Chat now with support
Chat with Support

Change Auditor for Defender 7.0.2 - User Guide

Deployment requirements and notes

Because Defender extends the Active Directory schema, once the Change Auditor for Defender license is applied, agents installed on Domain Controllers detect any changes made to the Defender-specific attributes in Active Directory and generate events.

Make changes and run a report

Launch the Change Auditor client (Start | All Programs | Quest | Change Auditor | Change Auditor Client) to review the events generated.
Expand the Shared | Built-in | Defender folder in the left pane.
Locate and double-click All Defender events in the last 30 days in the right pane.


If you have applied the Defender license but you are not receiving any events, ensure that the required Domain Controllers have agents deployed to them. Defender events are recorded in the Active Directory subsystem.


Defender Searches/Reports

Related Documents