Need suggestion regarding few issues.

Hi,

Quote:

---

As I mentioned installing applications could be installing a sofwtare, not just installing i need to put files in there directories as i mentioned eariler.

---

This is what I am a little concerned about. If you try to change software and files that it uses whilst it is active, you have a good chance of hitting problems that may take you quite some time to sort out.

Would it be acceptable to "suspend them" (change user) whilst this is done? However, you are still logging them out of their applications.

A work around that I have seen, is to add an installation script to their login script. Then, when they next login, it updates their software first.

I personally don't like keyloggers as a first line application, as they collect far too much information. More general stuff like logging websites visited, traffic volumes and the like should highlight any potential problem areas, then you use the keyloggers etc.

OK, you can probably get some keyloggers with fancy analysis capabilities, but it is all work? and the fancy stuff tends to cost money :(

You have not mentioned, but do you actually believe that you have a serious, ongoing problem, or are these just precautionary measures? If it is just a precaution, I would certainly go for the "log for exceptions, then investigate" approach.

Also, do you have a clearly stated authorised usage policy (AUP) that is in writing and signed by the users on a regular basis?

As for the Win98............like Morgana~ I am curious as to what you are running (application generator, database etc) that really needs it. Because it is a home user/stand alone type operating system, it does represent a weak link in your network.

For example, when you fire one up, you automatically have local administrator rights?

:)

Hey Hey,

Remotely deploying software is pretty common these days.... There's SMS as TH13 pointed out.... There's also some fancy tricks you can do with a network share and pstools... (if the software or files you are working with allow for unattended install)... you could also use group policy to push out the files to people...

Have you considered building your own MSI and pushing it out over group policy? You can find WinInstall LE in the ValueAdd folder of a Windows 2000 Server CD... This would have been a very simple way to push out your new DAT file for NAV..

Assuming you are a Domain Admin, you could have just remotely mapped a drive on each machine, or used tftp w/ pstools to put it on each machine... the methods of deploying a file without going to the machine are endless...

Even GenControl by slarty... it'll take over the current session.. You could have sat at your machine and called each user, asking them not to touch their keyboard and mouse for a couple of minutes.


As for the 98 issue... I could see reason for running it... While XPs compatibility mode is nice.. it isn't perfect...

I also don't know if I see running 98 as much of a security risk... your physical security had better be up to par if you're running it... but remotely XP is worse than 98... 98 is single user (as nihil said)... not a lot you can do to it remotely.

Peace,
HT

Quote:

---

I also don't know if I see running 98 as much of a security risk... your physical security had better be up to par if you're running it... but remotely XP is worse than 98... 98 is single user (as nihil said)... not a lot you can do to it remotely.

---

HT~ I might have read him wrong, but it seemed to me that the OP was talking inside the DMZ?

More HR than IT? which is why I raised the Win98 issue.............as physical access does seem to be an issue here?

Externally, Win98 runs far fewer services, for example, so is less vulnerable?

I was looking at his stats: 70 (XP/NTS) against 5 Win98?.................

I don't know the situation, but I would even consider building a physical firewall between the Win 98 and the "real" system....................

;)

Alternative "solution" for you...

Code:

---

* net-analyzer/aimsniff
    Available versions:  0.9-r1
    Installed:          none
    Homepage:            http://www.aimsniff.com/
    Description:        Utility for monitoring and archiving AOL Instant Messenger messages across a network

---

Quote:

---

Originally posted here by nihil
HT~ I might have read him wrong, but it seemed to me that the OP was talking inside the DMZ?

More HR than IT? which is why I raised the Win98 issue.............as physical access does seem to be an issue here?

Externally, Win98 runs far fewer services, for example, so is less vulnerable?

I was looking at his stats: 70 (XP/NTS) against 5 Win98?.................

I don't know the situation, but I would even consider building a physical firewall between the Win 98 and the "real" system....................

;)

---

Hey Hey,

I didn't note anything that lead me to believe it was the DMZ... but anythings possible on AO (the theme song for As The World Turns plays)...

Quote:

---

Externally, Win98 runs far fewer services, for example, so is less vulnerable?

---

You'll have to explain the ? to me... to late of a night and long of a day.... 5 hours of staring at Flash isn't my idea of a good time... I'd say if that was a statement that I'd agree with it... XP can be secured more and locked down tighter than 98... but with the way 99% of the places I've been operate, I'd put my trust in the 98 box.

As I said... I don't think the 98 systems are a threat, so I wouldn't see the need for a physical firewall... but again... that's my opinion..

Peace,
HT

As said previously ethereal is the way I would go. Aimsniff is basically a perl script that can either sniff live via the pcap libraries or parse a pcap file, ethereal produces a pcap file but aimsniff is for aim so it may require some recoding or in ethereal you can use the filters and filter for msn messages. just type in the filter box of ethereal "msnms" w/out the " and it will only show msn messenger activity. As for your win98 software.....try xp compatability mode....I didn;t really check to see if this was mentioned but it would work. There are many programs designed to monitor systems....if you ensist on keeping win98 also I would recommend using VNC. It can be configured to run hidden and as long as the network is fast you should have no problems. It can also be password secured...however the password is stored in the registry and is in a REVERSABLE FORMAT so be aware because you might end up opening a hole. For remote software install....in a domain setting I believe you can use group policy to run silent installs and most enterprise software has a slient install option.

Quote:

---

if that was a statement that I'd agree with it

---

Actually it was a rhetorical question, which is basically a statement that you are expected to agree with. ;)

Now, if we look at the OP's posts, he basically asks:

1. How to monitor that MSN is being used for the allowed purposes
2. How to check if only authorised people are using it.
3. How to monitor what users are doing.

He also mentions "the devil in them", and that they know how to disable the native MSN reporting.

This tells me that the user community is not entirely trusted. We therefore have a situation that is internal where there are 70 Win XP machines that can be locked down, and 5 Win 98 machines where you automatically become local administrator as soon as you power them up. That I see as a security issue, because it is a weak link in a potentially strong chain.

:)

morganlefay

Its a software they used for recording certain data developed by some local company, On WinXP we are unable to run it by clicking the exe file nothing happen.

We are going to implement another software which would be live too and this will take over this win98 thing but that would take 2-3 months, so have to use win98 till complete implmentation.

Nihil

This can be done suspending them not to do anything and wait for few mins. but again the problem is people sometime even if they are not too much busy would say they are doing important work and we should wait.

The situation is few peoples are not fully Cooperative with us, they think this IT will take away there jobs and so they don't want to bring the change. I have been facing this problem throughout my career.


The day i started monitoring i saw people misusing Internet faicility provided to them, like browsing, even i had report of people browsing Pronographic websites after office timing. So i have to put necessary precautions and also F**K those who are doing all these.

At the time of joining the company each employee gets an employee book containing details of rules and other policies, few things are missing relating to IT, i am working on it and will certainly talk and convience the HR regarding this.

HTRegz

Offcourse admin share is by default ON, why shouldn't i think of this before. :dunce: Thanks but still there is one problem now i have to visit those win98 client and manually put files there cause they dont have admin shares enable or atleast i have to go there once and share there main drive so that i can access them. Cool thing I am very glad to hear this.

So far i think i got what i have been looking for, but what about that config.messenger.msn.com , Today's log showing 4 people so far access this all are authroized persons and i have asked them and they said yes they have logged in. So what you think about this. ?

FanacooL

Have you tried this:

http://www.worldstart.com/tips/tips.php/754

:)

Naeh