Chat now with support
Chat with Support

Change Auditor for SharePoint 7.1.1 - User Guide

Change Auditor for SharePoint Overview

•
Introduction
•
System overview
•
Deployment requirements
•
Client components and features

Introduction

Auditing your SharePoint platform is critical to maintaining internal security controls and meeting external auditing regulation requirements. Change Auditor for SharePoint tracks operations across your SharePoint environment, providing comprehensive auditing and reporting that tells you ‘who, what, when and where’ changes are being made to SharePoint configuration, documents, lists and sites.

To enable SharePoint auditing, you must deploy the Change Auditor SharePoint component to the SharePoint farms, then create an auditing template for each farm to define the paths within the farm to audit, and the agent to capture the events.

* 
IMPORTANT: Change Auditor processes all activities on all site collections within the audited SharePoint farm. When auditing a large SharePoint farm with a lot of activity, the agent may experience performance-related issues including slowness in loading the plugin and capturing events or the potential for missed events. Factors that can impact performance include the number of site collections in the farm and the volume of activity in the SharePoint environment. Quest recommends performing a test in the environment of the similar size and configuration to determine if your farm is suitable to be audited by Change Auditor.

Change Auditor also audits user and administration activity for SharePoint Online (and OneDrive for Business) that corresponds to the events in the Office 365 Security & Compliance Center unified audit log. You can track, report, and create alerts on activities including:

•
When files and folders are accessed, created, deleted, uploaded, moved, renamed, and checked in and out of SharePoint Online and OneDrive for Business sites.
•
 

 

System overview

The following diagram illustrates how SharePoint integrates with Change Auditor to provide this auditing capability.

1
The SharePoint Farm Administrator deploys the SharePoint.Auditing.Monitor.wsp solution, which writes event information from each server to the SharePoint database. Deployment is done by running the SharePoint Solution Manager utility.
2
The administrator installs an agent on one of the SharePoint Web Front End servers in the farm.
3
The agent enables the solution for the event information to be captured and written to the SharePoint database AuditData table.
4
System provided SharePoint auditing writes events in the AuditData table shortly after events occur.
5
The agent periodically queries the SharePoint AuditData table to collect the events and forwards them to the coordinator.

Deployment requirements

For a successful deployment, ensure that your environment meets the minimum system requirements. For information about system requirements, see the Change Auditor Release Notes. For details on installing Change Auditor, see the Change Auditor Installation Guide.

* 
NOTE: This guide assumes SharePoint 2010/2013/2016/2019 is properly installed and configured. For detailed installation steps, see the appropriate guide from Microsoft.

After you have installed Change Auditor, complete the following to audit SharePoint events:

•
Enable SharePoint settings
•
Add and deploy Change Auditor SharePoint Solution
•
Create SharePoint Auditing template
Self Service Tools
Knowledge Base
Notifications & Alerts
Product Support
Software Downloads
Technical Documentation
User Forums
Video Tutorials
RSS Feed
Contact Us
Licensing Assistance
Technical Support
View All
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating