Chat now with support
Chat with Support

Change Auditor 7.1.1 - Installation Guide

Installation Overview Install Change Auditor Add Users to Change Auditor Security Groups Connecting to the Clients Deploy Change Auditor Agents Upgrade Change Auditor Installation Notes and Best Practices Multi-Forest Deployments Foreign Forest Agent Deployment Workstation Agent Deployment Agent Comparison Install an agent to audit ADAM (AD LDS) on workgroup servers Active Roles Integration Quest GPOADmin Integration Windows Installer Command Line Options

Post upgrade considerations

Querying the database directly is not supported. Any 5.x scripts previously created to manipulate the 5.x (or earlier) events do not work with Change Auditor 7.0 and later.

The Data Gateway Service is no longer used in Change Auditor for capturing user logon activity events. If you had an earlier version of this service running, you can remove it.

If the Active Roles scripting module has been deployed in a previous Change Auditor version, refer to the following knowledge base article which details the process to move to the updated version of these scripting modules that are available in Change Auditor 6.x: https://support.quest.com/change-auditor/kb?k=119136

When you upgrade the client and coordinator from Change Auditor version 6.8 or earlier:

As of Change Auditor version 7.0.4, additional Microsoft Graph API permissions are required to audit Azure Active Directory and Office 365. If you are updating from version 7.0.3 or older see Updating Azure Active Directory templates in the Office 365 and Azure Active Directory User Guide.

Installation Notes and Best Practices

This section contains notes and best practices that should be considered when installing Change Auditor. These notes and best practices are listed under the following topics:

Licensing Change Auditor products

You can upgrade to Change Auditor 7.1 from the following versions of Change Auditor: 6.0, 6.5, 6.6, 6.7, 6.8, 6.9. and 7.0.

The following Change Auditor products all require separate licenses which can be applied during the coordinator installation process:

If you are licensing multiple Change Auditor products, you can apply the licenses in any order but must apply all the licenses provided.

If you purchased more Change Auditor products after the initial installation, you can apply new licenses from the coordinator icon in the system tray.

2
From the Licenses tab, click Select License.

Permissions

User account performing the coordinator installation:

The user account installing the coordinator needs permission to perform the following tasks on the target server:

The user account performing the installation, must be a member of the Domain Admins group in the domain where the coordinator is being installed.

Service account running the coordinator service (LocalSystem by default):

By default, the Coordinator service runs as LocalSystem. To run the Change Auditor service as a Domain User or service account other than Local System, the Change Auditor SPN (Service Connection Point) must be removed from the Coordinator computer (local system) account and added to the Domain Account used to run the Coordinator service.

To do so, open a command prompt on a Domain Controller and perform the following:

SQL Server database access account specified during installation:

An account must be created to be used by the coordinator service on an ongoing basis for access to the SQL Server database. This account must have a SQL Login and be assigned the following SQL permissions:

Must be assigned the db_owner role on the Change Auditor database

The Agent Deployment wizard runs under the security context of the currently logged on user account. Therefore, you must have administrative authority to install software on every target machine. This means you must be a Domain Admin in every domain that contains servers that you are targeting for installation.

If you are targeting domain controllers only, membership in the Enterprise Admins group will grant you authority to all domain controllers in the forest.

All users responsible for deploying agents must also be a member of the ChangeAuditor Administrators group in the specified Change Auditor installation. If you are not a member of this security group for this installation, you will get an access denied error.

The user account used to install the agent by running the Windows Installer directly on the domain controller or member server or workgroup server or workstation needs permissions to perform the following tasks on the server:

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating