Chat now with support
Chat with Support

Change Auditor 7.4 - Installation Guide

Installation Overview Install Change Auditor Add Users to Change Auditor Security Groups Connecting to the Clients Deploy Change Auditor Agents Upgrade Change Auditor Installation Notes and Best Practices Deployment Options Workstation Agent Deployment Agent Comparison Install an agent to audit ADAM (AD LDS) on workgroup servers Windows Installer Command Line Options

System overview

System overview

Change Auditor agents are deployed to all servers (domain controllers and member servers) tracking configuration changes in real time. When a change is made on a server running a Change Auditor agent, the change information (audit event) is captured by the agent, batched and forwarded to a Change Auditor coordinator, which then inserts the event details into the Change Auditor database.

* 
NOTE: If the Change Auditor for Logon Activity Workstations auditing module is licensed, you must deploy agents to the workstations that you want to monitor.

For each change detected, an audit event entry is created in the Change Auditor database with the following information:

•
Type of configuration change event
•
Time and date of the configuration change event
•
Identity of the machine the change was made on
•
Identity of the managed object the change pertains to
•
Old and new value of the change (if applicable)
•
IP address of the workstation and client where the change originated

The coordinator fulfills client and agent requests and generates alerts. Multiple coordinators can be installed in a single forest and an agent can be connected to multiple coordinators simultaneously. All connected coordinators can participate in receiving events from the agent, allowing a high volume of events to be distributed for processing.

* 
NOTE: Server agents submit events to all available coordinators to load balance automatically. However, workstation agents randomly connect to a single coordinator. This design enables ‘scaling out’ options for large workstation agent deployments within a single site.

The Change Auditor client provides immediate access to key configuration change information. From the client you can:

•
Install, upgrade, or uninstall agents
•
Define search criteria to return specific events and view the search results
•
Enable and disable alerts and view the events that triggered these alerts
•
Enable and schedule email reporting for individual search queries
•
View agent and coordinator statistics
•
Define custom Active Directory and ADAM (AD LDS) objects and attributes to audit
•
Define the SharePoint farm and paths to audit
•
Define file system auditing for Windows File Servers and EMC and NetApp devices
•
Specify the SQL Server instances to audit
•
Specify the Exchange mailboxes to audit
•
Specify the Office 365 Exchange Online organizations and SharePoint Online and OneDrive for Business sites to audit
•
Specify the containers to exclude from Active Directory query auditing
•
Configure object protection for Active Directory, Exchange, File Systems, and Group Policies
•
Define and assign agent configurations
•
Configure SMTP for alerting and reporting
•
Create and schedule purge jobs for maintaining the database
•
Define who is authorized to use the Change Auditor client (Windows and web) features

Installation overview

Before installing Change Auditor, choose the SQL database to use. If you want to install the Change Auditor database to a SQL instance other than the default instance of the selected SQL Server, create the instance before running the installer.

During the coordinator installation, you have the option of adding the current user to the Change Auditor Administrators security group. If you select not to do this during the coordinator installation process, you need to add your user account (and any other appropriate user accounts) to one of the Change Auditor security groups. Quest also recommends that you add the Change Auditor Administrators and Change Auditor Operators groups to the appropriate SQL database role. See Add Users to Change Auditor Security Groups for more information regarding these security groups.

Open the client to deploy agents to the required servers. Also, if you have the Change Auditor for Logon Activity Workstation auditing module licensed, deploy agents to the domain workstations you want to monitor. See Deploy Change Auditor Agents for more details.

* 
IMPORTANT: You must be a member of the Change Auditor Administrators group and have local permissions to deploy agents.

You can optionally install the Change Auditor web client to access (search and report on) the data collected by Change Auditor, create custom search queries, and perform administration tasks to manage Change Auditor. See the Change Auditor Web Client User Guide for information about installing and running the web-based client.

Using group Managed Service Accounts (gMSA)

* 
NOTE: By default, all services run as LocalSystem. Using gMSA accounts as the service account is not supported.

When using group Managed Service Accounts:

•
The account must end with '$' and the password must be blank.
•
The local Administrator group must be added to the group policy debug programs. (Found under Local Computer Policy | Windows Settings | Security Settings | Local Policies | User Rights Assignments | Debug programs.)

Additional Requirements

•
Coordinator database connection
•
The coordinator host must be correctly configured to retrieve the managed password for the specified group Managed Service Account.
•
The coordinator installer must be run as the administrator. (Right-click and select Run as administrator.)
•
Agent deployment and configuration
•
The domain should be entered in the Fully Qualified Domain Name format.
•
The Windows client must be run as the administrator. (Right-click and select Run as administrator.)
•
The agent host must be correctly configured to successfully retrieve the managed password for the specified group Managed Service Account.
•
For manual installations, the agent installer must be run as the administrator. (Right-click and select Run as administrator.)
•
For foreign domain agent deployments, the account name for the agent to connect to the coordinator should be specified with the Fully Qualified Domain Name (For example: domain.com\user.)
•
For foreign domain agent deployments, a trust relationship with the foreign domain and the coordinator's domain is required.
•
The Coordinator Credential Configurator must be run as the administrator. (Right-click and select Run as administrator.)
•
Coordinator configurations that allow users to send reports to a shared folder.
•
The Windows client must be run as the administrator. (Right-click and select Run as administrator.)
•
The coordinator host must be correctly configured to retrieve the managed password for the specified group Managed Service Account.

For information on group Managed Service Account implementations and requirements, refer to Microsoft documentation.

 

 

Install Change Auditor

•
Installation workflow
•
Install the first coordinator
•
Install the client
•
Install multiple coordinators
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating