pc manager meeting january 25, 2006. today updates –next meeting –meeting maker upgrade...
TRANSCRIPT
PC Manager Meeting
January 25, 2006
Today
• Updates– Next Meeting– Meeting Maker Upgrade– Windows Policy– Training– Licensing– Security– Tool Of The Month
• This Month:– Event Sentry: CSI Server Logging
• Ken Fidler
Next Meeting
• Feb. 22nd – Topic TBD!
Meeting Maker Upgrade
• Upgraded server from 8.5.1 to 8.5.3 (performance improvements)
• Some clients at 8.5.1 experiencing problems
• New Clients available– SMS package available– New code on websitehttp://www-css.fnal.gov/csi/meetingmaker/
Documentation.htm
Windows Policy Committee
• Next Meeting: Feb 1st, 1:30-2:30pm, WH5SW
– Agenda:• Outstanding Account Requests• Server and Desktop Baseline
Review
Training and Development
• Nicole Gee:– Learning Tree Discounts– NIU BIS – Python programming classes
scheduled for Feb. and April– Is there interest for EPICS,Perl,
Java, and Javascript training?
License Updates
• Request from Microsoft to Patch:– Background: It was recently decided in a court of law
that certain portions of code found in Microsoft Office Professional Edition 2003, Microsoft Office Access 2003, Microsoft Office XP Professional and Microsoft Access 2002 infringe a third-party patent. As a result, Microsoft must make available a revised version of these products with the allegedly infringing code replaced.
– Action required: As a result of the above ruling, you are required to:
• Install Microsoft Office 2003 Service Pack 2 (Office 2003 SP2) for all your future deployments of Office Professional Edition 2003 and Office Access 2003
• Install the Microsoft Office XP Service Pack 3 Patch (Office XP SP3 Patch) for all your future deployments of Office XP Professional and Access 2002
• No required date given. CSS will provide an SMS package!
Security Updates
• Jan 2006, Fermi Windows Base Install CD Highlights– Sav 10.0.2 and Sav 10.0.2.2001 patch– Latest Microsoft patches– JoinDomain script– SMS Agent auto installed by GPO imediately after
PC joins domain– ISO Image in \\pseekits\iso$\FermiWin
• Free CDs!
• The future ... SMS "Package Bundles" to complete the setup process– Minimal_Desktop_Bundle (Add AcroReader, .NET,
MediaPlayer, MtgMkr ....etc)– General_Desktop_Bundle (Minimal_Desktop +
Office Pro + ... etc)
Cool Tool of The Month
• Shortcutsman http://www.nirsoft.net/utils/shman.html– Displays details of shortcuts on
desktop and start menu– Highlights broken shortcuts– Ability to delete/resolve– Save shortcut info to HTML/Text/XML
file– Small executable– Need admin rights for
delete/resolve/reporting
Cool Tool of The Month (cont)
Main Topic
• Event Sentry: CSI Server Logging– Ken Fidler
EventSentry - What is it?
• Near real-time monitoring of Windows event logs– Servers/Kiosks/remote systems
• System Health Monitor– Disk Space– Processes– Services
• Syslog Client/Server for Windows• Temperature and Humidity
Monitor
EventSentry – Why Use it?
• Timely analysis of event data• Alert admins before there is a
serious problem• Archive event data for future
analysis• Detect intrusions
EventSentry – Special Features
– Export/Import filter sets to additional systems
– Multiple Notification avenues• E-mail• Program• Syslog service• Write to a file or a database
– Monitor when you DO NOT receive key event log messages
– No reboot after install or upgrades– Low cost
EventSentry – Usage in CSI
– Monitor server events– Warn team of disk RAID or
hardware failures– Used on test domain controllers
• Monitor Active Directory
– Central windows syslog server– On Central AV server to
enhance alerts and logging info from Symantec software
EventSentry – Main Screen
EventSentry - DEMO
EventSentry – Define Notification
EventSentry - Variables
Runtime variables (just a subset)$HOSTNAME
local computer name
$COUNT the number of event log records in the email
$EVENTTYPE
the event type of the first event
$FILTER the name of the filter which captured the event
EventSentry – User Variables
EventSentry – Define Filters
EventSentry – Email Output
EventSentry – Save to a file
EventSentry – Default Notification
EventSentry – Default Filter
EventSentry – Client Syslog
EventSentry – Client Syslog
EventSentry – Syslog Server
EventSentry – Syslog Server
EventSentry – Syslog Server
EventSentry - Syslog
• Server code is only UDP based.
• Server will accept most Unix systems too
• Client – verification to UDP based servers does not return any errors
EventSentry – Call a Program
EventSentry – Call a Program
EventSentry – Monitor Services
EventSentry – Monitor Disk Space
EventSentry – Monitor Temp
EventSentry – Monitor Temp
• Requires special hardware from Netikus– Temp sensory - $80– Temp and Humidity - $140
EventSentry – CSI Futures
• Interface to Remedy and NGOP• Central Controls
– Setup Server Groups– Alerts to Application support groups– Use Active Directory
• Web Interface• Syslog to a database• Tools to extract data from syslog
files
EventSentry
• Miscellaneous Comments/Observations– Central control – Plan a strategy– Low overhead – Lean C++ code– Heartbeat monitor - NGOP– Monitor disk activity – Trend
changes– Small company – Very good
support
EventSentry
• Initial Cost ~$45/machine• FREE Trial version available• Maintenance: ~18%
• More info?– www.netikus.com
• FREE Tools on their site
– Windows Security Log Reference Sheet• www.ultimatewindowssecurity.com