Change Auditor for SharePoint 7.4


	NOTE: Log trimming is off by default. Enable log trimming to meet your policies. If the agent is offline or is otherwise unable to retrieve event information from the SharePoint database for a period longer than the trim period, events could be lost.

Versioning

To audit versioning within SharePoint, enable it for each individual Library and List Item pertaining to the Sites being audited.


	NOTE: This procedure also applies to announcements, calendars, and tasks. The only difference is that the ‘Tools’ section and tabs are specific to the List Settings item.

To enable document versioning for shared documents for a top-level site:

Navigate to a Document Library.

Under Library Tools, select the Library tab.

Click the Library Settings icon, located to the right of the ribbon.

Click Versions settings under General Settings.

In the Document Version History section, change the selection of No Versioning to the desired level of versioning: Create major versions or Create major and minor (draft) version.

Verify MySite permissions

For proper auditing of sites within the MySite Site Collection or Web Application, the account Change Auditor uses to access the SharePoint database must be added as a Site Collection Administrator (primary or secondary) or to the User Web Policy for the MySite host.

Depending on how your MySite host is initially set up, use the Central Administration Web Site to verify, and if necessary add, this account.


	NOTE: This account must be added BEFORE you add a personal site to a SharePoint auditing template or you will encounter an ‘access denied’ error when you select a personal site in the SharePoint Auditing wizard.

MySite Site Collection

This refers to the default ‘MySite’ Site Collection that is automatically created during a SharePoint Single Server installation. Its location is under the default SharePoint-80 Web Application (//veneno in the following screen shot). By default, the SharePoint farm account is assigned as the Primary Site Collection Administrator. However, if this site collection is manually created, then the primary and secondary administrator can be specified.

In this scenario, verify that the account Change Auditor is using is listed as either the Primary Site Collection Administrator or Secondary Site Collection Administrator for the MySite Site Collection.

MySite Web Application

This refers to the ‘MySite’ Web Application that is created manually after a SharePoint Multi-Server Farm installation. In this case, MySite is not tied to any other web application (i.e., is not underneath the default SharePoint Web Application) and therefore uses the User Policy permissions.

In this scenario, verify that the account Change Auditor is using is included in the User Web Policy for the MySite Web Application.

Add and deploy Change Auditor SharePoint Solution

To capture SharePoint events, add the Change Auditor SharePoint Solution (SharePoint.Auditing.Monitor.wsp) to the SharePoint Solution Store (which can be found on the Solution Manager page in the Central Administration site) and deploy it all SharePoint web applications of the SharePoint farms to audit.

Change Auditor provides the SharePoint Solution Manager utility to add the solution to the SharePoint Solution Store and deploy it globally to all SharePoint web applications. The Change Auditor SharePoint Solution must be deployed to all SharePoint web applications on all SharePoint farms that you want to audit.

NOTE:

•

If you have multiple SharePoint farms in your environment, you must run this utility locally on the Central Administration server in each SharePoint farm.

•

You can also do this manually using a Windows PowerShell cmdlet to add it to the store and then deploy it using the SharePoint Central Administration web site. See Manually Add and Deploy the Change Auditor SharePoint Solution.

To add and deploy the solution globally throughout a SharePoint farm:

On the local SharePoint farm server, run the SharePoint Solution Manager utility:

•

SharePoint 2016: SharePointSolutionManagerCALauncher2016.exe

•

SharePoint 2019: SharePointSolutionManagerCALauncher2019.exe

These utilities can be found in the Plug-in for SharePoint folder under the agent installation folder. For example, the default location is:

%ProgramFiles%\Quest\ChangeAuditor\Agent\Plug-in for SharePoint

On the SharePoint Solution Manager dialog, select both check boxes under the Install heading:

•

Add solution to SharePoint solution store

•

Deploy solution to all SharePoint web applications (requires IIS restart)


	NOTE: Since the deployment step requires an IIS restart, this is a separate step that can be run at a more convenient time when an IIS restart is less disruptive. Note that if you do not select this step, you must deploy the solution using the SharePoint Solution Manager utility or SharePoint’s Central Administration web site BEFORE Change Auditor can start capturing events.

Click Run.

A progress dialog is displayed. When completed, the Change Auditor SharePoint Solution status is updated at the top of the SharePoint Solution Manager dialog.


	NOTE: If the add and deploy solution process cannot be completed, an error message is displayed explaining why the process did not complete successfully. Click Close to exit the SharePoint Solution Manager utility. Once the issue is resolved, rerun the SharePoint Solution Manager utility to deploy the Change Auditor SharePoint Solution.

Click Close to close the SharePoint Solution Manager dialog.

A message is displayed explaining that the deployment status has changed and that the agent needs to be restarted. Click Close to close the message box.

Restart the agent to enable auditing of SharePoint events.

Create SharePoint Auditing template

Create a SharePoint Auditing template which specifies the SharePoint farm and the paths within the SharePoint farm to audit and the agent to receive events from the selected SharePoint farm.


	NOTE: If you have multiple SharePoint farms to be audited, create a separate SharePoint auditing template for each farm.

Client components and features

The following table lists the client components and features that require a valid Change Auditor for SharePoint license. The product will not prevent you from using these features; however, associated events will not be captured unless the proper license is applied.


	NOTE: To hide unlicensed Change Auditor features from the Administration Tasks tab (including unavailable audit events throughout the client), use the Action \| Hide Unlicensed Components menu command. Note that this command is only available when the Administration Tasks tab is the active page.