• If a user is using Quest Change Auditor for Active Directory across two different domains or multiple domains, how many licenses will be consumed by the user?

    If a user is using Quest Change Auditor for Active Directory across two different domains or multiple domains, how many licenses will be consumed by the user?

  • First Coordinator installation SQL

    Hi Experts,

    During the installation of the first Coordinator,  I faced an issue in the wizard where we needed to provide the SQL server information, clicking on Next provides the error "The Database server could not be located". Can you please help me…

  • Installation of Coordinator and Client

    Hi Experts,

    Can we install the Change Auditor Coordinator and Client on the same server in the test environment? Also, Can you specify the system and software configuration requirements as well as user account permissions? In Addition, is there a retention…

  • Migrating old change auditor for active directory policies to a new environment

    Hello Experts,

    We have an old environment where change auditor for active directories was installed and managed. Going to create new environment where policies need to new environment. how to migrate the old policies to new domain environment. 

    What would…

  • Change Auditor | Time Synchronization

    Dear Support Team,

    Would you describe the Time synchronization process between Change Auditor Coordinator, Agents, and domain servers?

    In case there is Light Saving time change happens

  • Change Auditor not sending AD security events


    I have a forest with 2 DCs and both DCs have the agent installed. The agents are active and i can see in the overview some events from subsystem Change Auditor, service and active directory but when i am disabling/enabling an account for example the…

  • Events per seconds / Volume size - Syslog event subscription


    I've receive a request to send the Change Auditor events to a syslog collector...  But for planning purposes they are wondering the ingestion rate (EPS / Volume Size) for the CA events.  Is there a way I could generate a reports with the information…

  • How to enable TLS for syslog with private certificate

    Hi all,

    I need help to configure Syslog with TLS encryption,

    I configured Syslog on the coordinator to send alerts to our SIEM system which is based on Elastic stack, I followed "Managing Syslog integration" section in "SIEM integration user guide", I…

  • Failed Group Policy Container Access (Change Auditor Protection)

    Change Auditor for Active Directory 7.1.1

    I recently implemented Protection on several GPOs. I only allow Domain Admins and Group Policy Creator Owners excluded from Protection.

    When I run the query 'All Group policy Events', I have hundreds of entries…

  • How To Add/Audit Attribute "PrincipalsAllowedToRetrieveManagedPassword"

    Hello ,

    Need Help Please,

    Does anyone know how to audit attribute 

    PrincipalsAllowedToRetrieveManagedPassword ?
    Best Regards,
  • is it possible to find out who created an alert and when?

    I'd like to find out who created an existing alert and when it was created?

    is there a log or audit feature?

  • Possible Agent issue with DC - Microsoft-Windows-Security-Kerberos

    Hello, I am working with PSO to deploy Change Auditor in production. I stood up a lab to test how some agents would interact. The agents of concern are ManageEngine PasswordSyncAgent and the Quest Change Auditor Agent.

    We couldn't find a smoking gun in…

  • Email notification stopped

    Hi  All

    I am new to this product we are using Quest Change Auditor Version 7.1/Build 16043. one of my AD group is protected and one of the user gets email notification when ever any user is added or removed from the group. Suddenly user is not receiving…

  • Need to understand the behavior of ADHooks property value from WMI class "Win32_PerfFormattedData_CAAD_ChangeAuditorforActiveDirectory"

    I observed that Change Auditor agent on Domain Controller doesn't pass ADEvents to Change Coordinator server even though the Agent service is running on the Domain Controller and it's passing other events too, It shows ADEevents zero on ServiceStatusTray…

  • Disable event auditing


    I am just interested to know if there is any performance advantage or any other advantages when I DISABLE events for which I have no License Type.

    I an running CA for Active Directory. When I look at all of the different Facility Names and their respective…

  • Create Web Search for all events for a user

    I cannot determine the exact criteria to find all Custom User Monitoring Events and Customer AD Object Monitoring Events for one user.

    I can create the search for the events in the Facility but I can't figure out how to select one user (not the user that…

  • Change Auditor Application User Interface Roles, Tasks and Operations matrix

    Is there a matrix or list published somewhere that lists the Operations associated with the built-in 'Operator' and 'Web Client Shared Overviews' Tasks?

  • InTune changes not included in Change Auditor for Azure.

    InTune changes not included in Change Auditor for Azure.  How do we get this on the road map?

  • Audit Active Directory LAPS by Change Auditor

    Hello , 

    has anyone tried before to Audit AD LAPS by Change Auditor ? is its possible ? and if yes , how ? 

    I need to Audit below LAPS Events :

    • Users who have viewed passwords.
    • Users who have modified a password's expiration time and date. 


  • Can I create a scoped GPO Search?

    I would like to alert on all Group Policy Object  and Group Policy Instance Facility events, but only related to GPO's linked to the domain root and one additional OU.

    Is there a way to scope a search/alert for this?


  • How to search any change on "EmployeeID" on user's properties

    Dear All

    We are using ChangeAuditor for AD v6.9.5/Build10608.

    In the Event Class, we can find general attributes (e.g. Company or City changed on user object)  

    How can we do the similar search for other attributes?

    We are looking for who make any change…

  • Protection Template Management rights required for CA Client

    From what I can see, you need to be in the Change Auditor Admins group to manage a protection template via the Change Auditor Client. Is there any way in v6.9.5 or above to have Protection template management be more granular?

  • Granularity with GPO object monitoring


    Is it possible to create a search where i can see all the changes for a specific set of GPOs based on name of GPO?

    For example, can I create a wildcard search that in effect says 'let me know any time something changes with all GPOs where name…

  • Search for when AD Computer Objects are moved to Computers OU

    I am looking to create a search that audits when any computer object is moved in or out of the default 'Computers' OU.

    I see there is a 'Computer moved' event class that I might be able to use. However, Im not sure what I would put in the 'Where…

  • SMTP Settings

    How do you change the SMTP settings if you have a new SMTP server to point to?