Change Auditor 7.4 - PowerShell User Guide

Adding the PowerShell module Viewing available commands and help Installing Change Auditor coordinators and web clients Setting the master time zone Finding Change Auditor installations and coordinators Connecting to and disconnecting from Change Auditor installations and coordinators Importing and exporting configuration settings Managing client authentication options Gathering Change Auditor system information Deploying Change Auditor agents Managing auditing templates Working with searches

Copy-CASearch

Managing Active Directory Database auditing Working with Active Directory Database protection templates Managing Windows File System auditing Managing SQL Extended Events Auditing (Preview) Managing Azure Active Directory auditing Managing Office 365 auditing Managing Skype for Business auditing Configuring a Quest On Demand Audit integration Working with Active Directory protection templates Working with GPO protection templates Our brand, our vision. Together. Contacting Quest Technical support resources

Managing client authentication options

Change Auditor has two authentication method:

•

Windows Forms Authentication (enabled by default)

When users log in, they must enter a Windows user account and a password.

•

Active Directory Client Certificate Authentication

When users log in, they must specify a smart card or certificate. User account and password are not required.

These commands allow you to manage the authentication used in your Change Auditor deployment.

Get-CAAuthenticationOptions

Use this command to view the authentication profile Change Auditor coordinators use in a particular installation.

Returns: An object containing the options for authentication for the specified installation.

Table 11. Available parameters
Parameter	Description
-Connection	A connection obtained by using the Connect-CAClient command.
-InstallationName (Optional)	The installation name to connect to. If an installation cannot be found with this name, no connection is made. If more than one Change Auditor installation exists in the current forest, this parameter is mandatory. Omitting it results in a connection failure due to ambiguity.
-DomainName (Optional)	The name of the domain where the Change Auditor installation exists.

Example

Get-CAAuthenticationOptions –InstallationName ‘DEFAULT’ –DomainName ‘DomainName.com’

Get-CAAuthenticationOptions -Connection $connection

Set-CAAuthenticationOptions

Use this command to alter the authentication profile the Change Auditor coordinators use in a particular installation.

Returns: An object containing the options for authentication for the specified installation.

Table 12. Available parameters


Parameter	Description
-Connection	A connection obtained by using the Connect-CAClient command.
-AlwaysChallengeForCredential (Optional)	When specified, instructs the coordinator to disallow any connection that is not accompanied by credentials. For PowerShell clients, this means that the Connect-CAClient command will not connect without the use of the -Credential parameter.
-AllowActiveDirectoryCertificateAuthentication (Optional)	When specified, instructs the coordinator to allow certificate authentication via a web client. This switch has no meaning for the Win32 client.
-AllowWindowsFormsAuthentication (Optional)	When specified, instructs the coordinator to accept default username/password style of credentials.
-AuthenticationOptions (Optional)	This parameter allows the caller to pass directly the result of the Get-CAAuthenticationOptions without having to break down the options into their constituent flag values.

Example

Set-CAAuthenticationOptions -Connection $connection -AlwaysChallengeForCredential
-AllowActiveDirectoryCertificateAuthentication -AllowWindowsFormsAuthentication

Set-CAAuthenticationOptions -Connection $connection -AuthenticationOptions $AuthenticationOptions

Gathering Change Auditor system information

You can gather Change Auditor system information to help you to manage your installation components.

•

•

•

•

Use this command to retrieve coordinator-specific (as opposed to installation-wide) status information from the connected coordinator such as coordinator name, status, deployment name, version, connected agents, connected legacy agents, connected clients, client port, total events, and buffered events which may be different on each coordinator.

Example: Gather coordinator information for a specified connection

Get-CACoordinator $connection

Example: Gather coordinator information for a specified connection, when using certificate authentication

$creds = Get-Credential

$connection = Connect-CAClient -Credential $creds

Get-CACoordinator -Connection $connection

Get-CACoordinators

Use this command to gather information about all the coordinators in a Change Auditor installation.

Example: Gather coordinator information for all coordinators for a specified connection

Get-CACoordinators -Connection $connection

Example: Gather coordinator information for all coordinators for a specified connection, when using certificate authentication

$creds = Get-Credential

$connection = Connect-CAClient -Credential $creds

Get-CACoordinators -Connection $connection

Get-CAInstallation

Use this command to retrieve installation-specific (as opposed to coordinator-specific) status information including the name of the installation, database server, and database and the database size.

Example: Gather installation information for a specified connection

Get-CAInstallation -Connection $connection

Get-CAAgents

Use this command to view information on all available (and optionally uninstalled) agents.


	NOTE: This returns information for workstation, server, and domain controller agents.

Table 13. Available parameters


Parameter	Description
-Connection	A connection obtained by using the Connect-CAClient command.
-IncludeUninstalled (Optional)	Adds uninstalled agents to the list of agents returned from this command.

Example: Viewing all available and unistalled agents within a specific installation

Get-CAAgents -Connection $connection -IncludeUninstalled

Deploying Change Auditor agents

The following commands are available to manage your agent deployments.


	NOTE: You must be a member of the Administrators role to use these commands. NOTE: Any changes affecting configuration are audited with internal events.

•

•

•

•

•

Update-CAAgentConfigurations

•

Set-CAAgentConfiguration

•

Get-CAAgentSubsystems

•

Enable-CAAgentTemplate

•

Disable-CAAgentTemplate

•

Remove-CAAgentTemplate

•

New-CAConfiguration

•

Get-CAConfigurations

•

Set-CAConfiguration

•

Remove-CAConfiguration

Install-CAAgent

Use this command to install an agent.

Table 14. Available parameters
Parameter	Description
-Connection	A connection obtained by using the Connect-CAClient command.
-MachineName	The fully qualified name of a target computer.
-Credential	Credentials used to access the target computer.
-OperationTime (Optional)	Specifies when to perform this operation. NOTE: If this is not specified, it defaults to the current time.

Example: Install an agent

Install-CAAgent -Connection $connection -MachineName "ComputerName.DomainName.com" -Credential $credential -OperationTime “01/01/2020 12:00:00”

Ping-CAAgent

Use this command to ensure that the coordinator and agent can communicate using WCF framework.

Table 15. Available parameters
Parameter	Description
-Connection	A connection obtained by using the Connect-CAClient command.
-AgentInfo	The PSCAAgentInfo retrieved from the Get-CAAgents command.

Example: Test the communication between an agent and coordinator

Ping-CAAgent -Connection $connection -AgentInfo $agentinfo

Uninstall-CAAgent

Use this command to uninstall an agent.

Table 16. Available parameters
Parameter	Description
-Connection	A connection obtained by using the Connect-CAClient command.
-MachineName	The fully qualified name of the target computer.
-Credential	Credentials used to access the target computer.
-OperationTime (Optional)	Specifies when to perform this operation. NOTE: If this is not specified, it defaults to the current time.

Example: Uninstall an agent

Uninstall-CAAgent -Connection $connection -MachineName "ComputerName.DomainName.com" -Credential $credential -OperationTime “01/01/2020 12:00:00”

Update-CAAgent

Use this command to upgrade an agent.

Table 17. Available parameters
Parameter	Description
-Connection	A connection obtained by using the Connect-CAClient command.
-Agent	Agents obtained from a previous call to Get-CAAgents.
-Credential	Credentials used to access the target computer.
-OperationTime (Optional)	Specifies when to perform this operation. NOTE: If this is not specified, it defaults to the current time.

Example: Upgrade an agent

Update-CAAgent -Connection $connection -Agent $agent -Credential $credential

Update-CAAgentConfigurations

Use this command to update the agent configuration to ensure that the agent is using the most up-to-date configuration.

Table 18. Available parameters


Parameter	Description
-Connection	A connection obtained by using the Connect-CAClient command.
-Agents	Agents obtained from a previous call to Get-CAAgents.

Example: Update an agent configuration

Update-CAAgentConfigurations -Connection $connection -Agents $agent

Set-CAAgentConfiguration

Use this command to assign an auditing configuration to an agent.

Table 19. Available parameters


Parameter	Description
-Connection	A connection obtained by using the Connect-CAClient command.
-Agents	Agents obtained from a previous call to Get-CAAgents.
-Configuration	The configuration obtained by a previous call to Get-CAConfigurations.

Example: Update an agent configuration

Set-CAAgentConfiguration -Connection $connection -Agents $agent -Configuration
$configuration

Get-CAAgentSubsystems

Use this command to see the list of subsystems included in an agent‘s configuration.

Table 20. Available parameters


Parameter	Description
-AgentInfo	The PSCAAgentInfo retrieved from the Get-CAAgents command.

Example: See a list of all subsystems included in an agent‘s configuration

Get-CAAgentSubsystems -AgentInfo $agentinfo

Enable-CAAgentTemplate

Use this command to enable a template.


	NOTE: Currently, this is only supported for Azure AD and Office 365.

Table 21. Available parameters
Parameter	Description
-Connection	A connection obtained by using the Connect-CAClient command.
-Template	The template to modify.
-Credential (Optional)	Credentials associated with the target agent and template. These vary depending on the type of template.

Example: Enable a template

Enable-CAAgentTemplate -Connection $connection -Template $template

Disable-CAAgentTemplate

Use this command to disable a template.


	NOTE: Currently, this is only supported for Azure AD and Office 365.

Table 22. Available parameters
Parameter	Description
-Connection	A connection obtained by using the Connect-CAClient command.
-Template	The template to modify.
-Credential (Optional)	Credentials associated with the target agent and template. These vary depending on the type of template.

Example: Disable a template

Disable-CAAgentTemplate -Connection $connection -Template $template

Remove-CAAgentTemplate

Use this command to remove a template.


	NOTE: Currently, this is only supported for Azure AD and Office 365.

Table 23. Available parameters
Parameter	Description
-Connection	A connection obtained by using the Connect-CAClient command.
-Template	The template to remove.
-Credential (Optional)	Credentials associated with the target agent and template. These vary depending on the type of template.

Example: Remove a template

Remove-CAAgentTemplate -Connection $connection -Template $template -credential $credential

New-CAConfiguration

Use this command to create an agent configuration.

Table 24. Available parameters
Parameter	Description
-Connection	A connection obtained by using the Connect-CAClient command.
-ConfigurationName	The name of the agent configuration to create.

Example: Create an agent configuration

New-CAConfiguration -Connection $connection -ConfigurationName $configurationName

Get-CAConfigurations

Use this command to get list of all agent configurations for a deployment.

Table 25. Available parameters
Parameter	Description
-Connection	A connection obtained by using the Connect-CAClient command.

Example: See a list of all agent configurations

Get-CAConfigurations -Connection $connection

Set-CAConfiguration

Use this command to change the agents port used for the coordinator to communicate with the agent and to configure a proxy server.


	NOTE: If you change the agent port number, you must also create a firewall exception for the new port number on your agent computers.


	NOTE: If your organization uses a proxy server to connect to the internet, you must configure the proxy parameters to audit Azure Active Directory and Office 365 targets. If your proxy server requires authentication, you must also set the credentials using the -ProxyCredential parameter.

Table 26. Available parameters


Parameter	Description
-Connection	A connection obtained by using the Connect-CAClient command.
-Configuration	The configuration on which to set the port on.
-Port	The port the agent starts its service on for coordinator and agent communication.
-ProxyServer	The fully qualified domain name, down-level name, or IPv4 address of the proxy server. NOTE: To clear the proxy configuration and set the proxy settings back to the default values, specify an empty value for this parameter.
-ProxyPort	The port on which to communicate with the proxy server. (Default is 8080).
-ProxyCredential	The credentials used to authenticate with the proxy server.
-ClearProxyCredential	Specify this parameter to clear the credentials for the proxy server authentication.

Example: Update the port used to communicate with the agent

Set-CAConfiguration –Connection $connection –Configuration $configurationObject –Port $port

Example: Update the configuration to allow for cloud-based auditing

Set-CAConfiguration -Connection $connection -Configuration $config -ProxyServer "ServerName" -ProxyPort 8080

Remove-CAConfiguration

Use this command to remove an existing agent configuration.

Table 27. Available parameters
Parameter	Description
-Connection	A connection obtained by using the Connect-CAClient command.
-Configuration	The name of the configuration to remove. NOTE: You cannot delete the default configuration template.

Example: Remove an agent

Remove-CAConfiguration -Connection $connection -Configuration $configuration

Managing auditing templates

•

Add-CATemplateToConfiguration

•

Get-CAConfigurationTemplates

•

Get-CATemplatesInConfiguration

•

Remove-CATemplatesFromConfiguration

Add-CATemplateToConfiguration

Use this command to assign an auditing template to a Change Auditor configuration.

Table 28. Available parameters
Parameter	Description
-Connection	A connection obtained by using the Connect-CAClient command.
-Configuration	The configuration to which to add a template. Use Get-CAConfigurations to obtain the configuration object.
-Templates	The templates to apply to the configuration. Use Get-CAConfigurationTemplates to obtain the templates.

Example: Assign a template to a configuration

Add-CATemplateToConfiguration -Connection $connection -Configuration $configuration -Templates $templates

Get-CAConfigurationTemplates

Use this command to get a list of all templates in the installation.

Table 29. Available parameters
Parameter	Description
-Connection	A connection obtained by using the Connect-CAClient command.

Example: Get a list of all templates in the installation

Get-CAConfigurationTemplates -Connection $connection

Get-CATemplatesInConfiguration

Use this command to get a list of the templates that are assigned to a configuration.

Table 30. Available parameters
Parameter	Description
-Connection	A connection obtained by using the Connect-CAClient command.
-Configuration	Use Get-CAConfigurations to obtain the configuration object.

Example: Get a list of all templates assigned to a configuration

Get-CATemplatesInConfiguration -Connection $connection -Configuration $configuration

Remove-CATemplatesFromConfiguration

Use this command to remove templates from a configuration.

Table 31. Available parameters
Parameter	Description
-Connection	A connection obtained by using the Connect-CAClient command.
-Configuration	The configuration from which to remove a template. Use Get-CAConfigurations to obtain the configuration object.
-Templates	The templates to remove from the configuration. Use Get-CAConfigurationTemplates to obtain the templates.

Example: Remove a template from a configuration

Remove-CATemplatesFromConfiguration -Connection $connection -Connection $connection
-Configuration $configuration

请选择您的产品：

为向您提供更好的服务，请填写'Purpose of your Chat'（联系目的）：

针对您的问题建议的解决方案

Change Auditor 7.4 - PowerShell User Guide

Managing client authentication options

Gathering Change Auditor system information

Deploying Change Auditor agents

Managing auditing templates