Change Auditor 7.5 - User Guide

Connection screen

Connection screen

The Connection screen appears when you launch the Change Auditor client (or when you use the File | Connect file menu command after disconnecting). From this screen you can chose to use the default connection profile or define/specify additional connection profiles for connecting to the Change Auditor coordinator.

The following conditions must be met for a client to properly connect:

1	Communications are successful, meaning the coordinator service is running and has a valid SCP listening port (no firewall implications). If this condition fails, the Change Auditor client will display an error dialog stating the appropriate issue.

2

The current authenticated user running the Change Auditor client has the proper credentials for accessing the Change Auditor coordinator service. If this condition fails, the client will display the Coordinator Credentials Required dialog allowing you to enter the proper logon credentials to access the Change Auditor coordinator.

3	The current authenticated user is a member of either the ChangeAuditor Administrators or ChangeAuditor Operators group (AD group in Native Mode and Local group in Mixed Mode). If this condition fails, the Change Auditor client will display an error dialog stating the appropriate issue.

4

When using the direct database connection, the current authenticated user running the Change Auditor client has the proper SQL credentials for accessing the SQL database. If this condition fails, the client will display the Database Credentials Required dialog allowing you to enter the proper logon credentials to access the SQL database.

The Connection screen consists of the following controls:

Profile

If communications are successful, meaning the coordinator service is running and has a valid SCP listening port, the ‘Default Connection’ profile will be displayed in this text box. You can either choose to connect to the coordinator using the default profile or if you have other connection profiles defined, select a different connection profile from the drop-down list.

If the default connection profile is not displayed and you have not defined any connection profiles, click the Manage button to define a new connection profile.

Select the check box to automatically connect to the currently displayed connection profile the next time the Change Auditor client is launched. When this option is selected, this dialog will appear momentarily when the Change Auditor client is launched, requiring no response from you.

You can turn the option off (and on) using the Action menu command.

Disconnect client after 30 minutes of inactivity

Select Disconnect client after 30 minutes of inactivity to disconnect from the coordinator after 30 minutes of inactivity.

Connect

After selecting a connection profile from the drop-down list, click the Connect button to connect to the specified coordinator.

Cancel

Once the Connect button is clicked it changes to a Cancel button. Click the Cancel button to close the Connection screen without connecting to the specified coordinator.

Manage

Use the Manage button to display the Manage Connection Profiles dialog where you can add new profiles, delete or edit profiles and clear the saved logon credentials.

Coordinator Configuration tool

Coordinator Configuration tool

The Coordinator Configuration tool can be used to modify the credentials used by the Change Auditor coordinator when accessing the database. The Coordinator Configuration tool is accessed through the Change Auditor coordinator system tray icon.

By right-clicking on the coordinator system tray icon and selecting the Coordinator Configuration command, the Coordinator Configuration tool appears allowing you to:

•	modify the credentials to be used to access the Change Auditor database

•	change the database instance

•	specify static SCP listening ports to be used to communicate with the coordinator

•	specify where the Active Directory and GPO protection templates are to be stored: SQL (default) or Active Directory

This tool consists of the following tabbed pages:

•	Security page

•	Ports page

•	LDAP Authentication page

•	Coordinator Credentials Required dialog

Security page

From the Security page, you can change the database instance and service accounts used to access the database. If User Account Control (UAC) is enabled, a confirmation dialog appears where you can authorize the Coordinator Configuration tool to use the required elevated rights.

Use the fields/options on this dialog to enter the credentials to be used to access the designated SQL server/instance as described below:

SQL server and instance

Enter the name or IP address of the SQL instance to be used. (i.e., <Server Name>\<Instance Name>). You can also click the Browse button to locate and select the SQL server and instance.

NOTE: The database must have been created by the coordinator installation.

Name of database Catalog

This text box displays the name assigned to the Change Auditor database.

Connect using

Specify whether Windows authentication, Microsoft Entra authentication or SQL server authentication will be used when communicating with the SQL database instance. (The authentication method is set up when SQL is installed.)

NOTE: Microsoft Entra authentication is only supported for SQL Managed Instances.

Depending on the authentication option selected, enter the appropriate user credentials.

▪	Windows Authentication - this is selected by default and will use Windows authentication to access the database.

If you are using a group Managed Service Account:

▫	The account must end with '$' and the password must be blank.

▫	The domain should be entered in the Fully Qualified Domain Name format.

▫	The local Administrator group must be added to the group policy debug programs. (Found under Local Computer Policy | Windows Settings | Security Settings | Local Policies | User Rights Assignments | Debug programs.)

▫	The coordinator host must be correctly configured to retrieve the managed password for the specified group Managed Service Account.

▫	The coordinator installer must be run as the administrator. Right-click and select Run as administrator.

▪	SQL Server Authentication - select this to use SQL Server authentication to access the database.

▪	Microsoft Entra Authentication - select this to use Microsoft Entra authentication to access the database located on an Azure SQL Managed Instance.

Azure SQL Managed Instance:

▪	For a private endpoint, specify the managed instance host name in the following format: MyHostName.dns_zone.database.windows.net

For private endpoint with default port, port specification is not explicitly required. For example: MyHostName.b1b2a3d4e5f7.database.windows.net

or

MyHostName.b1b2a3d4e5f7.database.windows.net,1433

▪	For a public endpoint, specify the managed instance host name and port in the following format: MyHostName.public.dns_zone.database.windows.net,3342

For public endpoint, port specification is required. For example: MyHostName.public.b1b2a3d4e5f7.databas

NOTE:

•	Azure SQL Managed Instance (PaaS) is supported using SQL authentication or Microsoft Entra Authentication with an encrypted connection. Windows authentication is not supported.

•	For an Azure SQL Managed Instance (PaaS), SQL authentication or Microsoft Entra authentication with an encrypted connection must be used.

•	Single User Mode is not supported during installation or upgrade when using Azure SQL Managed Instance. Ensure that all SQL connections to the Change Auditor database are closed before and during the upgrade.

•	Azure SQL Managed Instance (HA) high availability is supported using the read-write listener endpoint.

•	Performance may vary depending on network configuration, topology, and Azure SQL Managed Instance configuration.

Login ID

Enter the user name for the account to be used to access the SQL server instance.

Password

Enter the password associated with the user account entered above.

Domain

Enter the domain name for the Windows account to be used to access the designated SQL server instance. (Only valid for Windows Authentication.)

Encryption

Select the appropriate level of encryption for the data sent between the coordinator and SQL server.

•	Strict (SQL Server 2022): Select this option for SQL Server 2022 and Azure SQL Managed Instance or when the instance has Force Strict Encryption enabled.

•

Mandatory: Select this option when the instance has Force Encryption enabled. It can also be used when no encryption is configured for the instance, but Trust server certificate is enabled. While this method is less secure than installing a trusted certificate, it does support an encrypted connection.

•

Optional

Enabling Trust server certificate, when 'Optional' or 'Mandatory' encryption is selected, or if the server enforces encryption, means that SQL Server will not validate the server certificate on the client computer when encryption is enabled for network communication.

Under Host name in the certificate, you can provide an alternate, yet expected, Common Name (CN) or Subject Alternative Name (SAN) in the server certificate. You would use this option when the server name does not match the CN or SAN, for example, when using DNS aliases.

Leaving this option blank allows certificate validation to confirm that the CN or SAN matches the server name.

NOTE: Change Auditor supports TLS 1.3; however, TLS 1.2 remains a requirement since SQL Server 2022 satellite services require TLS 1.2 to be enabled.

 

Ports page

By default, Change Auditor dynamically assigns communication ports for each installed coordinator. However, using the Ports page of the Coordinator Configuration dialog, you can specify static SCP listening ports to be used to communicate with the Change Auditor coordinator.

If you upgraded from a 5.x installation where static ports were defined, these static ports will be retained as part of the upgrade process. However, the Agent Port setting, which is new and is used by 6.0 agents, will be set to use a dynamic port. (Note that the 5.x agents now use the Agent Port (Legacy) setting on this page.) Check with your system administrator to determine whether this new connection should also be using a static port.

Enter the port(s) to be used to communicate with the coordinator:

NOTE: A zero (0) indicates that a dynamic port is being used. If you have set a static port and wish to use a dynamic port, change the port number back to 0.

Client Port

Enter the static port number to be used by the Change Auditor client to communicate with the coordinator.

Public SDK Port

Enter the static port number to be used by external applications to access the Change Auditor coordinator.

Agent Port (Legacy)

Enter the static port number to be used for communication between a legacy (5.x) Change Auditor agent and a coordinator.

Agent Port

Enter the static port number to be used for communication between a Change Auditor agent (6.x) and a coordinator.

Protection page

By default, Change Auditor stores the Active Directory and GPO protection templates in SQL. However, you can use the Protection page of the Coordinator Configuration dialog to have Change Auditor store the Active Directory and GPO protection templates in Active Directory instead of SQL.

When you have selected to store your Active Directory and Group Policy protection templates in Active Directory, you can use the Security feature on the Active Directory Protection page or Group Policy Protection page to provide an additional layer of security. The additional setting is intended for customers who require tighter security ACLs on their Active Directory and GPO objects and templates (i.e., the Change Auditor SQL database may not be fully secured by ChangeAuditor Administrators). For more information about setting this additional security on protected objects, see the Change Auditor for Active Directory User Guide.

Specify the appropriate option for storing Active Directory/GPO protection and ADAM (AD LDS) protection:

Store Active Directory/GPO Protection in:

Select one of the following options:

▪	SQL (default)

▪

AD

Store ADAM (AD LDS) Protection in:

Select one of the following options:

▪	SQL (default)

▪

AD

LDAP Authentication page

From this page you can specify the authentication method to use to make Active Directory requests.

•	Simple Authentication and Security Layer (SASL) to use Kerberos or NTLM.

•	Select Secure Socket Layer (SSL) to use certificates.

IMPORTANT: If you choose SSL, please see the Change Auditor Install Guide for important guidelines.

NOTE: When making Active Directory requests, credentials and message content are encrypted for both authentication methods.

Coordinator Credentials Required dialog

Coordinator Credentials Required dialog

The Coordinator Credentials Required dialog appears when the current authenticated user running the Change Auditor client does not have the proper credentials for accessing the Change Auditor coordinator service.

From this dialog, enter the proper credentials for accessing this service.

When using a group Managed Service Account:

•	The account must end with '$' and the password must be blank.

•	The domain should be entered in the Fully Qualified Domain Name format.

•	The local Administrator group must be added to the group policy debug programs. (Found under Local Computer Policy | Windows Settings | Security Settings | Local Policies | User Rights Assignments | Debug programs.)

•	The coordinator host must be correctly configured to retrieve the managed password for the specified group Managed Service Account.

•	The coordinator installer must be run as the administrator. Right-click and select Run as administrator.

Server

This read-only field displays the IP address/name of the server where the Change Auditor coordinator resides.

User

Enter the name of the user to be used to access the designated server.

Password

Enter the password associated with the user account entered above.

Domain

Enter the domain name for the account to be used to access the designated server.

Remember Creds

Click to cache the logon credentials entered so they can be used for subsequent authentications to the Change Auditor coordinator.

NOTE: You can clear these saved credentials by clicking the Clear Creds button on the Manage Connection Profiles dialog. Clearing the cached logon credentials on the current workstation allows you to use a different set of credentials for accessing the coordinator.

Credentials Required dialog

Credentials Required dialog

This dialog appears when credentials are required in order to connect to the selected ADAM (AD LDS) instance. On this dialog, specify the workgroup server that hosts the selected ADAM (AD LDS) instance and the credentials of a user that can access this instance. The account and credentials entered on this dialog are those of the administrative user account that was defined during the installation of the ADAM (AD LDS) instance.

Windows Account

Select this option if the selected ADAM (AD LDS) instance uses a Windows account for its credentials.

ADAM (AD LDS) Account

Select this option if the selected ADAM (AD LDS) instance uses an ADAM (AD LDS) account for its credentials.

Server

This field is automatically filled in based on the ADAM (AD LDS) instance selected.

Port

This field is automatically filled in based on the instance selected.

User

Enter the name of the administrative user account to be used to access the selected ADAM (AD LDS) instance.

Password

Enter the password associated with the user account entered above.

Domain

Enter the computer name of the workgroup server. This is only valid for Windows accounts.