PC Manager Meeting

January 25, 2006

Today

• Updates– Next Meeting– Meeting Maker Upgrade– Windows Policy– Training– Licensing– Security– Tool Of The Month

• This Month:– Event Sentry: CSI Server Logging

• Ken Fidler

Next Meeting

• Feb. 22nd – Topic TBD!

Meeting Maker Upgrade

• Upgraded server from 8.5.1 to 8.5.3 (performance improvements)

• Some clients at 8.5.1 experiencing problems

• New Clients available– SMS package available– New code on websitehttp://www-css.fnal.gov/csi/meetingmaker/

Documentation.htm

Windows Policy Committee

• Next Meeting: Feb 1st, 1:30-2:30pm, WH5SW

– Agenda:• Outstanding Account Requests• Server and Desktop Baseline

Review

Training and Development

• Nicole Gee:– Learning Tree Discounts– NIU BIS – Python programming classes

scheduled for Feb. and April– Is there interest for EPICS,Perl,

Java, and Javascript training?

License Updates

• Request from Microsoft to Patch:– Background: It was recently decided in a court of law

that certain portions of code found in Microsoft Office Professional Edition 2003, Microsoft Office Access 2003, Microsoft Office XP Professional and Microsoft Access 2002 infringe a third-party patent. As a result, Microsoft must make available a revised version of these products with the allegedly infringing code replaced.

– Action required: As a result of the above ruling, you are required to:

• Install Microsoft Office 2003 Service Pack 2 (Office 2003 SP2) for all your future deployments of Office Professional Edition 2003 and Office Access 2003

• Install the Microsoft Office XP Service Pack 3 Patch (Office XP SP3 Patch) for all your future deployments of Office XP Professional and Access 2002

• No required date given. CSS will provide an SMS package!

Security Updates

• Jan 2006, Fermi Windows Base Install CD Highlights– Sav 10.0.2 and Sav 10.0.2.2001 patch– Latest Microsoft patches– JoinDomain script– SMS Agent auto installed by GPO imediately after

PC joins domain– ISO Image in \\pseekits\iso$\FermiWin

• Free CDs!

• The future ... SMS "Package Bundles" to complete the setup process– Minimal_Desktop_Bundle (Add AcroReader, .NET,

MediaPlayer, MtgMkr ....etc)– General_Desktop_Bundle (Minimal_Desktop +

Office Pro + ... etc)

Cool Tool of The Month

• Shortcutsman http://www.nirsoft.net/utils/shman.html– Displays details of shortcuts on

desktop and start menu– Highlights broken shortcuts– Ability to delete/resolve– Save shortcut info to HTML/Text/XML

file– Small executable– Need admin rights for

delete/resolve/reporting

Cool Tool of The Month (cont)

Main Topic

• Event Sentry: CSI Server Logging– Ken Fidler

EventSentry - What is it?

• Near real-time monitoring of Windows event logs– Servers/Kiosks/remote systems

• System Health Monitor– Disk Space– Processes– Services

• Syslog Client/Server for Windows• Temperature and Humidity

Monitor

EventSentry – Why Use it?

• Timely analysis of event data• Alert admins before there is a

serious problem• Archive event data for future

analysis• Detect intrusions

EventSentry – Special Features

– Export/Import filter sets to additional systems

– Multiple Notification avenues• E-mail• Program• Syslog service• Write to a file or a database

– Monitor when you DO NOT receive key event log messages

– No reboot after install or upgrades– Low cost

EventSentry – Usage in CSI

– Monitor server events– Warn team of disk RAID or

hardware failures– Used on test domain controllers

• Monitor Active Directory

– Central windows syslog server– On Central AV server to

enhance alerts and logging info from Symantec software

EventSentry – Main Screen

EventSentry - DEMO

EventSentry – Define Notification

EventSentry - Variables

Runtime variables (just a subset)$HOSTNAME

local computer name

$COUNT the number of event log records in the email

$EVENTTYPE

the event type of the first event

$FILTER the name of the filter which captured the event

EventSentry – User Variables

EventSentry – Define Filters

EventSentry – Email Output

EventSentry – Save to a file

EventSentry – Default Notification

EventSentry – Default Filter

EventSentry – Client Syslog

EventSentry – Client Syslog

EventSentry – Syslog Server

EventSentry – Syslog Server

EventSentry – Syslog Server

EventSentry - Syslog

• Server code is only UDP based.

• Server will accept most Unix systems too

• Client – verification to UDP based servers does not return any errors

EventSentry – Call a Program

EventSentry – Call a Program

EventSentry – Monitor Services

EventSentry – Monitor Disk Space

EventSentry – Monitor Temp

EventSentry – Monitor Temp

• Requires special hardware from Netikus– Temp sensory - $80– Temp and Humidity - $140

EventSentry – CSI Futures

• Interface to Remedy and NGOP• Central Controls

– Setup Server Groups– Alerts to Application support groups– Use Active Directory

• Web Interface• Syslog to a database• Tools to extract data from syslog

files

EventSentry

• Miscellaneous Comments/Observations– Central control – Plan a strategy– Low overhead – Lean C++ code– Heartbeat monitor - NGOP– Monitor disk activity – Trend

changes– Small company – Very good

support

EventSentry

• Initial Cost ~$45/machine• FREE Trial version available• Maintenance: ~18%

• More info?– www.netikus.com

• FREE Tools on their site

– Windows Security Log Reference Sheet• www.ultimatewindowssecurity.com