Chat now with support
Chat with Support

Change Auditor for Defender 7.0.4 - User Guide

Deployment requirements and notes

Because Defender extends the Active Directory schema, once the Change Auditor for Defender license is applied, agents installed on Domain Controllers detect any changes made to the Defender-specific attributes in Active Directory and generate events.

* 
NOTE: Specific Defender templates or configuration is not required.

Make changes and run a report

1
To test that events are being captured, make some changes on a domain where Defender is deployed.
For example:
•
Add or remove a Defender license
•
Add a Defender security server to a domain
•
Change a Defender policy for a group or user
2
Launch the Change Auditor client (Start | All Programs | Quest | Change Auditor | Change Auditor Client) to review the events generated.
3
Open the Searches tab.
4
Expand the Shared | Built-in | Defender folder in the left pane.
5
Locate and double-click All Defender events in the last 30 days in the right pane.
A new Search Results tab is added to the client displaying the events captured over the last seven days.
6
Select an event from the Search Results grid to display the event details for the selected event.
* 
NOTE: If the Search Properties tabs are displayed across the bottom of the Search Results page, double-click an event to display the event details for the selected event.

Troubleshooting

If you have applied the Defender license but you are not receiving any events, ensure that the required Domain Controllers have agents deployed to them. Defender events are recorded in the Active Directory subsystem.

 

Defender Searches/Reports

•
Defender built-in searches
•
Search results
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating