Chat now with support
Chat with Support

Change Auditor 7.4 - Quick Start Guide

Before you begin an installation

Quest recommends that you perform the following steps before you begin installing Change Auditor:

•
If you do not already have Change Auditor, you can download it from the Quest web site at https://support.quest.com/.
•
Before you can download the product, you must register with Quest. If you are a registered Quest user, log on using your email address and password.
•
Once you have registered or logged in, locate the product and version that you want to download from the product list.
•
On the download window, click the link and save the file to an appropriate directory (such as c:\temp).
* 
NOTE: If you have purchased multiple Change Auditor products, download one instance of Change Auditor only. The code is the same for all and the license keys determine what features are enabled or disabled.
•
Review the system requirements
•
Review the complete installation process
•
Review Installation Notes and Best Practices in the Change Auditor Installation Guide
•
Read the Release Notes for updated information
•
Ensure that you have the appropriate license files to enable Change Auditor auditing modules. (A separate license file is required to enable the functionality of each of the Change Auditor auditing modules.)
* 
NOTE: Change Auditor prompts you for a valid license during the coordinator installation. You cannot proceed with an invalid or expired license.

Installation overview

Quest recommends installing the Change Auditor components in the following order:

•
Database (SQL Server) — Ensure the SQL server is available and the installation account has SQL Server role as dbcreator. To host the Change Auditor database on a SQL instance other than the default instance of the selected SQL Server, create the instance before running the installer.
* 
NOTE: The database name must not include embedded spaces, special characters, or supplementary characters. For more details, see Microsoft’s database identifier documentation.
•
Coordinator — When prompted, specify the SQL server to use and the installation account. The Change Auditor database is created remotely on this server during the installation.
* 
NOTE: During the coordinator installation, you are have the option of adding the current user to the Change Auditor Administrators security group. If you did not add the current user during the installation process or want to add extra user accounts to the Change Auditor security groups, add them before running the client. We also recommend that you then add these security groups to the appropriate SQL database role (that is, Change Auditor Administrators — <InstallationName> group to the Change Auditor_Administrators role and ChangeAuditor Operators — <InstallationName> group to the ChangeAuditor_Operators role). See Add Users to Change Auditor Security Groups in the Change Auditor Installation Guide for more information.
•
Client — After you have confirmed that the coordinator is functioning correctly, install the client.
* 
TIP: Quest recommends that you install the first coordinator and client, but do not deploy agents until after you have installed required coordinators. When deploying agents, you can select which installation to use for each of the agents.
•
Agents — Open the client to deploy agents to your domain controllers and member servers. Also, if you have Change Auditor for Logon Activity Workstation licensed, deploy agents to the domain to monitor for logon activity.
•
Web client — Optionally, install the web client on the IIS web server.

Step 1: Install a coordinator

* 
IMPORTANT: Minimum permissions

User account installing the coordinator:

The user account that is installing the coordinator must have permission to perform the following tasks on the target server:

•
Windows permissions to create and modify registry values.
•
Windows administrative permissions to install software and stop or start services.

The user account must also be a member of the Domain Admins group in the domain where the coordinator is being installed.

Service account running the coordinator service (LocalSystem by default):

•
Active Directory permissions to create and modify SCP (Service Connection Point) objects under the computer object that is running a Change Auditor coordinator.
•
Local Administrator permissions on the coordinator server.

If you are running the coordinator under a service account (instead of LocalSystem), define a Manual connection profile where you can specify the IP address of the server hosting the coordinator. You can specify and select connection profiles whenever you open the Change Auditor client. See the Change Auditor User Guide or online help for more information about defining and selecting a connection profile.

SQL Server database access account specified during installation:

Create an account that the coordinator service can use on an ongoing basis for access to the SQL Server database. This account must have a SQL Login and be assigned the following SQL permissions:

•
Must be assigned the db_owner role on the Change Auditor database
•
Must be assigned the SQL Server role of dbcreator
To install a coordinator:
1
Verify that the user account used to run the coordinator installation is at least a Domain Admin in the domain to which the coordinator server belongs.
* 
NOTE: Membership in the Enterprise Admins group is not required, but can make agent deployment to domain controllers in multiple domains easier. Deploying agents to member servers requires that you must be a Domain Admin in every domain that contains servers that you are targeting for installation.
2
Use an existing account or create a user account that Change Auditor will use to access the SQL Server.
3
Create a SQL Login for this user account and assign the following permissions to this login: Server role: dbcreator
1
From the member server, browse to the folder where the Change Auditor package was downloaded, and run the Quest Change Auditor Coordinator(x64).msi file to open the Change Auditor Coordinator Setup wizard.
2
Enter the information requested in the Coordinator Setup wizard.
Review the table for additional information. This table only covers unfamiliar information. It does not include all the wizard screens or field descriptions. 
 
Table 1. Coordinator Setup wizard
Product Licensing screen

Licenses

Click Open License Dialog to locate and apply a license.

NOTE: Change Auditor 7.0 requires a new license for all modules.
Installation Name screen

After licensing the product, the setup wizard prompts you to enter a unique installation name to identify the database to which the coordinator will connect.

ChangeAuditor Installation Name

Enter a unique Change Auditor installation name that identifies the current installation within your Active Directory environment. An installation name is required; has a limit of 22 characters; can only contain alphanumeric characters and underscores; and is converted to all caps.

NOTE: Quest recommends that you use the default (DEFAULT) installation name.
NOTE: If you entered an existing installation name, confirm that you want to join this component to an existing installation. Click Yes to proceed or No to reenter a unique installation name.
SQL Server Information screen

SQL Server and Instance

Enter the server name or IP address (member server running the SQL instance) and the SQL instance name for the Change Auditor coordinator database such as, <FQDN of the SQL server>\<instance name> or browse your Active Directory network to locate the required instance.

Azure SQL Managed Instance:

•
For a private endpoint, specify the managed instance host name in the following format: MyHostName.dns_zone.database.windows.net
For private endpoint with default port, port specification is not explicitly required. For example: MyHostName.b1b2a3d4e5f7.database.windows.net
or
MyHostName.b1b2a3d4e5f7.database.windows.net,1433
•
For a public endpoint, specify the managed instance host name and port in the following format: MyHostName.public.dns_zone.database.windows.net,3342
For public endpoint, port specification is required. For example: MyHostName.public.b1b2a3d4e5f7.database.windows.net,3342
NOTE: Performance may vary depending on network configuration, topology, and Azure SQL Managed Instance configuration.
NOTE: Azure SQL Managed Instance (PaaS) is supported using SQL authentication or Azure Active Directory Authentication with an encrypted connection. Windows authentication is not supported.
NOTE: Single User Mode is not supported during installation or upgrade when using Azure SQL Managed Instance. Ensure that all SQL connections to the Change Auditor database are closed before and during the upgrade.
NOTE: Azure SQL Managed Instance (HA) high availability is supported using the read-write listener endpoint.
NOTE: If you are using Windows security to access your SQL Server, ensure that the domain user is granted access to the SQL Server.

Name of database catalog

Enter the name to assign to the Change Auditor database.

NOTE: If an existing Change Auditor database is present, you should provide a unique name for the Change Auditor database. If a database with the name entered is found, a warning message explains the need to provide a unique name for your new Change Auditor database. On this warning dialog, click Cancel to specify a different database name. Clicking OK proceeds to the Ready to Install the Program screen.

Authentication/ Credentials

Use the authentication section to specify whether to use Windows authentication or SQL authentication when communicating with the SQL database instance. (The authentication method is set up when SQL is installed.)

NOTE: If Windows Authentication is used to access the designated SQL instance, a verification screen is displayed. Verify that the server name, SQL instance name, and credentials are correct before proceeding. Incorrect entries cause the Change Auditor coordinator service to fail on startup.
NOTE: For Azure SQL Managed Instance (PaaS), SQL authentication or Azure Active Directory Authentication with an encrypted connection must be used.
NOTE: If you are using a group Managed Service Account:
•
The account must end with '$' and the password must be blank.
•
The coordinator host must be correctly configured to retrieve the managed password for the specified group Managed Service Account.
•
The coordinator installer must be run as the administrator. (Right-click and select Run as administrator.)
•
The local Administrator group must be added to the group policy debug programs. (Found under Local Computer Policy | Windows Settings | Security Settings | Local Policies | User Rights Assignments | Debug programs.)
ChangeAuditor Administrators screen

Add the current user to the “ChangeAuditor Administrators - <InstallationName>” security group

This check box is selected by default and adds the current user to the ChangeAuditor Administrators — <InstallationName> group.

Any user that is running a Change Auditor client must be added to either this security group or the ChangeAuditor Operators security group.

In addition, users responsible for deploying Change Auditor agents must be a member of the ChangeAuditor Administrators group in the specified ChangeAuditor installation.

See the Change Auditor Installation Guide for more information about these security groups and how to add more user accounts.

Specify Port Information screen

By default Change Auditor dynamically assigns communication ports to use to communicate with each installed coordinator. However, using the port settings on this screen you can specify static SCP listening ports to use instead.

NOTE: A zero (0) indicates that a dynamic port is being used. These port assignments can also be set using the Coordinator Configuration Tool which is accessed by right-clicking the Change Auditor coordinator system tray icon.

Client Port

Enter the static port number for the Change Auditor client to communicate with the coordinator.

TIP: If you are planning on installing the Change Auditor web client, enter a static client port.

Public SDK Port

Enter the static port number for external applications to access the coordinator.

Agent Port (Legacy)

Enter the static port number for legacy (5.x) Change Auditor agents to communicate with the coordinator.

Agent Port

Enter the static port number for Change Auditor 6.x agents to communicate with the coordinator.

3
After you have entered all the requested information, click Install to start the installation process.
4
Verify that the coordinator service has been installed by right-clicking the Change Auditor coordinator icon in the system tray and clicking Coordinator Status. Check for the correct version and that the Coordinator Status is 'Running'.

Step 2: Install the client

The client connects directly to the coordinator or to an archive database and is the user interface that provides immediate access to key configuration change information.

1
On a workstation, laptop or member server, browse to the folder where the Change Auditor package was downloaded, and run the Quest Change Auditor Client (x64).msi file to open the Change Auditor Client Setup wizard.
2
Enter the information requested on the Client Setup wizard pages:
•
When prompted, read and accept the license agreement.
•
On the Select Installation Folder page, click Next to accept the default installation path (%ProgramFiles%\Quest\ChangeAuditor\).
•
On the Configure Shortcuts page, select the locations where you’d like to create shortcuts for the client.
•
On the Ready to Install page, click Install to begin the client installation.
•
On the last page of the setup wizard, click Finish to exit the wizard.
3
Use Add/Remove Programs to verify that the Change Auditor client was successfully installed.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating