Chat now with support
Chat with Support

Change Auditor 7.5 - User Guide

Welcome to Change Auditor Help Change Auditor Core Functionality
Change Auditor Core Functionality Change Auditor Overview Agent Deployment Change Auditor Client Overview Overview Page Searches Search Results and Event Details Custom Searches and Search Properties Enable Alert Notifications Administration Tasks Agent Configurations Coordinator Configuration Purging and Archiving your Change Auditor Database Working with Private Alerts and Reports Generate and Schedule Reports SQL Reporting Services Configuration Change Auditor User Interface Authorization Client Authentication Certificate authentication for client coordinator communication Integrating with On Demand Audit Enable/Disable Event Auditing Account Exclusion Registry Auditing Service Auditing Agent Statistics and Logs Coordinator Statistics and Logs Change Auditor Commands Change Auditor Email Tags
Microsoft 365 and Microsoft Entra ID Auditing Change Auditor for Active Directory
Change Auditor for Active Directory Overview Custom Active Directory Searches and Reports Custom Active Directory Object Auditing Custom Active Directory Attribute Auditing Member of Group Auditing Active Directory Federation Services Auditing ADAM (AD LDS) Auditing Active Directory Database Auditing Active Roles Integration Quest GPOADmin Integration Active Directory Protection Event Details Pane About us
Change Auditor for Authentication Services Change Auditor for Defender Change Auditor for EMC Change Auditor for Exchange Change Auditor for Windows File Servers Change Auditor for Active Directory Queries Change Auditor for Logon Activity Change Auditor for NetApp Change Auditor for SharePoint Change Auditor for SQL Server Change Auditor SIEM Integration Guide
Webhooks in Change Auditor Integrating Change Auditor and SIEM Tools Subscription Management
Adding the PowerShell module Viewing available commands and help Connecting to Change Auditor Managing subscriptions Working with event subscriptions in the client Managing a Splunk integration Splunk event subscription wizard Managing an IBM QRadar integration QRadar event subscription wizard Managing a Micro Focus Security ArcSight Logger and Enterprise Security Manager (ESM) integration ArcSight event subscription wizard Managing a Quest IT Security Search integration (Preview) Managing a Syslog integration Syslog event subscription wizard Managing a Microsoft Sentinel integration Microsoft Sentinel event subscription wizard
Webhook technical insights
Change Auditor Threat Detection Deployment Change Auditor Threat Detection Dashboard Change Auditor PowerShell Command Guide Change Auditor Dialogs
Change Auditor dialogs
Quest Change Auditor dialog Add Administrator Add Agents, Domains, Sites dialog Add Container dialog Add Active Directory Container dialog (AD Query) Add Facilities or Event Classes dialog Add Facilities or Event Classes dialog (Add With Events) Add File System Path dialog Add Foreign Forest Credential Add Group Policy Container dialog Add Local Account dialog Add Logons dialog Add Logons dialog (Add With Events) Add Object Classes dialog Add Object Classes dialog (Add With Events) Add Origin dialog Add Origin dialog (Add With Events) Add Registry Key dialog Add Results dialog Add Service dialog Add Service dialog (Add With Events) Add Severities dialog Add Severities dialog (Add With Events) Add SharePoint Path dialog Add SQL Instance dialog Add SQL Data Level Object Add Users, Computers or Groups dialog Add Where dialog Add Who dialog Advanced Deployment Options dialog Agent Assignment dialog Alert Body Configuration dialog Alert Custom Email dialog Auditing and Protection Templates dialog Authorizations: Application Group dialog Authorizations: Operations | Role Definitions | Task Definitions | Application Group Authorizations: Role dialog Authorizations: Task dialog Auto Deploy to New Servers in Forest dialog Browse for Folder dialog Browse SharePoint dialog Comments dialog Configuration Setup dialog Configure cepp.conf Auditing dialog Connection screen Coordinator Configuration tool Coordinator Credentials Required dialog Credentials Required dialog Custom Filter dialog Database Credentials Required dialog Directory object picker Domain Credentials dialog Eligible Change Auditor Agents dialog Event Logging dialog Export/Import dialog Install or Upgrade/Uninstall/Update Foreign Agent Credentials IP Address dialog Log page Logon Credentials dialog (Deployment page) Logon Credentials dialog (EMC Auditing wizard) Manage Connection Profiles dialog New Report Layout dialog Microsoft 365 dialog Rename dialog Save As dialog Select a SQL Instance and Database dialog Select Destination Folder dialog Select Exchange Users dialog Select Registry Key dialog Select SQL Reporting Services Template dialog Shared Mailboxes dialog SharePoint Credentials Required dialog When dialog
About Us

Shared Mailboxes dialog

Previous Next

Shared Mailboxes dialog

The Shared Mailboxes dialog appears when the Shared Mailboxes tool bar button on the Exchange Mailbox Auditing Page is clicked.

* 
NOTE: The Shared Mailboxes tool bar button is only available when there is an Exchange server installed in the forest.

The Shared Mailboxes dialog consists of the following pages:

•
Auto Detected page
•
User Defined page
Auto Detected page

The Auto Detected page contains a read-only list of the Exchange 2007 (or higher) shared mailboxes that have been automatically detected in the network. The following information is displayed for all of the shared mailbox, room and equipment resources detected in an Exchange 2007 (or higher) mailbox store:

Share Type

Displays the type of shared resource: Mailbox, Room or Equipment.

Audited

Indicates whether the mailbox has been added to the Exchange Mailbox auditing list.

Exchange Mailbox

Displays the canonical name of the Exchange Mailbox.

Name

Displays the name of the Exchange Mailbox.

DisplayName

If applicable, displays the Display Name assigned to the Exchange Mailbox.

By default, this list is filtered to display only the shared mailboxes selected for auditing. However, if you would like to view a list of all shared mailboxes detected, clear the Filter Shared Mailboxes Based on Exchange Auditing Scope check box at the bottom of this page.

User Defined page

Using this page you can mark normal mailboxes as ‘shared’ by manually adding them to the shared mailbox list. To add a mailbox to this list, click Add to open the Exchange Shared Mailboxes wizard and select the directory objects whose Exchange mailboxes are to be marked as shared mailboxes by Change Auditor for Exchange.

* 
NOTE: Any mailbox can be marked as a shared mailbox by manually adding it to the shared mailbox list.

Auditing normal mailboxes where access permission is granted to many delegates (more than 10), will generate extremely large numbers of non-owner events. If these mailboxes need to be audited, add these mailboxes to the Shared Mailbox list to reduce unwanted non-owner events and to improve performance

Once added, the following information is displayed:

Type

Displays the type of directory object selected for Exchange Mailbox auditing: (for example, Organizational Unit, User, and so on).

Share Type

Indicates the type of shared resource: Mailbox, Room or Equipment.

Scope

Displays the scope of auditing coverage assigned:

▪
Object
▪
One Level
▪
Subtree

Exchange Mailbox

Displays the canonical name associated with the directory object.

Name

Displays the name of the directory object.

DisplayName

If applicable, displays the Display Name assigned to the directory object.

SharePoint Credentials Required dialog

Previous Next

SharePoint Credentials Required dialog

The SharePoint Credentials Required dialog appears when the Set Credentials button is clicked in the SharePoint Auditing wizard. When selecting the Change Auditor agent that is to be used to capture SharePoint events, you must enter the credentials to be used to access the selected SharePoint farm. This account must have the following permissions:

•
At a minimum, the account must have full access to all SharePoint sites. It must also have read permissions on all SharePoint SQL databases.
•
Recommended: Use the SharePoint farm administrator account that was supplied when SharePoint was installed.

User

Enter the account that has access to the SharePoint farm.

Password

Enter the password associated with the user account entered above.

Domain

Enter the name of the domain where the agented server resides.

When dialog

Previous Next

When dialog

The When dialog appears when the Runtime Prompt check box is checked on the When search properties tab of the search selected for execution.

Date Range

Select one of the following options to define the date range for the search query.

▪
From/To - Select this option to specify a start and end date. Once selected, the From and To controls are enabled allowing you to select a date from the calendar grid or enter a date.
▪
Last - Select this option to specify a relative date and value based on the actual date/time when the search is started. Once selected, the Last value controls are enabled allowing you to specify a number and a clock/calendar interval (minutes, hours, days, weeks, months, quarters, or years).
▪
This - Select this option to specify a current calendar interval (day, week or month).

Time of Day

Optionally, select the following option to specify a time range for the search query.

▪
From/To - Select this option to specify a start and end time. Once selected, the From and To controls are enabled allowing you to enter a time.

About Us

Previous Next

About Us

About us provides information about Quest Software core values, how to contact Quest, and technical support resources.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating