Change Auditor 7.5 - User Guide

Add and deploy Change Auditor SharePoint Solution

Add and deploy Change Auditor SharePoint Solution

To capture SharePoint events, add the Change Auditor SharePoint Solution (SharePoint.Auditing.Monitor.wsp) to the SharePoint Solution Store (which can be found on the Solution Manager page in the Central Administration site) and deploy it all SharePoint web applications of the SharePoint farms to audit.

Change Auditor provides the SharePoint Solution Manager utility to add the solution to the SharePoint Solution Store and deploy it globally to all SharePoint web applications. The Change Auditor SharePoint Solution must be deployed to all SharePoint web applications on all SharePoint farms that you want to audit.

NOTE:   • If you have multiple SharePoint farms in your environment, you must run this utility locally on the Central Administration server in each SharePoint farm. • You can also do this manually using a Windows PowerShell cmdlet to add it to the store and then deploy it using the SharePoint Central Administration web site. See Manually Add and Deploy the Change Auditor SharePoint Solution.

To add and deploy the solution globally throughout a SharePoint farm:

1	On the local SharePoint farm server, run the SharePoint Solution Manager utility:

▪	SharePoint 2016: SharePointSolutionManagerCALauncher2016.exe

▪	SharePoint 2019: SharePointSolutionManagerCALauncher2019.exe

These utilities can be found in the Plug-in for SharePoint folder under the agent installation folder. For example, the default location is:

%ProgramFiles%\Quest\ChangeAuditor\Agent\Plug-in for SharePoint

2	On the SharePoint Solution Manager dialog, select both check boxes under the Install heading:

▪	Add solution to SharePoint solution store

▪	Deploy solution to all SharePoint web applications (requires IIS restart)

 

NOTE: Since the deployment step requires an IIS restart, this is a separate step that can be run at a more convenient time when an IIS restart is less disruptive. Note that if you do not select this step, you must deploy the solution using the SharePoint Solution Manager utility or SharePoint’s Central Administration web site BEFORE Change Auditor can start capturing events.

Click Run.

3	A progress dialog is displayed. When completed, the Change Auditor SharePoint Solution status is updated at the top of the SharePoint Solution Manager dialog.

NOTE: If the add and deploy solution process cannot be completed, an error message is displayed explaining why the process did not complete successfully. Click Close to exit the SharePoint Solution Manager utility. Once the issue is resolved, rerun the SharePoint Solution Manager utility to deploy the Change Auditor SharePoint Solution.

Click Close to close the SharePoint Solution Manager dialog.

4	A message is displayed explaining that the deployment status has changed and that the agent needs to be restarted. Click Close to close the message box.

5	Restart the agent to enable auditing of SharePoint events.

Create SharePoint Auditing template

Create SharePoint Auditing template

Create a SharePoint Auditing template which specifies the SharePoint farm and the paths within the SharePoint farm to audit and the agent to receive events from the selected SharePoint farm.

NOTE: If you have multiple SharePoint farms to be audited, create a separate SharePoint auditing template for each farm.

Client components and features

Client components and features

The following table lists the client components and features that require a valid Change Auditor for SharePoint license. The product will not prevent you from using these features; however, associated events will not be captured unless the proper license is applied.

NOTE: To hide unlicensed Change Auditor features from the Administration Tasks tab (including unavailable audit events throughout the client), use the Action | Hide Unlicensed Components menu command. Note that this command is only available when the Administration Tasks tab is the active page.

 

 

Table 1. Change Auditor for SharePoint client components and features

Client page	Feature
Administration Tasks tab	Agent Configuration page • Event Logging - enable/disable SharePoint event logging Audit Task list: • SharePoint NOTE: See SharePoint Auditing for information about enabling event logging and creating templates to define SharePoint auditing.
Event Details pane	What details: • Farm • Site • Item URL
Events	Facilities: • SharePoint Document • SharePoint Document Library • SharePoint Farm • SharePoint Folder • SharePoint List • SharePoint List Item • SharePoint Permission • SharePoint Security Group • SharePoint Site • SharePoint Site Collection
Search Properties	What tab: • Subsystem | SharePoint NOTE: See SharePoint Searches and Reports for information on using the What tab to create custom SharePoint search queries.
Searches page	Built-in reports: • All SharePoint Events in the last 7 days • Document Content changes in the last 7 days • Document Story changes in the last 7 days • Document Version changes in the last 7 days • List Item changes in the last 7 days • Permission changes in the last 7 days • Permission Inheritance changes in the last 7 days • Site Collection Groups created and deleted in the last 7 days • Site Collection Groups Membership changes in the last 7 days • Site Collection Ownership changes in the last 7 days • Site Collections created and deleted in the last 7 days • Sites created and deleted in the last 7 days • Sites moved in the last 7 days
Advanced tab/Search Results page	Columns: • SharePoint FarmName • SharePoint ItemName • SharePoint ItemURL • SharePoint ListName • SharePoint ListPath • SharePoint WebName • SharePoint WebURL
Alert Body Configuration dialog - Event Details tab	Variables (email tags): • SHAREPOINT_FARMNAME • SHAREPOINT_ITEMNAME • SHAREPOINT_ITEMURL • SHAREPOINT_LISTNAME • SHAREPOINT_LISTPATH • SHAREPOINT_WEBNAME • SHAREPOINT_WEBURL NOTE: See the Change Auditor User Guide for a description of these email tags and how to configure alert email notifications.

 

 

Getting Started

Getting Started

•	Introduction

•	Verify deployment status of Change Auditor SharePoint Solution

•	Verify auditing template is applied

•	Make changes and run a report

•	Troubleshooting steps