Change Auditor 7.5 - User Guide

Coordinator configuration

Coordinator configuration

To configure certificate authentication on a coordinator:

1	Ensure a valid Server authentication certificate is deployed on the host server.

2	Install the Change Auditor coordinator as described in the Change Auditor Installation Guide.

NOTE: When specifying the Coordinator SQL Server information, connections using Windows authentication may fail if NTLM restrictions are in place and the SQL server specified is not excepted from the restrictions. In this case the use of SQL authentication is recommended.

3	Stop the coordinator, if it is running.

4	In the Coordinator installation folder (located by default in Program files\Quest\ChangeAuditor\Service). Make a backup copy of the ChangeAuditor.Service.exe.config file, then open the file using a text editor such as Notepad.exe.

5	Under the <configuration> <appSettings file=””> nodes, locate the <add key="WcfAuth" value="Windows" /> node and change the value from “Windows” to “Certificate”.

If you are using self-signed certificates (without Certificate Revocation List information), locate the <add key="DisableCrlCheck" value="false" /> node and change the value from “false” to “true”.

By default a suitable service certificate is selected from the Local Machine\Personal certificate store automatically. If an alternate certificate in the Local Machine\Personal certificate store is required, locate the <add key="ServiceCertificate" value="" /> node and change the value from “” (empty string) to the thumbprint string copied from a certificate found in the certlm.msc Certificate Manager for Local Machine applet in the User\Personal certificate store. Ensure that the certificate is trusted, is not expired, has a private key and at least the “Server Authentication” (“Ensures the identity of a remote computer”) purpose.

6	Save the changes to the file and restart the coordinator.

Windows client configuration

Windows client configuration

NOTE:   • Before starting, ensure that a valid client authentication certificate is deployed to the client host computer if any coordinator is configured for certificate authentication.

You can manage the connection profile for coordinators configured for certificate authentication by selecting Manage on the Connection screen. The following information and options are available:

•	The Connection Profiles displays Yes in the Certificate Auth column if the coordinator is configured for certificate authentication; and No if configured for the default Windows authentication. From here, you can also see the current certificate subject field and expiration date.

•	When the Override automatic client certificate selection for the current user option is enabled, users can specify an alternate certificate from the Current User’s Personal certificate store.

•	When you select to add or edit a manual connection, you will have the option to Use WCF Certificate Authentication and Disable Certificate Revocation List Check. When specifying the coordinator service properties, these check boxes must reflect the options for which the coordinator is configured.

NOTE: These options do not apply to the Forest, Global Catalog and Database Direct connection methods.

•

When using a connection profile for the first time, or one for which credentials have not been saved with the “Remember Me” option, the user is prompted for the credentials of a domain user with the Change Auditor security group membership appropriate to the user’s role (such as Operator or Administrator).

 

 

Integrating with On Demand Audit

Integrating with On Demand Audit

•	Managing a Quest On Demand Audit integration

•	Creating an On Demand Audit configuration

•	Working with an On Demand Audit configuration

Managing a Quest On Demand Audit integration

Managing a Quest On Demand Audit integration

Quest On Demand Audit is a Software as a Service (SaaS) application, available through quest-on-demand.com that provides extensive, customizable auditing of critical activities and detailed alerts about vital changes taking place in Microsoft 365 and Microsoft Entra ID.

On Demand Audit can provide a single view of activity across hybrid Microsoft environments. By sending Change Auditor Active Directory, Group Policy, Logon Activity, and File System Activity event data, you can gain visibility to on premises changes.

Historical data sent to On Demand Audit is as follows:

•	Trial On Demand Audit subscription: 24 hours.

•	Full On Demand Audit subscription: All events in Change Auditor. (Any events collected prior to Change Auditor 7.0.0 will not be included.)

By integrating Change Auditor with Quest On Demand Audit, you will gain access to:

•	Granular, delegated access to tenants, workloads, and reports.

•	Interactive, rich visualizations of on-premises and cloud events.

•	Responsive search across tenants that delivers immediate results.

•	Long-term storage of audit data.