Chat now with support
Chat with Support

Change Auditor 7.3 - Installation Guide

Installation Overview Install Change Auditor Add Users to Change Auditor Security Groups Connecting to the Clients Deploy Change Auditor Agents Upgrade Change Auditor Installation Notes and Best Practices Deployment Options Workstation Agent Deployment Agent Comparison Install an agent to audit ADAM (AD LDS) on workgroup servers Windows Installer Command Line Options

Configuration

•
Audit and protection configuration flow
•
Event flow
•
Reports and queries from the client
Audit and protection configuration flow

Audit and protection configurations are maintained using the client that is installed on either workstations or member servers. Configuration changes are stored in the SQL database by the coordinator service.

The following configurations can be shared across forests regardless of the forest trust level:

•
Active Directory Auditing — Object Class\Attributes
•
ADAM\AD (LDS) Auditing — Object Class\Attributes
•
Excluded Accounts templates
•
File System Auditing templates
•
Registry Auditing templates
•
Service Auditing templates
•
SQL Auditing templates
•
Audit Event configurations (for example, enabled or disabled, severity level)

The following configurations can be shared when a two-way trust exists:

•
Active Directory Protection templates
•
ADAM\AD (LDS) Protection templates
•
Exchange Protection templates
•
File System Protection templates
•
Group Policy Protection templates
* 
NOTE: A trust is required to view the Active Directory accounts in the other forest for protection account exclusions.

Event flow

Recorded audit events are first queued in a local database on each agent computer. Events are then batched and forwarded to a coordinator. The coordinator checks for new events every 10 seconds and does a bulk insert of the event details to the SQL database.

Reports and queries from the client

Change Auditor clients do not connect directly to the SQL database. Instead, the coordinator to which the client is connected processes search results and change requests. Clients can connect to any coordinator if the logged on user is a member of either the ChangeAuditor Administrators — <InstallationName> or the ChangeAuditor Operators — <InstallationName> group in the respective forest.

By default, user-configured alerts (SMTP, SNMP, and WMI) are generated and sent from the first installed coordinator in the Change Auditor installation.

Foreign forest agent deployment

•
Supported functionality
•
Requirements
•
Workflow
•
Connecting to a different foreign forest/updating credentials
•
Example deployment scenario

Supported functionality

Supported functionality

The support available for agents connected to a foreign forest includes the following:

Table 5. Foreign forest support
Functionality
Supported features

Auditing
•
Directory auditing:
•
GPO
•
Active Directory objects and attributes
•
AD Query
•
ADAM
•
Logon Activity
•
Windows File System

Protection
•
Windows File System
•
Active Directory
•
Group Policy Objects
•
Exchange mailboxes

Requirements

•
Network connectivity between the foreign server and coordinators in the remote forest.
•
A routable network path between the foreign forest computer and the coordinator servers.
•
Name resolution of domain controllers and the coordinator servers from the foreign forest server. This is required regardless of whether DNS server configuration, NetBIOS/WINS configuration or local hosts file entries are used.
•
Ensure that the account you are using to deploy agents is at least a Domain Admin in every domain that contains servers or workstations where agents will be deployed.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating