Skills 101: Change Auditor

Most customers already run Change Auditor, but many aren’t using the built-in capabilities that actively stop attacks, modernize identity security, and reinforce ROI. While deployments often cover the basics, some of the most powerful security features go untouched simply because teams don’t realize what’s already available out of the box. In this session, we’ll walk through five high-impact configurations and event sets that significantly strengthen Active Directory and identity security using only native Change Auditor functionality.

You’ll learn how to:
• Guard the Crown Jewels: Detect unauthorized NTDS.DIT and Domain Controller access in real time
• Unmask Kerberos Manipulation: Identify SPN tampering and ticket abuse before  escalation
• Gain Total Privilege Visibility: Use a one-click view into Tier 0 administrator activity
• Hunt High-Signal Persistence: Monitor critical registry paths attackers rely on
• Stop Lateral Movement Early: Track local user and group changes on high-value servers

New to Change Auditor or looking to get more out of your current environment? This Skills 101 session focuses on practical, real-world techniques to help you manage data growth, scale performance, and gain clearer insight into your Change Auditor infrastructure.
In this session, you’ll learn how to:

• Archive and purge data using smart policies that protect performance while preserving critical history
• Access archived data directly from the console for audits and troubleshooting
• Add coordinators confidently to scale performance and avoid common pitfalls
• Use coordinator statistics to monitor environment health and identify bottlenecks

Designed for administrators who want to run Change Auditor more efficiently without relying on trial and error.