Chat now with support
Chat with Support

Change Auditor 7.2 - User Guide

Change Auditor Overview Agent Deployment Change Auditor Client Overview Overview Page Searches Search Results and Event Details Custom Searches and Search Properties Enable Alert Notifications Administration Tasks Agent Configurations Coordinator Configuration Purging and Archiving your Change Auditor Database Disable Private Alerts and Reports Generate and Schedule Reports SQL Reporting Services Configuration Change Auditor User Interface Authorization Client Authentication Certificate authentication for client coordinator communication Integrating with On Demand Audit Enable/Disable Event Auditing Account Exclusion Registry Auditing Service Auditing Agent Statistics and Logs Coordinator Statistics and Logs Change Auditor Commands Change Auditor Email Tags

Deploy agents

Agents deployed to servers (domain controllers and member servers) track changes in real time. When a change is made on a server, the agent captures the change information (audit event), batches and forwards the information to the coordinator, which then inserts the event details into the Change Auditor database.

* 
NOTE: If the Change Auditor for Logon Activity Workstations auditing module is licensed, you must deploy agents to the workstations that you want to monitor.
To deploy agents:
1
Verify that the user account used to deploy agents is at least a Domain Admin in every domain that contains servers and workstations where agents are to be deployed.
2
Verify that the user account is also a member of the ChangeAuditor Administrators group in the specified Change Auditor installation.
3
Open the Change Auditor client. The Deployment page is displayed if agents have not yet been deployed. Otherwise, use View | Deployment to open the Deployment page.
The Deployment page is populated with the servers (domain controllers and member servers) and workstations discovered in your Active Directory environment.
* 
NOTE: The Deployment page may initially be empty until the current forest’s server topology has been initially harvested. This page is automatically refreshed after this task has completed.
4
From this list, select an entry and select Credentials | Set to enter the proper user credentials for installing agents on the selected domain.
* 
NOTE: If you are using a group Managed Service Account, ensure that the account ends with “$” and the password is left blank.
On the Domain Credentials dialog, select the domain from the list and click Set. On the Logon Credentials dialog enter the credentials of a user with administrator rights on the selected domain.
5
After entering the proper credentials, select the entry back on the Deployment page and select Credentials | Test. If you get a Valid Creds status in the Deployment Result column, you can start deploying agents to that domain.
If you get a Logon Failure status in the Deployment Result column, use the Credentials | Set command to reenter the proper credentials for installing agents.
6
By default, the Change Auditor agent folders (Agent, Systray) is installed to %ProgramFiles%\Quest\ChangeAuditor. You can, however, change the location of the installation folder by clicking Advanced Options.
7
Select one or more servers and workstations on the Deployment page and click Install or Upgrade.
8
On the Install or Upgrade dialog select one of the following options to schedule the deployment task:
•
Now (default)
•
When
If you select the When option, enter the date and time when you want the deployment task to be initiated. Click OK to initiate or schedule the deployment task.
Back on the Deployment page, the Agent Status column will display ‘Pending’ and the When column will display the date and time specified.
* 
NOTE: To cancel a pending deployment task, select the server and workstation and then click Install or Upgrade. On the Install or Upgrade dialog, click Clear Pending.
9
As agents are successfully connected to the coordinator, the corresponding Deployment Result cell displays ‘Success’, the Agent Status cell displays ‘Active’ and a desktop notification is displayed in the lower right-hand corner of your screen.
* 
NOTE: To deactivate these desktop notifications, select Action | Agent Notifications.
After the deployment, you will see a previous version of an agent in the Version cell if you installed the agent on an unsupported platform. See the Change Auditor Installation Guide for more details.

Change the agent installation location and system tray option

By default, the Change Auditor agent folders (Agent, Systray) is installed to %ProgramFiles%\Quest\ChangeAuditor\. You can, however, change the location of the installation folder by selecting Advanced Options on the Deployment page.

* 
NOTE: The other option available under Advanced Options are discussed in the Active Roles Integration section in the Change Auditor Installation Guide.
To change the agent installation location and system tray option:
1
On the Deployment page, select one or more agents from the server/workstation list, and click Advanced Options.
2
To change the installation folder, check the Specify Agent Installation Location check box and enter the location to use for the agent installation folder.
* 
NOTE: The location entered is used for all servers and workstations with agents selected on the Deployment page.
3
Select the appropriate option to specify the action to take if the path entered cannot be created on a server or workstation:
•
Use the default location and continue (Default)
•
Fail the installation/upgrade for that agent
4
By default, the system share (ADMIN$) is used; however, you can use a different share by selecting the Specify a Custom Share on the Remote Server option and entering the share to use.
5
Use the Launch ServiceStatusTray on startup options to indicate whether you would like to run/install the Change Auditor agent system tray icon when the agent is started.
•
Yes - launch the ServiceStatusTray on startup
•
No - do not launch the ServiceStatusTray on startup
•
Do not change - do not change the ServiceStatusTray launch option (default)
* 
NOTE: The agent system tray icon (and the LaunchServiceStatusTray on startup setting) applies only to server agents. For more information about this icon, see Agent system tray icon.
6
Use the Restart Agent on failure options to indicate whether to restart an agent if it fails to start.
•
Yes - restart agent on failure.
•
No - do not restart agent on failure
•
Do not change - do not change the restart agent option (default)
* 
NOTE: When you select Yes, the agent is restarted if a main Change Auditor service goes offline due to a crash, failure or unknown exception; however, if the agent is gracefully shut down, the service will not be restarted.
7
Optionally, select Save as Default to save the current advanced deployment settings as the default for future agent deployments.
You can select Restore to Default to restore all the advanced deployment settings to the factory default or last saved defaults.
8
Click OK to save your selections and close the dialog. These deployment settings apply to all the agents selected on the Deployment page.

Enable auto deployment

Auto deployment allows you to automatically deploy an agent to any new domain servers that are added to your forest.

* 
NOTE: Auto deployment does not apply to servers already in the topology that are promoted to domain controllers.
To enable auto deployment:
1
From the Deployment page, click Auto Deploy.
2
Select the Enable Auto Deployment to New Servers option.
If you enable Do Not Deploy on Read-Only DCs (Not Recommended), when a read-only domain controller is added to the domain, the agent is not installed on it.
If Do Not Deploy on Read-Only DCs (Not Recommended) is disabled (default state), when a read-only domain controller is added to the domain, the agent is installed on it.
3
If required, select Enable Auto Deployment to New Workstations check boxes.
4
Select one of the following options to specify the servers to which agents are to be deployed:
•
All New Servers/Workstations (default)
•
Include New Servers/Workstations in Container(s)
•
Exclude New Servers/Workstations in Container(s)
•
Include Read-Only DCs (default)
5
When the Include New Server/Workstations in Container(s) or Exclude New Server/Workstations in Container(s) option is selected, click Add to locate and select individual containers.
6
Clicking Add displays the Select Active Directory Objects dialog. Use the Browse or Search page to locate and select a container. Once a container is selected, click Add to add it to the Selection list. Once you have added all the containers, click Select to save your selection and close the dialog.
The containers specified are displayed in the Containers list on the Auto Deploy to New Computers dialog.
7
By default, Change Auditor checks if new servers are added to the forest every 60 minutes and if found will automatically deploy an agent. However, you can use one of the following Check for New Computers Added to Forest options to change this interval:
•
Every nn Minutes
•
Every Day At <time>
8
Click Set to specify the credentials of a user with administrator rights on the selected domains. Click OK to save these user credentials and close the Logon Credentials dialog.
* 
NOTE: If you are using a group Managed Service Account, ensure that the account ends with “$” and the password is left blank.
9
Click OK to save your selections and close the Auto Deploy to New Computers dialog.

Refresh or clear Deployment page information

To force a topology harvest refresh:
1
On the Deployment page, click Force Refresh.
2
Change Auditor forces a topology harvest and display any new servers/workstations added since the last topology harvest.
* 
NOTE: The default harvest interval is every 3 hours.
NOTE: Topology scan takes a long time when the environment contains a large number of workstations.
To refresh a coordinator’s status:
1
On the Deployment page, select one or more servers from the list.
2
Click Refresh Status.
3
Change Auditor retrieves and displays the latest status for the selected agents, including the agent version and deployment results.
To clear the deployment results:
1
On the Deployment page, right-click a server or workstation from the list and click Clear Result.
2
This clears the current and any future entries in the Deployment Result cell for the selected server and workstation.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating