Chat now with support
Chat with Support

Change Auditor 7.5 - Installation Guide

Installation Overview Install Change Auditor Add Users to Change Auditor Security Groups Connecting to the Clients Deploy Change Auditor Agents Upgrade Change Auditor Installation Notes and Best Practices Deployment Options Workstation Agent Deployment Agent Comparison Install an agent to audit ADAM (AD LDS) on workgroup servers Windows Installer Command Line Options

Installing agents in a foreign forest

To manually install an agent in a foreign forest:
1
Copy the appropriate agent installer package from the Change Auditor service installation directory to the required computers.
2
Run the installer file to open the Change Auditor Agent Setup wizard which steps you through the installation.
3
Accept the license agreement and click Next.
4
Select This agent connects to a coordinator in a foreign forest.
5
Enter the Active Directory credential information to locate the Change Auditor Installation and allow the agent to connect to the coordinator in the remote forest.
•
Coordinator Forest Root (example.com): Enter the coordinator forest root domain name and an account to be used by the agent to connect to the coordinator.
•
Account Name (example.com\user): Enter the name of the user that can find and connect to a coordinator in the Active Directory forest.
•
Account Password : Enter the password associated with the specified account.
•
Account Type: Select the account type of the specified account.
* 
NOTE: If you are using a group Managed Service Account, see Using group Managed Service Accounts (gMSA) for additional requirements.
•
Add this user to the ChangeAuditor Agents security group : This is selected by default indicating that the specified user account will be added to the ChangeAuditor Agents security group in the forest where the coordinator is located. User accounts must be added to this security group to properly authenticate.
* 
NOTE: You may need to pre-stage\create the "ChangeAuditor Agents – <InstallationName>" domain local security group and manually add the configured user account to the security group in additional domains within the forest where coordinators reside. If using a group Managed Service Account this step is required and must be performed manually.
You can add the domain user account to the ChangeAuditor Agents – <InstallationName> security group, if appropriate LDAP and network protocol access is available.
6
The Installation Name screen prompts you to enter the installation name to identify the database where the coordinator is located. Click Browse to select the required installation
7
Choose the destination folder and click Next.
8
Specify the authentication method to use to make Active Directory requests.
•
Select Simple Authentication and Security Layer (SASL) to use Kerberos or NTLM.
•
Select Secure Socket Layer (SSL) to use certificates. See SSL certificate configuration and deployment for more details.
* 
NOTE: When making Active Directory requests, credentials and message content are encrypted for both authentication methods.
9
Click Next to begin the installation.
Once the agent starts and connects to coordinator, the foreign forest computers will be available in the Deployment tab.

 

Example deployment scenario

The following diagram shows two separate forests where Change Auditor will be deployed. Forest A is deployed first and then Forest B is added.

Forest A installation
1
Install the coordinator on a member server in Forest A. In this example, Coordinator.ForestA.com is used as the coordinator server.
While installing the first coordinator, make note of the “Installation name”. The same installation name is required when deploying agents to Forest B.
2
Install the client on either a workstation or member server. In this example, CAClient1.ForestA.com is used as the client computer.
3
Using the client, connect to the coordinator in Forest A to deploy agents to computers in Forest A. See Deploy Change Auditor Agents for more details about deploying agents.
At this point, Change Auditor should be fully deployed to the first forest in the organization (ForestA.com in this example).
Forest B installation

Option 1: Deploying agents to a foreign forest through the Change Auditor client

1
Using the client, connect to the coordinator in Forest A.
2
Deploy agents to the required computers in Forest B. (See Deploying agents to a foreign forest for details.)

Option 2: Installing agents manually in a foreign forest

1
Run the appropriate Agent MSI on the required computers in Forest B where the installation is required. The MSI should be launched from an elevated command prompt.
2
When prompted, select the This agent connects to a coordinator in a foreign forest option.
3
Enter the Active Directory root domain name of the remote forest where the agent will connect.
4
Enter a domain administrator account for the coordinator domain and click Next. Ensure that you use the following format: fully-qualified-domain-name\user.
5
Enter the Installation Name that the agent needs to join and click Next.
6
Click Install.
The agent will now connect to the coordinator in Forest A and the computer will be available in the Deployment tab of the Change Auditor client.

 

Workstation Agent Deployment

Workstation agents are required to capture login activity events when a Change Auditor for Logon Activity Workstation license is applied. This section provides recommendations for deploying agents necessary for auditing both domain workstations and non-domain workstations. It also includes instructions on manually deploying workstation agents.

•
Recommendations and deployment requirements
•
Manual workstation agent deployment
•
Deploying workgroup agents (non-domain workstations)

 

Recommendations and deployment requirements

All workstation agents
•
See the Release Notes for a full list of the minimum system requirements for workstation agents.
•
Quest recommends a phased approach to deploying workstation agents. Deploying a maximum of 100 workstation agents at a time allows you to monitor the coordinator performance before deploying another batch of agents
•
When deploying agents using remote deployment from the Deployment tab, the LDAP option for the deployed agent will be set according to the current LDAP setting of the connected coordinator.
Deploying workstation agents (domain workstations)
•
The recommended installation is from the Deployment tab of the client. See Change Auditor agents.
•
Alternately, you can manually deploy workstation agents. See Manual workstation agent deployment.
Deploying foreign forest workstation agents (domain workstations)
•
The recommended installation is from the Deployment tab of the client. See Deploying foreign forest agents.
•
Alternately, you can manually deploy workstation agents. See Manual workstation agent deployment.

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating