Change Auditor 7.1 - Quick Start Guide

Change Auditor Overview

Overview

This guide has been prepared to assist you in installing and becoming familiar with Change Auditor. Even though most this content refers to Change Auditor for Active Directory, it also steps you through the process of setting up Quest Change Auditor for Exchange and Quest Change Auditor for Windows File Servers.

This guide is intended to be used to set up a test lab environment. It is not intended as a stand-alone guide and makes references to supporting product documentation that you should use when deploying the Change Auditor in your production environment.

Business challenges

Business solutions

Change Auditor provides total auditing and security coverage for your enterprise network. Change Auditor audits the activities taking place in your infrastructure and, with real-time alerts, delivers detailed information about vital changes and activities as they occur. Instantly know who made the change including the IP address of the originating workstation, where and when it occurred along with before and after values. Then automatically turn that information into intelligent, in-depth forensics for auditors and management — and reduce the risks associated with day-to-day modifications.

Change Auditor uses a modular approach which allows for separate product deployment and management for key environments including Active Directory, Windows File Servers, and Exchange.

Change Auditor for Active Directory drives the security and control by tracking, auditing, reporting, and alerting on the changes that impact your directory including changes to users, groups, nested groups, GPOs, computer, services, registry, local users, and groups and DNS — without the overhead of native auditing.

In addition, you can lock down critical Active Directory, ADAM (AD LDS), and Group Policy objects, to protect them from unauthorized or accidental modifications or deletions.

Change Auditor for Active Directory also audits activity in Microsoft Azure Active Directory.

Correlating activity across the on-premises and cloud directories, provides a single pane-of-glass view of your hybrid environment and makes it easy to search all events regardless of where they occurred.

Change Auditor for Windows File Servers enables administrators to achieve the comprehensive auditing coverage of native auditing tools without the mass of cumbersome data that native event logs generate. Change Auditor for Windows File Servers includes auditing for Windows file server activity related to files and folders, shares, and changes to permissions. Granular selection allows the auditing scope to be set on an individual file or folder and the entire subtree recursive or nonrecursive. Change Auditor for Windows File Servers also allows you to include or exclude certain files or folders from the audit scope to ensure a faster more efficient audit process.

Change Auditor for Windows File Servers also provides an access control model that permits administrators to protect business-critical files and folders on the file server.

Change Auditor for Exchange is the watchful eye that proactively tracks, audits, reports, and alerts on Exchange configuration and permission changes — without the need for native auditing. Change Auditor for Exchange audits for critical changes to Exchange including administrative groups, mailbox policies, public and private information store auditing, organizational changes such as ActiveSync mailbox policy changes, distribution list changes and more. Using the Exchange Mailbox Monitoring feature you can also audit for non-owner activity access and get complete visibility into these types of changes, including who accessed someone else’s mailbox, what message they accessed, and what they did with the message (read, delete, move, and so on). Continually being in-the-know helps you to prove compliance, drive security, and improve uptime while proactively auditing changes to Exchange Server configurations and permissions.

Through the Exchange Mailbox protection feature, you can prevent unwanted access to Exchange mailboxes, making it much more difficult for rogue administrators to access critical mailboxes.

You can also audit Office 365 Exchange Online configuration and permission changes.