Chat now with support
Chat with Support

Change Auditor 7.1 - Whats New

What's New in Change Auditor 7.1 What's New in Change Auditor 7.0.4 What's New in Change Auditor 7.0.3 What's New in Change Auditor 7.0.2 What's New in Change Auditor 7.0.1 What's New in Change Auditor 7.0 What's New in Change Auditor 6.9.5 What's New in Change Auditor 6.9.4 What's New in Change Auditor 6.9.3 What's New in Change Auditor 6.9.2 What's New in Change Auditor 6.9.1 What's New in Change Auditor 6.9

On Demand Audit integration updates

•
Ability to send the Change Auditor version and list of coordinators to On Demand Audit after an upgrade so that On Demand Audit can display the most current Change Auditor information.
•
New events generated when event forwarding to On Demand Audit is suspended due to an error and then resumed:
•
On Demand Audit subscription has suspended
•
On Demand Audit subscription has resumed
•
New events generated when an On Demand administrator makes changes to the Change Auditor event forwarding settings within On Demand Audit:
•
Event sending to On Demand Audit paused
•
Event sending to On Demand Audit resumed
•
On Demand Audit configuration removed
•
New event generated when Change Auditor connects to On Demand Audit:
•
On Demand Audit configuration added

Authentication and Logon activity updates

•
Additional events:
•
User performed a successful NTLM V1 logon is created when a user successfully logged into a server through NTLM V1.
•
User performed a successful NTLM V2 logon is created when a user successfully logged into a server through NTLM V2.
•
User authenticated through NTLM (or User failed to authenticate through NTLM) is created when a user successfully authenticates (or fails to authenticate) to a domain controller using NTLM authentication.
•
Additional built-in searches:
•
All Kerberos Authentication Activity in the past 24 hours
•
All NTLM Authentication Activity in the past 24 hours
•
All NTLM version 1 logons in the last 7 days
•
Ability to search logon events by the failure reason or status code.
•
Ability to set Kerberos ticket lifetime in agent configuration and detect possible golden ticket use. When a Kerberos ticket lifetime that exceeds the value specified in the agent configuration is detected, the “Kerberos user ticket that exceeds the maximum lifetime detected” domain controller authentication event is generated. A valid Change Auditor Logon Activity User license is required.

Additional platform support

The following support has been added:

•
Windows Server Core 1909 (Active Directory, Windows File System, Registry, Services, and Local User and Group auditing only)
•
Microsoft Exchange Server 2016 CU15
•
Microsoft Exchange Server 2019 CU4
•
Microsoft SQL Server 2019 CU2 (coordinator database, SQL and SQL DLA auditing)
•
.NET Framework 4.6.2 for the agent
•
NetApp 9.7
•
Defender 5.9.6
•
GPOADmin 5.14
•
Active Roles Server 7.4.2
•
Fluid File System 6.0.3

The following support has been removed:

•
Microsoft Exchange Server 2010 is no longer supported for auditing or protection
•
Windows Server 2008 R2 is no longer supported for agent installations
•
Windows server 2008 SP2 is no longer supported for legacy agent installations

Miscellaneous features and enhancements

•
Ability to manually specify a service name in the Services Auditing Template wizard.
•
Performance improvements when auditing a high volume of AD Query events.
•
Performance improvements have been made to the "Discard duplicate queries occurring within" event consolidation to reduce the amount of required memory. Note: Although improved, the agent will still consume considerably more memory when auditing high volume Active Directory Query events over longer periods of time compared to baseline agent memory usage.
•
SMTP Alert Failed event created when an SMTP alert notification fails enabling you to identify and fix SMTP server configuration issues.
•
Defender and Authentication Services auditing no longer requires a Change Auditor for Defender or a Change Auditor for Authentication Services license. Auditing for these applications is now enabled and disabled on a configuration basis from through the configuration setup. (After an agent upgrade from version 7.0.4 or earlier, you will need to update your configuration setup to enable Defender or Authentication Services auditing where required.)
•
Ability to use autofill software with the Change Auditor web client log on.
•
The "Refresh Status" button on the Deployment tab will now use the credentials defined in "Set credentials" dialog.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating