Change Auditor 7.0.4 - Release Notes

NOTE: Change Auditor agent requires File and Printer Sharing on Windows Server 2008 R2. By default, File and Printer sharing are not enabled on Windows Server 2008 R2 installations. To remotely deploy agents to Windows Server 2008 R2, enable the File and Printer sharing (SMB-in) Inbound rule in the Windows firewall (Port 445) on the target host machine. The File and Printer Sharing for Microsoft Networks service on the network adapter must also be enabled for remote deployment.

NOTE: Auditing of some Exchange events requires the latest Exchange service pack. See the Change Auditor for Exchange Event Reference Guide for the minimum service packs required for Exchange events.

Agent software and configuration

•

x64 version of Microsoft’s .NET Framework 4.5.2

•

x64 version of Microsoft XML Parser (MSXML) 6.0

•

x64 version of Microsoft SQLXML 4.0

•

The agent must have LDAP and GC connectivity to all domain controllers in the local domain and the forest root domain.

•

The Change Auditor agent service depends on the following Windows services to be running:

•

DNS Client

•

Remote Procedure Call (RPC)

•

Windows Event Log

NOTE: Ensure communication over RPC between coordinators and agents.

Agent footprint

•

Estimated hard disk space used: 120 MB + local database size + log size

Change Auditor agent log retention and content is configurable. That is, you can define how many files to retain and the level of logging.

•

Estimated physical memory (RAM) used: 60 to 100 MB; Agent RAM usage depends on the auditing modules you have licensed.

Agent installation is NOT compatible with the following applications

Chang Auditor agent cannot be installed on the same server as agents from Quest products that were precursors to Change Auditor including:

•

InTrust for Active Directory

•

InTrust for ADAM

•

InTrust for Exchange

•

InTrust for File Access

•

DirectoryLockdown

•

SecurityManager

These products are no longer available, but if their agents are still installed they should be removed before installing Change Auditor.

Due to the way Change Auditor integrates with Active Directory to capture all change details, there may be incompatibilities with third party agents that integrate with Active Directory in a similar way such as Active Directory auditing tools from other vendors.

Change Auditor may be incompatible out-of-the-box with agents that are designed to detect suspicious software such as anti-virus tools. In these cases, it may be necessary to configure the third party product to exclude the Change Auditor process from its scope.

If Change Auditor is going to be installed alongside products that conform to either of these patterns, Quest recommends that the installation is tested in a non-production environment first to identify any incompatibilities and adjust the product configurations as necessary before deploying to production.

Table 16. Agent minimum permissions
Account	Permissions
User account deploying agents	The Agent Deployment wizard runs under the security context of the currently logged on user account. Therefore, you must have administrative authority to install software on every target machine. This means you must be a Domain Admin in every domain that contains servers that you are targeting for installation. If you are targeting domain controllers only, membership in the Enterprise Admins group grants you authority to all domain controllers in the forest. In addition, all users responsible for deploying Change Auditor agents must also be a member of the ChangeAuditor Administrators group in the specified ChangeAuditor installation. If you are not a member of this security group for this installation, you get an access denied error.
System account running on agent	Change Auditor agents must run as Local System.

Change Auditor workstation agent (optional component)

You can deploy workstation agents to capture authentication activity and logon session events from monitored workstations when the Change Auditor for Logon Activity Workstation license is applied.


	NOTE: The recommended installation for domain workstations is from the Deployment tab of the Change Auditor Windows client. However, for non-domain workstations you must manually install the workstation agent. See the Change Auditor Installation Guide for recommendations and instructions on manually deploying workstation agents.