Chat now with support
Chat with Support

Change Auditor 7.5 - Installation Guide

Installation Overview Install Change Auditor Add Users to Change Auditor Security Groups Connecting to the Clients Deploy Change Auditor Agents Upgrade Change Auditor Installation Notes and Best Practices Deployment Options Workstation Agent Deployment Agent Comparison Install an agent to audit ADAM (AD LDS) on workgroup servers Windows Installer Command Line Options

SSL certificate configuration and deployment

When selecting to use SSL for LDAP authentication, ensure that you adhere to the following guidelines:

•
A public-key certificate for the domain controller is required on the host of each Change Auditor component that makes Active Directory requests to a domain controller.
•
A valid certificate must be provisioned, and your domain controller policy must be configured to use it.
•
SSL authentication settings are global. Once enabled, domain controllers within all domains known to the coordinator must be configured to support this authentication method. Domains which do not support SSL will not be searchable for Change Auditor auditing, protection or agent deployment.
•
For details on configuring certificates on domain controllers, see Microsoft documentation.
•
Certificates are deployed to all computers in the forest automatically when using Active Directory Certificate Services. Certificates must be manually deployed to foreign forests.
* 
NOTE: Visit the support portal knowledge base for more information.
•
A sample script is available that you can use to set or reset the authentication mode used for your Change Auditor components. By default, the script is located here: C:\Program Files\Quest\ChangeAuditor\Client\PowerShell Sample Scripts\ SetCALdapBindingOptions.ps1.

 

Add Users to Change Auditor Security Groups

Add Users to Change Auditor Security Groups
•
Introducing Change Auditor security groups
•
Add accounts to ChangeAuditor database role
•
Add accounts to security groups

Introducing Change Auditor security groups

During the coordinator installation, the following security groups are created to allow access for performing various functions within Change Auditor:

•
ChangeAuditor Administrators — <InstallationName> Group — provides access to all aspects of Change Auditor and to deploy agents.
•
ChangeAuditor Operators — <InstallationName> Group — provides access to Change Auditor except for making configuration changes.
•
ChangeAuditor Web Shared Overview Users — <InstallationName> Group — provides access to the web client shared overviews, while restricting access to only what has been shared. See the Change Auditor Web Client User Guide for more information about sharing overviews.

The installation name assigned during the coordinator installation is appended to these security groups. For example, when using the default installation name, these groups are named:

•
ChangeAuditor Administrators — DEFAULT
•
ChangeAuditor Operators — DEFAULT
•
ChangeAuditor Web Shared Overview Users — DEFAULT

Two Domain Local Security Groups are created in the same domain as the coordinator. The Group Scope can be changed to Universal as long as the Group Names remain ChangeAuditor Administrators — <InstallationName> and ChangeAuditor Operators — <InstallationName>.

* 
NOTE: If the domain’s Functional Level is in Windows 2000 Mixed mode, then Local Security groups are created on each coordinator member server.

Membership in the ChangeAuditor Administrators and ChangeAuditor Operators groups enable the client to connect and authenticate to a coordinator; therefore, any user that is running a Change Auditor client must be added to one of these groups. In addition, all users responsible for deploying agents must also be a member of the ChangeAuditor Administrators group in the specified Change Auditor installation. If you are not a member of this security group for this installation, you get an access denied error.

* 
NOTE: If multiple coordinators are installed in a mixed mode environment, to connect to each coordinator, you must add your user account to one of these groups on each of the member servers where the coordinators reside.

All users running a client must also have the proper SQL credentials for accessing a Change Auditor archive database. One way of accomplishing this would be to add the ChangeAuditor Administrators and ChangeAuditor Operators groups into the appropriate SQL database roles which were also created during the coordinator installation: ChangeAuditor_Administrators and ChangeAuditor_Operators.

Add accounts to security groups

During the coordinator installation process, you could add the current user to the ChangeAuditor Administrators security group in the specified Change Auditor installation. If you selected not to add the current user during the installation process or want to add more user accounts, use the following procedure.

To add user accounts to security groups:

Use the Active Directory Users and Computers MMC snap-in to add the appropriate user accounts to one of the Change Auditor groups:

1
Open the Active Directory Users and Computers snap-in.
2
Connect to the domain where the coordinator was installed.
3
Right-click and select Properties on the group called ChangeAuditor Administrators — <InstallationName> or ChangeAuditor Operators — <InstallationName>.
4
Select the Members tab.
5
Click Add and browse to the appropriate user object.
6
Click OK to close the Active Directory Users and Computers snap-in.
7
To apply this change, log out and back in.

Adding the appropriate users to one of these groups allow the client to successfully connect to the coordinator.

To add user accounts to security groups (Domain in Windows 2000 mixed mode):

Use the Microsoft Computer Management tool to add the appropriate user accounts to one of the Change Auditor groups:

1
From the member server where the Change Auditor coordinator is installed, right-click My Computer and select Manage.
2
From the Computer Management dialog, expand Local Users and Groups and select Groups.
3
Right-click and select Properties on the group called ChangeAuditor Administrators — <InstallationName> or ChangeAuditor Operators — <InstallationName>.
4
Click Add and browse to the appropriate user object.
5
Click OK to close the Computer Management tool.
6
To apply this change, log out and back in.

Adding the appropriate users to one of these groups allow the client to successfully connect to the coordinator.

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating