Chat now with support
Chat with Support

Change Auditor 7.2 - Release Notes

Skype for Business auditing

Table 31. Skype for Business auditing requirements
Components
Supported Versions

Change Auditor

Change Auditor for Skype for Business

NOTE: The Change Auditor for Lync license has been deprecated. You must obtain and import a new Change Auditor for Skype for Business license file to continue auditing Skype for Business.

Skype for Business

Microsoft Skype for Business Server 2015

Microsoft Skype for Business Server 2019

Microsoft Lync Server 2013

The SQL Server versions where the Central Management Store (CMS) is deployed
•
Microsoft SQL Server 2008 SP4
•
Microsoft SQL Server 2008 R2 SP3
•
Microsoft SQL Server 2012 SP4
•
Microsoft SQL Server 2014 SP3
•
Microsoft SQL Server 2016 SP2
•
Microsoft SQL Server 2017
•
Microsoft SQL Server 2019
•
Auditing is not supported on high availability and disaster recovery technologies such as SQL clusters and SQL Data mirroring.
•
Encrypted databases are not supported.
•
Due to some limitations on gathering logon information for SQL Server 2008 and 2008 R2, the following information may not be captured: Who and Origin.

Required rights and permissions

Each Microsoft Skype for Business Server 2015 installation requires one template assigned to the agent running on the Central Management Store (CMS) SQL Server. Ensure that the credentials for the account specified when you create a template has the following permissions:

•
Permission to open a connection to the CMS database.
•
Read permissions on CMS tables and system tables.
•
VIEW SERVER STATE permission.
•
For SQL 2012 and later: CONTROL SERVER permission and ensure that the CMS database can be opened on the target server.

Additional requirements
•
To audit changes to security setting stored in Active Directory agents must be deployed to Active Directory domain controllers.
•
To audit changes to management data such as topology, configurations, and policies stored in the Central Management Store (CMS) database, agents must be deployed on the SQL server hosting the CMS.
•
Auditing is only supported for CMS databases in Full and Bulk logged recovery models. If the recovery model is not Full or Bulk, the transaction logs are cleaned up more aggressively and Change Auditor might not have time to capture the event resulting in missed events. An initial backup is required for both Full and Bulk logged databases before the transaction log can support auditing.

For more information

See the Change Auditor for Skype for Business User Guide.

 

Office 365 auditing

Office 365 auditing
Table 32. Office 365 auditing requirements
Component
Supported versions

Change Auditor

Change Auditor for Exchange

Change Auditor for SharePoint

Office 365 subscriptions

Change Auditor can audit the various Office 365 plans offered by Microsoft including business and enterprise subscriptions.

Windows PowerShell

Windows PowerShell version 3 on the computer where the agent is installed.

URLs

The agent configured to monitor Office 365 must be able to access the following URLs:

•
https://login.microsoftonline.com
•
https://graph.windows.net
•
https://manage.office.com
•
https://outlook.office365.com/powershell-liveid
•
https://graph.microsoft.com

Ports

•
A firewall outbound exception for remote port 443 (https) must exist for every agent computer used for Office 365 auditing. Port 443 is used for communicating with the Microsoft cloud.
•
If an agent is separated from the coordinator by a firewall, you must create a firewall exception for port 8373 on every agent computer to be used for Office 365 or Azure Active Directory auditing. Port 8373 is the default port that enables the coordinator to communicate with the agent. A different port number can, however, be specified by running Set-CAConfiguration command. For details, see the Change Auditor PowerShell Command Guide.

Required rights and permissions

•
For Exchange Online, the user account specified for the Auditing Configuration Account must be assigned the Exchange Administrator role.
•
The user account specified for the Configuration Account must be assigned the Global Administrator role. The account must also be licensed for Exchange Online (other Office 365 licenses are not required).
•
Change Auditor does not support accounts that have multi-factor authentication enabled.
•
The accounts must be sourced from Azure Active Directory. Accounts from other sources are not supported.

For more information

See the Office 365 and Azure Active Directory Auditing User Guide.

Fluid File System auditing

Table 33. Fluid File System auditing requirements
Component
Supported versions

Change Auditor

Change Auditor for Fluid File System

Dell Fluid File System supported up to the following versions

Dell Fluid File System 5.0 up to version 6.0.4

NOTE: Auditing is supported only for the CIFS/SMB protocol. Events initiated through the NFS or FTP protocols are not supported.

Dell Enterprise Manager /Dell Storage Manager supported up to the following version

Dell Enterprise Manager version 15.3

Dell Storage Manager 18.1 and 19.1

NOTE: The FluidFS cluster that is going to be audited must be registered with Enterprise Manager’s Data Collector service.
NOTE: Administrator rights to Enterprise Manager are required to create, edit, delete FluidFS auditing templates in Change Auditor.

Change Auditor Configuration Service for Dell FluidFS

The Change Auditor Configuration Service for Dell FluidFS.msi is located in the Integration/FluidFS folder of the installation package.

NOTE: The service can be installed only on 64-bit Windows 2008 R2 and later and requires Microsoft’s .NET Framework 4.5.2.
IMPORTANT: The domain of the configuration service must have a two-way trust with the domain of the auditing agent and trust the domain of the coordinator (one-way trust).

Windows PowerShell

Windows PowerShell version 4 on the computer where the Data Collector service is installed.

Agent requirements

Locate an agent close to the Dell FS8600 cluster (use fastest connection type available).

Ports

To receive events, the following ports must be open:

•
Configuration Service TCP port 9003 on the local computer where the Change Auditor Configuration Service for Dell FluidFS is installed.
•
TCP port 9004 on the agent host for inbound connections with the FluidFS cluster.

These are default port values that are configurable.

To change the configuration service port:
1
Open the FluidFS.Configuration.Service.exe.config file. The default location for this file is "C:\Program Files\Quest\ChangeAuditor\FluidFS Configuration Service" where the FluidFS Configuration service is installed. Edit the port number with the following snippet in the code:
<appSettings>
    <add key="ServicePort" value="9003"/>
  </appSettings>
2
Enter the new port in the Change Auditor FluidFS auditing template in the client by adding the name of the server followed by a colon and the port number.
3
Refresh the agent configuration.
To change the RPC host port:
1
Change the port value using the Enterprise Manager client.
2
Save the template or run the Update-CAFluidFSConfiguration command.
The FluidFS.Configuration.Service.PowerShell module is located in the install directory of the Change Auditor Configuration Service for Dell FluidFS.
3
Refresh the agents.

Encryption

If you are going to turn on encryption for auditing, the domain of the coordinator must trust the domain of the user account specified (one-way trust) during encryption configuration.

Required rights and permissions

The account used for auditing and managing your FluidFS auditing templates in Change Auditor:

•
Should be granted ‘Administrator’ privilege in Enterprise Manager.
•
Should be used to register the FluidFS cluster in Enterprise Manager.

For more information

See the Change Auditor for Fluid File System User Guide for more information about configuring and using Change Auditor for Fluid File System.

Azure Active Directory auditing

Azure Active Directory auditing
Table 34. Azure Active Directory auditing requirements
Component
Supported versions

Change Auditor

Change Auditor for Active Directory

Azure Active Directory

Change Auditor can audit the Azure Active Directory that is included with an Office 365 subscription or the Azure Active Directory Basic subscription.

URLs

The agent configured to monitor Azure Active Directory must be able to access the following URLs:

•
https://login.microsoftonline.com
•
https://graph.windows.net
•
https://graph.microsoft.com

Ports

•
443 (HTTPS) — for the agent to connect to the Azure Active Directory.
•
8373 — for the Change Auditor coordinator service to connect to the agent computer.

Required rights and permissions

•
A user account with the Global Administrator role is required for auditing configuration. The account must be sourced from Azure Active Directory. Accounts from other sources are not supported.
•
Change Auditor does not support accounts that have multi-factor authentication enabled.

Synchronized environments

When auditing Azure Active Directory in a synchronized environment, Change Auditor provides more event details by mapping identities from on-premises directories with Azure Active Directory.

The following conditions must be met for Change Auditor to perform the mapping:

•
Synchronization performed with Azure Active Directory Connect (AD Connect).
•
Azure AD Connect synchronization process is active in your on-premises environment and directory sync is active in your cloud environment.
•
An Azure Active Directory auditing template has been created to audit your online environment that is being synchronized with on-premises Active Directory.
•
The agent that is specified in the auditing template, must be a member server of the forest that is being synchronized with the Azure Active Directory.

When Federation with AD FS is used as the single sign-on method, Azure logon events will no longer be generated since the authentication is done by the on-premises AD FS instance.

For more information

See the Change Auditor for Active Directory User Guide.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating