Change Auditor 7.4 - Installation Guide

Change Auditor for Authentication Services

Change Auditor for Authentication Services requires agents deployed on all Active Directory domain controllers in the forest to capture modifications to the Authentication Services configuration container.

Change Auditor for SharePoint

The Microsoft SharePoint requirements must be met. Change Auditor for SharePoint does not need any additional requirements.

See the Change Auditor for SharePoint User Guide for information about installing, configuring, and using Change Auditor for SharePoint.

Agent deployment

You need deploy an agent on one of the SharePoint servers in the SharePoint farm that you want to monitor.

The agent selected to connect to and collect events from the SharePoint farm must have the following permissions:

For proper auditing of the sites within the MySite Site Collection or Web Application, add the account Change Auditor uses to access the SharePoint database as a Site Collection Administrator (primary or secondary) or to the User Web Policy for the MySite host. Depending on how your MySite host is initially set up, use the Central Administration website to verify, and if necessary add, this account.

For Change Auditor to capture some of the SharePoint events, the following settings must be enabled:

NOTE: Log trimming is off by default. Enable log trimming to meet your policies. If the Change Auditor agent is offline or is otherwise unable to retrieve event information from the SharePoint database for a period longer than the trim period, events could be lost.

See the Change Auditor for SharePoint User Guide or Event Reference Guide for a list of the events that require these additional settings.

Backup notes

The coordinator uses Microsoft SQL Server as the main database for collecting and reporting audit information. This data must be protected and backed up regularly, acceptable to your data retention policies. There are several third-party tools available, including Microsoft’s SQL Tools, which provide backup and restore functions.

The agent uses a SQLCE database file (ChangeAuditorAgent.sdf) on the local drive of each agented DC/member server. This database is primarily used to capture the state values for Active Directory® objects, File System values, and Windows registry changes. The agent files are not required as part of the backup job since the data contained in the database files can be recreated upon agent installation. Quest recommends that you exclude the agent files (%ProgramFiles%\Quest\ChangeAuditor\Agent\DBScripts) from your backup solution.