Chat now with support
Chat with Support

Change Auditor 7.2 - Installation Guide

Installation Overview Install Change Auditor Add Users to Change Auditor Security Groups Connecting to the Clients Deploy Change Auditor Agents Upgrade Change Auditor Installation Notes and Best Practices Deployment Options Workstation Agent Deployment Agent Comparison Install an agent to audit ADAM (AD LDS) on workgroup servers Windows Installer Command Line Options

Installation Overview

Change Auditor provides auditing and security coverage for your enterprise network. You can audit the activities taking place in your infrastructure and receive real-time alerts on vital changes and activities as they occur. Instantly know who made changes including the IP address of the originating workstation, where and when it occurred along with before and after values. Then automatically turn that information into intelligent, in-depth forensics for auditors and management — and reduce the risks associated with day-to-day modifications.

•
Audit critical changes across your enterprise including Active Directory, Azure Active Directory, Office 365 (Exchange Online, SharePoint Online, and OneDrive for Business), Windows File Servers, NetApp, EMC, SQL Server, SharePoint, Microsoft Skype for Business and Fluid File Systems.
•
Collect user login and log out activity for regulatory compliance and user activity tracking.
•
Automate ongoing compliance with tracking and reporting for best practices and regulatory compliance mandates for SOX, PCI-DSS, HIPAA, FISMA, GLBA, and more.
•
Speed troubleshooting through real-time insight into changes with a comprehensive audit library including built-in audit alerts, reports, and powerful searches.
•
Proactively protect critical Active Directory objects, Exchange Mailboxes, and Windows files and folders from harmful changes that could open security holes or cause resources to become unavailable.
•
Separate product deployment and management for key environments including Active Directory, Exchange, Windows File Servers, NetApp, EMC, SQL Server, Active Directory Query, SharePoint, Logon Activity, and Skype for Business.
•
Integrate with other products to track, audit, report, and alert on critical changes made using Safeguard Authentication Services, Quest Defender, and Dell Fluid File System.

This guide contains the information required to install and configure Change Auditor and upgrade from a previous release. It is intended for network administrators, consultants, analysts, and any other IT professionals installing the product.

See the following information to get you started:

•
Before you begin
•
System requirements
•
System statistics and facilities
•
System overview
•
Installation overview
•
Using Group Managed Service Accounts (gMSA)

Before you begin

If you do not already have Change Auditor, download it from https://support.quest.com/.

•
Before you can download the product, you must register with Quest. If you are a registered Quest user, log on using your email address and password.
•
After you have registered or logged in, locate the product and version to download from the product list.
•
On the download window, click the link and save the file to an appropriate directory (such as c:\temp).
* 
NOTE: If you have purchased multiple Change Auditor products, download one instance of Change Auditor only. The code is the same for all and the license keys determine what features are enabled or disabled.

Before you install Change Auditor:

•
Review the system requirements
•
Review the complete installation process
•
Review Installation Notes and Best Practices
•
Read the Release Notes for updated information
•
Ensure that you have the appropriate license to enable Change Auditor auditing modules. (A separate license is required to enable the functionality of each of the Change Auditor auditing modules.)
* 
NOTE: Change Auditor prompts you for a valid license during the coordinator installation. You cannot proceed with an invalid or expired license.

System requirements

Change Auditor includes the following components, all which have specific system requirements:

•
Change Auditor coordinators
•
Change Auditor client
•
Change Auditor agents
•
Change Auditor workstation agents
•
Microsoft SQL Server database
•
Change Auditor web client
* 
NOTE: Each module also has specific auditing and system requirements.

See the Change Auditor Release Notes for details.

System statistics and facilities

Network traffic
•
1 to 3 KB of TCP traffic is generated per audit event sent from a Change Auditor agent to a Change Auditor coordinator.
•
1 to 3 KB of TCP traffic is generated per record upon a successfully run search query.
•
1 KB of TCP traffic is generated every five minutes to update the Change Auditor agent statistics, which are displayed on the Agent Statistics page.
* 
NOTE: There are other network communications, primarily the agent downloading licensing, or configuration data from the coordinator. This configuration can be large, depending on the auditing modules licensed and how they are configured.
Interval settings
 
Table 1. Interval settings
Setting
Description

Connection Interval

Every five minutes a Change Auditor agent tries to establish a connection or communication channel with a Change Auditor coordinator.

NOTE: Connection attempts can also be triggered when an agent loses its connection to the coordinator, where the agent tries to re-establish a connection.

Forwarding Interval

Every five seconds an agent forwards all the audited events stored in the local queue (agent’s database) to a Change Auditor coordinator. These audited events have not been previously sent to the coordinator.

This interval is configurable using the Configuration Setup dialog.

Polling Interval

Every 900 seconds (15 minutes) the agent checks to determine if there have been any modifications to the agent’s configuration.

This interval is configurable using the Configuration Setup dialog.

Retry Interval

If the agent does not receive an immediate success acknowledgment from the coordinator for the audited events it transmitted, the agent resends all unacknowledged events after five minutes (300 seconds) from the previous attempt.

This interval is configurable using the Configuration Setup dialog.

To display the Configuration Setup page
1
Select View| Administration to open the Administration Tasks tab.
2
Select Configuration | Agent from the navigation pane.
3
On the Agent Configuration page click Configurations to display the Configuration Setup dialog, open the System Settings tab to view and modify the Forwarding Interval, Polling Interval or Retry Interval settings.
Self Service Tools
Knowledge Base
Notifications & Alerts
Product Support
Software Downloads
Technical Documentation
User Forums
Video Tutorials
RSS Feed
Contact Us
Licensing Assistance
Technical Support
View All
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating