Chat now with support
Chat with Support

Change Auditor 7.6 - Installation Guide

Installation Overview Install Change Auditor Add Users to Change Auditor Security Groups Connecting to the Clients Deploy Change Auditor Agents Upgrade Change Auditor Installation Notes and Best Practices Deployment Options Workstation Agent Deployment Agent Comparison Install an agent to audit ADAM (AD LDS) on workgroup servers Windows Installer Command Line Options

Requirements

•
Network connectivity between the foreign server and coordinators in the remote forest.
•
A routable network path between the foreign forest computer and the coordinator servers.
•
Name resolution of domain controllers and the coordinator servers from the foreign forest server. This is required regardless of whether DNS server configuration, NetBIOS/WINS configuration or local hosts file entries are used.
•
Ensure that the account you are using to deploy agents is at least a Domain Admin in every domain that contains servers or workstations where agents will be deployed.

Workflow

•
Harvest the foreign forest topology. See Harvesting the foreign forest topology.
•
Deploy an agent in a foreign forest.
You can deploy agents either by installing agents on the required computers or using the deployment option in the Change Auditor client. See Installing agents in a foreign forest and Deploying agents to a foreign forest for details).
* 
NOTE:  
•
If the agent fails to connect to the coordinator, check the network connection, ensure that the coordinator name can be resolved, the group "ChangeAuditor Agents - <InstallationName>" is created in the domain where the coordinator is located, and the account has been added.
•
You may need to pre-stage\create the "ChangeAuditor Agents – <InstallationName>" domain local security group and manually add the configured user account to the security group in additional domains within the forest where coordinators reside.
•
Create any auditing templates as required and assign to the agent.
•
Events will be audited by the agent and displayed in the client once they are collected.

Harvesting the foreign forest topology

1
From the Change Auditor client, select the Deployment tab.
2
Click Foreign Forest to open the Foreign Forest Credentials dialog where you will provide the foreign forest DNS name and credentials required to collect the foreign forest topology.
3
Click Add to enter the credentials of a user with administrator rights on the selected domain and the required forest, and click OK.
4
Click Force Refresh to populate the available servers or workstations in the forest.

Deploying agents to a foreign forest

Deploying agents to a foreign forest
* 
NOTE: When deploying agents using remote deployment from the Deployment tab, the LDAP Authentication option for the deployed agent will be set according to the current LDAP Authentication setting of the connected coordinator.
To deploy agents to a foreign forest from the client:
1
From the Change Auditor client, select the Deployment tab.
The Deployment page is populated with the servers (domain controllers and member servers) and workstations in your Active Directory environment.
* 
NOTE: The Deployment page may initially be empty until the current forest’s server topology has completed. The topology scan takes a long time when the environment contains many workstations. This page is automatically refreshed after this task has completed.
2
From this list, select an entry and select Credentials | Set to enter the proper user credentials for installing agents on the selected domain.
* 
NOTE: If you are using a group Managed Service Account, see Using group Managed Service Accounts (gMSA) for additional requirements.
3
Select one or more servers or workstations on the Deployment page and click Install or Upgrade.
4
On the Install or Upgrade dialog select one of the following options to schedule the deployment task:
•
Now (default)
•
When
If you select the When option, enter the date and time when you want the deployment task to initiate. Click OK to initiate or schedule the deployment task.
5
Enter the Active Directory credential information to allow the agent to connect to the coordinator in the remote forest, and click OK.
•
Coordinator Root Domain Name (example.com): Enter the coordinator forest root domain name and an account to be used by the agent to connect to the coordinator.
•
Account Name (example.com\user): Enter the name of the user that can find and connect to a coordinator in the Active Directory forest.
•
Account Password : Enter the password associated with the specified account.
•
Account Type: Select the account type of the specified account.
* 
NOTE: If you are using a group Managed Service Account, see Using group Managed Service Accounts (gMSA) for additional requirements.
•
Add this user to the ChangeAuditor Agents security group: This is selected by default indicating that the specified user account will be added to the ChangeAuditor Agents security group in the supplied Active Directory domain. User accounts must be added to this security group to properly authenticate.
* 
NOTE: You may need to pre-stage\create the "ChangeAuditor Agents – <InstallationName>" domain local security group and manually add the configured user account to the security group in additional domains within the forest where coordinators reside. If using a group Managed Service Account this step is required and must be performed manually.
You can add the domain user account to the ChangeAuditor Agents – <InstallationName> security group, if appropriate LDAP and network protocol access is available.
Back on the Deployment page, the Agent Status column displays ‘Pending’ and the When column displays the date and time specified.
* 
NOTE: To cancel a pending deployment task, select the server or workstation and then click Install or Upgrade. On the Install or Upgrade dialog, click Clear Pending.
As agents are successfully connected to the coordinator, the corresponding Deployment Result cell displays ‘Success’, the Agent Status cell displays ‘Active’ and a desktop notification displays in the lower right-hand corner of your screen.
* 
NOTE: To deactivate these desktop notifications, select Action | Agent Notifications.
Once agents are deployed and you open the client, the Overview page opens and provides a real-time stream of events based on a ‘favorite’ search definition and other summary information.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating