• 成为门户专家
• 下载
• 打印
• 我的下载 ()

• 支持
• 技术说明文件
• Change Auditor 7.4
• Change Auditor 7.4 - User Guide

Change Auditor 7.4 - User Guide

内容导航  

Change Auditor Overview

Available Change Auditor auditing modules

Agent Deployment

Deployment page Using group Managed Service Accounts (gMSA) Deploy agents Connect to a different foreign forest/update credentials Change the agent installation location and system tray option Enable auto deployment Refresh or clear Deployment page information

Change Auditor Client Overview

Starting the Change Auditor client Accessing Change Auditor news and updates Managing connection profiles

Connection wizard

Client components Customize table content

Sort data Resize or move columns Add or remove columns Group data

Filter data

Using custom filters

Directory object picker

Overview Page

Overview My Favorite Search Define a favorite search Overview panes

Top Agent Activity Recent Event Activity Count of Events By Agent Status Coordinator Status

Event Details pane

Searches

Introduction Searches page

Explorer view Searches list Search Properties tabs

View a list of available searches Run searches Run a quick search

Search Results and Event Details

Introduction Search Results page

Search Results grid Search Properties tabs Event Details pane

View search results

Display results in different formats

Preview search results Compare results side-by-side View event details or search properties Copy event details Email event details Add comments View user context and run related searches Protect critical objects, mailboxes, files and folders Add search properties to existing event queries

Custom Searches and Search Properties

Introduction Create a custom search Search Properties tabs

Info tab Who tab What tab Where tab When tab Origin tab Alert tab Report tab Layout tab SQL tab XML tab

Enable Alert Notifications

Introduction Alert tab (Search Properties tabs) Enable alerts Disable alerts Alert History page View alert history View event details or alert properties

Administration Tasks

Administration Tasks tab Administration Task lists Export/import Administration Task settings

Agent Configurations

Introduction Agent Configuration page Define agent configurations Assign agent configurations to server agents Enable event logging

Coordinator Configuration

Coordinator Configuration page Configure email alert notifications/reports Customize alert email content Shared Folder Configuration Group Membership Expansion Add groups to Group Membership Expansion list Agent Heartbeat Check Disconnect client after 30 minutes of inactivity Scheduled Task Handling

Purging and Archiving your Change Auditor Database

Introduction Planning your jobs Purge and Archive page Create and maintain jobs Purge and Archive wizard Purge selected records

Disable Private Alerts and Reports

Introduction Private Alerts and Reports page Disable private alerts and reports

Generate and Schedule Reports

Schedule reports for distribution

Create global report template Define report content and layout Enable and schedule reporting

Launch Report Designer Publish reports Print or save a page's contents

SQL Reporting Services Configuration

Introduction SQL Reporting Services Page SQL Reporting Services Templates SQL Reporting Services Wizard

Change Auditor User Interface Authorization

Introduction Application User Interface Authorization page Add task definition Add role definition Add application group Remove a task definition

Client Authentication

Introduction Client Authentication Page

Changing authentication methods

Certificate authentication for client coordinator communication

Introduction

Installation settings Deployment Coordinator configuration Windows client configuration

Integrating with On Demand Audit

Managing a Quest On Demand Audit integration

Creating an On Demand Audit configuration Working with an On Demand Audit configuration

Enable/Disable Event Auditing

Introduction Audit Events page Enable/disable event auditing Modify event's severity level or event class description Define events to be captured based on results View event information

Account Exclusion

Introduction Excluded Accounts Auditing page Excluded Accounts templates Excluded Accounts wizard

Registry Auditing

Introduction Registry Auditing page Registry Auditing templates Registry Auditing wizard

Service Auditing

Introduction Services Auditing page Service Auditing templates Service Auditing wizard

Agent Statistics and Logs

Introduction Agent Statistics page

Agent Statistics grid Resource Properties pane

Machine Info page Processors page Drives page Shares page Services page Exchange Mailboxes page

Agent system tray icon

Change Auditor Agent Status dialog

View agent status/statistics Manage Change Auditor agents Agent Log page View and save agent trace logs

Coordinator Statistics and Logs

Introduction Coordinator Statistics page Coordinator system tray icon

Change Auditor Coordinator Status dialog Coordinator Configuration tool

View coordinator status and statistics Manage Change Auditor coordinators Coordinator Log page View and save coordinator trace logs

Change Auditor Commands

Menu commands Tool bar buttons Right-click commands

Change Auditor Email Tags

• Viewing Topics 181 - 184 of 203

×

Services page

The Services page contains the following information about the services installed on the selected server.

 

Table 7. Resource Properties pane: Services page field descriptions

Field	Description
Description	A comment that explains the purpose of the service.
DisplayName	The display name used by user interface programs to identify the service.
Name	The unique name assigned to the installed service.
PathName	The fully qualified path of the executable file for the service.
ProcessId	The process identifier of the service.
ServiceType	The type of service provided to calling processes: • Kernel Driver • File System Driver • Adapter • Recognizer Driver • Own Process • Share Process • Interactive Process
StartMode	The start mode of a Windows base service: • Boot: Device driver started by the operating system loader. • System: Device driver started by the operating system initialization process. • Auto: Service that is to be started automatically by the Service Control Manager during system startup. • Manual: Service that is to be started by the Service Control Manager when a process calls the StartService method. • Disabled: Service that cannot be started.
StartName	The name of the account under which the service should run.
State	The current state of the service: • Stopped • Start Pending • Stop Pending • Running • Continue Pending • Pause Pending • Paused • Unknown

Exchange Mailboxes page

For Exchange Mailbox servers, the Exchange Mailboxes page displays a list of the Exchange mailbox databases on the selected server.

Agent system tray icon

An agent icon in the system tray allows you to enable, disable, or display the status of the agent installed on the current server.

NOTE: The agent system tray icon is only available for server agents.

Whenever an agent is not active, a status indicator will appear in the lower left corner of this icon to represent its current status:

•	Red - inactive

•	Yellow - initializing

You can load the agent system tray icon using one of the following methods:

•	Click Advanced Options on the Deployment page to launch the Advanced Deployment Options dialog. From this dialog, select the Yes option for the Launch ServiceStatusTray on startup setting.

NOTE: By default, the Do not change option is selected which indicates that you want to use the current setting for the agent system tray icon. That is, if you already have it set to launch on startup it will continue to operate that way. Similarly, it will not launch on startup if this is a clean install and you have not previously set it up to do so.

•	Navigate to %ProgramFiles%\Quest\ChangeAuditor\Agent and double-click on the ServiceStatusTray.exe file.

By right-clicking on the agent system tray icon, a context menu is displayed which consists of the following commands:

 

Table 8. Agent system tray icon: Right-click commands

Command	Description
Agent Status	Displays the Change Auditor Agent Status dialog which assists you in determining if the agent is running, what version is installed, and how active the agent is. See Change Auditor Agent Status dialog for a full description of this status dialog.
Enable/Disable Agent	Starts or stops the agent service.
Find More Connections / Retry Connections	Looks for more coordinators in a forest than the agent automatically found. NOTE: An agent automatically connects to a coordinator in its own site. However, if a coordinator is not available in the site it will then search for a coordinator in the forest. When the agent is connected to a coordinator that is not currently running, use the Retry Connections command to reattempt to connect to a coordinator.
Refresh Configuration	Applies a new agent configuration to the selected agent. NOTE: This command only available when the coordinator to which the agent is connected is running.
Coordinator Credential Configurator	Use to enter the credentials of the agent that can be used to find and connect to a coordinator in an Active Directory forest. NOTE: This command is only available when you install a agent on a workgroup server.
View Agent Log	Opens the log viewer to review the events recorded in the Change Auditor agent log (ChangeAuditor.AgentLog.nptlog). For example: %ProgramFiles%\Quest\ChangeAuditor\Agent\Logs\ChangeAuditor.AgentLog.nptlog
Load on startup	Automatically loads the system tray application when the agent service starts.
About	Displays information about the agent including the installed version number and licensing information.
Exit	Closes the system tray application.

Change Auditor Agent Status dialog

Change Auditor Agent Status dialog

The Change Auditor Agent Status dialog helps you determine if the agent is running and what version is installed on the domain controller. The other status information in the dialog is broken down into the following sections:

•	Agent Information - displays the status, version number, the coordinator installation name to which the agent is connected, and the agent’s database size

•	Events - displays audit event activity

•	Coordinator Connection - displays information regarding the connection between the agent and the coordinators

This dialog contains the following status information:

 

Table 9. Change Auditor Agent Status dialog: Status information

Field	Description
Agent Information
Agent is	The current agent status: • Running - the agent service is running • Initializing - the agent service has started but is still initializing • Not Running - the agent service is not currently running • Failed - the agent service failed to initialize
Version	The current version of the agent installed on the server.
Installation Name	The installation name assigned to the coordinator to which the agent is connected.
DB Size (KB)	The size of the agent database, in kilobytes. This is dependent on the number of monitored Active Directory, registry and file system objects, and the number of events queued for transmission to the coordinator. If a coordinator is not available, this database may become large. When the events are successfully sent to a coordinator, the database space is re-used for subsequent events, but the displayed database size will not decrease.
License	The licenses that are applied. Use the arrow controls to scroll through the licenses.
Events Contains indicators of internal Change Auditor activity and may be used by Quest Support should they need to diagnose agent problems.
AD Events	If licensed (Change Auditor for Active Directory), this is the number of Active Directory related events processed by the agent. This field will be blank for agents running on member servers.
ADAM Events	If licensed (Change Auditor for Active Directory), this is the number of ADAM events processed by the agent.
Exchange Events	If licensed (Change Auditor for Exchange) and configured, this is the number of Exchange Mailbox events processed by the agent.
Local Security Events	If licensed (Change Auditor for Active Directory), this is the number of local user and group (SAM) events processed by the agent.
File System Events	If licensed (Change Auditor for Windows File Servers) and configured, this is the number of File System events processed by the agent.
Registry Events	If configured, this is the number of Registry events processed by the agent.
SQL Events	If licensed (Change Auditor for SQL Server) and configured, this is the number of SQL Server events processed by the agent.
NetApp Events	If licensed (Change Auditor for NetApp) and configured, this is the number of NetApp filer events processed by the agent.
EMC Events	If licensed (Change Auditor for EMC) and configured, this is the number of EMC events processed by the agent.
SharePoint Events	If licensed (Change Auditor for SharePoint) and configured, this is the number of SharePoint events processed by the agent.
Azure AD Events	If licensed (Change Auditor for Active Directory) and configured, this is the number of Azure AD events processed by the agent.
ADFS Events	If licensed (Change Auditor for Logon Activity) and configured, this is the number of ADFS events processed by the agent.
Logon Events	If licensed (Change Auditor for Logon Activity User), this is the number of user logon activity events processed by the agent.
Office 365 Events	If configured (Change Auditor for Exchange and Change Auditor for SharePoint), this is the number of Exchange Online, SharePoint Online, and OneDrive for Business events processed by the agent.
Other Events	This is the number of events processed by the agent that do not ‘fit’ into the other event categories (such as Authentication Services events, Service events, etc.).
Excluded Events	If configured, this is the number of events excluded by the agent because they originated from a user or computer that was defined as an excluded account.
Skype for Business Events	If licensed (Change Auditor for Skype for Business) and configured, this is the number of Skype for Business events processed by the agent.
Coordinator Connection
Connected	The computer name (and SCP port) of the coordinators to which this agent is currently connected. NOTE: For more details on agent connection behavior, see Installation Notes and Best Practices in the Quest Change Auditor Installation Guide.
All	The list of all available coordinators in the installation.
Last Conf Update	The time when the agent last downloaded the agent configuration information/settings.
Events Last Sent	The local time when the last event was sent. If no events have been detected by Change Auditor recently, this time may be fairly old.
Events Sent	The number of events that have been sent to a coordinator since the agent was last started.
Acknowledged	The number of events that a coordinator has acknowledged. Normally, this value will be the same as the Events Sent. However, it may be smaller if the coordinator is not running or if a large number of events are being processed by the coordinator which may be slowing it down. Events may also be lost due to communication problems, in which case the agent will try to re-send the events.
Events Waiting	The number of events in the agent database that are waiting to be forwarded to a coordinator. This value should be at or near zero when the server is idle, but can grow if it is busy. If the value never returns to zero, it may indicate that the agent is having difficulty communicating with the coordinator service. If this is the case, contact Technical Support for assistance.

•  上一页
• Viewing Topics 181 - 184 of 203
• 下一页 

搜索该文档 在所有文档中搜索该产品版本 在所有文档中搜索该产品 搜索所有文档

×

 欢迎访问支持

您可以在附属支持站点上查找适用于戴尔*产品*的在线支持帮助。单击“继续”，转至适用于*产品*的正确支持内容和帮助。

相关文档

The document was helpful.

选择评级

I easily found the information I needed.

选择评级

© ALL RIGHTS RESERVED. 使用条款 隐私 Cookie Preference Center