• First Coordinator installation SQL

    Hi Experts,

    During the installation of the first Coordinator,  I faced an issue in the wizard where we needed to provide the SQL server information, clicking on Next provides the error "The Database server could not be located". Can you please help me…

  • Change Auditor Agent Slow ingesting NetApp Filer Events

    We have a NetApp Agent pointing to a filer. The agent is reporting very few events (between 5 and 20 events) even though we can see in the logs that there are at least 960 events queued. The Agent does not appear to Forward the events to the Coordinator…

  • Change Auditor Coordinator Install

    Client had started an install of Change Auditor Coordinator on a server, but it had failed ( I do not know what caused it to fail).  They then removed Change Auditor software and deleted the SCP.  They then went a created a new Change Auditor Coordinator…

  • Change Auditor SQL


    Within Change Audtior is there a way to view the Task Queue for SQL.  In the Coordinator logs, all I have are a repetition of the same entry (3 to 5 times in a minutes):

    2022-02-02 12:04:19.678 [54][INFO][ChangeAuditor.Coordinator.EventAggregatorTask…

  • Configuration Changes Delay

    When I modify a configuration (Administration Tasks -> Configuration) how long does it take to have that change effective?

    Does the agent pick up the new configuration immediately if I restart the agent?

  • Agent Alert Change Inactive Auditor

    How can I create an alert to notify me when a Change Auditor Agent is inactive?

  • Upgrade from W2012 R2 Coordinator (6.7) to W2019 Coordinator (7.1.1)


    I recently take back an old project concerning the upgrade of Change Auditor to a new server, and I have some doubts about it.

    Our Change Auditor release is old (6.7), and the coordinator is installed on a Windows Server 2012 R.

    Our goal is to move the…

  • 2 Change Auditor Installs, how to move to 1

    I am looking for some direction on how to collapse 2 change auditor installations into 1.  Both are running the same version, 7.0.3 (for now) but are in 2 separate forests.    I'd like to point our agents and coordinators in Forest A to the installation…

  • is it possible to find out who created an alert and when?

    I'd like to find out who created an existing alert and when it was created?

    is there a log or audit feature?

  • Possible Agent issue with DC - Microsoft-Windows-Security-Kerberos

    Hello, I am working with PSO to deploy Change Auditor in production. I stood up a lab to test how some agents would interact. The agents of concern are ManageEngine PasswordSyncAgent and the Quest Change Auditor Agent.

    We couldn't find a smoking gun in…

  • How to extract list of integrated Server in CA

    Hi Community,

    I would like to know how to extract list of integrate servers in Change Auditor.

  • Email notification stopped

    Hi  All

    I am new to this product we are using Quest Change Auditor Version 7.1/Build 16043. one of my AD group is protected and one of the user gets email notification when ever any user is added or removed from the group. Suddenly user is not receiving…

  • Need to understand the behavior of ADHooks property value from WMI class "Win32_PerfFormattedData_CAAD_ChangeAuditorforActiveDirectory"

    I observed that Change Auditor agent on Domain Controller doesn't pass ADEvents to Change Coordinator server even though the Agent service is running on the Domain Controller and it's passing other events too, It shows ADEevents zero on ServiceStatusTray…

  • Change Auditor 7.0.4

    Any issues with Change Auditor version 7.0.4 that I should be aware of?


  • Capacity Planning

    Is there a capacity planning calculator available or a document that covers how to scale a CA install? As in, how many events per second a single Coordinator could handle based on a standard spec server?

  • Change Auditor Application User Interface Roles, Tasks and Operations matrix

    Is there a matrix or list published somewhere that lists the Operations associated with the built-in 'Operator' and 'Web Client Shared Overviews' Tasks?

  • Move Database from 2008 R2 to SQL 2016


    I am still running Change Auditor 6.8 on mirrored SQL 2008 R2 and I want to move this to SQL Server 2014 SP1.

    I am proposing to run the Change Auditor 6.8 SQL setup on the new SQL 2016 Database, export the custom searches and run the dbmigration tool…

  • Audit Active Directory LAPS by Change Auditor

    Hello , 

    has anyone tried before to Audit AD LAPS by Change Auditor ? is its possible ? and if yes , how ? 

    I need to Audit below LAPS Events :

    • Users who have viewed passwords.
    • Users who have modified a password's expiration time and date. 


  • How to import Search including Alert template with Powershell?

    I am running the following command but is not importing my custom alert:

    $searchDefinition = Get-Content "C:\Definitions\Search.xml"

    Add-CASearch –Connection $connection –XmlSearchDefinition $searchDefinition –IsPublic –Path "Shared\Test" …

  • Can I create a scoped GPO Search?

    I would like to alert on all Group Policy Object  and Group Policy Instance Facility events, but only related to GPO's linked to the domain root and one additional OU.

    Is there a way to scope a search/alert for this?


  • Protection Template Management rights required for CA Client

    From what I can see, you need to be in the Change Auditor Admins group to manage a protection template via the Change Auditor Client. Is there any way in v6.9.5 or above to have Protection template management be more granular?

  • Granularity with GPO object monitoring


    Is it possible to create a search where i can see all the changes for a specific set of GPOs based on name of GPO?

    For example, can I create a wildcard search that in effect says 'let me know any time something changes with all GPOs where name…

  • Search for when AD Computer Objects are moved to Computers OU

    I am looking to create a search that audits when any computer object is moved in or out of the default 'Computers' OU.

    I see there is a 'Computer moved' event class that I might be able to use. However, Im not sure what I would put in the 'Where…

  • The DACL was changed on the group CN=Schema Admins . . .



    Change Auditor 6.9.1 / Build 3131

    Change Auditor Active Directory

    Domain function level: Windows 2012R2

    I see the following events in Change Auditor:

    The DACL was changed for the group object CN=Schema Admins . .

    The event states is…

  • The DACL was changed for the group object CN=Schema Admins . . .



    Change Auditor 6.9.1 / Build 3131

    Change Auditor Active Directory

    Domain function level: Windows 2012R2

    I see the following events in Change Auditor:

    The DACL was changed for the group object CN=Schema Admins . .

    The event states is…