Change Auditor 7.5 - User Guide

Introduction

Introduction

You can search, report and alert on changes to SharePoint Server configuration, permissions, document stores and lists and receive real-time alerts whenever someone makes a critical change in your SharePoint environment.

Verify deployment status of Change Auditor SharePoint Solution

Verify deployment status of Change Auditor SharePoint Solution

NOTE: SharePoint auditing is only available if you have licensed Change Auditor for SharePoint. If you do not have a valid license you can use the features, however, associated events are not captured. To verify that it is licensed, right-click the coordinator icon in the system tray and select Licensing.

You can verify the deployment status of the Change Auditor SharePoint Solution using either the SharePoint Central Administration web site or through the SharePoint Auditing template defined in the client.

To verify status using SharePoint Central Administration web site:

1	Select Start | All Programs | Microsoft SharePoint 2016/2019 Products | SharePoint 2016/2019 Central Administration.

2	On the Central Administration Home page, select System Settings.

3	On the System Settings page, under Farm Management, click Manage farm solutions.

4	Verify that the status associated with the Change Auditor SharePoint Solution (SharePoint.Auditing.Monitor.wsp) is set to ‘Deployed’.

5	If the solution’s status is ‘Not Deployed’, deploy the solution:

▪	Click the Sharepoint.Auditing.Monitor.wsp entry.

▪	On the Solution Properties page, click Deploy Solution.

▪	On the Deploy Solution page, select the appropriate options as described below:

▫	Deploy When - select one of the following options: Now or At a specified time

▫	Deploy To - select to deploy globally to all web applications

▪	Click OK to save your selections and close the Deploy Solution page.

6	Once the solution is deployed, restart the agent to enable auditing of SharePoint events.

To verify status using the SharePoint auditing template in Change Auditor:

1	Select Start | All Programs | Quest | Change Auditor | Change Auditor Client.

2	Open the Administration Tasks tab (View | Administration menu command).

3	Click Auditing.

4	Select SharePoint (under the Applications heading in the Auditing task list) to open the SharePoint Auditing page.

5	Select the template from the list and click Edit.

6	Page through the screens of the SharePoint Auditing wizard using the Next button.

7	On the last page of the wizard, verify that the Change Auditor SharePoint Solution has been successfully added and deployed to the SharePoint farm selected for auditing.

NOTE: The Change Auditor SharePoint Solution status is checked/refreshed once every hour; therefore, the status displayed may not reflect the most current status. Click Refresh Change Auditor Solution Status to force a refresh of the solution’s status.

8	Click Finish to close the SharePoint Auditing wizard.

If the status indicates that the solution is not yet added and/or deployed, run the SharePoint Solution Manager utility to add and deploy it. See Add and deploy Change Auditor SharePoint Solution.

Verify auditing template is applied

Verify auditing template is applied

Check to see if the agent assigned to the SharePoint auditing template is using the latest agent configuration.

To verify that the latest agent configuration is being used:

1	Select Start | All Programs | Quest | Change Auditor | Change Auditor Client.

2	Open the Administration Tasks tab (View | Administration) menu command.

3	Click Configuration.

4	Select Agent in the Configuration task list to open the Agent Configuration page.

5	Select the agents assigned to the SharePoint auditing template (Auditing appears in the SharePoint column) and click Refresh Configuration.

NOTE: If you do not refresh the agent’s configuration, the agent automatically checks for a new agent configuration based on the polling interval setting (located on the System Settings tab of the Configuration Setup dialog). The default is every 15 minutes.

Make changes and run a report

Make changes and run a report

1	To test SharePoint auditing, make some changes to the SharePoint farm specified in the template.

For example:

▪	add a document

▪	add a folder

▪	add an announcement

▪	add a task

▪	delete the document added above

▪	delete the task added above

2	Select Start | All Programs | Quest | Change Auditor | Change Auditor Client to review the events generated.

3	Open the Searches tab.

4	Expand the Shared | Built-in | SharePoint folder in the left pane.

5	Locate and double-click All SharePoint Events in the last 7 days in the right-hand pane.

A new Search Results tab is added to the client displaying the SharePoint events that were captured.

6	Double-click an event from the Search Results grid to display the event details for the selected event.