Chat now with support
Chat with Support

Change Auditor 7.1.1 - Quick Start Guide

What is Change Auditor?

Change Auditor provides complete, real-time change management that drives network availability and productivity with proactive auditing, in-depth forensics, and comprehensive reporting on all key configuration changes in Windows — including® Active Directory, Windows File Servers, and® Exchange.

•
Enables enterprise-wide change management from a single client.
•
Ensures a secure and compliant networking environment by tracking all critical changes in real time.
•
Automates procedures to continually track and report on compliance initiatives.
•
Strengthens internal controls through real-time insight into both authorized and unauthorized changes.
•
Drives availability by enabling proactive troubleshooting.
•
Turns information into intelligent in-depth forensics for auditors and management.

How does Change Auditor work?

Change Auditor consists of four components:

•
Agents
•
Coordinators
•
Clients
•
Microsoft SQL Server database

Agents are deployed to all servers (domain controllers and member servers) tracking configuration changes in real time. When a change is made on a server running an agent, the change information (audit event) is captured, batched and forwarded to a coordinator, which then inserts the event details into the database.

* 
NOTE: If the Change Auditor for Logon Activity Workstations auditing is licensed, you will also deploy agents to the workstations to monitor.

For each configuration change detected, Change Auditor creates an audit event entry in the database with the following information:

•
The type of configuration change event
•
The time and date of the configuration change event
•
The identity of the machine the change was made on
•
The identity of the managed object the change pertains to
•
The old and the new value of the change (if applicable)
•
The IP address of the workstation and client computer where the change originated

The coordinator is responsible for fulfilling client and agent requests and for generating alerts. Multiple coordinators can be installed in a single forest and an agent can be connected to multiple coordinators simultaneously. All connected coordinators can participate in receiving events from the agent, allowing a high volume of events to be distributed for processing.

* 
NOTE: Server agents submit events to all available coordinators and load balancing occurs automatically. However, workstation agents randomly connect to a single coordinator. This design enables ‘scaling out’ options for large workstation agent deployments within a single site.

The client is the user interface that provides immediate access to key configuration change information. From the client you can perform tasks such as:

•
Install, upgrade, or uninstall agents
•
Define search criteria to return specific events and view the search results
•
Enable and disable alerts and view the events that triggered these alerts
•
Enable and schedule email reporting for individual search queries
•
View agent and coordinator statistics
•
Define custom Active Directory and ADAM (AD LDS) object and attribute auditing
•
Define the hosts to audit for VMware auditing
•
Define the farm and paths to audit for SharePoint auditing
•
Define file system auditing for Windows File Servers, EMC, and® NetApp devices
•
Define auditing for Fluid File System clusters
•
Specify the SQL instances to audit dfor SQL Server auditing
•
Specify the mailboxes to audit for Exchange mailbox auditing
•
Specify the mailboxes or administration cmdlets to audit for Office 365 Exchange online auditing
•
Specify the containers to exclude from Active Directory query auditing
•
Configure object protection for Active Directory, Exchange, File Systems, and Group Policies
•
Define and assign agent configurations
•
Configure SMTP for alerting and reporting
•
Create and schedule purge jobs for maintaining the database
•
Define who is authorized to use the Change Auditor client (Windows and web) features

System requirements

To ensure a successful installation, Quest strongly suggest creating a clean Windows test environment (virtual or physical). If this is not possible, ensure that your test environment is healthy and the following requirements are met.

See the Change Auditor Release Notes for the hardware and software requirements for the Change Auditor components.

 

Install Change Auditor

Install Change Auditor

The procedures provided in this topic are intended to be used to install Change Auditor in a test lab environment. For more detailed installation instructions, see the Change Auditor Installation Guide.

•
Before you begin an installation
•
Installation overview
•
Step 1: Install a coordinator
•
Step 2: Install the client
•
Step 3: Add user accounts to Change Auditor security groups
•
Step 4: Start the client
•
Step 5: Deploy agents
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating