Need to configure Change Auditor to audit domain events across multiple domains/forests.
Change Auditor Coordinators installed across non-trusted Forests are designed to write events to the same database (using SQL Authentication). This allows Reporting, Searching, and Alerting on events that occur in each Forest in the environment, from a single management console.
Please review "Multi-Forest Deployments" in the ChangeAuditor Install Guide.pdf which is part of the Documents folder included with your ChangeAuditor download or online here:
https://support.quest.com/technical-documents/change-auditor/installation-guide/12
For licensing considerations, refer to the following KB article:
https://support.quest.com/kb/4254797
