How to deploy the new Quest ChangeAuditor scripting module for use with Active Roles when upgrading from a much earlier version (4237812)

How to deploy the new Quest ChangeAuditor Dynamic Directory Control (DDC) scripting module for use with Active Roles, when upgrading from a much earlier version.

The previous ChangeAuditor scripting module for Active Roles (version 5.x and 6.x) had several limitations related (but not limited) to Active Roles over-ride accounts, deprovisioning processes and event timing issues for ChangeAuditor alert-enabled searches.

These steps assume Active Roles and ChangeAuditor, along with the Active Roles integration scripts are currently deployed and you have upgraded from a 5.x or 6.x version:

1. After upgrading ChangeAuditor (including all Domain Controller Agents), open the ChangeAuditor Client Select View | Deployment. Highlight the server where Active Roles is installed. Select Advanced Options with the arrow | Active Roles Integration and select which script deployment option required.
2. Once the script is deployed, open the Active Roles Console select Configuration | Scripting Modules | Administration

Now three scripts that show "Change Auditor XXXX Script" will be observed. The one WITHOUT the installation name is the new DDC script. If you do not see the other scripts, and you only see the new one without the installation name, the remainder of the steps are not needed.

3.  Select Policies | Administration and see two policies. Right click the policy that has the installation name | Select Policy Scope and remove the scopes. This will ensure only the new DDC Script will be used to forward event data to ChangeAuditor
4. Within the ChangeAuditor client select View | Administration | Agent | Configurations (make sure to select the Domain Controller Agent that Active Roles points to. Refresh the Agent configuration. This will force the agent(s) to check in and update the Active Roles EventSource and SID information.

Note: This is not required but highly recommended, doing so will force the agent to pull the changes now vs the polling interval (every 15 minutes)

Deployment considerations:

1. Some Operating Systems require setting the execution policy to "unrestricted" on the ARS server before deploying scripts
2. Following the changes to the configuration reboot of the Active Roles server (not just the service) to clear the cache of all of the changes made may be required.
3. Restart of the ChangeAuditor Agent on the Domain Controller the Active Roles is pointed to may be required or can be used as alternative option to step 4 described above.

Common Issues:

- The user account specified in the CA deployment settings is not an Active Roles administator
- The Active Roles service account is not a member of the ChangeAuditor administrator group