Chat now with support
Chat with Support

Change Auditor - For Advanced Users 7.0.1 - Technical Insight Guide

Change Auditor Services Change Auditor licensing processes Change Auditor network communications Coordinator internal tasks Coordinator Registry Settings Change Auditor built-in fault tolerance Change Auditor protection Database Considerations Account exclusions best practices

Client to coordinator connection

Client to coordinator connection
1
When the client is started, it searches Active Directory for the Service Connection Point (SCP) objects to retrieve connection information for the coordinator such as host name, listening port, and other authentication information.
2
The client connects to the coordinator using Windows Communication Foundation (WCF) using Kerberos authenticated connections.Ports are dynamically assigned, but can be statically set.
3
The coordinator encrypts protected data using Microsoft RSACryptoServiceProvider (PROV_RSA_FULL) APIs.
4
The client decrypts the protected data using Microsoft RSACryptoServiceProvider (PROV_RSA_FULL) APIs.

Legacy (5.x) agent to coordinator connection

1
When an agent is started, it searches Active Directory for the SCP objects to retrieve connection information for the coordinator such as host name, listening port, and other authentication information.
2
The legacy (5.x) agent connects to the coordinator using TCP/IP using Kerberos authenticated connections. Ports are dynamically assigned, but can be statically set.
3
For encrypted communications between legacy agents and the coordinator service, Change Auditor uses SSPI from http://technet.microsoft.com/en-us/library/bb742535.aspx.
•
SSPI selects a security provider based on a user-specified list of providers. Change Auditor negotiates authentication encryption, but favors Kerberos, if present, from http://msdn.microsoft.com/en-us/library/aa375385(VS.85).aspx.
•
Change Auditor uses SSPI with a key length equal to the length of the session key. This encryption is symmetric. This encryption is automatically enabled. This encryption cannot be used outside of Change Auditor.
•
Change Auditor also supports NTLM from http://msdn.microsoft.com/en-us/library/aa375388(VS.85).aspx.
•
Change Auditor uses NTLM with a key length equal to the length of the session key. This encryption is symmetric. This encryption is automatically enabled. This encryption cannot be used outside of Change Auditor.

Agent to coordinator connection

Change Auditor 6.x agents also search Active Directory for the SCP for connection information to the coordinator; however, they now connect to the coordinator using WCF as described here.

1
The Change Auditor 6.x agent connects to a coordinator using WCF using Kerberos authenticated connections. Ports are dynamically assigned, but can be statically set.
2
The coordinator encrypts protected data using Microsoft RSACryptoServiceProvider (PROV_RSA_FULL) APIs.
3
The agent decrypts the protected data using Microsoft RSACryptoServiceProvider (PROV_RSA_FULL) APIs.

Coordinator to SQL Server connection

1
Coordinators read the encrypted database connection string from the ChangeAuditor.Service.exe.config file which includes the SQL Server name \ Instance, User name, Password, and Domain if Windows authentication is selected.
This can be configured using the Security page on the Coordinator Configuration Tool, which is accessed by right-clicking the coordinator system tray icon and selecting Coordinator Configuration.
2
By default, connections to the SQL server are not encrypted; however to encrypt all data transmitted between an application computer and a computer running a SQL server instance, you can use the Secure Sockets Layer (SSL).
For more details on configuring client network protocols, see the following Microsoft article: http://msdn2.microsoft.com/en-us/library/ms190425.aspx.
 

 

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating