Change Auditor

Change Auditor



With Change Auditor, you get complete, real-time IT auditing, in-depth forensics and comprehensive security monitoring on all key configuration, user and administrator changes for Microsoft Active Directory, Azure AD, Exchange, Office 365, file servers and more. Change Auditor also tracks detailed user activity for logons, authentications and other key services across enterprises to enhance threat detection and security monitoring. A central console eliminates the need and complexity for multiple IT audit solutions.
Share on facebook
Share on twitter
Share on linkedin
Share on whatsapp


Change reporting and access logging for Active Directory (AD) and enterprise applications is cumbersome, time-consuming and, in some cases, impossible using native IT auditing tools. This often results in data breaches and insider threats that can go undetected without protections in place. Fortunately, there’s a Change Auditor.



Account lockout

Capture the originating IP address/workstation name for account lockout events to simplify troubleshooting.

Related searches

Provide instant, one-click access to all information on the change you’re viewing and all related events, such as what other changes came from specific users and workstations, eliminating additional guesswork and unknown security concerns.

Improved security insights

Correlate disparate IT data from numerous systems and devices into IT Security Search, an interactive search engine for fast security incident response and forensic analysis. Include user entitlements and activity, event trends, suspicious patterns and more with rich visualizations and event timelines.

Quest InTrust integration

Integrate with Quest InTrust for 20:1 compressed event storage and centralized native or third-party log collection, parsing and analysis with alerting and automated response actions to suspicious events such as known ransomware attacks or fishy PowerShell commands.

Superior auditing engine

Remove auditing limitations and capture change information without the need for native audit logs, resulting in faster results and significant savings of storage resources.

Security timelines

View, highlight and filter change events and discover their relation to other security events in chronological order across your Microsoft environment for better forensic analysis and security incident response.



Active Directory

Change Auditor for Active Directory and Change Auditor for Logon Activity detect and alert on vital events in Microsoft Active Directory and Azure AD with a single, correlated view across your hybrid AD environment. Track both Kerberos and NTLM authentications to help proactively identify vulnerabilities.

Azure AD and Office 365

With just a few clicks, you can pair Change Auditor for Active Directory and On Demand Audit to get a single, hosted view of all changes made across AD, Azure AD, Exchange Online, SharePoint Online and OneDrive for Business.


Change Auditor for Exchange simplifies the Exchange auditing process. Track, audit, report and alert on Microsoft Exchange on-premises and Exchange Online changes in real time within a single, correlated view.

Windows Server

Change Auditor for Windows File Servers helps you control and audit changes to Microsoft Windows Server efficiently and cost-effectively. Proactively track, audit, report on and alerts on vital changes, including user and administrator accounts, in real time and without the overhead of native auditing.

SQL Server

Change Auditor for SQL Server makes database auditing of Microsoft SQL Server easy and secure. It tracks, audits, reports on and alerts on changes in real time, translating events into simple terms and eliminating the time and complexity required for auditing.

Network-attached storage

Ensure the security, compliance and control of files, folders and shares by tracking, auditing, reporting and alerting on all changes in real time. With Change Auditor for NetApp, EMC or FluidFS, you can report on and analyze events and changes without the complexity and time required with native auditing.

SharePoint and OneDrive for Business

Change Auditor for SharePoint enables faster, easier and more secure SharePoint, SharePoint Online and OneDrive for Business auditing. It translates events into simple terms, stores data in one centralized and secure database and, in real time, tracks, audits, reports on and alerts on critical changes to:

  • SharePoint farms, servers, sites, users, permissions and more
  • File and folder activity as well as sensitive data moving in and out of OneDrive for Business

Skype for Business

Change Auditor for Skype for Business provides enterprise-wide visibility that allows you to see how Skype for Business is configured and enforced, so you can take a proactive management approach. Get alerts and reports on administrator activity, security and configuration changes in real time.


Change Auditor for VMware vCenter helps you ensure the security, compliance and control of event activity, and the security of VMware vCenter Server. It manages, audits, reports on and provides alerts on all changes to the platform in real time, making VMware monitoring easy.