Chat now with support
Chat with Support

Change Auditor 7.1.1 - Installation Guide

Installation Overview Install Change Auditor Add Users to Change Auditor Security Groups Connecting to the Clients Deploy Change Auditor Agents Upgrade Change Auditor Installation Notes and Best Practices Multi-Forest Deployments Foreign Forest Agent Deployment Workstation Agent Deployment Agent Comparison Install an agent to audit ADAM (AD LDS) on workgroup servers Active Roles Integration Quest GPOADmin Integration Windows Installer Command Line Options

Troubleshooting tips

If GPO events initiated by GPOADmin do not appear in the Change Auditor client as expected, check the following:

•
GPOADmin/Change Auditor integration is through the SDK. Once configured, Change Auditor agents receive the configured settings in the next configuration polling interval (default every 15 minutes). Before the configuration is received by a Change Auditor agent, GPOADmin initiator and comment information will not be available for GPO events.
To make sure Change Auditor has the latest GPOADmin configuration, manually refresh the agent configuration (Refresh Configuration on Agent Configuration Page on the Administration Tasks tab).
* 
NOTE: This delay is only applicable when you first install GPOADmin/Change Auditor or when the service account in GPOADmin has changed.
•
Verify that the GPO is not being protected by Change Auditor’s Group Policy Object Protection feature. When configured, Change Auditor prevents all changes to GPOs, regardless of the tool that is used to make the change (including GPOADmin).
•
GPOADmin only sends initiator and comment information to Change Auditor for GPO deployment, working copy check in, and working copy check out operations.
•
It may be necessary to restart the GPOADmin service before correct initiator information can be retrieve by Change Auditor. Before restarting the GPOADmin service, check the Change Auditor coordinator’s status to ensure that the coordinator has been initialized and is running.

Windows Installer Command Line Options

This section lists the Windows Installer command line options (MSIEXEC.exe) that are available for deploying an agent or installing a coordinator.

•
Agent options
•
Coordinator options
•
Web Client options

For more information on using the Windows Installer (MSIEXEC.exe) see: http://msdn.microsoft.com/en-us/library/aa367988(VS.85).aspx

Agent options

 
Table 8. Change Auditor agent command line options
Option
Use this to...

INSTALLATION_NAME="<name>", INSTALLATION_NAME_VALID="1"

Specify the Change Auditor installation name.

APPDIR="<install directory>"

Specify the installation path.

INSTALLER_ITAD_GPTBACKUP="<path>"

Specify a GPO backup path.

SYSTRAY_AUTOSTART="1"

SYSTRAY_AUTOSTART="0"

Specify whether to open the agent system tray icon on startup.

•
Set to "1" to launch agent system tray icon
•
Set to "0" to not launch the agent system tray icon

RESTARTONFAILURE="3"

RESTARTONFAILURE="0"

Specify whether to automatically restart the agent on failure.

•
Set to "3" to automatically restart the agent
•
Set to "0" to not automatically restart the agent

EVENTLOG_BLOCK_OVERRIDE="1"

Specify whether to override event log block detection.

•
Set to "1" to enable this override

When this setting is set to "0" (default), the event log detection is active which detects whether or not the system EventLog service is holding one of Change Auditor’s event log message DLLs open. If one of these DLLs are open, the Windows Installer Restart Manager can cause unpredictable restarts of dependent services.

FOREIGN_LOGON_ACCOUNT="<domain\user>"

FOREIGN_PASSWORD="<password>"

For foreign agents (non-domain members), specify the foreign credentials to be used to find and connect to a coordinator in the Active Directory forest.

FOREIGN_FOREST_ROOT_DOMAIN="<FQDN>"

For foreign agents (non-domain members), use this option to specify the fully-qualified domain name (domain.com) of the root domain of Active Directory.

FOREIGN_CREATE_AGENT_GROUP="1"

For foreign agents (non-domain members), specify whether the logged in user is to be added to the ChangeAuditor Agents security group.

•
Set to "1" to add the user to this security group.

Coordinator options

 
Table 9. Change Auditor coordinator command line options
Option
Use this to...

AGENT_PORT="<static port number>"

Assign the static port number to be used by the agents to communicate with the coordinator.

AGREETOLICENSE="YES"

Agree to the Software License Agreement.

CLIENT_PORT="<static port number>"

Assign the static port number to be used by the client when communicating with the coordinator.

INSTALLATION_NAME="<installation name>"

Set the Change Auditor installation name.

SDK_PORT="<static port number>"

Assign the static port number to be used by external applications to access the coordinator.

SQLSERVER_DATABASE="<database name>"

Provide the name of the Change Auditor database.

SQLSERVER_AUTH="1"

SQLSERVER_AUTH="1" SQLSERVER_AUTH="2" Specify whether to use SQL, Windows or Azure Active Directory authentication.

•
Set to "1" to use SQL authentication.
•
Set to "2" to use Azure Active Directory Authentication.
NOTE: For Azure SQL Managed Instance (PaaS), Azure Active Directory or SQL authentication with an encrypted connection must be used.

SQLSERVER_SQLSERVER="<IP address\server name>"

Specify the SQL instance used to store the Change Auditor database.

SQLSERVER_LOGINID="<user name>"

Specify the user name used to connect to the SQL instance.

SQLSERVER_PASSWORD="<password>"

Specify the password used to connect to the SQL instance.

SQLSERVER_DOMAIN="<domain name>"

If Windows authentication is being used, specify the domain of the user credentials used to connect to the SQL instance.

ADD_USER_CAADMINS="1"

Specify whether the logged in user is to be added to the ChangeAuditor Administrators security group.

•
Set to "1" to add the user to this security group.

EVENTLOG_BLOCK_OVERRIDE="1"

Specify whether to override event log block detection.

•
Set to "1" to enable this override

When this setting is set to "0" (default), the event log detection is active which detects whether or not the system EventLog service is holding one of Change Auditor’s event log message DLLs open. If one of these DLLs are open, the Windows Installer Restart Manager can cause unpredictable restarts of dependent services.

NOTE: This applies to coordinators running Windows Server 2012 (or later).
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating