Chat now with support
Chat with Support

Change Auditor 7.5 - User Guide

Welcome to Change Auditor Help Change Auditor Core Functionality
Change Auditor Core Functionality Change Auditor Overview Agent Deployment Change Auditor Client Overview Overview Page Searches Search Results and Event Details Custom Searches and Search Properties Enable Alert Notifications Administration Tasks Agent Configurations Coordinator Configuration Purging and Archiving your Change Auditor Database Working with Private Alerts and Reports Generate and Schedule Reports SQL Reporting Services Configuration Change Auditor User Interface Authorization Client Authentication Certificate authentication for client coordinator communication Integrating with On Demand Audit Enable/Disable Event Auditing Account Exclusion Registry Auditing Service Auditing Agent Statistics and Logs Coordinator Statistics and Logs Change Auditor Commands Change Auditor Email Tags
Microsoft 365 and Microsoft Entra ID Auditing Change Auditor for Active Directory
Change Auditor for Active Directory Overview Custom Active Directory Searches and Reports Custom Active Directory Object Auditing Custom Active Directory Attribute Auditing Member of Group Auditing Active Directory Federation Services Auditing ADAM (AD LDS) Auditing Active Directory Database Auditing Active Roles Integration Quest GPOADmin Integration Active Directory Protection Event Details Pane About us
Change Auditor for Authentication Services Change Auditor for Defender Change Auditor for EMC Change Auditor for Exchange Change Auditor for Windows File Servers Change Auditor for Active Directory Queries Change Auditor for Logon Activity Change Auditor for NetApp Change Auditor for SharePoint Change Auditor for SQL Server Change Auditor SIEM Integration Guide
Webhooks in Change Auditor Integrating Change Auditor and SIEM Tools Subscription Management
Adding the PowerShell module Viewing available commands and help Connecting to Change Auditor Managing subscriptions Working with event subscriptions in the client Managing a Splunk integration Splunk event subscription wizard Managing an IBM QRadar integration QRadar event subscription wizard Managing a Micro Focus Security ArcSight Logger and Enterprise Security Manager (ESM) integration ArcSight event subscription wizard Managing a Quest IT Security Search integration (Preview) Managing a Syslog integration Syslog event subscription wizard Managing a Microsoft Sentinel integration Microsoft Sentinel event subscription wizard
Webhook technical insights
Change Auditor Threat Detection Deployment Change Auditor Threat Detection Dashboard Change Auditor PowerShell Command Guide Change Auditor Dialogs
Change Auditor dialogs
Quest Change Auditor dialog Add Administrator Add Agents, Domains, Sites dialog Add Container dialog Add Active Directory Container dialog (AD Query) Add Facilities or Event Classes dialog Add Facilities or Event Classes dialog (Add With Events) Add File System Path dialog Add Foreign Forest Credential Add Group Policy Container dialog Add Local Account dialog Add Logons dialog Add Logons dialog (Add With Events) Add Object Classes dialog Add Object Classes dialog (Add With Events) Add Origin dialog Add Origin dialog (Add With Events) Add Registry Key dialog Add Results dialog Add Service dialog Add Service dialog (Add With Events) Add Severities dialog Add Severities dialog (Add With Events) Add SharePoint Path dialog Add SQL Instance dialog Add SQL Data Level Object Add Users, Computers or Groups dialog Add Where dialog Add Who dialog Advanced Deployment Options dialog Agent Assignment dialog Alert Body Configuration dialog Alert Custom Email dialog Auditing and Protection Templates dialog Authorizations: Application Group dialog Authorizations: Operations | Role Definitions | Task Definitions | Application Group Authorizations: Role dialog Authorizations: Task dialog Auto Deploy to New Servers in Forest dialog Browse for Folder dialog Browse SharePoint dialog Comments dialog Configuration Setup dialog Configure cepp.conf Auditing dialog Connection screen Coordinator Configuration tool Coordinator Credentials Required dialog Credentials Required dialog Custom Filter dialog Database Credentials Required dialog Directory object picker Domain Credentials dialog Eligible Change Auditor Agents dialog Event Logging dialog Export/Import dialog Install or Upgrade/Uninstall/Update Foreign Agent Credentials IP Address dialog Log page Logon Credentials dialog (Deployment page) Logon Credentials dialog (EMC Auditing wizard) Manage Connection Profiles dialog New Report Layout dialog Microsoft 365 dialog Rename dialog Save As dialog Select a SQL Instance and Database dialog Select Destination Folder dialog Select Exchange Users dialog Select Registry Key dialog Select SQL Reporting Services Template dialog Shared Mailboxes dialog SharePoint Credentials Required dialog When dialog
About Us

Refresh or clear Deployment page information

Previous Next

Refresh or clear Deployment page information

To force a topology harvest refresh:
1
On the Deployment page, click Force Refresh.
2
Change Auditor forces a topology harvest and display any new servers/workstations added since the last topology harvest.
* 
NOTE: The default harvest interval is every 3 hours.
NOTE: Topology scan takes a long time when the environment contains a large number of workstations.
To refresh a coordinator’s status:
1
On the Deployment page, select one or more servers from the list.
2
Click Refresh Status.
3
Change Auditor retrieves and displays the latest status for the selected agents, including the agent version and deployment results.
To clear the deployment results:
1
On the Deployment page, right-click a server or workstation from the list and click Clear Result.
2
This clears the current and any future entries in the Deployment Result cell for the selected server and workstation.

Change Auditor Client Overview

Previous Next

Change Auditor Client Overview

•
Starting the Change Auditor client
•
Managing connection profiles
•
Client components
•
Customize table content
•
Filter data
•
Directory object picker

Starting the Change Auditor client

Previous Next

Starting the Change Auditor client

To connect to the client, the following conditions must be met:

•
The coordinator service is running and has a valid SCP listening port (no firewall implications).
•
The current authenticated user running the client has the proper credentials to access the Change Auditor coordinator service. If this condition fails, the client displays the Coordinator Credentials Required dialog where you can enter the proper logon credentials.
•
The current authenticated user is a member of either the ChangeAuditor Administrators or ChangeAuditor Operators AD group. If this condition fails, the Change Auditor logon screen displays an error and credential text boxes for entering the appropriate credentials.
•
When using a direct database connection, the current authenticated user running the client has the proper SQL credentials to access the SQL database. If this condition fails, the client displays the Database Credentials Required dialog where you can enter new logon credentials.
To start the client
1
Select Start | All Programs | Quest | Change Auditor | Change Auditor Client.

You can connect to the ‘default connection’ profile or specify a different connection profile. A connection profile defines the connection method to connect to a coordinator in trusted or untrusted forests, or to the database directly without connecting with the coordinator. See Managing connection profiles for more information.

2
Select Connect to use the default connection profile.

Alternatively, select a previously defined connection profile and click Connect.

If you do not have the proper credentials required for access, the credentials dialogs display allowing you to enter the required credentials.

Depending on how your system has been configured:

▪
You may need to enter a user account and password or a smart card certificate and personal identification number.
▪
Select the option to disconnect the client from the coordinator after 30 minutes of inactivity.
3
The first time the client opens, you are presented with the Start page which provides up-to-date product information.
4
Select the Deployment page to deploy agents. This page may initially be empty until the current forest’s server topology is harvested. This page automatically refreshes when the topology harvest completes.
* 
NOTE: Topology scan takes a long time when the environment contains many workstations.
5
To see a real-time stream of events based on a ‘favorite’ search definition as well as other valuable summary information about the application, select the Overview page.

Accessing Change Auditor news and updates

Previous Next

Accessing Change Auditor news and updates

The first time you open Change Auditor, you are presented with the Start page. Form here, you can view and access relevant information including news and updates, support and knowledge base content, online documentation (release notes and guide), links to the latest releases, and essential contact links.

If you do not want to see this page, clear the Display this page each time I log in option. The next time you log in to Change Auditor you will be directed automatically to the Overview page. However, we suggest you keep the Start page active as it contains the most up-to-date access to the supporting information you may require.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating