Change Auditor - For Advanced Users 7.1.1

지금 지원 담당자와 채팅

Secure password storage Client to coordinator connection Agent to coordinator connection (version 6.x and 7.0.1) Agent to coordinator connection (version 7.0.2) Coordinator to SQL Server connection

Coordinator internal tasks

Forest topology collection Group expansion Alert processing License check Remote deployment Agent heartbeat check Refresh coordinator statistics Event aggregator SQL upgrade monitor Open handle Scheduled purge job Scheduled archive job Scheduled report job

Registry Settings

Force agent WCF port Force client port Force SDK port Use predefined GC for name resolution Allow collation switch Report zip limit SQL command timeout Enable ChangeAuditor Agent service to start with the Microsoft security update (KB2264107) Adjust memory dumps settings

Change Auditor built-in fault tolerance Change Auditor protection

Using multiple protection templates

How access rules are evaluated How scheduling and location works with denied access

Database Considerations

How to move the Change Auditor database and coordinator to another server How to estimate the required SQL server disk space How SQL Server Autogrow affects Change Auditor How to query an archive database

Account exclusions best practices

User counts

The coordinator determines maximum licensed users by comparing the value associated with the component license to the total count of users in each domain. The coordinator does this by issuing LDAP queries to Active Directory using specific filters for a precise count.

Generic User Count Query (for Active Directory, File System, SQL Server, EMC, NetApp, SharePoint, Skype for Business, Logon Activity User licensing):

(&(objectCategory=Person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=512)(!userAccountControl:1.2.840.113556.1.4.803:=2))

Mail Enabled User Count Query (for Exchange licensing including Office 365 Exchange Online):

(&(samAccountType=805306368)(|(&(!userAccountControl:1.2.840.113556.1.4.803:=2)(msExchHomeServerName=*))(&(userAccountControl:1.2.840.113556.1.4.803:=2)(msExchMasterAccountSid=*))))

Workstation Installation Count (for Logon Activity licensing):

Workstation counts are based on the actual number of workstations harvested in the topology.

Component Start-up Considerations

This section describes installation notes and best practices:

•

Start up delays

When set to ‘false’ the GeneratePublisherEvidence setting is used to bypass digital signature verification for programs on start-up which allows for faster start up time. This is set to false by default for the following components in Change Auditor: Coordinator, Windows Client, Agent plug-in for VMWare auditing, Coordinator Configuration and Coordinator Status in the system tray.

If required, you can change this setting to 'true' to allow digital signatures to be verified, by modifying the following files:


Component	File
Coordinator	Program Files\Quest\ChangeAuditor\Service\ChangeAuditor.Service.exe.config
Windows Client	Program Files\Quest\ChangeAuditor\Client\ChangeAuditor.exe.config
Agent Plug-in for VMWare auditing	Program Files\Quest\ChangeAuditor\Agent\Plug-in for VMWare\VMWarePluginCA.exe.config
Coordinator Configuration	Program Files\Quest\ChangeAuditor\Service\ConfigureDatabase.exe.config
Coordinator Status	Program Files\Quest\ChangeAuditor\Service\CoordinatorTray.exe.config