Chat now with support
Chat with Support

Change Auditor 7.1 - Quick Start Guide

Check agent status

Once agents have been deployed, the next step is to ensure that all the agents have checked in.

1
From within the client, use the View | Statistics | Agent menu command to open the Agent Statistics page.
2
A list of all deployed agents are displayed. Check to ensure that the status of each agent is 'Active'.
* 
NOTE: If an agent’s status is not connected, ensure that the agent service is running on that domain controller or member server.

Change Auditor client overview

The client connects directly to the Change Auditor database and provides immediate access to key configuration change information. The following table describes the tasks that can be performed.

 
Table 2. Change Auditor tasks by page
Tabbed page:
Tasks that can be performed on page:

Overview
•
Access valuable information about the application (for example, agent status, coordinator status, top agent activity)
•
View real-time results for your 'favorite' search

Deployment
•
Install or upgrade agents and view deployment results
•
Uninstall an existing agent service
•
Enable auto deployment to new servers and workstations
•
Modify default agent installation location and settings
•
View associated agent and coordinator logs
•
Print the contents of the Deployment page

Searches
•
View list of available searches
•
View or modify the properties of a search query
•
Create custom searches
•
Run searches
•
Set a search as a 'favorite'
•
Enable and disable alerting for individual search queries
•
View alert history
•
Enable and schedule email reporting for individual search queries
•
Define client and report content for individual search results
•
Publish search query results to Quest Knowledge Portal
•
Print the contents of the Searches page

Search Results
•
View search results
•
View event details or search properties
•
Copy, email, or print event details
•
Display a knowledge base topic for an event
•
Add comments to an event
•
Disable an event
•
Request more information about the user object of an event
•
Run extra search queries related to an event
•
Preview results based on changes made to a search
•
Compare results side by side
•
Print search results

Agent Statistics
•
Get a global view of all installed agents
•
Review status and statistics for each agent
•
View properties of managed resources
•
Stop, start, and restart an agent
•
Retrieve associated trace logs
•
Print agent statistics

Coordinator Statistics
•
Get a global view of all installed coordinators
•
Review status and statistics for each coordinator
•
Retrieve associated trace logs
•
Print coordinator statistics

Log
•
View selected trace log
•
Search selected trace log

Administration Tasks

Configuration task list:

•
Define and assign agent configurations
•
Configure coordinator email notifications
•
Define group expansion
•
Create and schedule purge jobs
•
Disable private alerts and reports
•
Create Report Layout templates that define the header and footer information to be displayed in reports
•
Define who is authorized to use the client features (Windows client and web client)

Administration Tasks

Auditing task list:

•
Enable and disable event auditing and modify an event’s severity level or description
•
Create Excluded Accounts templates to define individual accounts to exclude from auditing
•
Define custom Active Directory object class auditing
•
Define custom AD attribute auditing
•
Define a Member of Group auditing list to specify the users to audit based on their group membership
•
Define Active Directory containers to exclude from Active Directory query auditing
•
Define custom ADAM (AD LDS) object class auditing
•
Specify ADAM (AD LDS) attributes for auditing
•
Define an Exchange Mailbox auditing list to specify what directory objects’ mailbox activities to audit
•
Create Office 365 auditing templates to specify the type of Exchange Online, SharePoint Online, and OneDrive for Business activity to audit.
•
Create Azure Active Directory auditing templates to define the Azure Active Directory activity to audit.
•
Create SQL auditing templates to define the SQL instances and operations to audit
•
Create SQL Data Level auditing templates audit changes to databases and tables.
•
Create VMware auditing templates to specify the VMware vCenter or ESX hosts to audit
•
Create SharePoint auditing templates to define the SharePoint farm and paths to audit
•
Create File System auditing templates to define the files and folders to audit
•
Create Registry auditing templates to define the registry keys to audit
•
Create Service auditing templates to specify the system services to audit
•
Create EMC auditing templates for each EMC file server (CIFS) to audited
•
Create NetApp auditing templates for each NetApp filer to audit
•
Create Skype for Business auditing templates to audit configuration and security setting changes in Microsoft Skype for Business Server 2015 and Microsoft Lync Server 2013.

Administration Tasks

Protection task list:

•
Define protection for critical Active Directory objects
•
Define protection for critical ADAM (AD LDS) objects
•
Define protection for critical Group Policy objects
•
Define protection for critical Exchange Mailboxes
•
Define protection for critical File System files, folders, and shares

Alert History
•
View details regarding the events that triggered an SMTP alert
 

Client walkthrough

The following scenarios introduce you to some of Change Auditor’s functionality.

Set up your testing environment, by performing the following tasks:

•
Use the Searches page to run a report and generate a Search Results page
•
Use the Coordinator Configuration page (on the Administration Tasks tab) to set up email notification and reporting
•
Use the Searches page to enable an SMTP alert
•
Use the Searches page to enable and schedule reporting
* 
NOTE: These scenarios assume that Change Auditor for Active Directory is licensed. If it is not licensed, changing Active Directory will not generate any of the events mentioned.

Make changes to Active Directory and run a query

1
Make changes to Active Directory, for example:
•
Open Active Directory Users and Computers and add an OU called 'Quest Test'. This OU can be at any level within the AD topology.
•
Create and link a new GPO called 'Sample GPO' to the Quest Test OU.
* 
NOTE: If you are using Windows Server® 2008 R2, use the Group Policy Management Console to create a GPO.
•
Add a new user to the Domain Admins security group.
•
Finally, open Active Directory Sites and Services and expand the Inter-Site Transport folder, then the IP folder. Double-click the DEFAULTSITELINK and change the replication interval.
2
Select Start | All Programs | Quest | Change Auditor | Change Auditor Client.
3
Click the Searches tab.
4
Expand the Shared | Built-in folder and then the All Events folder.
5
In the right pane, locate All Active Directory Events and double-click the entry. This runs the selected report.
6
A new Search Results page is displayed populated with the Active Directory events generated.
7
Ensure that the following events were generated for each of the Active Directory changes made:
•
A new OU was added.
•
A new GPO was created, renamed, and linked to an OU (three events).
•
A new user was added to the Domain Admins security group (two events).
•
The DEFAULTSITELINK was changed.
8
To display more details for an event, double-click the event entry in the results grid of the Search Results page.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating