• 成为门户专家
• 下载
• 打印
• 我的下载 ()

• 支持
• 技术说明文件
• Change Auditor 7.3
• Change Auditor 7.3 - User Guide

Change Auditor 7.3 - User Guide

内容导航  

Change Auditor Overview

Available Change Auditor auditing modules

Agent Deployment

Deployment page Deploy agents Change the agent installation location and system tray option Enable auto deployment Refresh or clear Deployment page information

Change Auditor Client Overview

Starting the Change Auditor client Accessing Change Auditor news and updates Managing connection profiles

Connection wizard

Client components Customize table content

Sort data Resize or move columns Add or remove columns Group data

Filter data

Using custom filters

Directory object picker

Overview Page

Overview My Favorite Search Define a favorite search Overview panes

Top Agent Activity Recent Event Activity Count of Events By Agent Status Coordinator Status

Event Details pane

Searches

Introduction Searches page

Explorer view Searches list Search Properties tabs

View a list of available searches Run searches Run a quick search

Search Results and Event Details

Introduction Search Results page

Search Results grid Search Properties tabs Event Details pane

View search results

Display results in different formats

Preview search results Compare results side-by-side View event details or search properties Copy event details Email event details Add comments View user context and run related searches Protect critical objects, mailboxes, files and folders Add search properties to existing event queries

Custom Searches and Search Properties

Introduction Create a custom search Search Properties tabs

Info tab Who tab What tab Where tab When tab Origin tab Alert tab Report tab Layout tab SQL tab XML tab

Enable Alert Notifications

Introduction Alert tab (Search Properties tabs) Enable alerts Disable alerts Alert History page View alert history View event details or alert properties

Administration Tasks

Administration Tasks tab Administration Task lists Export/import Administration Task settings

Agent Configurations

Introduction Agent Configuration page Define agent configurations Assign agent configurations to server agents Enable event logging

Coordinator Configuration

Coordinator Configuration page SMTP Configuration Configure email alert notifications/reports Customize alert email content Shared Folder Configuration Group Membership Expansion Add groups to Group Membership Expansion list Agent Heartbeat Check Disconnect client after 30 minutes of inactivity Scheduled Task Handling

Purging and Archiving your Change Auditor Database

Introduction Planning your jobs Purge and Archive page Create and maintain jobs Purge and Archive wizard Purge selected records

Disable Private Alerts and Reports

Introduction Private Alerts and Reports page Disable private alerts and reports

Generate and Schedule Reports

Schedule reports for distribution

Create global report template Define report content and layout Enable and schedule reporting

Launch Report Designer Publish reports Print or save a page's contents

SQL Reporting Services Configuration

Introduction SQL Reporting Services Page SQL Reporting Services Templates SQL Reporting Services Wizard

Change Auditor User Interface Authorization

Introduction Application User Interface Authorization page Add task definition Add role definition Add application group Remove a task definition

Client Authentication

Introduction Client Authentication Page

Changing authentication methods

Certificate authentication for client coordinator communication

Introduction

Installation settings Deployment Coordinator configuration Windows client configuration

Integrating with On Demand Audit

Managing a Quest On Demand Audit integration

Creating an On Demand Audit configuration Working with an On Demand Audit configuration

Enable/Disable Event Auditing

Introduction Audit Events page Enable/disable event auditing Modify event's severity level or event class description Define events to be captured based on results View event information

Account Exclusion

Introduction Excluded Accounts Auditing page Excluded Accounts templates Excluded Accounts wizard

Registry Auditing

Introduction Registry Auditing page Registry Auditing templates Registry Auditing wizard

Service Auditing

Introduction Services Auditing page Service Auditing templates Service Auditing wizard

Agent Statistics and Logs

Introduction Agent Statistics page

Agent Statistics grid Resource Properties pane

Machine Info page Processors page Drives page Shares page Services page Exchange Mailboxes page

Agent system tray icon

Change Auditor Agent Status dialog

View agent status/statistics Manage Change Auditor agents Agent Log page View and save agent trace logs

Coordinator Statistics and Logs

Introduction Coordinator Statistics page Coordinator system tray icon

Change Auditor Coordinator Status dialog Coordinator Configuration tool

View coordinator status and statistics Manage Change Auditor coordinators Coordinator Log page View and save coordinator trace logs

Change Auditor Commands

Menu commands Tool bar buttons Right-click commands

Change Auditor Email Tags

• Viewing Topics 193 - 196 of 202

×

Coordinator Configuration tool

You can use the Coordinator Configuration tool to modify the credentials used by the coordinator when accessing the database. Right-clicking the coordinator system tray icon and selecting Coordinator Configuration, displays the Coordinator Configuration tool. From here, you can:

•	modify the credentials to be used to access the Change Auditor database

•	change the database instance

•	specify static SCP listening ports to be used to communicate with the coordinator

•	specify where the Active Directory and GPO protection templates are to be stored: SQL (default) or Active Directory

This tool consists of the following tabbed pages:

•	Security page

•	Ports page

•	Protection page

Security page

From the Security page, you can change the database instance and service accounts used to access the database.

NOTE: If User Account Control (UAC) is enabled, a confirmation dialog appears where you can authorize the Coordinator Configuration tool to use the required elevated rights.

Use the fields/options to enter the credentials to be used to access the designated SQL Server/instance as described below:

SQL server and instance

Enter the name or IP address of the SQL instance to be used. (i.e., <Server Name>\<Instance Name>). You can also click Browse to locate and select the SQL server and instance.

NOTE: If your database is in a SQL AlwayOn Availability Group, specify the name of the availability group listener for the SQL Server name.

Name of database Catalog

This displays the name assigned to the Change Auditor database.

Connect using

Specify whether Windows authentication, Azure Active Directory authentication or SQL server authentication will be used when communicating with the SQL database instance. (The authentication method is set up when SQL is installed.)

NOTE: Azure Active Directory authentication is only supported for SQL Managed Instances.

Depending on the authentication option selected, enter the appropriate user credentials.

•	Windows Authentication - this is selected by default and will use Windows authentication to access the database.

NOTE: If you are using a group Managed Service Account, ensure that the account ends with '$' and the password is left blank.

•	SQL Server Authentication - select this to use SQL Server authentication to access the database.

•	Azure Active Directory Authentication - select this to use Azure Active Directory authentication to access the database located on an Azure SQL Managed Instance.

Azure SQL Managed Instance:

•	For a private endpoint, specify the managed instance host name in the following format: MyHostName.dns_zone.database.windows.net

For private endpoint with default port, port specification is not explicitly required. For example: MyHostName.b1b2a3d4e5f7.database.windows.net

or

MyHostName.b1b2a3d4e5f7.database.windows.net,1433

•	For a public endpoint, specify the managed instance host name and port in the following format: MyHostName.public.dns_zone.database.windows.net,3342

For public endpoint, port specification is required. For example: MyHostName.public.b1b2a3d4e5f7.database.windows.net,3342

NOTE:   • Azure SQL Managed Instance (PaaS) is supported using SQL authentication or Azure Active Directory Authentication with an encrypted connection. Windows authentication is not supported. • For an Azure SQL Managed Instance (PaaS), SQL authentication or Azure Active Directory authentication with an encrypted connection must be used. • Single User Mode is not supported during installation or upgrade when using Azure SQL Managed Instance. Ensure that all SQL connections to the Change Auditor database are closed before and during the upgrade. • Azure SQL Managed Instance (HA) high availability is supported using the read-write listener endpoint. • Performance may vary depending on network configuration, topology, and Azure SQL Managed Instance configuration.

Login ID

Enter the user name for the account to be used to access the SQL server instance.

Password

Enter the password associated with the user account entered above.

Domain

Enter the domain name for the Windows account used to access the designated SQL server instance. (Only valid for Windows Authentication.)

Encrypt connection

Select to use SSL encryption for all data sent between the coordinator and the SQL server. To use this option, the SQL server must have a certificate installed and the format of the SQL server name specified must be an exact match to the name format used in the certificate (for example FQDN or NetBios).

Ports page

By default, Change Auditor dynamically assigns communication ports for each installed coordinator. However, using the Ports page of the Coordinator Configuration dialog, you can specify static SCP listening ports to be used to communicate with the coordinator.

NOTE: If you upgraded from a 5.x installation where static ports were defined, these static ports are retained as part of the upgrade process. However, the Agent Port setting, which is used by 6.0 agents, is set to use a dynamic port. Check with your system administrator to determine whether this new connection should also be using a static port.

Enter the ports to use to communicate with the coordinator:

NOTE: A zero (0) indicates that a dynamic port is being used. If you have set a static port and wish to use a dynamic port, change the port number back to 0.

Client Port

Enter the static port number to be used by the client to communicate with the coordinator.

Public SDK Port

Enter the static port number to be used by external applications to access the coordinator.

Agent Port

Enter the static port number to be used for communication between a agent and a coordinator.

Protection page

By default, Change Auditor stores the Active Directory and GPO protection templates in SQL. However, you can use the Protection page of the Coordinator Configuration dialog to store the Active Directory and GPO protection templates in Active Directory instead of SQL.

NOTE: When you select to store your Active Directory and Group Policy protection templates in Active Directory, you can use the Security feature on the Active Directory Protection page or Group Policy Protection page to provide an additional layer of security. The additional setting is intended when you require tighter security ACLs on your Active Directory and GPO objects and templates (for example, the Change Auditor SQL database may not be fully secured by ChangeAuditor Administrators). For more information about setting this additional security on protected objects, see the Change Auditor for Active Directory User Guide.

Specify the appropriate option for storing Active Directory/GPO protection and ADAM (AD LDS) protection:

Store Active Directory/GPO protection in:

Select one of the following options:

•	SQL (default)

•

AD

Store ADAM (AD LDS) protection in:

Select one of the following options:

•	SQL (default)

•

AD

 

View coordinator status and statistics

To view coordinator status and statistics (Overview page):

1	Open the Overview page and if the Coordinator Status overview pane is not being displayed, click the arrow button on an overview pane and select one of the following commands:

•	Coordinator Status | Enterprise View

•	Coordinator Status | <domain>

This displays a pie chart depicting the current status of all the coordinators installed in either the entire enterprise or in a selected domain.

2	By default, this pane only includes installed coordinators in the pie chart. You can however, select the Show Uninstalled Coordinators check box to include uninstalled coordinators in the pie chart.

3	Double-clicking the pie chart displays the Coordinator Statistics page.

To view coordinator status/statistics (Coordinator Statistics page):

1	Open the Coordinator Statistics page.

2	Click Show Uninstalled Coordinators to include coordinators set as ‘uninstalled’. Click Hide Uninstalled Coordinators to exclude these coordinators from the display.

The values in the different event columns are links, which when selected will open up a new Search Results tab to display the related details for these events.

To view coordinator status/statistics on current coordinator only (coordinator system tray icon):

1	From the server where the coordinator is installed, right-click the coordinator system tray icon and select Coordinator Status.

2	This displays the Change Auditor Coordinator Status dialog with the status and statistics regarding the coordinator, database, agent connections and events and alerts.

3	Click OK to close this dialog.

Manage Change Auditor coordinators

To stop a coordinator:

NOTE: You can use Action | Agent Notifications to hide (or display) the desktop notifications that are displayed when these processes are performed.

1	From the server where the coordinator is installed, right-click the coordinator system tray icon and select Disable Coordinator.

2	On the confirmation dialog, click Yes to stop the coordinator service.

A message displays explaining that the coordinator is being stopped.

In addition, a desktop notification displays in the lower right-hand corner of your screen explaining that the selected coordinator is being disabled.

Once disabled, the coordinator system tray icon contains a red light indicating that the coordinator is disabled.

3	If you so choose, click Set Coordinator Uninstalled to flag the selected coordinator as ‘Uninstalled’.

4	Click Show Uninstalled Coordinators to include uninstalled coordinators in the Coordinator Statistics list. Click Hide Uninstalled Coordinators to exclude uninstalled coordinators from the display.

To start a coordinator:

•	From the server where the coordinator is installed, right-click the coordinator system tray icon and select Enable Coordinator.

A message displays explaining that the coordinator is being started.

In addition, a desktop notification is displayed in the lower right-hand corner of your screen explaining that the selected coordinator is being started.

Once restarted, the coordinator system tray icon no longer contains a red or yellow button indicating that the coordinator is now active.

Coordinator Log page

Two new log pages are created whenever you select View Coordinator Log. These log pages contain the event details that were recorded in each of these trace logs for the selected coordinator:

•	Service: CA4xCompat.exe.nptlog - this log includes the messages logged during agent to coordinator communications.

•	Service: ChangeAuditor.ServiceLog.nptlog - this log includes the messages logged during client to coordinator communications.

The data grid and event details pane on this page contains the following information for each log entry. The default column in the table below identifies the fields that are displayed in the data grid by default. To display different fields, click the Field Chooser button located to the far left of the column headings.

 

Table 4. Coordinator Log page: Field descriptions

Column	Default	Description
File	No	Specifies the name of the source file that logged the message.
Function	No	Displays the name of the function that logged the message.
ID	No	Displays the event ID used to identify the event.
Level	Yes	Indicates the severity of the event message: • Info - ‘For your information’; does not require attention • Error - events that indicate a problem has occurred; requires attention • Warning - events that warn of potential problems; does not require immediate attention
Line	No	Specifies the line within the source file that logged the message.
Logger	No	Specifies the logger used to log events.
Message	Yes	Displays the event message that was posted to the log.
Thread	No	Specifies the thread within the source file that logged the message.
Timestamp	Yes	Displays the date and time when the entry was posted to the log. NOTE: Based on the client’s current local date and time. The format used to display this date and time is determined by the local machine’s regional and language setting.

Use the tool bar buttons at the top of the log page to scroll through the log and search for log entries.

 

Table 5. Coordinator Log page: Tool bar buttons

Refresh	Use to refresh and reload the log entries from the source file. NOTE: Not available when the log page is launched using the View Coordinator Log command.
Copy	Use to copy the selected content to the clip board. Use with the Select All button to copy and paste the contents of the entire log into another application.
Select All	Use to select the entire contents of the log. Use with the Copy button to copy and paste the contents of the log into another application.
Find:	Enter a specific string of characters or word to be located in the log and use the Find button to locate the text.
Show Matched Entries Only (Ctrl+M)	Use to display only the entries that match the word/string of characters entered in the search text.
Match Case	Use to locate entries that match the case as it was entered in the search text.
Previous	Use to move to the previous entry that contains the search text.
Next	Use to move to the next entry that contains the search text.
Print	Use one of the Print options to print or save the contents of the log.

•  上一页
• Viewing Topics 193 - 196 of 202
• 下一页 

搜索该文档 在所有文档中搜索该产品版本 在所有文档中搜索该产品 搜索所有文档

×

 欢迎访问支持

您可以在附属支持站点上查找适用于戴尔*产品*的在线支持帮助。单击“继续”，转至适用于*产品*的正确支持内容和帮助。

相关文档

The document was helpful.

选择评级

I easily found the information I needed.

选择评级

© 2024 Quest Software Inc. ALL RIGHTS RESERVED. 使用条款 隐私 Cookie Preference Center