N Wrix Windows Server Change Reporter

NetWrix Windows Server Change Reporter Installation and Configuration Guide 4. CONFIGURING RIGHTS AND PERMISSIONS The account that is used for data collection from target computers, Data Processing Account, as well as other accounts you may use to access the SQL database, and/or view reports, must comply with the requirements listed in the table below: Table 5: Account Data Processing Account. Required Rights and Permissions Task To run the product scheduled task and data collection Data Processing Account, or another account used to access to the SQL database. To access the SQL database with audit data Account used to upload reports to the Report Server and to view reports. To view reports in NetWrix Management Console Account used to view reports. To view reports in a browser Procedure 2. Requirements Local administrator rights, including “Manage auditing and security log” policy enabled and “Log on as a batch job” policy defined; If the computer with the product installed and the monitored servers belong to the same domain, this account must be assigned the domain administrator permissions; If the computer with the product installed and the monitored servers belong to a workgroup or different domains, the target servers must have accounts with the same name and password as the Data Processing Account. All these accounts must be assigned the local administrator permissions, including the “Log on as a batch job” policy defined. For details on how to define the policy, refer to Procedure 2 To define the Log on as a batch job policy. Target database owner (dbo) role. For details on how to assign the dbo role to an account, refer to Procedure 3 To assign the database owner (dbo) role. Content Manager role for the SSRS Home folder. For details on how to assign the role, refer to Procedure 4 To assign the Content Manager role. Browser role for the SSRS Home folder. To define the Log on as a batch job policy 1. On a domain controller, navigate to Start Administrative Tools Group Policy Management. 2. Expand the Forest Domains your Domain node, right-click Default Domain Policy and select Edit from the pop-up menu. 3. In the Group Policy Management Editor, in the left pane, navigate to Computer Configuration Policies Windows Settings Security Settings Local Policies User Rights Assignment and locate the “Log on as a batch job policy” on the right: Copyright 2013 NetWrix Corporation. All Rights Reserved Suggestions or comments about this document? www.netwrix.com/feedback Page 8 of 23

NetWrix Windows Server Change Reporter Installation and Configuration Guide Figure 2: 4. Double-click this policy. In the dialog that opens, select the Define these policy settings: option and click the Add User or Group button: Figure 3: 5. Group Policy Management Editor Logon as a batch job Properties Specify the account that you want to define this policy for, and click OK to save the changes. Copyright 2013 NetWrix Corporation. All Rights Reserved Suggestions or comments about this document? www.netwrix.com/feedback Page 9 of 23

NetWrix Windows Server Change Reporter Installation and Configuration Guide Procedure 3. To assign the database owner (dbo) role 1. On the computer where SQL Server is installed, navigate to Start All Programs Microsoft SQL Server SQL Server Management Studio. 2. Select the server and click Connect. 3. In the left pane, expand the Security node. Right-click the Logins node and select New Login from the pop-up menu. The Login New dialog will be displayed: Figure 4: Login – New: General 4. Click the Search button next to the Login Name field and specify the user that you want to assign the dbo role to. 5. If you are assigning the dbo role to the Data Processing Account, make sure the Windows authentication option is selected. If this is a different account, select the SQL Server authentication option. 6. In the left pane, select Server Roles: Figure 5: Login – New: Server Roles Copyright 2013 NetWrix Corporation. All Rights Reserved Suggestions or comments about this document? www.netwrix.com/feedback Page 10 of 23

NetWrix Windows Server Change Reporter Installation and Configuration Guide 7. You can assign the sysadmin role to the new login: all members of this role have the dbo role by default. If you do not want to assign the sysadmin role to this user, select public as server role. Then select User Mapping in the left pane. 8. Select the database used by NetWrix Windows Server Change Reporter to store audit data in the upper pane and check db owner in the lower pane: Figure 6: 9. Login – New: User Mapping Click OK to save the changes. If the account that you want to assign the dbo role to has already been added to SQL Server Logins, expand the Security Logins node, right-click this account, select Properties from the pop-up menu, and edit its roles. Procedure 4. To assign the Content Manager role 1. Open a web browser and type in the Report Server URL. 2. In the Report Manager, select the Folder Settings on the Home page, and click New Role Assignment (the path can vary slightly depending on your SQL Server version). 3. Specify the necessary group or user account in the following format: domain\group, or domain\user. The account should be in the same domain or in a trusted domain. 4. Select Content Manager. 5. Click OK to save the role assignments. Copyright 2013 NetWrix Corporation. All Rights Reserved Suggestions or comments about this document? www.netwrix.com/feedback Page 11 of 23

NetWrix Windows Server Change Reporter Installation and Configuration Guide 5. CONFIGURING AUDIT SETTINGS ON TARGET SERVERS Successful change monitoring requires a certain configuration of the audit settings on your target servers. These settings can be configured automatically after you have installed the product and started using it. If you wish to configure the audit settings manually, follow the procedures below: To configure Windows registry audit settings To configure local audit policies on pre-Vista Windows versions To configure local audit policies on Windows Vista and above To specify the maximum event log size and retention method 5.1. Configuring Windows Registry Audit Settings The following audit permissions HKEY LOCAL MACHINE\SOFTWARE, HKEY USERS\.DEFAULT nodes: Set Value Create Subkey Delete Write DAC Write Owner Procedure 5. must be set to “Successful” HKEY LOCAL MACHINE\SYSTEM, for the and To configure Windows registry audit settings 1. On your target server, open Registry Editor: navigate to Start Run, enter “regedit” and click OK. 2. In the registry tree, expand the HKEY LOCAL MACHINE node, right-click SOFTWARE and select Permissions from the pop-up menu. 3. In the Permissions for SOFTWARE dialog, click the Advanced button. 4. In the Advanced Security Settings for SOFTWARE dialog, select the Auditing tab and click the Add button. Figure 7: Advanced Security Settings for SOFTWARE Copyright 2013 NetWrix Corporation. All Rights Reserved Suggestions or comments about this document? www.netwrix.com/feedback Page 12 of 23

NetWrix Windows Server Change Reporter Installation and Configuration Guide 5. In the dialog that opens, select the Everyone group, and click OK. 6. In the Auditing Entry for SOFTWARE dialog, select Successful for the following access types: Set Value, Create Subkey, Delete, Write DAC, and Write Owner: Figure 8: Auditing Entry for SOFTWARE 7. Click OK and save all changes. 8. Repeat steps 2 to 6 for HKEY USERS\.DEFAULT nodes. the HKEY LOCAL MACHINE\SYSTEM and 5.2. Configuring Local Audit Policies Configure local audit policies on your target servers as described in this Section, to get the “Who” and “When” values for the changes of the following monitored system components: Services Hardware and system drivers Windows registry Scheduled tasks Local users and groups The procedures below provide you with one of several possible ways to configure the audit policy, depending on your operating system version: To configure local audit policies on pre-Vista Windows versions To configure local audit policies on Windows Vista and above You must be logged on as a member of the Administrators group or you must be granted the Manage auditing and security log right to perform this procedure. For instructions on how to assign the Manage auditing and security log right, refer to Procedure 8 To assign the Manage auditing and security log right. Copyright 2013 NetWrix Corporation. All Rights Reserved Suggestions or comments about this document? www.netwrix.com/feedback Page 13 of 23

NetWrix Windows Server Change Reporter Installation and Configuration Guide Note: The procedures below provide instructions on how to configure local audit policies for a whole domain. Procedure 6. 1. To configure local audit policies on pre-Vista Windows versions Navigate to Start Programs Administrative Tools Group Policy Management. The Group Policy Management dialog opens: Figure 9: Group Policy Management 2. Under the Domains node, right-click the company domain name node and select Create a GPO in this domain and Link it here. The New GPO dialog appears. 3. Type in the name of your new GPO into the Name field, and click OK. Figure 10: New GPO 4. Right-click the newly created GPO in the left pane of the Group Policy Management form and select the Edit option. Group Policy Management Editor opens. 5. Expand the Computer Configuration node on the left and then navigate to Policies Windows Settings Security Settings Local Policies Audit Policy. Copyright 2013 NetWrix Corporation. All Rights Reserved Suggestions or comments about this document? www.netwrix.com/feedback Page 14 of 23

NetWrix Windows Server Change Reporter Installation and Configuration Guide Figure 11: 6. Double-click Audit account management on the right, select Success in the properties dialog, and click OK: Figure 12: 7. Audit account management Properties Double-click Audit object access on the right, select Success in the properties dialog, and click OK. Procedure 7. 1. Group Policy Management Editor To configure local audit policies on Windows Vista and above Navigate to Start Programs Administrative Tools Group Policy Management. The Group Policy Management dialog opens: Copyright 2013 NetWrix Corporation. All Rights Reserved Suggestions or comments about this document? www.netwrix.com/feedback Page 15 of 23

NetWrix Windows Server Change Reporter Installation and Configuration Guide Figure 13: Group Policy Management 2. Under the Domains node, right-click the company domain name node and select Create a GPO in this domain and Link it here. The New GPO dialog appears. 3. Type in the name of your new GPO into the Name field, and click OK. Figure 14: New GPO 4. Right-click the newly created GPO in the left pane of the Group Policy Management form and select the Edit option. Group Policy Management Editor opens. 5. Expand the Computer Configuration node on the left and then navigate to Policies Windows Settings Security Settings Advanced Audit Policy Configuration Audit Policies Account Management: Copyright 2013 NetWrix Corporation. All Rights Reserved Suggestions or comments about this document? www.netwrix.com/feedback Page 16 of 23

NetWrix Windows Server Change Reporter Installation and Configuration Guide Figure 15: 6. Group Policy Management Editor Double-click Audit Security Group Management on the right, select Success in the properties dialog, and click OK: Figure 16: Audit Security Group Management Properties Copyright 2013 NetWrix Corporation. All Rights Reserved Suggestions or comments about this document? www.netwrix.com/feedback Page 17 of 23

NetWrix Windows Server Change Reporter Installation and Configuration Guide 7. Double-click Audit User Account Management on the right, select Success in the properties dialog, and click OK. 8. Under the Audit Policies node, select Object Access: Figure 17: 9. Group Policy Management Editor Double-click Audit Handle Manipulation on the right, select Success in the properties dialog, and click OK. 10. Repeat step 9 for the Audit Other Object Access Events and Audit Registry policies. You can also refer to the Windows Server TechCenter article for additional information: Create a new Group Policy object: Group Policy. If you wish to use the local policy, you can find instructions in the following Windows Server TechCenter article: Define or modify auditing policy settings for an event category: Auditing. Procedure 8. To assign the Manage auditing and security log right 1. Navigate to Start Administrative Tools Group Policy Management. 2. In the left pane, navigate to Forest: domain name Domains domain name Domain Controllers. Right-click the effective domain controllers policy (by default, it is the Default Domain Controllers Policy) node and select Edit from the pop-up menu. 3. In the Group Policy Management Editor, in the left pane, navigate to Computer Configuration Policies Windows Settings Security Settings and select Local Policies. 4. On the right, double-click the User Rights Assignment policy. 5. Locate the Manage auditing and security log right and double-click it. The Manage auditing and security log Properties dialog will be displayed: Copyright 2013 NetWrix Corporation. All Rights Reserved Suggestions or comments about this document? www.netwrix.com/feedback Page 18 of 23

NetWrix Windows Server Change Reporter Installation and Configuration Guide Figure 18: Manage Auditing and Security Log Properties Dialog 6. Click the Add User or Group button. In the dialog that appears, type in the name of the user that you want to grant this right to and click OK. 5.3. Maximum Event Log Size and Retention Method Specify the maximum size for the Application, Security, System and Microsoft-WindowsTaskScheduler/Operational event logs. The procedure below provides you with one of several possible ways to specify the event log settings. If you have multiple target computers, you need to perform this procedure on each of them. Procedure 9. 1. To specify the maximum event log size and retention method On the target server, navigate to Start Programs Administrative Tools Event Viewer: Figure 19: Event Viewer Copyright 2013 NetWrix Corporation. All Rights Reserved Suggestions or comments about this document? www.netwrix.com/feedback Page 19 of 23

NetWrix Windows Server Change Reporter Installation and Configuration Guide 2. In the Event Viewer tree, open the Windows Logs node, right-click Application and select Properties. The Log Properties dialog opens: Figure 20: Log Properties 3. Make sure the Enable logging check box is selected. 4. In the Maximum log size field specify the size: For pre-Vista Windows version: 300 MB. For Windows Vista or above: 1GB. 5. Make sure the Do not overwrite events (Clear logs manually) option is NOT selected. If this option is selected, change the retention method by selecting another option: Overwrite events as needed (oldest events first). Click OK to save the changes. 6. Repeat steps 2 to 5 for the Security and System event logs under the Windows Logs node, and for the Microsoft-Windows-TaskScheduler/Operational event log by navigating to Applications and Services Logs Microsoft Windows TaskScheduler Operational. Copyright 2013 NetWrix Corporation. All Rights Reserved Suggestions or comments about this document? www.netwrix.com/feedback Page 20 of 23

NetWrix Windows Server Change Reporter Installation and Configuration Guide 6. UPGRADING FROM PREVIOUS VERSIONS Procedure 10. To upgrade NetWrix Windows Server Change Reporter 1. Make sure no data collection task is running. 2. On the computer where the product is installed, close all program windows (NetWrix Enterprise Management Console, wizards, and others). 3. Download NetWrix Change Reporter Suite. 4. On the page that opens, click the Install link under Windows Server: 5. When the installation is complete, enable the NetWrix Windows Server Change Reporter tasks in the Task Scheduler. After the product upgrade, the NetWrix Windows Server Change Reporter agents on the target computers will be upgraded automatically and all your current product settings will be preserved, but the upgrade from NetWrix Server Configuration Change Reporter v.3.0 to NetWrix Windows Server Change Reporter v.4.0 results in the following exceptions: False “add/remove programs” changes may be reported after the first data collection. The Report Manager will contain two report folders for both product versions: the old NetWrix Server Configuration Change Reporter folder and the new NetWrix Windows Server Change Reporter folder. All reports generated by NetWrix Windows Server Change Reporter are stored in the new folder. Audit data collected before the upgrade will only be available in the NetWrix Server Configuration Change Reporter folder. The database retention setting available in the new product version will be inapplicable to audit data collected before the upgrade. To delete old audit data collected before the upgrade manually, refer to the following KB article: How to delete audit data from the database after the upgrade. If you have NetWrix Management Console installed on the computer where you are going to perform the upgrade, the console SMTP settings will be applied to the Windows Server Change Reporter module. Otherwise, the SMTP settings specified for NetWrix Server Configuration Change Reporter will be saved in the console. Copyright 2013 NetWrix Corporation. All Rights Reserved Suggestions or comments about this document? www.netwrix.com/feedback Page 21 of 23

NetWrix Windows Server Change Reporter Installation and Configuration Guide 7. UNINSTALLING NETWRIX WINDOWS SERVER CHANGE REPORTER To uninstall NetWrix Windows Server Change Reporter, perform the following procedures in the order they are provided. You need to uninstall the product agent if you have enabled the Network Traffic Compression option. Procedure 11. To uninstall the product agent 1. On the target server, navigate to Start Control Panel Programs and Features. 2. Select NetWrix Windows Server Change Reporter Agent Enterprise Edition in the dialog that opens and double-click it. 3.

NetWrix Windows Server Change Reporter can be installed on any computer in any domain, or a workgroup. If you wish to monitor several domains, establish a trust relationship between these domains and the domain where the product is installed. Note: NetWrix Windows Server Change Reporter requires remote access to a set of