Chat now with support
Chat with Support

Change Auditor 7.5 - Installation Guide

Installation Overview Install Change Auditor Add Users to Change Auditor Security Groups Connecting to the Clients Deploy Change Auditor Agents Upgrade Change Auditor Installation Notes and Best Practices Deployment Options Workstation Agent Deployment Agent Comparison Install an agent to audit ADAM (AD LDS) on workgroup servers Windows Installer Command Line Options

Change Auditor for SQL Server — SQL auditing

Auditing events on SQL Server

Due to a Microsoft hotfix, agents do not capture SQL-related events unless the following action is taken on the SQL Server:

•
Using SQL Server Configuration Manager, add a startup parameter called ‘-T1906’ on the Startup Parameters tab in the SQL Server Properties dialog.
•
Restart the SQL Server service.
SQL Server auditing for Itanium platform — Not supported

Auditing of SQL Servers running on Itanium platforms is not supported.

 

Deployment Options

Change Auditor can be configured to audit and report on one or many Active Directory forests to facilitate searching for compliance audit data. There are two deployment options available to you:

•
Multi-forest deployment which requires at least one coordinator in each monitored forest. This option provides full auditing support.
•
Foreign forest deployment with agents running on a domain-joined server, domain controller, or workstation connected to coordinators in a foreign Active Directory forest. This option allows for improved centralization of agent management while providing most core Change Auditor functionality. For details on the level of support, see Supported functionality.

The following section outlines the support, requirements, recommendations and steps for deploying agents, and example deployments for these deployment options:

•
Multi-forest deployment
•
Foreign forest agent deployment

Multi-forest deployment

•
Requirements
•
Example deployment scenario
•
Configuration

Requirements

The following must be in place for multi-forest deployments:

•
Network connectivity between each monitored forest.
Coordinators in all forests connect directly to the SQL server that is hosting the Change Auditor audit database.
Coordinators must resolve the host name of the SQL server or must be configured to use the IP address of the SQL server.
•
At least one coordinator deployed in each forest.
The coordinator collects and maintains the topology information for each forest. This includes domains, sites, domain controllers, and member servers. The coordinator is also responsible for:
•
Sending alerts by email, SMNP, or WMI
•
Sending agent configuration settings, auditing and protection templates
•
License enforcement
•
Agent status updates
•
Agent installation and upgrade
•
Auto deployment
•
Event statistics
•
Group membership expansion
•
Change Auditor groups created in each forest.
To connect to coordinators in other forests, users must be added to either the ‘ChangeAuditor Administrators — <InstallationName>’ OR ‘ChangeAuditor Operators — <InstallationName>’ in the forest where the coordinator is joined.
•
Credentials for the Microsoft SQL server backend.
Depending on whether the Active Directory forests have a trust in place, you need to configure Change Auditor to use the appropriate SQL credentials.
Scenario A — One or more of the forests do not have a valid trust in place.
The coordinator that is not part of the same forest where the SQL server is joined to, must be configured to use a SQL user account or a Domain Account from the forest where the SQL server resides.
Scenario B — All forests have a valid trust in place.
Each of the coordinators may be configured to use either authentication type. Both Windows or SQL user accounts may be used in each of the forests.

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating