Chat now with support
Chat with Support

Change Auditor 7.6 - User Guide

Change Auditor Overview Agent Deployment Change Auditor Client Overview Overview Page Searches Search Results and Event Details Custom Searches and Search Properties Enable Alert Notifications Administration Tasks Agent Configurations Coordinator Configuration Purging and Archiving your Change Auditor Database Working with Private Alerts and Reports Generate and Schedule Reports SQL Reporting Services Configuration Change Auditor User Interface Authorization Client Authentication Certificate authentication for client coordinator communication Integrating with On Demand Audit Enable/Disable Event Auditing Account Exclusion Registry Auditing Service Auditing Agent Statistics and Logs Coordinator Statistics and Logs Change Auditor Commands Change Auditor Email Tags

Changing authentication methods

If you move from the default Windows Forms Authentication to Active Directory Client Certificate Authentication:

•
A coordinator is required on each IIS server where the Change Auditor web client is installed. Installing the coordinator on the same computer as the IIS web server allows Change Auditor to securely and reliably authenticate the user account by its certificate without transmitting any credentials on the network.
For more information see the Installation Guide and follow the Change Auditor Coordinator Setup wizard to install a new coordinator.
•
Each web client will need to be configured to use the coordinator that is on the local IIS server. The web client will use this particular coordinator for accessing your Change Auditor installation. If a web client is already installed and using a different coordinator, it will need to be uninstalled, and re-installed to use the local coordinator. A reinstall is also necessary to change the web server configuration to allow Active Directory Client Certificate Authentication.
•
Before you install the web client, ensure that your system meets the following minimum requirements:
•
IIS web server is configured with appropriate certificates to support Smart Cards.
•
Web site exists and is configured to use the HTTS protocol.
•
Active Directory Client Certificate mapping authentication is enabled in IIS on a server level.
•
Change Auditor coordinator is installed locally on the computer where you plan to install the web client.

If you move from Active Directory Client Certificate Authentication to Windows Forms Authentication, you will need to:

•
Uninstall and re-install the web client. A re-install is necessary to change the web server configuration to allow Windows Forms Authentication.
To change the authentication method
1
Open the Administration Tasks tab and click Configuration.
2
Select Client Authentication in the Configuration task list to open the Client Authentication page.
3
Select the required method and click Apply.
Because this is a significant change which may require the re-deployment of Change Auditor components, you are presented with a confirmation dialog. Select Yes to continue or No to return to the Client Authentication page.

Certificate authentication for client coordinator communication

•
Introduction
•
Installation settings
•
Deployment
•
Windows client configuration

 

Introduction

The following section provides information on configuring and maintaining certificate authentication between the client and coordinator in environments where NTLM restrictions are in place.

* 
NOTE:  
•
When using certificate authentication for client / coordinator authentication, the option to use Active Directory Client Certificate Authentication for the client in the Client Authentication page is not available.
•
For information on connecting to a coordinator with certificate authentication using PowerShell refer to the Connect-CAClient, Find-CASuitableCoordinator, and Install-CALicenses commands in the Change Auditor PowerShell User Guide.

Installation settings

The default Change Auditor installation includes the following configuration:

•
Windows authentication for the connection between the Windows client and the coordinator.
•
Coordinator and agent services run with the local system computer account.

In environments with stringent security requirements, administrators can:

•
Restrict NTLM in their Active Directory domains by enabling and changing one or more of the following group policy settings:
•
Network security: Restrict NTLM: Incoming NTLM traffic.
•
Network security: Restrict NTLM: NTLM authentication in this domain.
•
Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers.
•
Configure the coordinator to run with an alternate service account.

When these security options are in place, the default Windows authentication cannot be used for client - coordinator communication; instead certificate authentication can be used.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating