Chat now with support
Chat with Support

Change Auditor for Logon Activity 7.4 - User Guide

Recommendations/deployment requirements

All workstation agents
•
.NET framework 4.5.2 is the minimum requirement.
•
Quest highly recommends a phased approach to deploying workstation agents. A phased approach, where a maximum of 100 workstation agents are deployed at a time which will allow you to monitor the coordinator performance before deploying another batch of agents.
Deploying workstation agents (domain workstations)
•
Recommended installation is from the Deployment tab.
•
Alternately, workstation agents can be manually deployed. See Manual workstation agent deployment for more information on manually installing agents.
Deploying foreign workstation agents (non-domain workstations)
•
A routable network path must exist between non-domain workstations, domain controllers and the coordinator servers. Name resolution of domain controller(s) and the coordinator servers is also required from the non-domain workstations, whether DNS server configuration, NetBIOS/WINS configuration or local hosts file entries are used.
•
Required installation is to manually deploy the workstation agent. See Manual workstation agent deployment for more information.
•
During installation, the workstation agent prompts for Active Directory domain and credential information to locate a coordinator and installation name.
•
When the first foreign workstation agent is manually installed, a ChangeAuditor Agents - <InstallationName> security group is created. User accounts must be added to this security group in order to properly authenticate.
•
The Workstation Agent installer allows you to add the domain user account to the ChangeAuditor Agents – <InstallationName> security group, if appropriate LDAP and network protocol access is available.
* 
NOTE: In some cases, it might be necessary to pre-stage\create the ChangeAuditor Agents – <InstallationName> security group and manually add the configured workstation agent user account to the security group.
•
The Coordinator Credential Configuration can also be used to change between coordinator domains at any time after the agent is installed.
The Coordinator Credential Configurator application can be launched using the CoordinatorCredentialConfigurator.exe file in the agent installation folder on the workstation. The default agent installation location is: %ProgramFiles%\Quest\ChangeAuditor\Agent

Manual workstation agent deployment

When installed manually, the Change Auditor Workstation Agent installer must be run as an account with the local administrator account privileges and with elevated User Account Control (UAC) permissions.

* 
NOTE: Depending on the User Account Control (UAC) policies (refer to User Account Control (UAC) settings for more information), elevated UAC permissions may require launching the installer using one of the following methods:
•
Shift + Right-click installer to select ‘Run as a different user’.
•
From the Windows Task Manager, select File | Run New Task, browse and select the Change Auditor Workstation Agent installer file, and select the ‘Create this task with administrative privileges’ option, then click OK.
To manually install a workstation agent:
1
Copy the appropriate agent installer package from the Change Auditor service installation directory (%ProgramFiles%\Quest\ChangeAuditor\Service) to the workstation to be monitored:
•
Quest Change Auditor Workstation Agent 6 (x64).msi
•
Quest Change Auditor Workstation Agent 6 (x86).msi
2
Run the installer file on the workstation to open the Quest Change Auditor Workstation Agent Setup wizard.
3
Review the following table for additional information about the information requested in this wizard. This table only covers unfamiliar information. It does not include all the wizard pages or field descriptions.
Table 3. Change Auditor Workstation Agent wizard
Active Directory Information screen

On the Active Directory Information screen, enter the Active Directory information which will allow the agent to establish a coordinator connection.

Name of Active Directory Root Domain
(domain.com)

Enter the DNS name (domain.com) of the root domain of Active Directory.

Account Name (domain\user)

Enter the name of the user (domain\user) that can find and connect to a Change Auditor coordinator in the Active Directory forest.

Account Password

Enter the password associated with the user account entered above.

Add this user to the “ChangeAuditor Agents - <InstallationName>” security group

This check box is selected by default indicating that the user account specified above will be added to the ChangeAuditor Agents security group.

NOTE: User accounts must be added to this security group in order to properly authenticate.
Installation Name screen

The Installation Name screen will prompt you to enter the installation name to identify the database to which the coordinator is to be connected. A workstation agent must join an existing Change Auditor installation.

ChangeAuditor Installation Name

Click Next to use the DEFAULT installation name.

If you want to use a different Change Auditor installation, enter the installation name of an existing Change Auditor installation or click the Browse button to select an existing Change Auditor installation. Clicking the Browse button will display the Browse for ChangeAuditor Installation dialog allowing you to select from a list of existing installations.

4
Repeat to install a workstation agent to all of the workstations to be monitored.
User Account Control (UAC) settings
•
UAC policies typically use different settings for the ‘Administrator’ account and other accounts with Administrative privileges, so it may be easier to run the Change Auditor Workstation Agent installer with elevated UAC permissions if the Administrator account is used.
•
General UAC elevation and prompt level configurations can be accessed via the Control Panel User Access Control configuration.
•
More specific UAC policies can be configured in the Local Security Policy or a Group Policy Object (where appropriate) to determine whether all Administrators or the built-in Administrator account are run in Admin Approval Mode, the elevation prompt level, whether the secure desktop is used for prompting, whether elevation is possible without prompting, etc.

Appendix: Agent Comparison

There are a few Change Auditor client features that are not available for workstation agents. The following table displays the agent-related features that are available for server and workstation agents.

 
Table 4. Agent comparison
Page/Feature
Available for server agents?
Available for workstation agents?
Deployment Page

The Deployment page will not display non-member objects, such as ADAM workgroup servers or non-Active Directory workstations, because agents cannot be deployed to non-member objects using the Deployment tab. See the Appendix: Workstation Agent Deploymentfor more information on manually installing agents to workgroup servers or non-Active Directory workstations.

Included in topology harvest

Yes

Yes

Install or Upgrade (deploy agent)

Yes

Yes

Advanced Options | Specify Agent Installation Location

Yes

Yes

Advanced Options | Specify a Custom Share on the Remote Server

Yes

Yes

Advanced Options | Launch ServiceStatusTray on startup

Yes

No

Advanced Options | Restart Agent on failure

Yes

Yes

New Servers | Enable Auto Deployment on New Servers

Yes

No

Overview Page
Agent Status Pane
•
Enterprise View (member objects)
•
Workstation View (member objects)
•
Other View (non-member objects)
•
<Domain> (member and non-member objects)

 

Yes

No

Yes

Yes

 

No

Yes

Yes

Yes

Count of Events Pane
•
Location (member and non-member objects)

 

Yes

 

Yes

Top Agent Activity Pane
•
All (member and non-member objects)
•
DCs (member objects)
•
Servers (member objects)
•
Workstations (member objects)
•
Others (non-member objects)

 

Yes

Yes

Yes

No

Yes

 

Yes

No

No

Yes

Yes

Search Properties Tabs

Where Tab

Yes

Yes

Origin Tab

Yes

Yes

Agent Statistics Page
Included in Agent Statistics page

Yes

Yes

Start | Stop | Restart agent (member objects)

Yes

Yes

Start | Stop | Restart agent (non-member objects)

No

No

Set Agent Uninstalled

Yes

Yes

Hide | Show Uninstalled agents

Yes

Yes

View agent logs

Yes

Yes
(See Note below)

View resource properties

Yes

Yes

Administration Tasks Page - Agent Configuration
Included in Agent Configuration page

Yes

No

Assign agent configurations

Yes

No
(Uses Default Configuration)

Configuration Setup dialog | System Settings

Yes

Yes
(From Default Configuration)

Configuration Setup dialog | File System settings
(Change Auditor for Windows File Servers, Change Auditor for EMC or Change Auditor for NetApp)

Yes

No

Configuration Setup dialog | AD Query settings
(Change Auditor for Active Directory Queries)

Yes

No

Configuration Setup dialog | Exchange settings
(Change Auditor for Exchange)

Yes

No

Agent system tray icon

Yes

No

 
 
* 
NOTE: For workstation log management (such as Get Logs and View Agent Logs), the following must be enabled on the workstation:
•
Windows Management Instrumentation (WMI) must be enabled in the firewall rule set (usually domain) on the workstation
•
Network Discovery and File Sharing must be enabled
•
Remote Registry Service must be set to ‘Start Automatically’. By default, this service is stopped and set to ‘Manual’ for Windows 10.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating