Change Auditor 7.5 - Installation Guide


	NOTE: The database name must not include embedded spaces, special characters, or supplementary characters. For more details, see Microsoft’s database identifier documentation.

•

Coordinator — When prompted, specify the SQL server to use and the installation account. The Change Auditor database is created remotely on this server during the installation.


	NOTE: During the coordinator installation, you are have the option of adding the current user to the Change Auditor Administrators security group. If you did not add the current user during the installation process or want to add extra user accounts to the Change Auditor security groups, add them before running the client. Quest also recommends that you add these security groups to the appropriate SQL database role (that is, Change Auditor Administrators — <InstallationName> group to the Change Auditor_Administrators role and ChangeAuditor Operators — <InstallationName> group to the ChangeAuditor_Operators role). See Add Users to Change Auditor Security Groups.

•

Client — After you have confirmed that the coordinator is functioning correctly, install the client.


	TIP: Quest recommends that you install the first coordinator and client, but do not deploy agents until you have installed required coordinators. When deploying agents, you can select which installation to use for each of the agents.

•

Agents — Open the client to deploy agents to your domain controllers and member servers. Also, if you have Change Auditor for Logon Activity Workstation licensed, deploy agents to the domain to monitor for logon activity.

•

Web client — Optionally, install the web client on the IIS web server.

Install the first coordinator

The coordinator fulfills client and agent requests and generates alerts. You can install multiple coordinators in a single forest to provide fault tolerance of the Change Auditor service tier. See Install the client.

NOTE:

•

You cannot use an existing database. The database must be created by the coordinator installation.

•

UDP port 389 must be open on initial installs and upgrades for the coordinator to start.

The coordinator installation creates the following components:

•

The coordinator

•

A coordinator system tray icon, where you can enable or disable the coordinator, display the status of the coordinator installed on the current computer, change the database instance or service accounts used to access the database, or specify a static port to use to communicate with the coordinator.


	NOTE: See the Change Auditor User Guide for more information about the Change Auditor coordinator system tray icon.

•

Three installation-specific Active Directory security groups to enable access to the Change Auditor client and shared overviews distributed using the Change Auditor web client.

•

ChangeAuditor Administrators — <InstallationName>

•

ChangeAuditor Operators — <InstallationName>

•

ChangeAuditor Web Shared Overview Users — <InstallationName>

Where <InstallationName> is a unique name selected during the coordinator installation to isolate your components from any other Change Auditor installation in your Active Directory forest.


	NOTE: See the Change Auditor Web Client User Guide for more information about the ChangeAuditor Web Shared Overview Users security group.

•

Two SQL database roles (ChangeAuditor_Administrators and ChangeAuditor_Operators). These roles are added to the Change Auditor database to facilitate database connections from an untrusted forest with the least amount of privileges. The two roles allow administrators to control access to the Change Auditor database through SQL security.

Required permissions

IMPORTANT: Minimum permissions

User account installing the coordinator:

The user account that is installing the coordinator must have permission to perform the following tasks on the target server:

•

Windows permissions to create and modify registry values.

•

Windows administrative permissions to install software and stop or start services.

The user account must also be a member of the Domain Admins group in the domain where the coordinator is being installed.

Service account running the coordinator service (LocalSystem by default):

•

Active Directory permissions to create and modify SCP (Service Connection Point) objects under the computer object that is running a Change Auditor coordinator.

•

Local Administrator permissions on the coordinator server.

By default, the Coordinator service runs as LocalSystem. To run the Change Auditor service as a Domain User or service account other than Local System, the Change Auditor SPN (Service Connection Point) must be removed from the Coordinator computer (local system) account and added to the Domain Account used to run the Coordinator service.

To do so, open a command prompt on a Domain Controller and perform the following:

Remove the SPN from the computer object by entering:

setspn -D NPRepository4(INSTALLATION_NAME)/SERVER.DOMAIN.TLD SERVERNAME

Add the SPN to the service account by entering:

setspn -A NPRepository4(INSTALLATION_NAME)/SERVER.DOMAIN.TLD USERNAME

INSTALLATION_NAME = Change Auditor Installation (Default name is DEFAULT)

SERVER.DOMAIN.TLD = FQDN of the coordinator server

SERVERNAME = Short name of the coordinator server

USERNAME = SAM account name of the service account

Update the Coordinator service to run under the user name context in question.

Restart the Coordinator service.

SQL Server database access account specified during installation:

Create an account that the coordinator service can use on an ongoing basis for access to the SQL Server database. This account must have a SQL Login and be assigned the following SQL permissions:

•

Must be assigned the db_owner role on the Change Auditor database

•

Must be assigned the SQL Server role of dbcreator

To install the first coordinator:

NOTE:

•

You should have received separate licenses from Quest to enable the Change Auditor products you purchased. Before you begin the installation, copy the appropriate license to the local hard drive where you are installing Change Auditor.

•

You cannot use an existing database. The database must be created by the coordinator installation.

Verify that the user account used to run the coordinator installation is at least a Domain Admin in the domain to which the coordinator server belongs.

Use an existing account or create a user account that Change Auditor will use to access the SQL Server.

Create a SQL Login for this user account and assign the following permissions to this login: Server role: dbcreator

From the member server, browse to the folder where the Change Auditor package was downloaded, and run the Quest Change Auditor Coordinator (x64).msi file to open the Change Auditor Coordinator Setup wizard.

Enter the information requested in the Coordinator Setup wizard.

Review the table for additional information. This table only covers unfamiliar information. It does not include all the wizard screens or field descriptions.

Table 2. Coordinator Setup wizard — installing first coordinator

Product Licensing screen

Licenses

Click Open License Dialog to locate and apply a license.

NOTE: As of Change Auditor 7.0 a new license is required for all modules.

Installation Name screen

After licensing the product, the setup wizard prompts you to enter a unique installation name to identify the database to which the coordinator will connect.

NOTE: If you plan on installing multiple coordinators, see Install the client for more details regarding the ChangeAuditor installation name.

ChangeAuditor Installation Name

Enter a unique Change Auditor installation name that identifies the current installation within your Active Directory environment. An installation name is required; has a limit of 22 characters; can only contain alphanumeric characters and underscores; and is converted to all caps.

NOTE: Quest recommends that you use the default (DEFAULT) installation name.

NOTE: If you entered an existing installation name, confirm that you want to join this component to an existing installation. Click Yes to proceed or No to reenter a unique installation name.

SQL Server Information screen

SQL Server and Instance

Enter the server name or IP address (member server running the SQL instance) and the SQL instance name for the Change Auditor coordinator database such as, <FQDN of the SQL server>\<instance name> or browse your Active Directory network to locate the required instance.

Azure SQL Managed Instance:

•

For a private endpoint, specify the managed instance host name in the following format: MyHostName.dns_zone.database.windows.net

For private endpoint with default port, port specification is not explicitly required. For example: MyHostName.b1b2a3d4e5f7.database.windows.net

MyHostName.b1b2a3d4e5f7.database.windows.net,1433

•

For a public endpoint, specify the managed instance host name and port in the following format: MyHostName.public.dns_zone.database.windows.net,3342

For public endpoint, port specification is required. For example: MyHostName.public.b1b2a3d4e5f7.database.windows.net,3342

NOTE: Visit the support portal knowledge base for more information about migrating from SQL on-premises to SQL Managed Instance.

NOTE: Performance may vary depending on network configuration, topology, and Azure SQL Managed Instance configuration.

NOTE: Azure SQL Managed Instance (PaaS) is supported using SQL authentication or Microsoft Entra authentication with an encrypted connection. Windows authentication is not supported.

NOTE: Single User Mode is not supported during installation or upgrade when using Azure SQL Managed Instance. Ensure that all SQL connections to the Change Auditor database are closed before and during the upgrade.

NOTE: Azure SQL Managed Instance (HA) high availability is supported using the read-write listener endpoint.

NOTE: If you are using Windows security to access your SQL Server, ensure that the domain user is granted access to the SQL Server.

NOTE: If you plan to add the Change Auditor database to a SQL AlwaysOn Availability Group, ensure that the availability group has already been configured and then specify the name of the availability group listener for SQL server name.

Name of database catalog

Enter the name to assign to the Change Auditor database.

NOTE: If an existing Change Auditor database is present, you should provide a unique name for the Change Auditor database. If a database with the name entered is found, a warning message explains the need to provide a unique name for your new Change Auditor database. On this warning dialog, click Cancel to specify a different database name. Clicking OK proceeds to the Ready to Install the Program screen.

Authentication/ Credentials

Use the authentication section to specify whether the authentication to use when communicating with the SQL database instance. (The authentication method is set up when SQL is installed.)

NOTE: If Windows Authentication is used to access the designated SQL instance, a verification screen is displayed. Verify that the server name, SQL instance name, and credentials are correct before proceeding. Incorrect entries cause the Change Auditor coordinator service to fail on startup.

NOTE: For Azure SQL Managed Instance (PaaS), SQL authentication or Microsoft Entra Authentication with an encrypted connection must be used.

NOTE: If you are using a group Managed Service Account:

•

The account must end with '$' and the password must be blank.

•

The coordinator host must be correctly configured to retrieve the managed password for the specified group Managed Service Account.

•

The coordinator installer must be run as the administrator. (Right-click and select Run as administrator.)

•

Encryption

NOTE:

•

Change Auditor supports TLS 1.3; however, TLS 1.2 remains a requirement since SQL Server 2022 satellite services require TLS 1.2 to be enabled. For more information on TLS support, see Microsoft documentation.

Select the appropriate level of encryption for the data sent between the coordinator and SQL server.

•

Strict (SQL Server 2022): Select this option for SQL Server 2022 and Azure SQL Managed Instance or when the instance has Force Strict Encryption enabled.

•

Mandatory: Select this option when the instance has Force Encryption enabled. It can also be used when no encryption is configured for the instance, but Trust server certificate is enabled. While this method is less secure than installing a trusted certificate, it does support an encrypted connection.

•

Optional

Enabling Trust server certificate, when 'Optional' or 'Mandatory' encryption is selected, or if the server enforces encryption, means that SQL Server will not validate the server certificate on the client computer when encryption is enabled for network communication.

Under Host name in the certificate, you can provide an alternate, yet expected, Common Name (CN) or Subject Alternative Name (SAN) in the server certificate. You would use this option when the server name does not match the CN or SAN, for example, when using DNS aliases.

Leaving this option blank allows certificate validation to confirm that the CN or SAN matches the server name.

ChangeAuditor Administrators screen

Add the current user to the “ChangeAuditor Administrators - <InstallationName>” security group

This check box is selected by default and adds the current user to the ChangeAuditor Administrators — <InstallationName> group.

Any user that is running a Change Auditor client must be added to either this security group or the ChangeAuditor Operators security group.

In addition, users responsible for deploying Change Auditor agents must be a member of the ChangeAuditor Administrators group in the specified ChangeAuditor installation.

See Add Users to Change Auditor Security Groups for more information about these security groups and how to add more user accounts.

Specify Port Information screen

By default Change Auditor dynamically assigns communication ports to use to communicate with each installed coordinator. However, using the port settings on this screen you can specify static SCP listening ports to use instead.

NOTE: A zero (0) indicates that a dynamic port is being used. These port assignments can also be set using the Coordinator Configuration Tool which is accessed by right-clicking the Change Auditor coordinator system tray icon.

Client Port

Enter the static port number for the Change Auditor client to communicate with the coordinator.

TIP: If you are planning on installing the Change Auditor web client, enter a static client port.

Public SDK Port

Enter the static port number for external applications to access the coordinator.

Agent Port (Legacy)

Enter the static port number for legacy (5.x) Change Auditor agents to communicate with the coordinator.

Agent Port

Enter the static port number for Change Auditor agents to communicate with the coordinator.

Specify LDAP Authentication Type

Specify the authentication method to use to make Active Directory requests.

•

Select Simple Authentication and Security Layer (SASL) to use Kerberos or NTLM.

•

Select Secure Socket Layer (SSL) to use certificates. See SSL certificate configuration and deployment for more details.

NOTE: When making Active Directory requests, credentials and message content are encrypted for both authentication methods.

After you have entered all the requested information, click Install to start the installation process.

After the coordinator is installed, you can install the client.


	NOTE: Reboot the server if you have any other Quest solutions installed on this server.

If you are using the SQL AlwaysOn Availability Groups functionality, you now need to put the database in an SQL availability group.

Stop the coordinator.

Put the database is in full recovery mode.

Backup the database.

Move the database to a previously configured availability group.

Allow database replication to complete.

Start the coordinator.

Install the client

The client connects directly to the coordinator or to an archive database and is the user interface that provides immediate access to key configuration change information.

To install the client:

On a workstation, laptop or member server, browse to the folder where the Change Auditor package was downloaded, and run the Quest Change Auditor Client (x64).msi file to open the Change Auditor Client setup wizard.

Select Install Change Auditor Client to open the Client Setup wizard.


	NOTE: If Microsoft .NET is not installed on the computer, an extra screen is displayed explaining that this application was not found and the install cannot continue. Click Close to stop the client install. Download and install the required .NET version. After .NET is successfully installed, restart the client installation.

Read and accept the license agreement and click Next.

Select the installation directory and click Next.

Select your shortcut options and click Next.

Specify the authentication method to use to make requests to Active Directory.

Select Simple Authentication and Security Layer (SASL) to use Kerberos or NTLM.

Select Secure Socket Layer (SSL) to use certificates. See SSL certificate configuration and deployment for more details.


	NOTE: When making Active Directory requests, credentials and message content are encrypted for both authentication methods.

Click Install.

If you are installing multiple coordinators, install your additional coordinators now.

Install multiple coordinators

When installing multiple coordinators in your Active Directory forest, the Change Auditor installation name entered during the coordinator installation determines if they connect to the same SQL database or to different database installation. That is,

•

If you use an existing installation name for each coordinator, these coordinators all connect to the same SQL database installation.

•

If you enter a unique installation name for each coordinator, these coordinators connect to different SQL database installations.

A unique installation name allows you to isolate your installation of Change Auditor from any other installations of Change Auditor in your Active Directory forest. When all Change Auditor installations are upgraded in the forest, the installation name:

•

Allows all coordinators to use your central SQL database, while ensuring no other installation’s coordinators use your SQL database.

•

Ensures that only agents in your installation connect to your coordinator. See Deploy Change Auditor Agents.

•

Ensures only users in your installation’s security groups can use the Change Auditor client to manipulate your configuration and view your data.


	TIP: Quest recommends that you install the first coordinator and client, but do not deploy agents until after you have installed all additional coordinators required. When deploying agents, you can select which installation to use for each of the agents.

To install more coordinators:

On the individual member servers that are to host a coordinator, browse to the folder where the Change Auditor package was downloaded, and run the Quest Change Auditor Coordinator (x64).msi file to open the Change Auditor Coordinator Setup wizard.

Enter the information requested in the Coordinator Setup wizard.

Review the following table for additional information. This table only covers information regarding multiple coordinator installations. It does not include all the wizard screens or field descriptions.

Table 3. Coordinator Setup wizard — installing multiple coordinators

Product Licensing screen

Licenses

Use the same license files used for the first coordinator.

NOTE: If you have installed or licensed multiple auditing modules, apply the appropriate license for each of the installed auditing modules.

Installation Name screen

Change Auditor Installation Name

Enter a unique installation name to use a different database. Enter an existing installation name or browse to connect to an existing Change Auditor installation.