Configure a New Audit Installation

An audit installation is a logical object similar to an Active Directory forest or site. It encompasses all of the auditing components you deploy—agents, collectors, audit stores, audit store databases, management database, and consoles—regardless of how they are distributed on your network. The installation also defines the scope of audit data available. All queries and reports are against the audit data contained within the logical boundary of the installation.

To create a new installation for auditing in the evaluation environment

  1. If you have launched the new installation wizard automatically, at the Welcome page, click Next.

    You can also use Audit Manager to launch the new installation wizard.

  2. In the New Installation wizard, accept the default audit installation name by clicking Next.

    For the evaluation, use the default installation name to automatically collect the sessions cached on the managed computers. If you use a different name, you must manually specify the installation an audited computer should use.

  3. Select the option to create a new management database and verify the SQL Server computer name, instance name, and database name are correct, then click Next.

  4. Select Use the default NT AUTHORITY\SYSTEM account to run the stored procedures that read and write information to the management database, then click Next.

  5. Type the license key you received, then click Add or click Import to import the keys directly from a file, then click Next.

  6. Accept the default location for publishing installation information, then click Next.

  7. Select the installation-wide auditing options you want to enable, then click Next.

    For the evaluation, select Enable video capture recording of user activity to capture shell activity on the audited computer, then click Next. Do not select the options that disallow the review and deletion of your own sessions.

  8. Review details about the installation and management database, then click Next.

    If you have SQL Server system administrator (sa) privileges and can connect to the SQL Server instance, the wizard automatically creates the management database.

  9. Select the Launch Add Audit Store Wizard option if you want to start the Add Audit Store wizard, then click Finish.