Change Auditor for Active Directory Reviews

My main use case for Change Auditor for Active Directory is to use it as a forensic tool, where I can monitor any action performed on the domain controller. There are a few licenses that come with Change Auditor for Active Directory where I can monitor and capture user actions, administrative privileges, and admin actions, including changes regarding group policy, DNS changes, and attribute changes made in Active Directory.

I find myself relying on Change Auditor for Active Directory for investigations or monitoring very often; it is indeed a very useful tool for investigating actions I might not be aware of. If someone changes any attribute, group policy, or anything related to the Active Directory environment and I might not accept that, in that case, I have the logs available in Change Auditor for Active Directory. I keep the 180 days logs in Change Auditor for Active Directory so that if anybody made changes in the last 180 days, I can investigate all those events.

The main use case of Change Auditor for Active Directory is that if any changes are made to the Active Directory environment in a domain controller, that can be captured by Change Auditor for Active Directory. For example, when lockout events occur, if someone's account gets locked out, I can easily identify from which machine or source machine the user account is getting locked out. Such information is very clearly visible in Change Auditor for Active Directory.

Change Auditor for Active Directory has positively impacted my organization by helping address security questions that arise, such as when a specific account got disabled. Since I manage the 180 days logs events in Change Auditor for Active Directory, it is very easy to find that information in the Change Auditor for Active Directory database.

I work in the core Active Directory team and synchronize with the HR partner; sometimes, information is required regarding employees who left the organization but whose accounts still exist in the system. I need to provide details about when the user account was disabled and when the person left the organization, and such information is readily available in Change Auditor for Active Directory concerning actions performed on the domain controller. It is very useful.

Change Auditor for Active Directory's best feature is protection for your attributes. I can use the protection feature in Change Auditor for Active Directory, which helps ensure that if someone tries to change my Active Directory attributes, they cannot change it. I can monitor this, control this from Change Auditor for Active Directory, and identify if someone is trying to change the attribute of a respective object, which helps save me from disasters or impactful situations.

Change Auditor for Active Directory helps me in my day-to-day work significantly; when I work in a large environment with 150,000 users, the presence of cyber attacks is a concern. It provides a two-layer protection—one from the network side and one from the Change Auditor for Active Directory side—thus really saving me from such security threats.

Additionally, Change Auditor for Active Directory does not only share reports; it can also provide visible diagrams, such as pie charts or pivot diagrams. This feature is really helpful when I want to see specific events and how many events have been generated for particular activities.

Change Auditor for Active Directory is already a very improved product, but there is still scope for improvement. It should provide more graphical views, offering a dashboard that shows the events currently going on, so I don't need to look for each event individually; I can easily identify what is happening in Change Auditor for Active Directory through a dashboard.

I use Change Auditor for Active Directory for around seven and a half years.

In my experience, Change Auditor for Active Directory is stable. If the underlying operating system is stable, then Change Auditor for Active Directory will be stable as well. Whether using Windows Server 2016, 2019, 2022, or 2025, my overall experience has been very stable.

Regarding the scalability of Change Auditor for Active Directory, I can add multiple domain controllers, and there is no specific count limitation. I had 17 domains and around 120 domain controllers, all of which I monitored using Change Auditor for Active Directory, thus meeting my expectations.

Customer support for Change Auditor for Active Directory is another significant factor in my decision to purchase this product. Change Auditor for Active Directory provides very good support that satisfies users and clients' questions, and they assist with any requirements I may have.

I would rate the customer support a nine out of ten.

I see a good return on investment from using Change Auditor for Active Directory because when I look for information that is 170 days old and have no clue about it, Change Auditor for Active Directory is my best friend who helps me in that worst situation, informing me about what happened on that day and time. It's very helpful for infrastructure security, and as I mentioned regarding the protection feature, it provides an excellent return on investment by protecting my users, objects, and attributes. Therefore, it is definitely worth investing in Change Auditor for Active Directory.

Regarding pricing, setup costs, and licensing for Change Auditor for Active Directory, I wasn't involved in the cost aspect, but I know I am using three licenses that capture events, user actions, and infrastructure changes.

I did not explore other options before choosing Change Auditor for Active Directory; I had a very good session with the Change Auditor for Active Directory sales team, which was truly wonderful and fulfilled all our requirements, leading to our purchase.

I would rate Change Auditor for Active Directory a perfect score of ten out of ten.

I give it a ten out of ten because it functions effectively as a forensic tool. It provides on-demand monitoring and gives me immediate information if anyone tries to do something in my environment. It contains very useful information related to cyber attacks and forensic investigations.

With respect to the AI capabilities of Change Auditor for Active Directory, it is very useful for governance, providing information about when changes are made, who made the changes, when the account was locked out, and from where the account is getting locked out, all of which can be integrated with AI.

I have not worked directly with the AI capabilities; however, as an overall product, I find it very accurate and reliable because whenever I look for information, it provides valid information from the Change Auditor for Active Directory database.

If others are looking into using Change Auditor for Active Directory, I advise them to consider it when they want to monitor their environment for any changes made in the domain controller for DNS, group policy, DHCP, user objects, and computer objects. If they are seeking specific events or want to protect their user objects, they should indeed go for Change Auditor for Active Directory.

My main use case for Change Auditor for Active Directory is auditing changes, finding changes to undo, and break-fix solving issues.

For example, I could give you a quick specific example of how I've used it to solve an issue: somebody made a change to a person's attribute that caused an application issue, and we found that it was changed on thousands of accounts. We identified the source; it was a script, and we discovered who ran it and from what machine.

In addition to that, I have also used Change Auditor for Active Directory to find out who's making inefficient LDAP calls to domain controllers.

The best features Change Auditor for Active Directory offers are that it's lightweight and easy to understand. You don't have to memorize event IDs since it's in English.

What makes Change Auditor for Active Directory lightweight and easy to understand in my experience is that it doesn't require the events to record to the domain controllers. Therefore, I can focus just on the event types without having to turn up detailed logging on my DCs.

Change Auditor for Active Directory has positively impacted my organization by helping us respond to audits very quickly to show that we had evidence of who was making the changes and match them up to the ticket request and who approved it.

After implementing Change Auditor for Active Directory, it has allowed us to answer questions literally in minutes, whereas it would have taken us half a day to a day before.

Change Auditor for Active Directory could be improved if the client were more flexible when installed, so if I upgrade the server, I wouldn't have to replace the clients at the same time.

I think giving it a nine has to do more so with cost and the amount of SQL maintenance that has to be done.

I have been using Change Auditor for Active Directory since 2007, so that would be 18 years.

Change Auditor for Active Directory is stable.

Change Auditor for Active Directory is scalable because I can deploy multiple repository servers to do the collections from many different domains and domain controllers across the globe.

The customer support for Change Auditor for Active Directory, the few times I've had to use it, has been very good.

Negative

I previously used a different solution, which was Splunk, but the reason for the switch is that Splunk relies on the events logging to forward through the Splunk forwarders, while Change Auditor for Active Directory does not.

I have seen a return on investment since I think it's been time saved to free up staff to focus on other things without having to dig through event logs or Splunk to find the changes.

My experience with pricing, setup cost, and licensing was pretty straightforward. Actually, we bundled it with some other services offered from Quest to get a volume discount.

Before choosing Change Auditor for Active Directory, I did not evaluate other options.

My advice to others looking into using Change Auditor for Active Directory is to request eval keys for as many different suite components as you need. Don't overlook the log on events and LDAP events besides the AD events. Consider getting Change Auditor for Active Directory module for Azure as well. I would rate this product a nine.

The primary use case is to manage human errors, like protecting identities from being modified by the software, and to audit security. This includes monitoring high-privilege accounts and having the ability to back up previous values if unauthorized modifications occur in the Active Directory.

This solution helps manage human errors by protecting identities and allows auditing of high-privilege accounts. It also provides the capability to backup previous values when unauthorized changes occur.

The most valuable features are the ability to protect Active Directory accounts and groups, and the real-time notifications that help manage Active Directory more effectively.

Areas that could be improved include having more management capabilities with command-line scripts and more flexibility in general. Often this type of tool could benefit from better scripting capabilities.

I have been using this solution for about two years.

I have never experienced any outage or latency with this solution. It is highly stable.

The product is very scalable; we handle a large number of accounts without performance issues.

I have only used the documentation on the website, which has been technically sufficient to answer my questions. I haven't had to call support.

The price can vary based on the components purchased and the needs and budget of the organization. It is considered a bit pricey, especially for smaller companies.

To configure the solution effectively, protect groups as well as high-privilege accounts to prevent privilege escalation. Focus on a detailed and well-thought-out configuration, not just the default settings.

I'd rate the solution nine out of ten.