Change Auditor 7.3 - User Guide

This page displays when Agent is selected from the Configuration task list in the navigation pane of the Administration Tasks tab. From here you can define and assign agent configurations.


	NOTE: Workstation agents always use the default configuration and cannot be assigned to a different agent configuration; therefore, they are not included on the Agent Configuration page.

The following information is available for each deployed server agent. To display columns not on by default, use the Field Chooser button located to the far left of the column headings.


	NOTE: All dates and times are based on the client’s current local date and time. The format used to display the date and time is determined by the local computer’s regional and language setting.

Table 1. Agent Configuration page: Field descriptions

Indicates whether Active Directory auditing and/or protection has been defined.

ADAM (AD LDS)

Indicates whether ADAM (AD LDS) auditing and/or protection has been defined.

Agent

Yes

Displays the NetBIOS name of the server that hosts the Change Auditor agent.

Agent FQDN

Displays the fully qualified domain name (FQDN), consisting of the host and domain name including the top-level domain, of an agent.

Configuration

Yes

Displays the name of the agent configuration assigned to each agent listed.

Coordinator

Displays the computer name of the Change Auditor coordinator that an agent is connected through.

DB Size

Displays the size of an agent’s database.

Domain

Yes

Displays the name of the domain where the server resides.

EMC

Yes

Indicates whether an agent has been assigned to an EMC auditing template to receive EMC events.

Events Last 24 Hours

Displays the number of events encountered on the agent during the past 24 hours from when the Agent Configuration page is initially opened during the current client session or when the page is refreshed using the Refresh button.

The value in this field is a hypertext link and when selected launches a quick search to display the events generated in the last 24 hours.

Events Last Hour

Displays the number of events encountered on the agent in the last 60 minutes from when the Agent Configuration page is initially opened during the current client session or when the page is refreshed using the Refresh button.

The value in the field is a hypertext link and when selected launches a quick search to display the events generated in the last 60 minutes.

Events Today

Displays the number of events encountered on the agent since 12:00 a.m. of the current day (based on the relative coordinator computer's time).

The value in this field is a hypertext link and when selected launches a quick search to display today’s events.

Events Total

Displays the number of events encountered since the agent was started.

The value in this field is a hypertext link and when selected launches a quick search to display all events encountered since the agent was started.

Events Yesterday

Displays the number of events encountered between 12:00 a.m. yesterday and 12:00 a.m. of the current day (based on the relative coordinator computer's time).

The value in this field is a hypertext link and when selected launches a quick search to display yesterday’s events.

Exchange

For agents hosting Exchange, this column indicates whether Exchange Mailbox auditing and/or Exchange Mailbox protection has been defined.

Office 365

Yes

Indicates whether an agent has been assigned to an Office 365 auditing template to receive Exchange Online, SharePoint Online, and OneDrive for Business events.

Exchange Server

Indicates whether the server is an Exchange server.

Exclude Account

Yes

Indicates whether an Excluded Accounts Auditing template has been assigned to an agent’s configuration.

File System

Yes

Indicates whether a File System Auditing or File System Protection template has been assigned to an agent’s configuration.

Forest

Displays the name of the forest where the agent resides.

Group Policy

Indicates whether Group Policy protection has been defined.

Last Update

Displays the date and time when the agent configuration was last updated.

NetApp

Yes

Indicates whether an agent has been assigned to a NetApp Auditing template to receive NetApp filer events.

Registry

Yes

Indicates whether a Registry Auditing template has been assigned to an agent’s configuration.

Service

Yes

Indicates whether a Service Auditing template has been assigned to an agent’s configuration.

SharePoint

Yes

Indicates whether an agent has been assigned to a SharePoint Auditing template to capture SharePoint events.

SQL

Yes

Indicates whether a SQL Auditing template has been assigned to an agent’s configuration.

Skype for Business CMS

Yes

Indicates whether a Skype for Business template has been created for the Central Management Store SQL Server.

SQL Data Level

Yes

Indicates whether a SQL Data Level Auditing template has been assigned to an agent’s configuration.

Startup Time

Displays the date and time when the agent was last initialized.

Status

Displays the current status of the agent:

•

•

•

Displays the agent platform:

•

•

•

Displays the number of events that have not yet been sent to the coordinator.

Uptime

Displays how long the agent has been running.

Version

Displays the version number of the Change Auditor agent currently deployed.

Define agent configurations

To define a new agent configuration:

Open the Administration Tasks tab and click Configuration.

Select Agent in the Configuration task list.

From the Agent Configuration page, click Configurations.

The Configuration Setup dialog opens, which contains a list of configuration definitions available as well as the means for creating a new configuration.

Click Add to create a new definition or click Copy to duplicate the configuration selected in the Configurations list box.

This adds a new configuration to the list, allowing you to name the new configuration, specify the system settings and assign auditing and protection templates to the configuration.

With the new/copied configuration highlighted in the Configuration list, enter the name for your new agent configuration.

Use the tabbed pages at the top of the dialog to modify the system settings, file system settings, AD Query settings, Exchange settings, Defender auditing, and Authentication Services auditing. The settings that can be modified on these tabs include:

Table 2. Agent Configuration settings
Setting:	Default:	Valid range:
System Settings
Polling Interval	900 seconds	60 - 9999 seconds
Forwarding Interval	5 seconds	5 - 999 seconds
Retry Interval	300 seconds	60 - 600 seconds
Kerberos Ticket Lifetime (hours)	10 hours	1 to 99999 hours
Max events per connection	1500 events	100 - 99999 events
Agent Load Threshold	10000 events	100 - 100000 events
Allowed time for connection	Sunday - Saturday 12:00 am - 11:59 pm	N/A
Proxy Server Settings If your organization uses a proxy server to connect to the internet, these settings are required to audit Azure Active Directory and Office 365 targets. Selecting Validate Proxy Settings uses the configured settings to access a website through the proxy server. This test uses the https://www.quest.com web site. NOTE: Clearing the value for 'Proxy Server' and selecting Apply resets all proxy settings to default values.
Proxy Server	Not set	fully qualified domain name, down-level name, or IPv4 address
Port	8080	1- 65535
Requires Authentication If your proxy server requires authentication, click the option and enter the required credentials.	Not set	N/A
File System The settings on the File System tab only apply when Change Auditor for Windows File Servers, Change Auditor for EMC or Change Auditor for NetApp is licensed.
Discard duplicates that occur within nn seconds	Enabled by default 10 seconds	1 - 600 seconds
Audit all configured, including duplicates (Not recommended)	Disabled by default	N/A
AD Query The settings on the AD Query tab only apply when Change Auditor for Active Directory Queries is licensed.
Discard query results less than nn records	0 records	0 - 99999 records
Discard queries taking less than nn milliseconds	20 milliseconds	0 - 99999 milliseconds
Discard duplicate queries occurring within nn minutes	15 minutes	1 - 1440 minutes
AD Query auditing enabled	Enabled by default	N/A
Exchange The setting on the Exchange tab only applies when Change Auditor for Exchange is licensed. NOTE: These settings only apply to the Exchange subsystem events; they do not apply to the Office 365 subsystem events.
Discard duplicates that occur within nn seconds	0 seconds	0 - 600 seconds
Defender
Defender auditing enabled	Disabled by default	N/A
Authentication Services
Authentication Services auditing enabled	Disabled by default	N/A

To add an auditing or protection template to the selected configuration, use the Auditing and Protection Templates pane. This pane displays the auditing and protection templates previously defined.

Use one of the following methods to assign a template to an agent configuration:

•

Select a template and ‘drag and drop’ it onto a configuration in the Configuration list.

•

Select a configuration from the Configuration list and ‘drag and drop’ it onto a template in the Auditing and Protection Templates pane.

•

Select a configuration, then select a template, right-click and select Assign.

•

Select a configuration, then select a template, click in the corresponding Assigned cell and click Yes.

Repeat this step to add additional templates to the selected configuration.

If the templates list is empty or you want to define a new template, click Edit Templates.

•

On the Auditing and Protection Templates dialog, select the tab for the type of template to be added (e.g., Excluded Accounts) and click Add Template.

•

The associated wizard will be displayed allowing you to define the auditing or protection to be applied. Refer to the appropriate chapters in this guide for details on completing each of these wizards.

Once you have defined the new template, click OK to close this dialog and return to the Configuration Setup dialog. Select this new template, right-click and select Assign.

Once you have named the configuration, selected the system settings and added auditing or protection templates, click OK to save your configuration and return to the Agent Configuration page.

Assign agent configurations to server agents

Once agent configurations are defined you can assign it to one or more installed server agents from the Agent Configuration page.

To assign a configuration to an agent from the Agent Configuration page:

On the Agent Configuration page, select one or more agents from the agent list and click Assign.

On the Agent Assignment dialog, select the configuration definition to be assigned to the selected agents and click OK.

On the Agent Configuration page, the agent configuration assignment will be updated in the Configuration column.

Select the agents assigned to the agent configuration and click Refresh Configuration to ensure that the assigned agents are using the latest agent configuration.

To reset ALL agent configurations back to the default configuration:

On the Agent Configuration page, click Default All.

A message is displayed confirming that you want to reset all agent configurations back to the factory default settings. Click Yes.

The agent configuration assignment will be updated in the Configuration column.

Select the agents assigned to the agent configuration and click Refresh Configuration to ensure that the assigned agents are using the latest agent configuration.

Enable event logging

Using the Agent Configuration page you can enable the event logging feature which writes Change Auditor events locally to a Windows event log. These event logs can then be collected using InTrust to satisfy long-term storage requirements.

NOTE: This is a global setting and applies to all agents. Keep the following in mind when defining custom auditing:

•

Disabling Change Auditor events does NOT impact event logging.

•

Excluding accounts from auditing does NOT impact event logging with the exception of Exchange. That is, if an Exchange Mailbox account is set to exclude ALL mailbox events, then these events will also be excluded from the event log.

•

For Registry events, event logging is disabled by default. When enabled, only configured activities are sent to the event log.

•

For Service events, event logging is disabled by default. When enabled, only configured activities are sent to the event log.

•

For Active Directory events, event logging is disabled by default. When enabled, all Active Directory activity is sent to the event log.

•

For Azure Active Directory events, event logging is disabled by default. When enabled, only configured activities are sent to the event log

•

For ADAM (AD LDS) events, event logging is disabled by default. When enabled, all ADAM activity is sent to the event log.

•

For File System events, event logging is disabled by default. When enabled, only configured activities are sent to the event log.

•

For Exchange mailbox events, event logging is disabled by default. When enabled, only configured Exchange Mailbox activities are sent to the event log. Office 365 Exchange Online events are not logged to this event log.

•

For SQL Server events, event logging is disabled by default. When enabled, only configured activities are sent to the event log.

•

For SQL Data Level events, event logging is disabled by default. When enabled, only configured activities are sent to the event log.

•

For AD Query events, event logging is disabled by default. When enabled, all Active Directory queries, except those specified in the excluded AD Query list are sent to the event log. When enabling AD Query event logging, keep in mind that AD Query events could be of very high volume.

•

For EMC events, event logging is disabled by default. When enabled, only configured activities are sent to the event log.

•

For NetApp events, event logging is disabled by default. When enabled, only configured activities are sent to the event log.

•

For SharePoint events, event logging is disabled by default. When enabled, only configured activities are sent to the event log.

•

For Skype for Business events, event logging is disabled by default. When enabled, all Skype for Business events are sent to the event log.

To enable event logging:

Open the Administration Tasks tab and select Agent (under the Configuration task list) to display the Agent Configuration page.

Click Event Logging.

Select the type of event logging to enable:

•

•

•

•

•

•

•

•

•

•

•

•

•

•

•

•


	NOTE: Event Logging is supported only for Skype for Business Administration facility; it is not supported for the Skype for Business Configuration facility.


	NOTE: If an option is disabled, this indicates that you do not have the corresponding component licensed.

Click OK to save your selection and close the dialog.

Please select your product:

To serve you better, please complete the Purpose of your Chat:

Recommended Solutions for Your Problem

Change Auditor 7.3 - User Guide

Agent Configuration page

Define agent configurations

Assign agent configurations to server agents

Enable event logging