Chat now with support
Chat with Support

Change Auditor 7.4 - User Guide

Change Auditor Overview Agent Deployment Change Auditor Client Overview Overview Page Searches Search Results and Event Details Custom Searches and Search Properties Enable Alert Notifications Administration Tasks Agent Configurations Coordinator Configuration Purging and Archiving your Change Auditor Database Disable Private Alerts and Reports Generate and Schedule Reports SQL Reporting Services Configuration Change Auditor User Interface Authorization Client Authentication Certificate authentication for client coordinator communication Integrating with On Demand Audit Enable/Disable Event Auditing Account Exclusion Registry Auditing Service Auditing Agent Statistics and Logs Coordinator Statistics and Logs Change Auditor Commands Change Auditor Email Tags

Assign agent configurations to server agents

Once agent configurations are defined you can assign it to one or more installed server agents from the Agent Configuration page.

To assign a configuration to an agent from the Agent Configuration page:
1
On the Agent Configuration page, select one or more agents from the agent list and click Assign.
2
On the Agent Assignment dialog, select the configuration definition to be assigned to the selected agents and click OK.
On the Agent Configuration page, the agent configuration assignment will be updated in the Configuration column.
3
Select the agents assigned to the agent configuration and click Refresh Configuration to ensure that the assigned agents are using the latest agent configuration.
To reset ALL agent configurations back to the default configuration:
1
On the Agent Configuration page, click Default All.
2
A message is displayed confirming that you want to reset all agent configurations back to the factory default settings. Click Yes.
The agent configuration assignment will be updated in the Configuration column.
3
Select the agents assigned to the agent configuration and click Refresh Configuration to ensure that the assigned agents are using the latest agent configuration.

Enable event logging

Using the Agent Configuration page you can enable the event logging feature which writes Change Auditor events locally to a Windows event log. These event logs can then be collected using InTrust to satisfy long-term storage requirements.

 
* 
NOTE: This is a global setting and applies to all agents. Keep the following in mind when defining custom auditing:
•
Disabling Change Auditor events does NOT impact event logging.
•
Excluding accounts from auditing does NOT impact event logging with the exception of Exchange. That is, if an Exchange Mailbox account is set to exclude ALL mailbox events, then these events will also be excluded from the event log.
•
For Registry events, event logging is disabled by default. When enabled, only configured activities are sent to the event log.
•
For Service events, event logging is disabled by default. When enabled, only configured activities are sent to the event log.
•
For Active Directory events, event logging is disabled by default. When enabled, all Active Directory activity is sent to the event log.
•
For Azure Active Directory events, event logging is disabled by default. When enabled, only configured activities are sent to the event log
•
For ADAM (AD LDS) events, event logging is disabled by default. When enabled, all ADAM activity is sent to the event log.
•
For File System events, event logging is disabled by default. When enabled, only configured activities are sent to the event log.
•
For Exchange mailbox events, event logging is disabled by default. When enabled, only configured Exchange Mailbox activities are sent to the event log. Office 365 Exchange Online events are not logged to this event log.
•
For SQL Server events, event logging is disabled by default. When enabled, only configured activities are sent to the event log.
•
For SQL Data Level events, event logging is disabled by default. When enabled, only configured activities are sent to the event log.
•
For AD Query events, event logging is disabled by default. When enabled, all Active Directory queries, except those specified in the excluded AD Query list are sent to the event log. When enabling AD Query event logging, keep in mind that AD Query events could be of very high volume.
•
For EMC events, event logging is disabled by default. When enabled, only configured activities are sent to the event log.
•
For NetApp events, event logging is disabled by default. When enabled, only configured activities are sent to the event log.
•
For SharePoint events, event logging is disabled by default. When enabled, only configured activities are sent to the event log.
•
For Skype for Business events, event logging is disabled by default. When enabled, all Skype for Business events are sent to the event log.
To enable event logging:
1
Open the Administration Tasks tab and select Agent (under the Configuration task list) to display the Agent Configuration page.
2
Click Event Logging.
3
Select the type of event logging to enable:
•
Active Directory
•
ADAM (AD LDS)
•
Azure AD
•
Exchange
•
File System
•
SQL
•
SQL Data Level
•
EMC
•
AD Query
•
Registry
•
Service
•
Local Account
•
Change Auditor
•
NetApp
•
SharePoint
•
Skype for Business
* 
NOTE: Event Logging is supported only for Skype for Business Administration facility; it is not supported for the Skype for Business Configuration facility.
* 
NOTE: If an option is disabled, this indicates that you do not have the corresponding component licensed.
4
Click OK to save your selection and close the dialog.

 

Coordinator Configuration

•
Coordinator Configuration page
•
Configure email alert notifications/reports
•
Customize alert email content
•
Shared Folder Configuration
•
Group Membership Expansion
•
Add groups to Group Membership Expansion list
•
Agent Heartbeat Check
•
Disconnect client after 30 minutes of inactivity
•
Scheduled Task Handling

Coordinator Configuration page

The Coordinator Configuration page is displayed when you select Coordinator from the Configuration task list in the navigation pane of the Administration Tasks tab.

This page consists of the following:

•
Configure email alert notifications/reports - for enabling and configuring SMTP email and Microsoft 365 Mail for alerting and reporting
•
Shared Folder Configuration - for enabling and configuring shared folders for reporting
•
Group Membership Expansion - for defining the schedule for expanding nested membership of Active Directory groups that are referenced in searches (Who search criteria) or groups that are defined in the Member of Group auditing feature
•
Agent Heartbeat Check - for specifying how long the coordinator service is to wait before an agent that is not sending updates will be marked as ‘inactive’
•
Scheduled Task Handling - for specifying which coordinators should handle purge, archive, and scheduled reports jobs.

 

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating