Change Auditor 7.5 - User Guide

Search Results Grid

Search Results Grid

For logon activity events, a new Logon Type column is added to the Search Results grid. This column displays the type of logon that occurred:

•	Domain Authentication

•	Interactive

•	Remote Interactive

In addition, the Search Results grid for Logon Session events displays the Logon Start, Logon End, Logon Session Start, Logon Session End and Logon Duration columns.

Event Details Pane

Event Details Pane

For user logon activity events, the What field combines various event data to form a detailed description of the event that occurred. In addition, for Logon Session events, the Event Details pane displays the following attributes about the session:

•	Logon Start

•

Logon End

•

Duration

•	Session Start

•	Session End

The following table provides a description of the event details provided for user logon activity events.

 

Table 2. Event Details pane: User logon activity events

ChangeAuditor	Description
Severity	Displays ‘Medium’, which is the severity level assigned to all user logon activity events.
Who	Specifies the name of the user who initiated the change.
When	Specifies the date and time when the change occurred.
Where	Displays the name of the server where the change occurred.
Source	Displays ‘Change Auditor’ which is the application from which the event was retrieved.
Origin	Displays the NetBIOS name and IP address of the workstation or server from which the event was generated.
What	Displays a description of the user logon activity that occurred. This description consists of various fields to describe the user logon activity. NOTE: For lengthy descriptions, hover your cursor over the description field to view the entire event description.
Result	Indicates whether the user logon activity was successfully completed. Displays one of the following: • Success • Failed
Subsystem	Defines the subsystem, or area of auditing, where the event occurred. Displays ‘Logon Activity’.
Facility	Depending on the type of event, this field displays one of the following: • Authentication Activity • Domain Controller Authentication • Logon Session
Logon Start	For Logon Session events, the date and time when the user initially logged onto the computer.
Logon End	For Logon Session events, the date and time when the user logged out of the computer.
Duration	For Logon Session events, how long the user session lasted or how long the user was actually logged onto the computer (depends on the event).
Session Start	For Logon Session events, the date and time when the current user session began.
Session End	For Logon Session events, the date and time when the current user session ended.

Appendix: Workstation Agent Deployment

Appendix: Workstation Agent Deployment

Change Auditor for Logon Activity workstation agents are required to capture logon activities when a Change Auditor for Logon Activity Workstation license is applied.

This section provides recommendations for deploying agents necessary for auditing both domain workstations and non-domain workstations. It also includes instructions on manually deploying workstation agents.

•	Recommendations/deployment requirements

•	Manual workstation agent deployment

Recommendations/deployment requirements

Recommendations/deployment requirements

All workstation agents

•	.NET framework 4.8 is the minimum requirement.

•	Quest highly recommends a phased approach to deploying workstation agents. A phased approach, where a maximum of 100 workstation agents are deployed at a time which will allow you to monitor the coordinator performance before deploying another batch of agents.

Deploying workstation agents (domain workstations)

•	Recommended installation is from the Deployment tab.

•	Alternately, workstation agents can be manually deployed. See Manual workstation agent deployment for more information on manually installing agents.

Deploying foreign workstation agents (non-domain workstations)

•

A routable network path must exist between non-domain workstations, domain controllers and the coordinator servers. Name resolution of domain controller(s) and the coordinator servers is also required from the non-domain workstations, whether DNS server configuration, NetBIOS/WINS configuration or local hosts file entries are used.

•	Required installation is to manually deploy the workstation agent. See Manual workstation agent deployment for more information.

•	During installation, the workstation agent prompts for Active Directory domain and credential information to locate a coordinator and installation name.

•	When the first foreign workstation agent is manually installed, a ChangeAuditor Agents - <InstallationName> security group is created. User accounts must be added to this security group in order to properly authenticate.

▪	The Workstation Agent installer allows you to add the domain user account to the ChangeAuditor Agents – <InstallationName> security group, if appropriate LDAP and network protocol access is available.

NOTE: In some cases, it might be necessary to pre-stage\create the ChangeAuditor Agents – <InstallationName> security group and manually add the configured workstation agent user account to the security group.

▪	The Coordinator Credential Configuration can also be used to change between coordinator domains at any time after the agent is installed.

The Coordinator Credential Configurator application can be launched using the CoordinatorCredentialConfigurator.exe file in the agent installation folder on the workstation. The default agent installation location is: %ProgramFiles%\Quest\ChangeAuditor\Agent