Change Auditor does not parse or scrape the Windows Event logs. The CA agent injects dlls and hooks into the processes it is licensed to audit.
For example, when an agent is installed on a DC and the Change Auditor for AD License is applied, the agent will inject hooks into the LSASS process to audit changes made to AD objects.
© 2024 Quest Software Inc. ALL RIGHTS RESERVED. Feedback 使用条款 隐私 Cookie Preference Center