• The DACL was changed on the group CN=Schema Admins . . .

    Hi,

    Environment:

    Change Auditor 6.9.1 / Build 3131

    Change Auditor Active Directory

    Domain function level: Windows 2012R2

    I see the following events in Change Auditor:

    The DACL was changed for the group object CN=Schema Admins . .

    The event states is…

  • The DACL was changed for the group object CN=Schema Admins . . .

    Hi,

    Environment:

    Change Auditor 6.9.1 / Build 3131

    Change Auditor Active Directory

    Domain function level: Windows 2012R2

    I see the following events in Change Auditor:

    The DACL was changed for the group object CN=Schema Admins . .

    The event states is…

  • User lockout origin is simply WORKSTATION?

    Apologies if this has been asked before, but I couldn't find the topic using Search.

    I've seen on occasion where a user account is locked out and the Origin has a value of "WORKSTATION".  Does anyone know what type of situation would…

  • Failure Type : Unknown error occurred

    Hi Quest,

    Change Auditor: 6.9.3

    Change Auditor for Active directory

    I have been noticing quite a few Failure notices in Change Auditor. A special service account is trying to move a group from one OU to another OU. I have checked the security permissions…

  • Display username variable in email subject line

    We recently migrated from InTrust to CA.

    We had a Real Time Alert to send an email if a user account gets locked out. In InTrust we could send all the relevant information in just the subject line, with the body providing further details.

    After migrating…

  • Getting Domain Controller moved to OU events for workstations

    We started to get CAAD alerts for non-dc's being moved to a different OU.

     

    We are running CAAD 6.9.1

     

    Does anyone else get this? I don't think these workstations have MSMQ installed on them.

  • change auditor - Why am I getting Domain Controller moved to OU events for workstations

    We started to get CAAD alerts for non-dc's being moved to a different OU.

     

    We are running CAAD 6.9.1

     

    Does anyone else get this? I don't think these workstations have MSMQ installed on them.

  • Agent status "Never" on servers with same name, new fresh installation

    Hi guys!

    Thank you very much for your help.

    Happens with a customer that we have 27 agents installed (FS, DC, SQL etc)

    They install new DC (three servers) keeping the name and the IP address of the "previous" servers that were installed and auditing,…

  • Change Auditor alert for larger number of AD groups

    Hello,

    We have recently brought in Quest Change Auditor (6.9.4 Build 9177) to help us with Active Directory.

    Our first directive is to use the tool to monitor up to 1,200 AD groups for membership changes.  When membership changes are detected, send an…

  • How do I alert when a Protection template is Disabled?

    We have enabled Group Protection Templates using Change Auditor at my company. How do I alert if this template is Disabled/Enabled?

     

    Thanks,

     

    Steve

  • How to query groups with no description and who created them?

    I'm having trouble getting this query done...I'd like to get a list of all groups in AD that do not have a description set, and who created them. I can't seem to figure out what to query on this. Any help is appreciated!

  • Change Auditor Agent Status report - script.

    Hi All,

    We have deployed Change Auditor for Active Directory V.6.5+.

    We are looking for a report on weekly basis which list Change Auditor Agent status for all the Domain Controller reporting to Change Coordinator in forest.

    Graphically we are able to see…

  • Custom Search for Member of Group

    We recently had a need to find who removed a user from a group.  Under Security, User Management, there is a report for Users removed from group in the last 30 days.  However, the "who" in this report is the person who made the change - not the member of…

  • ANNOUNCMENT: We are now on Twitter!!! Contact a Technical Support expert today.

    Do you have a quick support question and short of time ? Contact us Via Twitter  @QuestExperts and we will take care of you. #Jointheinnovation #WeareQuest

  • Top 20 Users Account Lockout Report

    Can we generate a report of Top 20 Users whose accounts have got locked in a week. 

  • FRS -> DFSR migraiton and alerts in Change Auditor

    I am migrating FRS to DFSR and going from 'REDIRECTED' to 'ELIMINATED'.

    During this phase the FRS service is stopped and Disabled.

    I receive an alert in Change Auditor on Windows 2008 R2 DCs, but not on Windows 2012 R2 DCs. On a 2012 R2…

  • Top 5 Knowledge Base Articles:

  • How to get the most out of this forum –best practices for what information to include:

    The better a problem is described, the better the assistance tends to be.

    In order to better assist with your issue at hand, please include the following information in your initial post:

     

    • Product, Version, and relevant environment details.
    • Include a…
  • Video: Active Directory is the heart of your business. That’s why the bad guys want to break it.

    This video is a high level overview of how Change Auditor can protect your Active Directory environment from hackers, external threats and disgruntled employees.

     

  • Latest Version - Change Auditor 6.8

    The current version of Change Auditor is 6.8

    Trial Downloads:

    Current customer, download…