Chat now with support

Get Live Help
Complete Registration

Sign In

Request Pricing

Contact Sales

Change Auditor 7.4 - User Guide

Table of Contents

Change Auditor Overview

Available Change Auditor auditing modules

Agent Deployment

Deployment page Using group Managed Service Accounts (gMSA) Deploy agents Connect to a different foreign forest/update credentials Change the agent installation location and system tray option Enable auto deployment Refresh or clear Deployment page information

Change Auditor Client Overview

Starting the Change Auditor client Accessing Change Auditor news and updates Managing connection profiles

Connection wizard

Client components Customize table content

Sort data Resize or move columns Add or remove columns Group data

Using custom filters

Directory object picker

Overview My Favorite Search Define a favorite search Overview panes

Top Agent Activity Recent Event Activity Count of Events By Agent Status Coordinator Status

Event Details pane

Introduction Searches page

Explorer view Searches list Search Properties tabs

View a list of available searches Run searches Run a quick search

Search Results and Event Details

Introduction Search Results page

Search Results grid Search Properties tabs Event Details pane

View search results

Display results in different formats

Preview search results Compare results side-by-side View event details or search properties Copy event details Email event details Add comments View user context and run related searches Protect critical objects, mailboxes, files and folders Add search properties to existing event queries

Custom Searches and Search Properties

Introduction Create a custom search Search Properties tabs

Info tab Who tab What tab Where tab When tab Origin tab Alert tab Report tab Layout tab SQL tab XML tab

Enable Alert Notifications

Introduction Alert tab (Search Properties tabs) Enable alerts Disable alerts Alert History page View alert history View event details or alert properties

Administration Tasks

Administration Tasks tab Administration Task lists Export/import Administration Task settings

Agent Configurations

Introduction Agent Configuration page Define agent configurations Assign agent configurations to server agents Enable event logging

Coordinator Configuration

Coordinator Configuration page Configure email alert notifications/reports Customize alert email content Shared Folder Configuration Group Membership Expansion Add groups to Group Membership Expansion list Agent Heartbeat Check Disconnect client after 30 minutes of inactivity Scheduled Task Handling

Purging and Archiving your Change Auditor Database

Introduction Planning your jobs Purge and Archive page Create and maintain jobs Purge and Archive wizard Purge selected records

Disable Private Alerts and Reports

Introduction Private Alerts and Reports page Disable private alerts and reports

Generate and Schedule Reports

Schedule reports for distribution

Create global report template Define report content and layout Enable and schedule reporting

Launch Report Designer Publish reports Print or save a page's contents

SQL Reporting Services Configuration

Introduction SQL Reporting Services Page SQL Reporting Services Templates SQL Reporting Services Wizard

Change Auditor User Interface Authorization

Introduction Application User Interface Authorization page Add task definition Add role definition Add application group Remove a task definition

Client Authentication

Introduction Client Authentication Page

Changing authentication methods

Certificate authentication for client coordinator communication

Installation settings Deployment Coordinator configuration Windows client configuration

Integrating with On Demand Audit

Managing a Quest On Demand Audit integration

Creating an On Demand Audit configuration Working with an On Demand Audit configuration

Enable/Disable Event Auditing

Introduction Audit Events page Enable/disable event auditing Modify event's severity level or event class description Define events to be captured based on results View event information

Account Exclusion

Introduction Excluded Accounts Auditing page Excluded Accounts templates Excluded Accounts wizard

Registry Auditing

Introduction Registry Auditing page Registry Auditing templates Registry Auditing wizard

Service Auditing

Introduction Services Auditing page Service Auditing templates Service Auditing wizard

Agent Statistics and Logs

Introduction Agent Statistics page

Agent Statistics grid Resource Properties pane

Machine Info page Processors page Drives page Shares page Services page Exchange Mailboxes page

Agent system tray icon

Change Auditor Agent Status dialog

View agent status/statistics Manage Change Auditor agents Agent Log page View and save agent trace logs

Coordinator Statistics and Logs

Introduction Coordinator Statistics page Coordinator system tray icon

Change Auditor Coordinator Status dialog Coordinator Configuration tool

View coordinator status and statistics Manage Change Auditor coordinators Coordinator Log page View and save coordinator trace logs

Change Auditor Commands

Menu commands Tool bar buttons Right-click commands

Change Auditor Email Tags

Introduction

Once Change Auditor captures an event, it provides several ways to generate reports. All event information is displayed in the client and the built-in reports provide views for the most common and complex requests. You can view configuration changes from a variety of perspectives. For example, you can view all changes at a particular site; changes made during a specific time frame; or changes performed by a particular administrator. You can also run detailed searches based on user-defined criteria to fit the needs of your organization.

Searches page

The Searches page displays all search definitions, both private and shared, and the built-in reports. This page consists of the following panes:

•

•

•

Search Properties tabs

Explorer view

The left pane of the Searches page displays a hierarchical view of the folders used to manage your search definitions and the built-in reports. This view initially displays the following folders:

Allows you to define a search that is to run as soon as the definition is finished. Unlike other custom searches, this search definition will not be saved unless you click Save As on one of the Search Properties tabs.

Used to store your personal custom searches. Only you can see these searches.


	NOTE: A foreign security principal in foreign forests is required for some private searches to function properly. To store foreign user created searches in Change Auditor: 1. Create a trust between the foreign domain and the domain where Change Auditor is installed. 2. Add the foreign user to any group in the Change Auditor domain. This will cause Windows to create a foreign security principal object in the Change Auditor domain.

Contains the predefined search definitions provided with Change Auditor and can also be used to store public custom searches. All users can see these searches.

Contains all predefined reports.

Searches list

The right pane of the Searches page displays a list of the search definitions or built-in reports contained in the folder selected in the explorer view.

The following information is displayed for each search definition:

Table 1. Searches list: Field descriptions

Displays the type of entry: Private Search, Shared Search, Private Alert, Shared Alert or Report.

Indicates whether an alert has been enabled for the search query. Valid entries for this field are:

•

Enabled: Alerting is enabled for the search query and that at least one transport method is enabled.

•

Disabled: Alerting is disabled for the search query; however at least one transport method is still enabled.

Indicates whether reporting had been enabled for the search query. Valid entries for this field are:

•

Enabled: Reporting is enabled for the search query and a report will be sent to the specified recipients as defined on the Report tab.

•

Disabled: Previously enabled reporting has now been disabled for the search query.

Displays the name assigned to the search definition.

Displays the email address of any recipients specified to receive an alert email notification.

In addition to an email address or distribution list address, you will see the following parameterized values when the corresponding option has been selected on the Alert Custom Email dialog:

•

%WHO% - Indicates that an alert is to be sent to the user who initiated the change that triggered the alert.

•

%OWNER% - Indicates that an alert is to be sent to the changed user account, the Exchange Mailbox owner or whose mailbox was accessed by another user and their action triggered an alert.

•

%MANAGEDBY% - For events associated with users or groups that are being managed by another account, indicates that an alert is to be sent to the managing user’s email.

Displays the email address of any ‘carbon copy’ recipients specified to receive an alert email notification.

Displays the email address of any ‘blind carbon copy’ recipients specified to receive an alert email notification.

Displays the email address of any recipients and shared folder specified to receive a report as defined on the Report tab.

Displays the email address of any ‘carbon copy’ recipients specified to receive a report email.

Displays the email address of any ‘blind carbon copy’ recipients specified to receive a report email.

Double-clicking a search definition will run the selected search and display the results in a new Search Results page.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating

© 2024 Quest Software Inc. ALL RIGHTS RESERVED. Terms of Use Privacy Cookie Preference Center