Product Support - Change Auditor

Filter to browse recommended product support content
(Choose different product)

Self-service tools will help you to install, configure and troubleshoot your Dell product.

Our technical support staff has identified the following critical information to get you started. To get the best results make sure you read through all material prior to using your Dell Product.

Searches published as widgets in the Web Client are unable to be selected for a Shared Overview
If a search is published as a widget for use on a Shared Overview, it may not be able to be found when trying to add it.  The Widget drop-down menu will show the correct total number of widgets at first, but if the arrow is clicked to show the next page, the total count changes.In Change Auditor 6.5 and 6.6, if you select the Searches filter on the right hand side, it should show the searches...
How to manually install the Change Auditor Agent on a remote server
There are a number of circumstances which may lead to needing to manually installing the Change Auditor Agent on a remote server  including, but not limited to, being unable/unwilling to open the necessary ports used during the normal installation process.
Can Change Auditor 6.5 (or higher) be configured to publish a scheduled report to a file share rather than an email?
In earlier versions of Change Auditor, twhich relied on SQL Server Reporting Services (SSRS), some customers would publish reports to a file share rather than email them.  Since Change Auditor 6.5 has its own built-in reporting engine, there is a desire to have this same functionality available.
Alert for only when a specific type of file is changed
There is a File System alert setup to send out an email every time an administrator makes a change to a file on any server. Preference would be to be alerted only when an administrator changes a specific type of file.  Is there anyway this can be done since in its current form, this alert is flooding recipient mailboxes as soon as someone logs on to a server
How to apply new license files to Change Auditor
How to apply new license files to Change Auditor.
How to filter Change Auditor Events to ensure only failed events are displayed
Administrators may want to filter Events recorded by Change Auditor to view only events that have a "Failed" result.
How to create a query based on folders with specific characters.
How can you create a search query based on folders with specific characters. e.g. folders containing the symbol "#".
How to investigate Change Auditor Agent high memory usage using User Mode Stack Trace Database
How to investigate Change Auditor Agent high memory using User Mode Stack Trace Database when instructed by Support.
Excluding C drive auditing from file server templates
It is recommended to exclude C drive from file system/windows file server auditing templates.
How to Upgrade to ChangeAuditor 6.0
How to upgrade Change Auditor 5.6, 5.7, 5.8 or 5.9 to Change Auditor 6.0
Below is a list of the recommended software along with any documentation that will help with the install process to bring your product to the version referenced.

Having issue setting up the trial, getting database error in the coordinator
Database could not be intialized in Coordinator logs SQL logs said "cannot open domain\username default database"  
Cannot upgrade / uninstall Dell Change Auditor Agent due to EventLog record lock message
During attempt to upgrade or uninstall the Change Auditor Agents the process fails with Deployment Result:"The Windows EventLog service has a Change Auditor event message file locked. Close all Event Log Viewers and try again, or run the installer manually to override."
Exception is generated after Exchange 2013 CU 6 is applied
Exchange services fail after upgrading Exchange 2013 from CU4 to CU6. In example RPC proxy fails with this exception: Could not load file or assembly 'ChangeAuditor.HookCommon, Version=, Culture=neutral, PublicKeyToken=null' or one of its dependencies. The private assembly was located outside the appbase directory. (Exception from HRESULT: 0x80131041) at ChangeAuditor.RpcOverHttpHook.RpcO...
Does Change Auditor 6.5 support Microsoft Exchange 2013 CU 6
Administrators may inquire if ChangeAuditor 6.5 has been tested with Microsoft Exchange 2013 CU 6 and if there are any known issues.
Does ChangeAuditor 5.8 support Exchange 2010 SP3?
Does Change Auditor support Exchange 2010 SP3?
Windows 2000 Computers do not show in the Deployment Tab / Server Topology of the ChangeAuditor C
Windows 2000 Computers do not show in the Deployment Tab / Server Topology of the ChangeAuditor Client.
After agent installation on Exhange CAS role OWA http request returns "Outlook Web Access enco
After deploying ChangeAuditor agent to your Exchange CAS OWA server the errors below are displayed in the browser: "Outlook Web Access encountered an unexpected error and was unable to handle your request"Exception Exception type: System.IO.FileNotFoundException Exception message: Could not load file or assembly 'System.Core, Version=, Culture=neutral, PublicKeyToken=b77a5c561934e089' o...
Does ChangeAuditor support Agent installation on Microsoft Windows Small Business Server?
Does ChangeAuditor support Agent installation on Microsoft Windows Small Business Server? The ChangeAuditor Client will not display Windows Small Business Server computers in the Domains / Forest on the Deployment tab.
Agent does not install
Installing Agent on Exchange 2010 Windows 2008R2 with Change Auditor fails with error:1603 "Can't adjust token privileges for SeDebugPrivilege (0x514)"
Does Change Auditor for Exchange 6.5 and/or 6.6 support Exchange 2013 CU7 or higher
Does Change Auditor for Exchange support Exchange 2013 CU7 or higher?
Technical Support has reviewed all the support information and has identified the most popular helpful tips and how to videos or articles to ensure you get the most out of your Dell Product.

Unable to distinguish between legitimate and false positive events for "Failed file access (NTFS permissions)"
Change Auditor for Windows Files Server is unable to distinguish between legitimate and false positive events for "Failed file access (NTFS permissions)"
ConfigurationTemplates Import and export issue
ChangeAuditor client crashes when importing the exported configuration.There is a SQL error shown in the Clientat System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection) at System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning() at System.Data.SqlClient.TdsParser.Run(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimp...
Add NETAPP events to the built in File Access search
The standard built-in report for File/Folder moves does not show actions that occurred on the Netapp filers
File-system template audit path has optional variables in the drop down when "Folder" audit path
When selecting "Folder" in the "Audit Path" area of the file-system template the drop down for the specified folder area contains four optional variables as below: [program files] [common program files] [windows directory] [system directory]
Does Change Auditor for SQL support auditing SQL Express Edition?
Does Change Auditor support auditing SQL Express edition?
Add hyperlink to CA email alerts that direct user to the web client with the event details
In the scenario a user would like to view the event details of the email alert received, he would need to login to the CA client and run the respective search to locate the event to his interest. Is there a way that we could configure the email alert with a hyperlink that direct user to the event details via the web client?
Audit Microsoft SQL Server using SQL Server Extended Events
Currently ChangeAuditor uses 'Event Tracing for Windows' (ETW) for auditing Microsoft SQL Server 2005 and higher. Microsoft offers newer technology for tracing SQL activity such as 'SQL Server Extended Events' which is light-weight monitoring system which uses very few performance resources.
Does Change Auditor support SQL Extended Events?
As of SQL Server 2008, Microsoft has introduced a new auditing option called Extended Events.  Some customers have asked if Change Auditor currently supports capturing these Extended Events.
Assigning multiple Change Auditor SQL Templates to an Agent configuration doesn´t work as expected
When multiple SQL Auditing templates are assigned to an agent configuration, only the last one assigned works, while events specified on the other ones are ignored.
Exclude SQL Roles by Excluded accounts
An administrator does not want to record events by specific SQL Roles but is unable to create a User Exclusion for SQL Roles.
The information below represents the most common issues customers are encountering or recent resolutions to help you trouble shoot your Dell Product.

Coordinator stops 5 minutes after upgrade from ChangeAuditor 5.9.
Five minutes after the Coordinator starts, it stops again with the following errors in the Coordinator log:[INFO][Dell.ChangeAuditor.Migration.ConfigurableParams.GetValueForKey(0)] Returning default value: 60 for 5xMigrationSQLTimeoutInMinutes[ERROR][Dell.ChangeAuditor.Migration.SourceData.DataSetSqlExecute(0)] Error executing sql: IF OBJECT_ID( N'Audit.Event', N'U' ) IS NOT NULL S...
False positive "Failed file access (NTFS permissions)" event generated when a user runs a .BAT file
False positive "Failed file access (NTFS permissions)" event generated when a user runs a .BAT file for which they have permissions.The event may appear similar the following:When: 06/11/2014 1:04:28 PMSeverity: Medium SeverityWho: Domain\administratorWhat: Access to file C:\Test\Testbat.bat was denied on NB-TESTENV\machinename by NTFS permissions. (Denied access: read, write, create).Ac...
ChangeAuditor for Windows File Servers File System Auditing not auditing events
ChangeAuditor File System Auditing not auditing. The File System template appears to be correctly configured and is applied correctly to the Agent Configuration.
Report preview is a blank page
A working search configuration is not modified, yet  when the Report preview is selected the report is blank.Attempted to refresh the agent configuration and received error message "FQDN failed"
"Failed folder access" "NTFS permissions. (Denied access: DACL change, owner change)" events are incorrectly reported
"Failed folder access" "NTFS permissions. (Denied access: DACL change, owner change)" events are incorrectly reported when a user with permissions view the Security tab of the Propeties on a monitored folder in Windows 2012 Server.
Upgraded to Change Auditor 6.6.407 and File System Auditing stopped on some servers
After we upgrading to Change Auditor 6.6.407, Change Auditor stopped auditing File System events from some of the file servers.
Windows Backup leads to server hang when Change Auditor Agent is running
Consider the following scenario...On a computer running Windows 7 or Windows Server 2008 R2, the computer may stop responding. When this issue occurs, you must restart the computer.Here is a sample scenario:1) You install a Change Auditor Agent on a computer that is running Windows Server 2008 R2.2) You run Windows Backup on the computer.3) The computer becomes unresponsive 
Cannot view more than one day's events in a search
Unable to view more than one day's events even if the When tab set to more than 1 day.
When events are backlogged, the Overview tab may not display any recent events.
Under some circumstances, it is possible that there will be a backlog of events entering the database.  This can be more common on earlier versions (5.x) of Change Auditor, but could happen on the newer versions as well.  When this happens, the Overview tab default search may not show any events.
ObjectName field in SNMP alerts is empty
Using SNMP trays in Change Auditor 6.0 returned no value for field #5 Objectname.
Version Full Support as of Limited Support as of Support Discontinued
6.7 7/31/2015
6.6 10/16/2014
6.5 8/5/2014
6.0 10/25/2013
5.9 4/1/2013 9/15/2014 9/15/2015
5.8 11/16/2012 7/8/2014 7/8/2015
Earlier product versions not listed are considered discontinued.

The Product Support Lifecycle table above describes the phase during which Dell Software products are eligible for product support and new release downloads.

Product Support Policies

The Product Support Lifecycle describes the phases during which our products are eligible for patches (fixes), support and downloads from the Support Portal.

It is our policy to provide support and fixes in current versions of our products when you are under a current support agreement. Fixes to older versions are at our discretion. We strive to put resources behind the most recent product releases in order to continually improve and enhance the value of our products.

We will attempt to answer questions on older versions of our products provided resources are available; however, if you are using a discontinued version, we encourage you to upgrade to the currently supported version of the product.

Our usual support policy is to provide support on both the current (n) and prior (n-1) versions of our products. Refer to the product lifecycle table on your Product Support Page or Knowledge Base for more information.

Full Support

  • Product is fully supported, generally available release/version.
  • Includes most current released version of a product and one or more prior releases.
  • Enhancement requests for this release are accepted and may be considered for future releases.
  • Maintenance releases and/or hot fixes are periodically made available for this release.
  • Release/version is fully supported by both Support and Development.
  • Release/version is available for download from Support Portal.

Limited Support

  • Support is available for this release/version, and we will use best efforts to provide known workarounds or fixes.
  • No new code fixes will be generated except under extreme circumstances and at our discretion.
  • Enhancement requests are not accepted.
  • You are encouraged to plan an upgrade to a release/version on "Full Support".
  • Release/version is available for download from the Support Portal.


  • Includes release/versions which are retired or discontinued.
  • No new patches or fixes will be created for this release.
  • Release is not available for download from the Support Portal.
  • Support will be provided to assist with upgrading to a supported version.
  • Support is not obligated to provide assistance on this version of the product.

Continuing Support

If you are unable to upgrade or migrate your product prior to its end-of-life, we offer a Continuing Support service to provide you with one year of limited support beyond your software’s end-of-life or end-of-support date. Continuing Support is not guaranteed on every product.

  • Annual software maintenance contract must be renewed.
  • Includes uninterrupted access to technical support via phone, online and chat.
  • Support Engineers will provide known workaround solutions and fixes.
  • Fee-based service available on selected products.

    Product Enhancements

    If you are interested in submitting product enhancement requests, you can do so by creating a case with support. When we receive a product enhancement request, the Support Engineer will work to define and clearly document the request. Once documented, the request will be submitted into the enhancement review system, the identification number will be provided to the submitter, and the support case will be closed.

    Product Management will review the open enhancement requests on a periodic basis and consider them for inclusion in a future product release. Product enhancements will not be considered or implemented in current or prior product releases. There is no guarantee that a specific enhancement request will be implemented in a future version of our product. It is at our discretion if a certain enhancement will be offered for an additional charge or as a chargeable option.

    Product Defects

    If your issue is determined to be a defect in the product, it is recorded in our defect tracking system, a unique Defect Identifier (ID) will be provided to you and the support case will be closed. Notifications of new product releases will be emailed to you as long as you who have configured your profile to receive product notifications. Release Notes for new releases of products will contain the list of Defect Identifiers that were addressed in the release. You can review the release notes or search the Knowledge Base on the Support Portal using your Defect Identifier to see if the issue has been addressed. We do not guarantee that all defects identified will be fixed in a future release of the product.

    Our products have license keys generated for their use. Some products require a new license key when upgrading to a new release and/or patch. We also recommend that prior to any migration or upgrade of products, new licenses are confirmed as functioning properly as some license keys are machine and machine name specific.

    If you have questions regarding licensing of a product please complete the form available on the Support Portal Licensing Page. A Dell Software Licensing Representative will respond to your query within 24 hours.

    You may also email the Dell Software Licensing team:

    For SonicWALL specific licensing questions, contact SonicWALL Customer Service.

    Support for Trial Users

    We offer software trials on selected products for testing purposes. Support for trial users is limited to 30 days from the registration date. Service Requests for your trial product may only be submitted during the first 30 days of your testing period. You will still have unlimited access to our Support Portal for accessing the Knowledge Base and Product Pages.

    Customizations policy for Dell Software products

    A customization indicates functionality and configurations added to a product that are not provided as part of the core product release and, as such, would be outside the scope of normal support and maintenance. Customizations may take the form of new or modified scripts used within or alongside our products, as well as additional functionality such as custom reports, dashboards, rules, automated actions, etc. developed by you, your partners, or our Professional Services Organization.

    Support and Customizations

    We do not perform or maintain customizations. The design and development of customizations to our products is your responsibility. Assistance from Support will be limited to helping ensure that the product's functionality which enables the addition of customizations is functioning as expected. Alternatively, you may obtain guidance through product specific community sites or the Support Knowledge Base.

    Advanced Assistance

    If more thorough and detailed assistance is needed to design and develop customizations, we recommend that you engage our Professional Services Organization or fully certified partners to assist. Their expertise in designing customized solutions will ensure customers receive maximum value and product adoption. In addition to providing post-implementation expert services, Professional Services also offers a variety of pre-packaged customizations for some products which may meet your specific requirements.

    Training & Certification

    We recommend that you obtain the appropriate product training before attempting to design, develop, and implement any customization to our products. Our training courses will equip you with the necessary knowledge and ability to design and implement effective changes to our products. For more detail on the training services available, please refer to Training & Certification Services .

    Maintaining Customizations

    Careful consideration should be given to all customizations during future migration or upgrade exercises to new product and platform versions. Customizations could inhibit the upgrade itself and may require a level of re-work to continue functioning properly. Support does not take ownership for any customizations. We strongly encourage you to document and maintain records on any implemented customization work. These records can be useful in isolating problems that may be attributable to the customization or a defect in the core product.

    Support Policy on Virtualization

    Virtualization is a technique for hiding the physical characteristics of computing resources from the way in which other systems, applications or end users interact with those resources. It is able to make a single physical resource, such as a server, operating system, application or storage device, appear to function as multiple logical devices. It can also make multiple physical resources such as storage devices or servers appear as a single logical resource. As a result virtualization enables IT departments to increase the utilization of resources, increase high availability, and simplify back-up, systems administration and recovery procedures. It also allows IT departments to be more responsive to the dynamic needs of the business. Examples of virtualization technologies include VMware ESX Server, Citrix/XenServer and Microsoft Windows Server 2008 Hyper-V.

    Our products leverage the binary compatibility offered through virtualization technologies, which provide complete transparency to the operating systems and applications deployed. As a result, for all casework received where the Dell Software product is being used in a virtual environment, we will assume that the problem is common to both native and virtual operating environments, and that we will only require the customer to recreate the problem in a native environment if and when there is reason to believe that the problem is unique to the virtual environment itself.

    From a purely functional perspective, our products will operate in exactly the same way, however we can make no guarantees with respect to performance or scalability in a virtualization environment running multiple virtual instances. Configuration aspects such as CPU, memory availability, I/O subsystem and network infrastructure can all influence such a deployment, which should be given careful consideration to ensure the virtual layer has the necessary resources available to provide a satisfactory user experience.

    Support Policy on Third-Party Software

    We are committed to providing products which work on the latest platforms and technologies available in the industry today. We work closely with technology vendors to ensure earliest possible compatibility with our solutions. We provide full details of all systems requirements, together with platform and third-party product versions supported with our products, in the Release Notes published for each product. These include operating system versions, service pack levels, mail clients or server versions, database versions, browsers and other related technology supported and at which particular version level our products have been formally tested and certified to run against. The support of future platform versions, new service packs and other related technologies would be taken into consideration and addressed during the regular product maintenance and release cycles of our products. This provides ongoing upward compatibility of our products as used in customer environments. It should be noted therefore that there could be a delay between the availability of the latest platform technology release or service patch, and the product version certified to operate against this. Please contact Support should you have any questions with regards to the current support status of any product and a particular related platform, patch or third-party product support not explicitly documented in our release notes.

    For more information about the latest third-party platforms and versions supported, please review the System Requirements section of the release notes for your product or search our Knowledge Base on the Support Portal. Please note that while we do not directly or officially support third-party software, we work closely with many other providers to ensure our customers receive the best possible service at all times.

    Regional software license agreement applicable to your use of the software is available below (including software preinstalled on Dell hardware or made available to you by download, disk media or otherwise, at no additional cost).

    Click here to find your regional agreement.

    See all Support Policies