지금 지원 담당자와 채팅
지원 담당자와 채팅

Change Auditor 7.0.4 - Installation Guide

Installation Overview Install Change Auditor Add Users to Change Auditor Security Groups Connecting to the Clients Deploy Change Auditor Agents Upgrade Change Auditor Installation Notes and Best Practices Multi-Forest Deployments Foreign Forest Agent Deployment Workstation Agent Deployment Agent Comparison Install an agent to audit ADAM (AD LDS) on workgroup servers Active Roles Integration Quest GPOADmin Integration Windows Installer Command Line Options

Troubleshooting Tips

Not receiving events from Active Roles

To diagnose problems with receiving events from Active Roles, check the ‘Active Roles Admin Service’ event log on the Active Roles server.

Initiator information missing in events

Some events do not provide the initiator account information. This could be caused by the following:

•
Manually created objects
Computer objects that are manually created do not capture the initiator account information of the user that initiated the change.
•
Protected and unprotected objects
If an object is protected and unprotected through the Active Roles console, the initiator account will be missing from Change Auditor.
The Protect/Unprotect operation in Active Roles is not a direct Active Directory attribute operation. When you protect/unprotect an object, you actually add an Access Template link to the security descriptor in Active Directory. Because of this, the initiator account information is not captured for events related to protect/unprotect events.
•
In some scenarios, the following events do not capture the initiator account information when made through the Active Roles console:
•
User password changed
•
User password changed by non-owner
•
User must change password at next logon option changed

Quest GPOADmin Integration

GPOADmin uses a proxy account (service account) to connect and change Active Directory objects and group policies. In past releases, Change Auditor only captured the service account name in the event details for changes initiated through GPOADmin. GPOADmin now integrates with Change Auditor and allows the name of the user who initiated the GPOADmin operation and comments to display in the Change Auditor client.

* 
NOTE: GPOADmin only sends initiator and comment information to Change Auditor for the following operations:
•
GPO deployment
•
Working copy check-in
•
Working copy check-out

This appendix covers the following topics for GPOADmin integrations:

•
Requirements
•
GPOADmin and Change Auditor integration process
•
Client components added to Change Auditor
•
Troubleshooting tips

Requirements

GPOADmin
•
GPOADmin 5.9 to 5.13.
•
The GPOADmin service account must be authorized to access the Change Auditor SDK. That is, add the GPOADmin service account to the ChangeAuditor Administrators security group.
* 
NOTE: If you must use a role with the minimum permissions, use the Application User Interface page on the Administration Tasks tab to define a new role that contains the ‘Add Sdk’ and ‘View Sdk’ operations. Also, the GPOADmin service account must be added to the ChangeAuditor Administrators group for integration to function properly.
NOTE: For more information on using the Application User Interface page to define a new role, see the Change Auditor User Guide.
•
Change Auditor auditing must be enabled GPOADmin server properties for events to generate.
Change Auditor for Active Directory
•
Change Auditor for Active Directory 5.7 (or higher)

GPOADmin and Change Auditor integration process

Some GPOADmin events recorded by Change Auditor have the initiator name in the event. The initiator is the name of the account logged in to the GPOADmin client performing actions in GPOADmin. However, the initiator name is not always populated due to how the GPO is processed in Active Directory.

The following is a high-level overview of typical Change Auditor events recorded when modifying a GPO using GPOADmin:

1
A user logged in to GPOADmin to modify a GPO setting.
Change Auditor records the following events:
An event for the creation of a new GPO (the working copy GPO). The “who” in the event shows the GPOADmin service account and the initiator and the name of the user who was logged in to GPOADmin.
A rename event for the new GPO.
A permission change for the new GPO, granting the user logged in to GPOADmin rights to the working copy GPO.
Modification events performed on the working copy GPO. The who of these events show the user logged in to GPOADmin and the initiator blank as the initiator and the who are the same.
2
Once the GPO is checked in, there are number of events recorded with the “who” being the GPOADmin service account and the initiator blank. This is because importing the settings from the working copy to the live copy is performed in Sysvol, outside of GPOADmin. It is the same processes that are performed if the GPO was edited in GPMC. GPOADmin has no knowledge of what is being performed with these Active Directory operations and cannot communicate to Change Auditor who the initiator is as they happened outside of all the GPOADmin processes.
3
Approval is requested in GPOADmin. The approver approves and deploys the GPO.
This generates Change Auditor events where the “who” is the GPOADmin service account and the initiator is the name of the approver.
Events where the initiator is the name of the approver and the action logged was that the version of the GPO attribute was changed, are the events that show when the GPO was deployed and who performed the deployment.
4
GPOADmin provides the initiator name to Change Auditor using Change Auditor APIs.
You will see a considerable amount Change Auditor GPO events generated when performing actions in GPOADmin. This is due to how GPOADmin processes GPOs and how they are deployed to the live environment.
관련 문서

The document was helpful.

평가 결과 선택

I easily found the information I needed.

평가 결과 선택