logs, the adder...

When trying to install the agent from the Deployment page in the Client, the following error "The service did not respond to the start or control...

An agent is accumulating high numbers of events and not sending to SQL. The number of "DB events waiting" may decrease but never catches up.

In the search tabs, there are two options when specifying criteria.  Either "Add" or "Add with events".  Selecting these may produce different...

Need to specify which Coordinator runs the archive job.

An administrator is trying to create two different protection templates in Active Directory and apply them to the same OU. He needs to protect the...

Need to track changes made to the Master Server list in DNS Stub Zones

How to install a new license file

When running the Powershell cmdlets, does the user need to be a member of the Change Auditor Administrators group?

Change Auditor Administrator should have an option to run a custom script as a pre- or post-deployment activity for Change Auditor Agent...

The"Get-CAADProtectionTemplates" PowerShell cmdlet to get AD Protection template details does not include all the data it has such as Override...

When we try to configure a local share folder under coordinator configuration or alert configuration we get an error that the credentials are...

An administrator needs an example of how to configure shares under a Qtree for a NetApp in Cluster Mode.

In a multi forest or just a multi Change Auditor Coordinator installation, by default any coordinator can send out SMTP alerts or reports.

Does Change Auditor support auditing authentication and logon events for  Group Managed Service Accounts (GMSA)?

we can't add new column in Web Client layout when a search is done. In the "normal" client it works.

Exchange "Owner" Events are not recorded in ChangeAuditor even though "Owner, Non-Owner" have been specified in the Exchange Auditing Template...

How many days does ChangeAuditor for SharePoint import on install?

How to delete / reset change auditor agent cache / database

If only Rename File System protection is enabled, user will be able to read the Microsoft Office files (docx and xlsx) but and attempts to edit...

The coordinator service cannot start. The error in Coordinator logs is "Duplicate Ports Detected". 

There is a permissions error when reading the events for SQL Extended events when using a local agent and Windows authentication (Windows user...

How to enable Alerting for a search.

Is there any way to add or use a GMSA on the override list on a protection template?

In some circumstances, a Group Policy Object (GPO) may fail to replicate to all Domain Controllers if Change Auditor Group Policy Protection is...

Does Change Auditor support using a gMSA for the Coordinator Database Connection, Agent Deployment or for the Shared Folder account?

During start-up of the Change Auditor agent on Exchange server, Outlook connections are reset.

I am looking to automate and schedule the export of Searches and Configuration for disaster recovery purposes. Is this possible or does it have to...

Not receiving Azure events Error in the LOG: 2023-05-22 14:01:43.977 [58][WARN][MicrosoftCloud.Service.AzureADHelper.GetAzureAdSignOnEvents(0...

There is a need to know what permissions administrators and operators have in the ChangeAuditor Client?

As a CA Admin, I would like to include additional port information, cipher information used, if StartTLS was used, expand the TLS versions, and...

When using Sophos Intercept X or Exploit prevention, with the option to protect again Credential Theft enabled, the Change Auditor agent service...

After enabling a comprehensive forest-wide OU-change alert, purge jobs cannot finish in time and alerts are not triggered. 

What does SCMHook monitor and what are the impacts in disabling it?

Certain object types (for example Contact objects) should be created only in specific containers. How to create an Alert to be notified when the...

When running the ChangeAuditor Agent Deployment Wizard, user receives ERROR: "Failed to retrieve directory topology".

Most SMTP alert emails send normally and are received, but I have missed a few and I would like to know why.

Which GPO and Computer Events are supported under Change Auditor for Active Directory License?

In some situations, The web client upgrade for Change Auditor may fail, resulting with error messages that exit the installer.

Administrators may want to compare the number of licenses added versus the number of licenses used by ChangeAuditor.

How to set trace memory and processor issues, setting performance counters with perfmon (performance monitor)

An administrator noticed that "User account locked" events are no longer be recorded. 

Consider the following scenario… Change Auditor coordinators are installed in a multi-domain forest. There are coordinators installed in the...

Are 3rd party deployment tools, such as SCCM, supported for deploying the Change Auditor agents?

An Administrator needs to force the Agent to connect to only one designated Coordinator in their Active Directory Forest .

How to configure the Change Auditor Coordinator  or Change Auditor Agent to use a specific Global Catalog server

How to check  how far back in time the events on change auditor are stored on the CA database.

High CPU spike on SQL server 

Change Auditor Agent stops working and may cause the domain controller to crash (in some cases) after installing the  Microsoft Windows February...

Need to run a summary report or table of all custom searches that will provide filter criteria in WHAT,WHO and other TABS.

Can Change Auditor support Azure SQL and Azure IIS cloud services, PaaS (Azure SQL) or SaaS (IIS - For Web Client)?

This document will provide the steps for creating a Change Auditor File System Template.

Is it supported to have the CA database hosted on a non-Microsoft SQL server (for example Postgres) or to audit non-Microsoft SQL?

How does Change Auditor determine how many users are enabled or exchange mailbox users there are for licensing?

When using the AD object picker from a search, what does the Ambiguous Name Resolution (ANR) checkbox do? In some situations, not all available AD...

Does Change Auditor have the ability to send event information to Splunk?

SCCM silent Change Auditor Agent installer syntax/command 

How to Create an alert to notify when a Change Auditor agent is disconnected

Unable to enable or disable the report option in a search because it is grayed out even though the user is logged in as a Change Auditor...

When using the Coordinator Email Alerts Configuration wizard to create the Microsoft 365 Mail app registration, the wizard may freeze and not...

The following is displayed when attempting to connect to an archive database with the Change Auditor client: "Incorrect product version. Would...

How does Change Auditor create the Archive Database

The documents state the following permissions are required for Change Auditor, but what are the absolute minimum rights needed to run Change...

If you change the password of a user to the same password that is currently used, CA does not report any type of event.

Can a Change Auditor for Active Directory search / alert be created for users which match a certain naming convention?

When Microsoft Office creates, deletes, or renames a Word document or Excel spreadsheet file,  events are being audited, however when the same file...