Change Auditor 7.2 - Release Notes

Select STORAGE | File | NAS Servers. Open the server properties and select Event Publishing. Select to Enabling Common Event Publishing. Add the CEPA Server where the CEE is installed, select All Events, and save the settings.

•

Select File System you want to audit and choose the Advanced tab. Under the Events Notifications, select Enable SMB Events publishing.

NOTE: When auditing EMC Unity using an agent on Windows Server 2019, the lowest supported version is EMC Unity 4.4.1.

Agent

Locate the Change Auditor agent near the EMC device (use fastest connection type available).

•

Quest recommends to have 1 Gbps network connectivity (or faster connection type) between the monitored EMC device and the computer where the Change Auditor agent service is running. Use a direct or one-switch connection.

Use multiple CPU hosts for Change Auditor agent service (at least 2 CPUs or 2 CPU core).

Rights and permissions

•

Administrative rights on the EMC Control Station to create or modify the cepp.conf file on the EMC file server (CIFS).

•

The computer account where the Change Auditor agent is running must have permissions on the EMC Virus Checking policy.

For more information

See the Change Auditor for EMC User Guide for detailed information about installing, configuring, and using Change Auditor for EMC.

NetApp auditing

Table 28. NetApp auditing requirements

Component

Supported Versions

Change Auditor

Change Auditor for NetApp

NetApp Filer

NetApp Filer with Clustered data ONTAP 8.2 to 9.8

NOTE: NetApp events initiated through the NFS protocol are not supported.

Agent

•

Locate a Change Auditor agent close to the NetApp filer (use fastest connection type available).

•

Quest recommends to have 1 Gbps network connectivity (or faster connection type) between the monitored NetApp filer and the computer where the Change Auditor agent service is running. Use a direct or one-switch connection.

•

Use a multiple CPU host for Change Auditor agent service (at least 2 CPUs or 2 CPU core).

•

In order for the NetApp filer to properly send events to the Change Auditor agent, reverse DNS zone must be configured for the Change Auditor agent server’s IP address. This can be configured in the Reverse Lookup Zone of the DNS server used by the NetApp filer. To verify you can look up a Change Auditor agent using its IP address, use the nslookup command as illustrated below:

•

If Windows Firewall is enabled on the server hosting the Change Auditor agent responsible for capturing the NetApp events, it must be configured to allow ‘File sharing’.

Rights and permissions

NetApp running in cluster mode

Use the Set Credentials button on the NetApp Auditing template. The account should be an Active Directory user that is a member of the local Administrators group of the NetApp filer.

To grant ONTAPI access for the NetApp cluster for an Active Directory user, run the following command on the cluster console:

security login create –vserver <vservername> -username <domain\username> -application ontapi -authmethod domain -role <rolename>

Optionally, you can use the default role “vsadmin” as the rolename which has the administrator permissions of the NetApp filer.

To create a new role and assign the minimum required rights, run the following commands:

security login role create -vserver <vservername> -role <rolename> -cmddirname "version" -access all

security login role create -vserver <vservername> -role <rolename> -cmddirname "volume" -access readonly

security login role create -vserver <vservername> -role <rolename> -cmddirname "vserver fpolicy" -access all

NOTE: domain\username and password are case-sensitive, so the credentials used with the NetApp auditing template must match.

See the NetApp user guide for more details on enabling Active Directory domain users access to the cluster.

To add a new account to a NetApp filer’s local Administrators group:

Open Active Directory Users and Computers MMC snap-in.

Select the domain where the NetApp filer is located.

Select Computers from the tree and then select the filer from the list in the right pane.

By default, the computer name is the same as the filer name. The actual container and the computer names are configured during CIFS setup on the filer.

Right-click the filer and click Manage. The Computer Management console opens.

Select System Tools | Local Users and Groups | Groups.

Double-click the Administrators group on the right.

Click Add to add an account to the Administrators group.

For more information

See the Change Auditor for NetApp User Guide for detailed information about installing, configuring, and using Change Auditor for NetApp.

SharePoint auditing

Table 29. SharePoint auditing requirements

Component

Supported versions

Change Auditor

Change Auditor for SharePoint

IMPORTANT: The Change Auditor for SharePoint module processes all activities happening on all site collections within the audited SharePoint farm. When auditing a large SharePoint farm with much activity, the Change Auditor agent may experience performance-related issues including slowness in loading the plugin, slowness in capturing events, or the potential for missed events. Factors that can impact Change Auditor performance include the number of site collections in the farm and the volume of activity taking place in the SharePoint environment. Quest recommends performing a test in an environment that is similar in size and configuration to determine if your farm is suitable to be audited by Change Auditor.

SharePoint

SharePoint Server 2013 SP1

SharePoint Server 2016

SharePoint Server 2019

SharePoint Foundation 2013 SP1

Required rights and permissions

When selecting the agent to capture SharePoint events, you must enter the credentials to use to access the selected SharePoint farm. This account must have the following permissions:

•

Local Administrator on the Change Auditor Agent\SharePoint Central Administration server

•

SharePoint Farm Administrator

•

The following mappings on the SQL Server that contains the SharePoint databases:

•

SharePoint_Config

SharePoint_Shell_Access

SPDataAccess

•

WSS_Content

SPDataAccess

•

SharePoint_AdminContent

SPDataAccess

For more information

See the Change Auditor for SharePoint User Guide for detailed information about installing, configuring, and using Change Auditor for SharePoint.

Logon Activity auditing

Table 30. Logon Activity auditing requirements
Component	Supported versions
Change Auditor	Change Auditor for Logon Activity User license for auditing server agents Change Auditor for Logon Activity Workstation license for auditing workstation agents
Change Auditor \| Server agents	Change Auditor for Logon Activity User NOTE: See Change Auditor agent (Server-side component).
Change Auditor \| Workstation agents	Change Auditor for Logon Activity Workstation
For more information	See the Change Auditor for Logon Activity User Guide.

Please select your product:

To serve you better, please complete the Purpose of your Chat:

Recommended Solutions for Your Problem

Change Auditor 7.2 - Release Notes

EMC auditing

NetApp auditing

SharePoint auditing

Logon Activity auditing