Chat now with support
Chat with Support

Change Auditor 7.5 - User Guide

Welcome to Change Auditor Help Change Auditor Core Functionality
Change Auditor Core Functionality Change Auditor Overview Agent Deployment Change Auditor Client Overview Overview Page Searches Search Results and Event Details Custom Searches and Search Properties Enable Alert Notifications Administration Tasks Agent Configurations Coordinator Configuration Purging and Archiving your Change Auditor Database Working with Private Alerts and Reports Generate and Schedule Reports SQL Reporting Services Configuration Change Auditor User Interface Authorization Client Authentication Certificate authentication for client coordinator communication Integrating with On Demand Audit Enable/Disable Event Auditing Account Exclusion Registry Auditing Service Auditing Agent Statistics and Logs Coordinator Statistics and Logs Change Auditor Commands Change Auditor Email Tags
Microsoft 365 and Microsoft Entra ID Auditing Change Auditor for Active Directory
Change Auditor for Active Directory Overview Custom Active Directory Searches and Reports Custom Active Directory Object Auditing Custom Active Directory Attribute Auditing Member of Group Auditing Active Directory Federation Services Auditing ADAM (AD LDS) Auditing Active Directory Database Auditing Active Roles Integration Quest GPOADmin Integration Active Directory Protection Event Details Pane About us
Change Auditor for Authentication Services Change Auditor for Defender Change Auditor for EMC Change Auditor for Exchange Change Auditor for Windows File Servers Change Auditor for Active Directory Queries Change Auditor for Logon Activity Change Auditor for NetApp Change Auditor for SharePoint Change Auditor for SQL Server Change Auditor SIEM Integration Guide
Webhooks in Change Auditor Integrating Change Auditor and SIEM Tools Subscription Management
Adding the PowerShell module Viewing available commands and help Connecting to Change Auditor Managing subscriptions Working with event subscriptions in the client Managing a Splunk integration Splunk event subscription wizard Managing an IBM QRadar integration QRadar event subscription wizard Managing a Micro Focus Security ArcSight Logger and Enterprise Security Manager (ESM) integration ArcSight event subscription wizard Managing a Quest IT Security Search integration (Preview) Managing a Syslog integration Syslog event subscription wizard Managing a Microsoft Sentinel integration Microsoft Sentinel event subscription wizard
Webhook technical insights
Change Auditor Threat Detection Deployment Change Auditor Threat Detection Dashboard Change Auditor PowerShell Command Guide Change Auditor Dialogs
Change Auditor dialogs
Quest Change Auditor dialog Add Administrator Add Agents, Domains, Sites dialog Add Container dialog Add Active Directory Container dialog (AD Query) Add Facilities or Event Classes dialog Add Facilities or Event Classes dialog (Add With Events) Add File System Path dialog Add Foreign Forest Credential Add Group Policy Container dialog Add Local Account dialog Add Logons dialog Add Logons dialog (Add With Events) Add Object Classes dialog Add Object Classes dialog (Add With Events) Add Origin dialog Add Origin dialog (Add With Events) Add Registry Key dialog Add Results dialog Add Service dialog Add Service dialog (Add With Events) Add Severities dialog Add Severities dialog (Add With Events) Add SharePoint Path dialog Add SQL Instance dialog Add SQL Data Level Object Add Users, Computers or Groups dialog Add Where dialog Add Who dialog Advanced Deployment Options dialog Agent Assignment dialog Alert Body Configuration dialog Alert Custom Email dialog Auditing and Protection Templates dialog Authorizations: Application Group dialog Authorizations: Operations | Role Definitions | Task Definitions | Application Group Authorizations: Role dialog Authorizations: Task dialog Auto Deploy to New Servers in Forest dialog Browse for Folder dialog Browse SharePoint dialog Comments dialog Configuration Setup dialog Configure cepp.conf Auditing dialog Connection screen Coordinator Configuration tool Coordinator Credentials Required dialog Credentials Required dialog Custom Filter dialog Database Credentials Required dialog Directory object picker Domain Credentials dialog Eligible Change Auditor Agents dialog Event Logging dialog Export/Import dialog Install or Upgrade/Uninstall/Update Foreign Agent Credentials IP Address dialog Log page Logon Credentials dialog (Deployment page) Logon Credentials dialog (EMC Auditing wizard) Manage Connection Profiles dialog New Report Layout dialog Microsoft 365 dialog Rename dialog Save As dialog Select a SQL Instance and Database dialog Select Destination Folder dialog Select Exchange Users dialog Select Registry Key dialog Select SQL Reporting Services Template dialog Shared Mailboxes dialog SharePoint Credentials Required dialog When dialog
About Us

Enable and schedule reporting

Previous Next


Enable and schedule reporting

When reporting is enabled, a report containing the search results of an individual search, built-in, or custom, can be sent as an attachment through email to the designated recipients or written to a shared folder. Use the Report tab, which is one of the Search Properties tabs, to enable reporting for the selected search, define the format, and how and when to distribute the report.

To email reports, you need to enable SMTP for alerting and reporting and specify the Mail Server to use in the SMTP Configuration pane on the Coordinator Configuration page. The same SMTP configuration is used for both alert notifications and reporting. See Configure email alert notifications/reports for more information.

To send reports to a shared folder, you need to enable shared folders for reports and specify the credentials that will be used to write to a shared folder. See Shared Folder Configuration for details.

Change Auditor calculates the Next Run of the reports, archive, and purge jobs based on the master time zone. For new deployments, the maser time zone is set to the time zone of the server where the first coordinator is installed. During an upgrade, the master time zone is set to UTC. You can manually change the master time zone, using the set-CAScheduleMaserTimeZone and get-CAScheduleMasterTimeZone commands. See the Change Audit PowerSell Command User Guide for details. Quest recommends that you set the master time zone to the time zone where most the users are located.

Report tab (Search Properties tabs)

The Report tab displays the current report configuration for the selected search definition. From the Report tab you can perform the following tasks:

Use the controls on the Report tab as described in the following table:

Table 1. Report tab: Field and Control descriptions

Field and Control

Description

Report Enabled

Select to enable reporting for the current search definition.

Report Configuration

Layout

Specifies the report template to use for the report’s headers and footers.

The Default report template is defined for you. To define more templates, use the Report Layouts page on the Administration Tasks tab.

NOTE: This setting is disabled if you click Design Report to define a custom report layout for the selected search.

Report

Specifies if the report is generated and sent on a weekly (default) or monthly schedule.

NOTE: When Monthly is selected, specify the schedule to generate the report. For example, 1 for every month (default), 2 for every other month, 6 for every six months or twice a year.

Every

When a Weekly report is selected, specify the schedule to use to generate the report. For example, 1 for every week (default), 2 for every other week, 3 for every third week, and 4 for every fourth week.

On Days

When a Weekly report is selected, define the days of the week to generate the report. The default is Monday through Friday.

On Day of Month

When a Monthly report is selected, specifies on which day of month to generate the report:

Run Time

Specifies the time to generate the report.

Reset

Use to reset the settings back to the factory defaults.

Send to a mailbox

Use to select the options to share reports through email.

Enter the email address of one or more persons who are to receive the report.

You can also use the browse button to locate and select the users who are to receive the report. Selecting this button displays one of the following dialogs:

Click Expand Properties (right arrow) to the left of the To field to enter additional recipients and/or change the subject. When expanded, you can enter the following information:

To: Enter or use the browse button to specify the email address of users who are to receive the report.
Reply: Enter or use the browse button to specify the email address to which reply emails are to be sent.
Cc: Enter or use the browse button to specify the email address of users who are to receive a copy of the report email.
Bcc: Enter or use the browse button to specify the email address of users who are to receive a blind copy of the report email.

Click Collapse Properties (down arrow) to hide these additional properties and show the other settings available on the Report Configuration pane.

Send to a shared folder

Use to select a shared folder to write reports to. You must enter a network path; a local address will not be accepted.

The To field is automatically populated with the default shared folder path. However, you can specify a different path.

The credentials from the Shared Folder Configuration are used to write reports to the shared folder. (The credentials are specified under the coordinator configuration Shared Folder Configuration option. See Shared Folder Configuration for details.) Ensure that the account has permissions to write to the shared folder.

If you change the shared folder, the new path does not display in the search grid until you refresh the searches tree (click F5 while on the searches tree).

Do not send empty reports

When selected, a report will not be sent to email or a shard folder if it does not contain any results.

Send empty report email notification

Select this to receive an email notification for a report that ran but did not contain any results.

Attach

The report is sent as an email attachment. Select the appropriate Attach option to define the format to be used for the report:

Columns

Defines how the report content is to fill the page:

Fixed Width nn.nn Inches/Column
NOTE: These settings are disabled if you click Design Report to define a custom report layout for the selected search.

Time Zone

Specifies the time zone to be used for the time stamp in the name of the report attachment. By default, the time zone of the computer where the Change Auditor client resides is used.

Last Run

This read-only field specifies the last time (date and time) the report ran.

Next Run

This read-only field specifies the next time (date and time) when the report is scheduled to run.

To enable/schedule reporting:
2
Expand the Private or Shared folders in the explorer view to locate the search to which reporting is to be enabled. Select the search from the Search list in the right pane.
a
To share a report through email, select Send to a mailbox, enter a valid email address in the To field and then select the Report Enabled check box.
b
To send a report to a folder, select Send to a shared folder, enter a valid network path in the To field and then select the Report Enabled check box.
Run Time: Specify the time (based on the client’s current local date and time) at which the report is to be run.
NOTE: See Table 1 for a detailed description of the report configuration settings.
5
Click Save.

When reporting is enabled, the following details are added to the search entry in the Searches list:

Report column displays ‘Enabled’
Report To, Report Cc and Report Bcc columns display the email address of specified recipients or a shared folder path.
To disable a scheduled report:
2
Expand the Private or Shared folders in the explorer view to locate the search whose reporting is to be disabled. Select the search from the Search list in the right pane.
Right-click the search and select Report | Disable Report.
Open the Report tab and clear the Report Enabled check box. Click Save.

Launch Report Designer

Previous Next


Launch Report Designer

The report designer in Change Auditor uses StimulReport.Net components for designing reports. For a detailed description and functionality of each component available, click F1 to view the Stimulsoft online help (www.stimulsoft.com).

To launch the report designer:

The report designer appears allowing you to create a custom report layout for the selected search.

NOTE: Once the report designer is launched, the Layout and Columns settings on the Report tab for the selected search are disabled. To re-enable these settings, click Reset at the bottom of the Report tab.

Publish reports

Previous Next


Publish reports

ChangeAuditor supports Microsoft's Microsoft SQL Server Reporting Services (SRS), providing a comprehensive, server-based solution that enables the creation, management and delivery of reports.

To publish reports to a SRS server:
2
Expand the Private and Shared folders and select a folder in the explorer view to display the list of search/report definitions stored in the selected folder.
3
From the right-hand pane, right-click a search/report definition and select Publish reports using SQL Reporting Services. This displays the Create Report dialog allowing you to configure the SQL Server Reporting services to be used and to specify the report details. (To publish a series of reports (folder), select a folder in the explorer view.)

Where: <SQL_Server> is the name of the server hosting SRS and <ReportServer> is the name of the report server virtual directory. (In a default Reporting Services installation, the name of the virtual directory is reportserver.)

NOTE: You can use the Import SRS Settings button on the Reporting Services Setup dialog to import a SQL Reporting Services template that was previously created to define the necessary SRS settings or enter the SRS settings as defined below.
Click Test to verify the credentials entered above.

Print or save a page's contents

Previous Next


Print or save a page’s contents

From the client you can print or save the contents of the currently displayed page using the File | Print menu commands or the Print tool bar options. For each Change Auditor page, the data grid as it is displayed on the page is printed, except for the following pages:

To print a page:
NOTE: You may want to use the Print | Page Setup option in the client or Preferences button on the Print dialog to change the page orientation to Landscape and decrease the page margins prior to printing the pages that contain grids.
3
Click Print to close the dialog and send the displayed page to the designated printer.
To preview a report prior to printing:
1
Open the page to be printed, expand Print and select Print Preview.
To save a page to a file:
1
Open the page to be saved to a file, expand Print and select one of the following commands:
2
The Save As dialog appears allowing you to specify the file name and location. Also if you clicked the Print to File command, you can specify the type of file to be saved (.xls, .xlsx or .csv).
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating