Chat now with support
Chat with Support

Change Auditor 7.1.1 - Installation Guide

Installation Overview Install Change Auditor Add Users to Change Auditor Security Groups Connecting to the Clients Deploy Change Auditor Agents Upgrade Change Auditor Installation Notes and Best Practices Multi-Forest Deployments Foreign Forest Agent Deployment Workstation Agent Deployment Agent Comparison Install an agent to audit ADAM (AD LDS) on workgroup servers Active Roles Integration Quest GPOADmin Integration Windows Installer Command Line Options

Agent Comparison

There are a few client features that are not available for workstation agents. The following table displays the agent-related features that are available for server and workstation agents.

 
Table 6. Agent comparison
Page and Feature
Available for server agents?
Available for workstation agents?
Deployment Page

The Deployment page does not display non-member objects, such as ADAM workgroup servers or non-Active Directory workstations, because agents cannot be deployed to non-member objects using the Deployment tab.

Included in topology harvest

Yes

Yes

Install or Upgrade (deploy agent)

Yes

Yes

Advanced Options | Specify Agent Installation Location

Yes

Yes

Advanced Options | Specify a Custom Share on the Remote Server

Yes

Yes

Advanced Options | Launch ServiceStatusTray on startup

Yes

No

Advanced Options | Restart Agent on failure

Yes

Yes

New Servers | Enable Auto Deployment on New Servers

Yes

No

Overview Page
Agent Status Pane
•
Enterprise View (member objects)
•
Workstation View (member objects)
•
Other View (non-member objects)
•
<Domain> (member and non-member objects)

 

Yes

No

Yes

Yes

 

No

Yes

Yes

Yes

Count of Events Pane
•
Location (member and non-member objects)

 

Yes

 

Yes

Top Agent Activity Pane
•
All (member and non-member objects)
•
DCs (member objects)
•
Servers (member objects)
•
Workstations (member objects)
•
Others (non-member objects)

 

Yes

Yes

Yes

No

Yes

 

Yes

No

No

Yes

Yes

Search Properties Tabs

Where Tab

Yes

Yes

Origin Tab

Yes

Yes

Agent Statistics Page
Included in Agent Statistics page

Yes

Yes

Start | Stop | Restart agent (member objects)

Yes

Yes

Start | Stop | Restart agent (non-member objects)

No

No

Set Agent Uninstalled

Yes

Yes

Hide | Show Uninstalled agents

Yes

Yes

View agent logs

Yes

Yes
(See Note below)

View resource properties

Yes

Yes

Administration Tasks Page — Agent Configuration
Included in Agent Configuration page

Yes

No

Assign agent configurations

Yes

No
(Uses Default Configuration)

Configuration Setup dialog | System Settings

Yes

Yes
(From Default Configuration)

Configuration Setup dialog | File System settings
(Change Auditor for Windows File Servers, Change Auditor for EMC or Change Auditor for NetApp)

Yes

No

Configuration Setup dialog | AD Query settings
(Change Auditor for Active Directory Queries)

Yes

No

Configuration Setup dialog | Exchange settings
(Change Auditor for Exchange)

Yes

No

Configuration Setup dialog | VMware settings

Yes

No

Agent system tray icon

Yes

No

 
 
* 
NOTE: For workstation log management (such as Get Logs and View Agent Logs), the following must be enabled on the workstation:
•
Windows Management Instrumentation (WMI) in the firewall rule set (usually domain) on the workstation
•
Network Discovery and File Sharing
•
Remote Registry Service set to ‘Start Automatically’. By default, this service is stopped and set to ‘Manual’ for Windows 8.1 and 10.

Install an agent to audit ADAM (AD LDS) on workgroup servers

Change Auditor audits Active Directory Application Mode (ADAM) or Active Directory Lightweight Directory Services (AD LDS) events. This section provides information regarding the agent installation necessary for auditing ADAM (AD LDS) instances on workgroup servers.

Agent installation
* 
NOTE: An agent must be installed on the server where the ADAM (AD LDS) instance to audit resides.
To install agents to audit ADAM (AD LDS) on workgroup servers:
* 
NOTE: A workgroup agent requires NetBIOS over TCP enabled and access to the following ports inbound to the domain controllers:
•
UDP port 137 (name services)
•
UDP port 138 (datagram services)
•
TCP port 139 (session services)
1
Copy the appropriate agent installer package from the Change Auditor service installation directory to the workgroup server to monitor. The default directory is %ProgramFiles%\Quest\ChangeAuditor\Service\ Change Auditor Agent (x64).msi.
2
Run the installer file on the workgroup server to open the Change Auditor Agent wizard which steps you through the installation.
3
Review the following table for additional requested information in this wizard. This table only covers unfamiliar information. It does not include all the wizard screens or field descriptions.
Table 7. Change Auditor Agent wizard
Active Directory Information screen

On the Active Directory Information screen, enter the Active Directory information required for the agent to establish a coordinator connection.

Name of Active Directory Root Domain
(domain.com)

Enter the DNS name (domain.com) of the root domain of Active Directory.

Account Name (domain\user)

Enter the name of the user (domain\user) that can find and connect to a Change Auditor coordinator in the Active Directory forest.

Account Password

Enter the password associated with the previously entered user account.

Installation Name screen

The Installation Name screen prompts you to enter the installation name to identify the database to which the coordinator is to be connected. A workgroup agent must join an existing Change Auditor installation.

ChangeAuditor Installation Name

Enter an existing Change Auditor installation or click Browse to select from a list of existing installations.

Active Roles Integration

Active Roles uses a proxy account (service account) to connect and change Active Directory objects and group policies. Change Auditor can deploy to an Active Roles server which signals it to retrieve and send the name of the user that was logged in to the Active Roles console to Change Auditor. This additional information is then displayed in the Change Auditor client for events initiated using Active Roles.

* 
NOTE: Change Auditor audits changes made through Active Roles workflow that are initiated by the Active Roles service account.
* 
NOTE: As of Active Roles version 7.3.3, you can monitor a single server from multiple installations of Change Auditor. To ensure that the Active Roles server EventSource is created and registered in the Change Auditor database, you need to deploy the Active Roles integration script from each Change Auditor installation. See Deploying Change Auditor/Active Roles integration scripts.

This section covers the following topics for Active Roles integrations:

•
Requirements
•
Deploying Change Auditor/Active Roles integration scripts
•
Client components added to Change Auditor
•
Removing deployed Change Auditor/Active Roles integration scripts
•
Troubleshooting Tips

Requirements

Active Roles
•
Active Roles 6.9 through 7.4.2
* 
NOTE: To capture the additional events and initiator account information available with the latest integration scripts, you must be running Active Roles 6.9 (or higher) with Change Auditor for Active Directory 6.0 (or higher).
* 
NOTE: To work with Active Roles 7.0, you must have installed: hotfix 7.0.2 SOL188024 for Active Roles and at a minimum Change Auditor 6.7.1539, Change Auditor 6.8.1474, or Change Auditor 6.9.
NOTE: If both Active Roles versions 6.x and 7.0.2 SOL188024 are installed on the same server as a side-by-side deployment, Change Auditor installs integration scripts to both.
•
Microsoft .NET Framework 4.5 (or higher) must be installed and enabled on the target Active Roles server
•
PowerShell 2.0 must be installed on the target Active Roles server
•
PowerShell Execution policy must be set to ‘AllSigned’, ‘RemoteSigned’ or ‘Unrestricted’ on the target Active Roles server. (For more information, see https://technet.microsoft.com/en-us/library/ee176961.aspx.)
•
Active Roles administrator right is required to deploy the integration scripts.
•
The Active Roles service account (or the override account) must be authorized to access the Change Auditor SDK. That is, add the Active Roles server service account to the ChangeAuditor Administrators security group.
* 
NOTE: If you use a role with the minimum permissions, use the Application User Interface page on the Administration Tasks tab to define a role that contains the ‘Add Sdk’ and ‘View Sdk’ operations. For more information about using the Application User Interface page to define a new role, see the Change Auditor User Guide.
Change Auditor for Active Directory
•
Change Auditor for Active Directory 5.6 (or higher)
* 
NOTE: To capture the additional events and initiator account information available with the latest integration scripts, you must be running Active Roles 6.9 (or higher) with Change Auditor for Active Directory 6.0 (or higher). To deploy Active Roles 7.0, you must have installed at a minimum, Change Auditor 6.7.1539, Change Auditor 6.8.1474, or Change Auditor 6.9.
•
The integration scripts must be deployed to a server running Active Roles.
* 
NOTE: If Active Roles replication is configured correctly, you only need to deploy the integration script to one Active Roles server.
•
The Change Auditor agents must be installed on all domain controllers in the environment to ensure that the Active Directory changes are picked up.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating