Chat now with support
Chat with Support

Change Auditor 7.0.4 - Release Notes

Office 365 auditing

Office 365 auditing
Table 31. Office 365 auditing requirements
Component
Supported versions

Change Auditor

Change Auditor for Exchange

Change Auditor for SharePoint

Office 365 subscriptions

Change Auditor can audit the various Office 365 plans offered by Microsoft including business and enterprise subscriptions.

Windows PowerShell

Windows PowerShell version 3 on the computer where the agent is installed.

URLs

The agent configured to monitor Office 365 must be able to access the following URLs:

•
https://login.microsoftonline.com
•
https://graph.windows.net
•
https://manage.office.com
•
https://outlook.office365.com/powershell-liveid
•
https://graph.microsoft.com

Ports

•
A firewall outbound exception for remote port 443 (https) must exist for every agent computer used for Office 365 auditing. Port 443 is used for communicating with the Microsoft cloud.
•
If an agent is separated from the coordinator by a firewall, you must create a firewall exception for port 8373 on every agent computer to be used for Office 365 or Azure Active Directory auditing. Port 8373 is the default port that enables the coordinator to communicate with the agent. A different port number can, however, be specified by running Set-CAConfiguration command. For details, see the Change Auditor PowerShell Command Guide.

Required rights and permissions

•
For Exchange Online, the user account specified for the Auditing Configuration Account must be assigned the Exchange Administrator role.
•
The user account specified for the Configuration Account must be assigned the Global Administrator role. The account must also be licensed for Exchange Online (other Office 365 licenses are not required).
•
Change Auditor does not support accounts that have multi-factor authentication enabled.
•
The accounts must be sourced from Azure Active Directory. Accounts from other sources are not supported.

For more information

See the Office 365 and Azure Active Directory Auditing User Guide.

Fluid File System auditing

Table 32. Fluid File System auditing requirements
Component
Supported versions

Change Auditor

Change Auditor for Fluid File System

Dell Fluid File System supported up to the following versions

Dell Fluid File System version 5.0

Dell Fluid File System version 6.0

NOTE: Auditing is supported only for the CIFS/SMB protocol. Events initiated through the NFS or FTP protocols are not supported.

Dell Enterprise Manager /Dell Storage Manager supported up to the following version

Dell Enterprise Manager version 15.3

Dell Storage Manager version 16.3

NOTE: The FluidFS cluster that is going to be audited must be registered with Enterprise Manager’s Data Collector service.
NOTE: Administrator rights to Enterprise Manager are required to create, edit, delete FluidFS auditing templates in Change Auditor.

Change Auditor Configuration Service for Dell FluidFS

The Change Auditor Configuration Service for Dell FluidFS.msi is located in the Integration/FluidFS folder of the installation package.

NOTE: The service can be installed only on 64-bit Windows 2008 R2 and later and requires Microsoft’s .NET Framework 4.5.2.
IMPORTANT: The domain of the configuration service must have a two-way trust with the domain of the auditing agent and trust the domain of the coordinator (one-way trust).

Windows PowerShell

Windows PowerShell version 4 on the computer where the Data Collector service is installed.

Agent requirements

Locate an agent close to the Dell FS8600 cluster (use fastest connection type available).

Ports

To receive events, the following ports must be open:

•
Configuration Service TCP port 9003 on the local computer where the Change Auditor Configuration Service for Dell FluidFS is installed.
•
TCP port 9004 on the agent host for inbound connections with the FluidFS cluster.

These are default port values that are configurable.

To change the configuration service port:
1
Open the FluidFS.Configuration.Service.exe.config file. The default location for this file is "C:\Program Files\Quest\ChangeAuditor\FluidFS Configuration Service" where the FluidFS Configuration service is installed. Edit the port number with the following snippet in the code:
<appSettings>
    <add key="ServicePort" value="9003"/>
  </appSettings>
2
Enter the new port in the Change Auditor FluidFS auditing template in the client by adding the name of the server followed by a colon and the port number.
3
Refresh the agent configuration.
To change the RPC host port:
1
Change the port value using the Enterprise Manager client.
2
Save the template or run the Update-CAFluidFSConfiguration command.
The FluidFS.Configuration.Service.PowerShell module is located in the install directory of the Change Auditor Configuration Service for Dell FluidFS.
3
Refresh the agents.

Encryption

If you are going to turn on encryption for auditing, the domain of the coordinator must trust the domain of the user account specified (one-way trust) during encryption configuration.

Required rights and permissions

The account used for auditing and managing your FluidFS auditing templates in Change Auditor:

•
Should be granted ‘Administrator’ privilege in Enterprise Manager.
•
Should be used to register the FluidFS cluster in Enterprise Manager.

For more information

See the Change Auditor for Fluid File System User Guide for more information about configuring and using Change Auditor for Fluid File System.

Azure Active Directory auditing

Azure Active Directory auditing
Table 33. Azure Active Directory auditing requirements
Component
Supported versions

Change Auditor

Change Auditor for Active Directory

Azure Active Directory

Change Auditor can audit the Azure Active Directory that is included with an Office 365 subscription or the Azure Active Directory Basic subscription.

URLs

The agent configured to monitor Azure Active Directory must be able to access the following URLs:

•
https://login.microsoftonline.com
•
https://graph.windows.net
•
https://graph.microsoft.com

Ports

•
443 (HTTPS) — for the agent to connect to the Azure Active Directory.
•
8373 — for the Change Auditor coordinator service to connect to agent computer.

Required rights and permissions

•
A user account with the Global Administrator role is required for auditing configuration. The account must be sourced from Azure Active Directory. Accounts from other sources are not supported.
•
Change Auditor does not support accounts that have multi-factor authentication enabled.

Synchronized environments

When auditing Azure Active Directory in a synchronized environment, Change Auditor provides more event details by mapping identities from on-premises directories with Azure Active Directory.

The following conditions must be met for Change Auditor to perform the mapping:

•
Synchronization performed with Azure Active Directory Connect (AD Connect).
•
Azure AD Connect synchronization process is active in your on-premises environment and directory sync is active in your cloud environment.
•
An Azure Active Directory auditing template has been created to audit your online environment that is being synchronized with on-premises Active Directory.
•
The agent that is specified in the auditing template, must be a member server of the forest that is being synchronized with the Azure Active Directory.

When Federation with AD FS is used as the single sign-on method, Azure logon events will no longer be generated since the authentication is done by the on-premises AD FS instance.

For more information

See the Change Auditor for Active Directory User Guide.

Product licensing

As of Change Auditor 7.0 a a new license key is required. Please obtain the new key before installing the new release. To obtain a new key, refer to the License Key Upgrade page: https://support.quest.com/my-account/licensing.

* 
NOTE: You will need your current license numbers. To get this information, select the license in the License Manager and choose Details.

If you purchased multiple Change Auditor products, you only need one instance of the Change Auditor product. The code is the same for all and the license keys determine what features are enabled and disabled in the product.

The following products require separate licenses which can be applied during the coordinator installation process:

•
Change Auditor for Active Directory
•
Change Auditor for Active Directory Queries
•
Change Auditor for Authentication Services
•
Change Auditor for Defender
•
Change Auditor for EMC
•
Change Auditor for Exchange
•
Change Auditor for Fluid File System
•
Change Auditor for Logon Activity User (to capture logon activity from server agents)
•
Change Auditor for Logon Activity Workstation (to capture logon activity from workstation agents)
•
Change Auditor for Skype for Business
•
Change Auditor for NetApp
•
Change Auditor for SharePoint
•
Change Auditor for SQL Server
•
Change Auditor for Windows File Servers

If you are licensing multiple Change Auditor products, you can apply the licenses in any order but must apply all the licenses provided.

To enable a trial or purchased commercial license:
1
Copy the Change Auditor license files to your desktop, or other convenient location.
2
If you have not installed the Change Auditor components, from a member server run the autorun.exe file to start the Quest Change Auditor autorun. See Upgrade and compatibility for more information about installing the Change Auditor components.
3
On the Install page of the autorun, click Install for the Install Change Auditor Coordinator option to start the Change Auditor Coordinator Setup wizard.
4
During the coordinator installation, you are prompted to locate the Change Auditor license files. Click Open License Dialog to locate and apply a license.
5
Review your installed licensed components by right-clicking the coordinator icon in the system tray and selecting Licensing or by selecting Help | About | Licensing in the client.
To apply licenses after initial installation:

If you purchased more Change Auditor products after the initial installation, you can apply new licenses from the coordinator icon in the system tray.

1
Right-click the coordinator icon in the system tray and select Licensing.
2
From the Licenses tab, click Select License.
3
Locate and apply the new product licenses.
The new licenses are applied once the configuration is updated.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating