Active Administrator 8.7 - User Guide

Moving an audit agent

Moving an audit agent

You can move the audit agent from one computer to another.

To move an audit agent

1	Select Auditing & Alerting | Agents.

2	Select a domain controller, and select More | Move.

IMPORTANT: Auditing must be enabled in all domains that will be monitored. Make sure auditing is enabled on the Default Domain Controller policy. See the Quest® Active Administrator®Install Guide.

3	Select the account to use to move the agent. You can use the Active Administrator Foundation Service (AFS) account, or indicate a specific user account.

 

NOTE: The selected account must be a full Administrator on the target server.

4	Click Next.

5	Type the target computer name or browse to locate a computer.

6	Type the user name and password of the account with domain administrative rights on the selected target computer.

NOTE: The Active Administrator Agent service can run under a domain user account provided it is a local administrative account, which gives it the rights to log on as a service, log on locally, and manage auditing and security log, or an account with these privileges granted individually. This account should also be a member of the AA_Admin group, which by default is located in the Local groups of the server where the ActiveAdministrator database is located. If the group is not found in this location, the settings during the initial database creation were modified and the group can be found under the Users container object of Active Directory®.

7	Choose options for the install process.

 

Table 67. Install options

Option	Description
Start collecting events immediately after installation of the agent	By default, the audit agent is activated and collection begins immediately upon completion of the installation process. Clear the check box if you want to activate the audit agents manually.
Enable agent monitoring and recovery	By default, Active Administrator monitors the status of the audit agent.

8

Click OK.

NOTE: You can view details about the move agent process in the MoveAgentInstall*.log file, which is located in C:\ProgramData\Quest\Active Administrator\Logs.

Automating audit agent deployment

Automating audit agent deployment

Once you have installed an agent into a domain, Active Administrator® can monitor the domain for new domain controllers. When a new domain controller is discovered, the agent can be automatically installed on that domain controller. You also have the option to just notify users of a new domain controller so they can install the agent manually.

•	Deploy audit agent automatically

•	Notify users only

Deploy audit agent automatically

To deploy the audit agent automatically

1	Select Auditing & Alerting | Agents.

2	Click Auto Deployment.

3	On the General tab, select Enable automated agent deployment and notification.

4	Select whether to install the audit agent on the newly discovered domain controller or to audit the newly discovered domain controller using an agent on a different computer.

 

Table 68. Install options

Option	Description
Install on target Domain Controller(s)	By default, the audit agent is installed on the newly discovered domain controllers.
Audit from an agent on the following computer	Select to install the audit agent on a computer in the domain. Type a computer name in the box, or browse to locate a computer. NOTE: If you choose to do remote monitoring, the Advanced Agent is not installed on the selected domain controllers.

5	Type an account with domain administrative rights, or browse to locate an account, and enter the password.

NOTE: The Active Administrator Agent service can also run under a domain user account provided it is a local administrative account, which gives it the rights to log on as a service, log on locally, and manage auditing and security log, or an account with these privileges granted individually. This account should also be a member of the AA_Admin group, which by default is located in the Local groups of the server where the ActiveAdministrator database is located. If the group is not found in this location, the settings during the initial database creation were modified and the group can be found under the Users container object of Active Directory®.

6	By default, Active Administrator waits 24 hours after discovering a domain controller before installing the audit agent. Change the wait time if necessary.

NOTE: During the wait time, you can cancel the pending installation. See Canceling pending automated deployments.

7	By default, Active Administrator monitors the status of the audit agent. To disable service monitoring and recovery, clear the check box.

8

Click OK.

Notify users only

To only notify users of newly discovered domain controllers

1	Select Auditing & Alerting | Agents.

2	Click Auto Deployment.

3	On the General tab, select Enable automated agent deployment and notification.

4	Select Only notify users.

5	Use the buttons to add, edit, or remove email addresses from the list.

 

NOTE: You also can manage the Agent Auto Deploy Configuration email list from the Settings menu. See Managing email addresses.

6

Click OK.

Canceling pending automated deployments

Canceling pending automated deployments

When you set up Auto Deployment, you set a wait time between discovering domain controllers and installing the agent. During that wait time you can cancel the installation.

Topics 

•	Creating an alert

•	Managing existing alerts

•	Changing the alert notification policy

•	Setting global quiet time

•	Managing alert history

To cancel pending automated deployments

1	Select Auditing & Alerting | Agents.

2	Click Auto Deployment.

3	Click Pending Installations.

4	Select a pending installation, and click Cancel automated agent installation.

5

Click OK.

Managing alerts

Managing alerts

Alerts give you the opportunity to combine different alert conditions into a set that is sent to specified individuals. You can also add a filter to the condition set to further isolate audit events for the email recipient.

 

NOTE: The email server must be configured to send notifications. See Setting email server options. TIP: You can configure the notification service to send emails in batches. See Setting notification options. NOTE: The Active Directory Health module also uses alerts to help you manage Active Directory®. See Setting alerts. TIP: Each alert has a separate email address list for notification. To manage the email list, you can edit the individual alert or you can manage the email address lists in one location. See Managing email addresses.

The Alert page shows the alerts in the top pane and the alert history for a selected alert in the bottom pane. You can size the panes by dragging the horizontal split bar up or down.

To manage alerts

1	Select Auditing & Alerting | Alerts.

2	Use the tool bar to manage alerts.

 

Table 69. Alerts tool bar

Option	Description
Refresh	Refresh all alerts.
Refresh Selected	Refresh selected alerts.
New	Add a new alert. See Creating an alert.
Edit	Edit an existing alert.
Delete	Delete a selected alert.
More	Enable or disable alerts. Suspend or resume email notifications. See Managing alerts.
Notification Policy	Set the policy for alert notification emails. See Changing the alert notification policy.
Global Quiet Times	Set global alert quiet times for all alerts. See Setting global quiet time.
Alert History	Filter the alert history, view details on an alert history item, resend an alert in an email, or run a report. See Setting global quiet time.