• Events per seconds / Volume size - Syslog event subscription

    Hi,

    I've receive a request to send the Change Auditor events to a syslog collector...  But for planning purposes they are wondering the ingestion rate (EPS / Volume Size) for the CA events.  Is there a way I could generate a reports with the information…

  • How to enable TLS for syslog with private certificate

    Hi all,

    I need help to configure Syslog with TLS encryption,

    I configured Syslog on the coordinator to send alerts to our SIEM system which is based on Elastic stack, I followed "Managing Syslog integration" section in "SIEM integration user guide", I…

  • Failed Group Policy Container Access (Change Auditor Protection)

    Change Auditor for Active Directory 7.1.1

    I recently implemented Protection on several GPOs. I only allow Domain Admins and Group Policy Creator Owners excluded from Protection.

    When I run the query 'All Group policy Events', I have hundreds of entries…

  • How To Add/Audit Attribute "PrincipalsAllowedToRetrieveManagedPassword"

    Hello ,

    Need Help Please,

    Does anyone know how to audit attribute 

    PrincipalsAllowedToRetrieveManagedPassword ?
    Best Regards,
    Gabi
  • is it possible to find out who created an alert and when?

    I'd like to find out who created an existing alert and when it was created?

    is there a log or audit feature?

  • Possible Agent issue with DC - Microsoft-Windows-Security-Kerberos

    Hello, I am working with PSO to deploy Change Auditor in production. I stood up a lab to test how some agents would interact. The agents of concern are ManageEngine PasswordSyncAgent and the Quest Change Auditor Agent.

    We couldn't find a smoking gun in…

  • Email notification stopped

    Hi  All

    I am new to this product we are using Quest Change Auditor Version 7.1/Build 16043. one of my AD group is protected and one of the user gets email notification when ever any user is added or removed from the group. Suddenly user is not receiving…

  • Need to understand the behavior of ADHooks property value from WMI class "Win32_PerfFormattedData_CAAD_ChangeAuditorforActiveDirectory"

    I observed that Change Auditor agent on Domain Controller doesn't pass ADEvents to Change Coordinator server even though the Agent service is running on the Domain Controller and it's passing other events too, It shows ADEevents zero on ServiceStatusTray…

  • Disable event auditing

    Hi,

    I am just interested to know if there is any performance advantage or any other advantages when I DISABLE events for which I have no License Type.

    I an running CA for Active Directory. When I look at all of the different Facility Names and their respective…

  • Create Web Search for all events for a user

    I cannot determine the exact criteria to find all Custom User Monitoring Events and Customer AD Object Monitoring Events for one user.

    I can create the search for the events in the Facility but I can't figure out how to select one user (not the user that…

  • Change Auditor Application User Interface Roles, Tasks and Operations matrix

    Is there a matrix or list published somewhere that lists the Operations associated with the built-in 'Operator' and 'Web Client Shared Overviews' Tasks?

  • InTune changes not included in Change Auditor for Azure.

    InTune changes not included in Change Auditor for Azure.  How do we get this on the road map?

  • Audit Active Directory LAPS by Change Auditor

    Hello , 

    has anyone tried before to Audit AD LAPS by Change Auditor ? is its possible ? and if yes , how ? 

    I need to Audit below LAPS Events :

    • Users who have viewed passwords.
    • Users who have modified a password's expiration time and date. 

    Thanks 

  • Can I create a scoped GPO Search?

    I would like to alert on all Group Policy Object  and Group Policy Instance Facility events, but only related to GPO's linked to the domain root and one additional OU.

    Is there a way to scope a search/alert for this?

    Thanks

  • How to search any change on "EmployeeID" on user's properties

    Dear All

    We are using ChangeAuditor for AD v6.9.5/Build10608.

    In the Event Class, we can find general attributes (e.g. Company or City changed on user object)  

    How can we do the similar search for other attributes?

    We are looking for who make any change…

  • Protection Template Management rights required for CA Client

    From what I can see, you need to be in the Change Auditor Admins group to manage a protection template via the Change Auditor Client. Is there any way in v6.9.5 or above to have Protection template management be more granular?

  • Granularity with GPO object monitoring

    Hello,

    Is it possible to create a search where i can see all the changes for a specific set of GPOs based on name of GPO?

    For example, can I create a wildcard search that in effect says 'let me know any time something changes with all GPOs where name…

  • Search for when AD Computer Objects are moved to Computers OU

    I am looking to create a search that audits when any computer object is moved in or out of the default 'Computers' OU.

    I see there is a 'Computer moved' event class that I might be able to use. However, Im not sure what I would put in the 'Where…

  • SMTP Settings

    How do you change the SMTP settings if you have a new SMTP server to point to?

  • Delegation with Change Auditor

    Hey All,

    I was wondering if there would be a way to restrict the access of admin users within Change Auditor so they can just search for events which occurred on Objects within one OU?

  • The DACL was changed on the group CN=Schema Admins . . .

    Hi,

    Environment:

    Change Auditor 6.9.1 / Build 3131

    Change Auditor Active Directory

    Domain function level: Windows 2012R2

    I see the following events in Change Auditor:

    The DACL was changed for the group object CN=Schema Admins . .

    The event states is…

  • The DACL was changed for the group object CN=Schema Admins . . .

    Hi,

    Environment:

    Change Auditor 6.9.1 / Build 3131

    Change Auditor Active Directory

    Domain function level: Windows 2012R2

    I see the following events in Change Auditor:

    The DACL was changed for the group object CN=Schema Admins . .

    The event states is…

  • User lockout origin is simply WORKSTATION?

    Apologies if this has been asked before, but I couldn't find the topic using Search.

    I've seen on occasion where a user account is locked out and the Origin has a value of "WORKSTATION".  Does anyone know what type of situation would…

  • Failure Type : Unknown error occurred

    Hi Quest,

    Change Auditor: 6.9.3

    Change Auditor for Active directory

    I have been noticing quite a few Failure notices in Change Auditor. A special service account is trying to move a group from one OU to another OU. I have checked the security permissions…

  • Display username variable in email subject line

    We recently migrated from InTrust to CA.

    We had a Real Time Alert to send an email if a user account gets locked out. In InTrust we could send all the relevant information in just the subject line, with the body providing further details.

    After migrating…