Active Administrator 8.6.3

Updating audit agents

Auditing & Alerting > Managing audit agents > Updating audit agents

Updating audit agents

If you receive an update to the audit agent, use this option to install the update.

To update audit agents

1

Select Auditing & Alerting | Agents.

2

To update selected domain controller(s), select More | Update.

–OR-

To update all listed domain controllers, select More | Update All.

NOTE: You may need to refresh the audit agents to correct the display. Click Refresh or select domain controllers, and click Refresh Selected.

	NOTE: You may need to refresh the audit agents to correct the display. Click Refresh or select domain controllers, and click Refresh Selected.

Moving an audit agent

Auditing & Alerting > Managing audit agents > Moving an audit agent

Moving an audit agent

You can move the audit agent from one computer to another.

To move an audit agent

1

Select Auditing & Alerting | Agents.

2

Select a domain controller, and select More | Move.

IMPORTANT: Auditing must be enabled in all domains that will be monitored. Make sure auditing is enabled on the Default Domain Controller policy. See the Quest® Active Administrator®Install Guide.

3

Select the account to use to move the agent. You can use the Active Administrator Foundation Service (AFS) account, or indicate a specific user account.

NOTE: The selected account must be a full Administrator on the target server.

4

Click Next.

5

Type the target computer name or browse to locate a computer.

6

Type the user name and password of the account with domain administrative rights on the selected target computer.

NOTE: The Active Administrator Agent service can run under a domain user account provided it is a local administrative account, which gives it the rights to log on as a service, log on locally, and manage auditing and security log, or an account with these privileges granted individually. This account should also be a member of the AA_Admin group, which by default is located in the Local groups of the server where the ActiveAdministrator database is located. If the group is not found in this location, the settings during the initial database creation were modified and the group can be found under the Users container object of Active Directory®.

7

Choose options for the install process.

Table 67. Install options

Option

Description

Start collecting events immediately after installation of the agent

By default, the audit agent is activated and collection begins immediately upon completion of the installation process. Clear the check box if you want to activate the audit agents manually.

Enable agent monitoring and recovery

By default, Active Administrator monitors the status of the audit agent.

8

Click OK.

NOTE: You can view details about the move agent process in the MoveAgentInstall*.log file, which is located in the Active Administrator\Server\Logging folder.

	IMPORTANT: Auditing must be enabled in all domains that will be monitored. Make sure auditing is enabled on the Default Domain Controller policy. See the Quest® Active Administrator®Install Guide.

	NOTE: The selected account must be a full Administrator on the target server.

	NOTE: The Active Administrator Agent service can run under a domain user account provided it is a local administrative account, which gives it the rights to log on as a service, log on locally, and manage auditing and security log, or an account with these privileges granted individually. This account should also be a member of the AA_Admin group, which by default is located in the Local groups of the server where the ActiveAdministrator database is located. If the group is not found in this location, the settings during the initial database creation were modified and the group can be found under the Users container object of Active Directory®.

Table 67. Install options
Option	Description
Start collecting events immediately after installation of the agent	By default, the audit agent is activated and collection begins immediately upon completion of the installation process. Clear the check box if you want to activate the audit agents manually.
Enable agent monitoring and recovery	By default, Active Administrator monitors the status of the audit agent.

	NOTE: You can view details about the move agent process in the MoveAgentInstall*.log file, which is located in the Active Administrator\Server\Logging folder.

Automating audit agent deployment

Auditing & Alerting > Managing audit agents > Automating audit agent deployment

Automating audit agent deployment

Once you have installed an agent into a domain, Active Administrator® can monitor the domain for new domain controllers. When a new domain controller is discovered, the agent can be automatically installed on that domain controller. You also have the option to just notify users of a new domain controller so they can install the agent manually.

•

Deploy audit agent automatically

•

Notify users only

Deploy audit agent automatically

To deploy the audit agent automatically

1

Select Auditing & Alerting | Agents.

2

Click Auto Deployment.

3

On the General tab, select Enable automated agent deployment and notification.

4

Select whether to install the audit agent on the newly discovered domain controller or to audit the newly discovered domain controller using an agent on a different computer.

Table 68. Install options

Option

Description

Install on target Domain Controller(s)

By default, the audit agent is installed on the newly discovered domain controllers.

Audit from an agent on the following computer

Select to install the audit agent on a computer in the domain. Type a computer name in the box, or browse to locate a computer.

NOTE: If you choose to do remote monitoring, the Advanced Agent is not installed on the selected domain controllers.

5

Type an account with domain administrative rights, or browse to locate an account, and enter the password.

NOTE: The Active Administrator Agent service can also run under a domain user account provided it is a local administrative account, which gives it the rights to log on as a service, log on locally, and manage auditing and security log, or an account with these privileges granted individually. This account should also be a member of the AA_Admin group, which by default is located in the Local groups of the server where the ActiveAdministrator database is located. If the group is not found in this location, the settings during the initial database creation were modified and the group can be found under the Users container object of Active Directory®.

6

By default, Active Administrator waits 24 hours after discovering a domain controller before installing the audit agent. Change the wait time if necessary.

NOTE: During the wait time, you can cancel the pending installation. See Canceling pending automated deployments.

7

By default, Active Administrator monitors the status of the audit agent. To disable service monitoring and recovery, clear the check box.

8

Click OK.

Notify users only

To only notify users of newly discovered domain controllers

1

Select Auditing & Alerting | Agents.

2

Click Auto Deployment.

3

On the General tab, select Enable automated agent deployment and notification.

4

Select Only notify users.

5

Use the buttons to add, edit, or remove email addresses from the list.

NOTE: You also can manage the Agent Auto Deploy Configuration email list from the Settings menu. See Managing email addresses.

6

Click OK.

Table 68. Install options
Option	Description
Install on target Domain Controller(s)	By default, the audit agent is installed on the newly discovered domain controllers.
Audit from an agent on the following computer	Select to install the audit agent on a computer in the domain. Type a computer name in the box, or browse to locate a computer. NOTE: If you choose to do remote monitoring, the Advanced Agent is not installed on the selected domain controllers.

	NOTE: The Active Administrator Agent service can also run under a domain user account provided it is a local administrative account, which gives it the rights to log on as a service, log on locally, and manage auditing and security log, or an account with these privileges granted individually. This account should also be a member of the AA_Admin group, which by default is located in the Local groups of the server where the ActiveAdministrator database is located. If the group is not found in this location, the settings during the initial database creation were modified and the group can be found under the Users container object of Active Directory®.

	NOTE: During the wait time, you can cancel the pending installation. See Canceling pending automated deployments.

	NOTE: You also can manage the Agent Auto Deploy Configuration email list from the Settings menu. See Managing email addresses.

Canceling pending automated deployments

Auditing & Alerting > Managing audit agents > Canceling pending automated deployments

Canceling pending automated deployments

When you set up Auto Deployment, you set a wait time between discovering domain controllers and installing the agent. During that wait time you can cancel the installation.

Topics

•

Creating an alert

•

Managing existing alerts

•

Changing the alert notification policy

•

Setting global quiet time

•

Managing alert history

To cancel pending automated deployments

1

Select Auditing & Alerting | Agents.

2

Click Auto Deployment.

3

Click Pending Installations.

4

Select a pending installation, and click Cancel automated agent installation.

5

Click OK.

请选择您的产品：

为向您提供更好的服务，请填写'Purpose of your Chat'（联系目的）：

针对您的问题建议的解决方案

Active Administrator 8.6.3 - User Guide

Updating audit agents

Moving an audit agent

Automating audit agent deployment

Canceling pending automated deployments