Change Auditor 7.1.1 - Installation Guide

System overview

Change Auditor agents are deployed to all servers (domain controllers and member servers) tracking configuration changes in real time. When a change is made on a server running a Change Auditor agent, the change information (audit event) is captured by the agent, batched and forwarded to a Change Auditor coordinator, which then inserts the event details into the Change Auditor database.

NOTE: If the Change Auditor for Logon Activity Workstations auditing module is licensed, you must deploy agents to the workstations that you want to monitor.

For each change detected, an audit event entry is created in the Change Auditor database with the following information:

The coordinator fulfills client and agent requests and generates alerts. Multiple coordinators can be installed in a single forest and an agent can be connected to multiple coordinators simultaneously. All connected coordinators can participate in receiving events from the agent, allowing a high volume of events to be distributed for processing.

NOTE: Server agents submit events to all available coordinators to load balance automatically. However, workstation agents randomly connect to a single coordinator. This design enables ‘scaling out’ options for large workstation agent deployments within a single site.

The Change Auditor client provides immediate access to key configuration change information. From the client you can:

Installation overview

Before installing Change Auditor, choose the SQL database to use. If you want to install the Change Auditor database to a SQL instance other than the default instance of the selected SQL Server, create the instance before running the installer.

Using the Change Auditor product DVD or running the autorun.exe file opens the Quest Change Auditor autorun, allowing you to install the different Change Auditor components, access the product documentation, and install other related Quest products and knowledge packs.

During the coordinator installation, you have the option of adding the current user to the Change Auditor Administrators security group. If you select not to do this during the coordinator installation process, you need to add your user account (and any other appropriate user accounts) to one of the Change Auditor security groups. Quest also recommends that you add the Change Auditor Administrators and Change Auditor Operators groups to the appropriate SQL database role. See Add Users to Change Auditor Security Groups for more information regarding these security groups.

Open the client to deploy agents to the required servers. Also, if you have the Change Auditor for Logon Activity Workstation auditing module licensed, deploy agents to the domain workstations you want to monitor. See Deploy Change Auditor Agents for more details.

IMPORTANT: You must be a member of the Change Auditor Administrators group and have local permissions to deploy agents.

You can optionally install the Change Auditor web client to access (search and report on) the data collected by Change Auditor, create custom search queries, and perform administration tasks to manage Change Auditor. See the Change Auditor Web Client User Guide for information about installing and running the web-based client.

Install Change Auditor

Installation workflow

Quest recommends installing the Change Auditor components in the following order:

NOTE: The database name must not include embedded spaces, special characters, or supplementary characters. For more details, see Microsoft’s database identifier documentation.

NOTE: During the coordinator installation, you are have the option of adding the current user to the Change Auditor Administrators security group. If you did not add the current user during the installation process or want to add extra user accounts to the Change Auditor security groups, add them before running the client. Quest also recommends that you add these security groups to the appropriate SQL database role (that is, Change Auditor Administrators — <InstallationName> group to the Change Auditor_Administrators role and ChangeAuditor Operators — <InstallationName> group to the ChangeAuditor_Operators role). See Add Users to Change Auditor Security Groups.

TIP: Quest recommends that you install the first coordinator and client, but do not deploy agents until you have installed required coordinators. When deploying agents, you can select which installation to use for each of the agents.