Configuration: Add a Cayosoft Administrator server

Changes made through Cayosoft Administrator are performed by the Cayosoft Administrator service account. Without this integration, Cayosoft Guardian shows that service account as the initiator. When you register a Cayosoft Administrator server in Cayosoft Guardian, Guardian collects Cayosoft Administrator audit events (event ID 6215) and adds them to Change History as separate records that show the user who performed the action in Cayosoft Administrator.

Prerequisites

• Cayosoft Administrator is assigned the managed domains and/or Microsoft Entra ID tenant whose changes you want to track.
• Cayosoft Administrator is configured to write audit events to the Application event log.
• The Cayosoft Administrator service is installed and running on the server.
• WinRM ports TCP 5985/5986 are open from the Cayosoft Guardian server to the Cayosoft Administrator server. Learn more: Planning and preparation: Required ports for Cayosoft Guardian.
• An account that can connect to the Cayosoft Administrator server over WinRM and read its Application event log. The account doesn't need to be a Cayosoft Administrator account. Learn more: Permissions for Change Monitoring and Rollback in Cayosoft Guardian.

Supported Cayosoft Administrator extensions

Cayosoft Guardian supports change history from the extensions available by default in the Cayosoft Administrator web portal:

• Active Directory
• Microsoft Cloud (Microsoft 365 / Microsoft Entra ID)
• Microsoft Exchange
• Cayosoft Guardian integration extension

Changes from other extensions, such as Google Workspace or AD LDS, aren't supported. If Cayosoft Guardian receives events from these sources, it still creates change history records, but with a generic object type and the raw object path.

To add a Cayosoft Administrator server

1. Open the Cayosoft Guardian web portal.
2. Navigate to Configuration > Cayosoft Administrator.
3. Click Add.
4. In Name, enter the host name of the Cayosoft Administrator server. If you enter an IP address, Cayosoft Guardian replaces it with the resolved host name.
5. In Credentials, specify the account Cayosoft Guardian uses to connect to the server.
6. (Optional) In Managed tenant, select the Microsoft Entra ID tenant managed by Cayosoft Administrator.
7. (Optional) In Managed domains, select the Active Directory domains managed by Cayosoft Administrator.
8. Click Save.

Cayosoft Guardian verifies that it can connect to the server and that the Cayosoft Administrator service is installed and running. You can't add the same server twice.

NOTE    The Managed tenant and Managed domains fields are optional. Cayosoft Guardian uses these values to identify the object type and location when the Cayosoft Administrator event doesn't contain this information. If you leave them empty, change history records are still created, but some objects may be shown with a generic object type. You can change these values at any time.

After you add the server, the Cayosoft Administrator Event Collection Job starts collecting events from it.

Remove a Cayosoft Administrator server

To stop collecting events, select the server under Configuration > Cayosoft Administrator and click Delete. Change history records already collected from the server are kept. If you add the same server again later, these records stay linked to it.

When you remove the last registered Cayosoft Administrator server, the Cayosoft Administrator Event Collection Job stops running.

Possible errors

Message	Cause and solution
Cannot connect to server '{name}'. Verify the server name and credentials.	Check the server name, credentials, and that WinRM ports 5985/5986 are open.
Cannot read Application event log on '{name}'. Ensure the account has Event Log Readers permissions.	Add the account to the Event Log Readers group on the server.
Cayosoft Administrator host {name} is already registered.	The server is already in the list.