Need suggestion regarding few issues.

I seek your help, sugesstions and guidance for certain issues related with my network.

Network Detail

Let me first give brief info. about my network.

Server X 2

1: Main Server (Running ISA, Mail server, DHCP, DNS and SQL)
2: NAV server

O.S on main server is Windows 2003 and on 2nd is XP with SP2.

Clients X 75. 70 of them running on XP while 5 have Win98.

My questions are : -

MSN Monitoring

Few of our clients are allowed to use MSN messenger service but strictly they are ordered to use it for offical communication no personal usage is allowed. What i want to know is there a tool available that can monitor there conversation or can make log of them. I know there is bulitin feature but they know how to disable it so i wanted a better solution.

Another issue relating with MSN is that i also wanted to monitor are there any unauthorized users using MSN messenger.

Remote installation on Clients

Do you know any good tool via i could remotely able to install softwares in the clients. I can access them via remote desktop connection but it log off the current user.

Remote Monitoring

Lastly i wanted to monitor the clients activities, any suggestion for this.

Any other helpful tool that you people are using for managing networks, have to be free of cost :D

well i'm guessing you're looking for basically legitimate keyloggers, spyware, etc. for monitoring people's uses. well i don't have much experience in this, but the best thing to do is to probably get some software that can set passwords on options or software [some software has that included in allowing access to set up their options] (i also believe symantec has something like that called the password manager but i'm not exactly sure what that does).

general idea for setting up msn messenger
once you have put that software on the client computers you want to monitor, adjust the settings for msn messenger so that it records all of the chat history and saves them maybe in a network folder only you have access to, then lock out the option controls so that they can only be accessed with the password you set.

general idea for remote installation on clients
hmm i believe there is some free software out there that can do this if its connected in a network ( i think its illegal though and regarded as hacking software) and i dont recall its name, although i've seen it being put to use.

general idea for remote monitoring
probably the easiest thing to do is get a legitimate, good keylogger...i believe one was posted a while ago on antionline here: http://www.antionline.com/showthread...hreadid=272976

that one seems quite good in my opinion since it keeps such detailed logs on a lot of stuff, such as:

Quote:

---

1. What was the Computer Named that Entered the Keystrokes?
2. What was the Domain Name of the Domain the computer was on?
3. What was the User name on the computer that entered the keys?
4. What date were those keystrokes entered?
5. What time were those keystrokes entered?
6. What application did the keystrokes come from?
7. What was the Window Title of where the Keystrokes came from?
8. What was the Windows Class of the program that handled the keys?
9. Can more than ONE copy be accidentally started?
10. What Hot-Key Can stop the program?

---

although adding in such a keylogger could involve conflicts with firewalls and antiviruses, so i advise you to select the ignore feature on their detection for this and lock out their settings with passwords (almost all security software has that option for accessing its settings)


well i hope this helps, a lot of stuff i've generalized a bit however and i'l see if i can find anymore information if i can.

Quote:

---

Do you know any good tool via i could remotely able to install softwares in the clients. I can access them via remote desktop connection but it log off the current user.

---

Are you sure that this is a good idea? I would not want to attempt software installation on a machine that was being used by someone to do something else. There is far to much potential for conflicts, crashes and the like. And if you can do it , so can malware?

OK, security type software is designed to do an interactive update in many cases but ordinary software generally is not. It wants a dedicated machine. I am generally reluctant to recommend anything that saves time in one area and creates ten times the work somewhere else. I try not to create helpdesk calls where posssible ;)

Also, I would warn you that there is not much free stuff for managing commercial networks. Other people like to eat as well :p and you do need to consider support requirements. It might be an idea to sound out what kind of a budget you can have?

And 5 Windows 98 boxes on your network?......................I would put that security issue at the top of my list

:)

Nihil as far as that Win98 clients, well there is an internal software running on these computers and that can only be run on win98.

I won't mind paying a little for a good tool:-)

All i need is monitoring and control on my network clients so that if the devil in them tries to misguide them i am there to stop them.

The only reason i am using remote desktop connection is to make my life easy, as i have to rectify user-end problems so i can logged into my system remotely and can check my emails and other queries (keeping in mind that i only spend around 45% of my time infront of my PC).

Nihil what about that messenger issue isn't there a way i can achieve this.

Corrupted_code you are suggesting key logger hmhm not what i am looking for...... The main thing is i wanted to know on what application they are currently working? Outlook or our software stuff like that.

well i do agree that keylogger is a relatively aggressive method of monitoring, but it is in my opinion a rather decent way to gather information about the user if you cannot find an alternative. (by the way it does include logs that show which application the key strokes came from). if i find anything i'll keep you posted..it's just i normally don't deal with stuff like this as much. oh and nihil has made some very good points as well :P although im not sure if there are any paid versions of software doing this kind of task for legitimate reasons, but i guess its the software shops that know

I am using GFI Web Monitor and was going through the log and i came across this URL config.messenger.msn.com, few of my clients access this among them i am also included as i am authorized to use :-), anyways my new query is that is this a URL Msn messenger access when you use it? If thats the case then i think i have found the solution to one of my MSN problem.

The only reason i am looking for remote installation on clients is that sometime i need to put a file in there folders so it take too much time to go there and retrieve file manually its better i can do it from one sitting. For instance yesterday i have to change the parent server for all the NAV clients and have to put the GRC.dat file it took me whole day to do this.

So i am looking for convienence and technology is mend to be for this.

Answers:

Quote:

---

What i want to know is there a tool available that can monitor there conversation or can make log of them.

---

Download Ethereal and place it at your network chokepoint. A little known fact about ethereal is that it comes with a MSN chat parser so once you collect all your data, you can parse out all the MSN conversations in a nicely formatted file with usernames, conversations, etc.

Quote:

---

Do you know any good tool via i could remotely able to install softwares in the clients. I can access them via remote desktop connection but it log off the current user.

---

Be more specific. What kind of apps? If you want to simply patch systems, use Windows Udate Service, which is a free patch management solution from MS.

Otherwise, you'll need a solution like SMS which does cost a considerable amount of money.

Quote:

---

Lastly i wanted to monitor the clients activities, any suggestion for this.

---

Again, be more specific. There are many free tools that do a few things well. A great commercial solution for monitoring is Websense.

If you want to get security info on your network and you have to keep it open source, check out http://www.ossim.net/

It takes feeds from Snort and other network devices to provide you with realtime views of your network and what's happening to it.

--TH13

As i mentioned installing applications could be installing a sofwtare, not just installing i need to put files in there directories as i mentioned eariler.

As far as activities are concerned i mean monitoring of what they are doing? a list of application of softwares currently they are running, things like that.

thehorse13 is correct about Ethereal. It's about the best way to monitor chat sessions without spending big bucks.

Also, check out http://www.dameware.com/

I've used this in the past, neat little tool.

Quote:

---

Nihil as far as that Win98 clients, well there is an internal software running on these computers and that can only be run on win98.

---

Have you tried running this software on XP.....

I have a few older databases and have been able to run using the compatiblity mode function...Printing is slow...but everything else works

MLF

Hi,

Quote:

---

As I mentioned installing applications could be installing a sofwtare, not just installing i need to put files in there directories as i mentioned eariler.

---

This is what I am a little concerned about. If you try to change software and files that it uses whilst it is active, you have a good chance of hitting problems that may take you quite some time to sort out.

Would it be acceptable to "suspend them" (change user) whilst this is done? However, you are still logging them out of their applications.

A work around that I have seen, is to add an installation script to their login script. Then, when they next login, it updates their software first.

I personally don't like keyloggers as a first line application, as they collect far too much information. More general stuff like logging websites visited, traffic volumes and the like should highlight any potential problem areas, then you use the keyloggers etc.

OK, you can probably get some keyloggers with fancy analysis capabilities, but it is all work? and the fancy stuff tends to cost money :(

You have not mentioned, but do you actually believe that you have a serious, ongoing problem, or are these just precautionary measures? If it is just a precaution, I would certainly go for the "log for exceptions, then investigate" approach.

Also, do you have a clearly stated authorised usage policy (AUP) that is in writing and signed by the users on a regular basis?

As for the Win98............like Morgana~ I am curious as to what you are running (application generator, database etc) that really needs it. Because it is a home user/stand alone type operating system, it does represent a weak link in your network.

For example, when you fire one up, you automatically have local administrator rights?

:)

Hey Hey,

Remotely deploying software is pretty common these days.... There's SMS as TH13 pointed out.... There's also some fancy tricks you can do with a network share and pstools... (if the software or files you are working with allow for unattended install)... you could also use group policy to push out the files to people...

Have you considered building your own MSI and pushing it out over group policy? You can find WinInstall LE in the ValueAdd folder of a Windows 2000 Server CD... This would have been a very simple way to push out your new DAT file for NAV..

Assuming you are a Domain Admin, you could have just remotely mapped a drive on each machine, or used tftp w/ pstools to put it on each machine... the methods of deploying a file without going to the machine are endless...

Even GenControl by slarty... it'll take over the current session.. You could have sat at your machine and called each user, asking them not to touch their keyboard and mouse for a couple of minutes.


As for the 98 issue... I could see reason for running it... While XPs compatibility mode is nice.. it isn't perfect...

I also don't know if I see running 98 as much of a security risk... your physical security had better be up to par if you're running it... but remotely XP is worse than 98... 98 is single user (as nihil said)... not a lot you can do to it remotely.

Peace,
HT

Quote:

---

I also don't know if I see running 98 as much of a security risk... your physical security had better be up to par if you're running it... but remotely XP is worse than 98... 98 is single user (as nihil said)... not a lot you can do to it remotely.

---

HT~ I might have read him wrong, but it seemed to me that the OP was talking inside the DMZ?

More HR than IT? which is why I raised the Win98 issue.............as physical access does seem to be an issue here?

Externally, Win98 runs far fewer services, for example, so is less vulnerable?

I was looking at his stats: 70 (XP/NTS) against 5 Win98?.................

I don't know the situation, but I would even consider building a physical firewall between the Win 98 and the "real" system....................

;)

Alternative "solution" for you...

Code:

---

* net-analyzer/aimsniff
    Available versions:  0.9-r1
    Installed:          none
    Homepage:            http://www.aimsniff.com/
    Description:        Utility for monitoring and archiving AOL Instant Messenger messages across a network

---

Quote:

---

Originally posted here by nihil
HT~ I might have read him wrong, but it seemed to me that the OP was talking inside the DMZ?

More HR than IT? which is why I raised the Win98 issue.............as physical access does seem to be an issue here?

Externally, Win98 runs far fewer services, for example, so is less vulnerable?

I was looking at his stats: 70 (XP/NTS) against 5 Win98?.................

I don't know the situation, but I would even consider building a physical firewall between the Win 98 and the "real" system....................

;)

---

Hey Hey,

I didn't note anything that lead me to believe it was the DMZ... but anythings possible on AO (the theme song for As The World Turns plays)...

Quote:

---

Externally, Win98 runs far fewer services, for example, so is less vulnerable?

---

You'll have to explain the ? to me... to late of a night and long of a day.... 5 hours of staring at Flash isn't my idea of a good time... I'd say if that was a statement that I'd agree with it... XP can be secured more and locked down tighter than 98... but with the way 99% of the places I've been operate, I'd put my trust in the 98 box.

As I said... I don't think the 98 systems are a threat, so I wouldn't see the need for a physical firewall... but again... that's my opinion..

Peace,
HT

As said previously ethereal is the way I would go. Aimsniff is basically a perl script that can either sniff live via the pcap libraries or parse a pcap file, ethereal produces a pcap file but aimsniff is for aim so it may require some recoding or in ethereal you can use the filters and filter for msn messages. just type in the filter box of ethereal "msnms" w/out the " and it will only show msn messenger activity. As for your win98 software.....try xp compatability mode....I didn;t really check to see if this was mentioned but it would work. There are many programs designed to monitor systems....if you ensist on keeping win98 also I would recommend using VNC. It can be configured to run hidden and as long as the network is fast you should have no problems. It can also be password secured...however the password is stored in the registry and is in a REVERSABLE FORMAT so be aware because you might end up opening a hole. For remote software install....in a domain setting I believe you can use group policy to run silent installs and most enterprise software has a slient install option.

Quote:

---

if that was a statement that I'd agree with it

---

Actually it was a rhetorical question, which is basically a statement that you are expected to agree with. ;)

Now, if we look at the OP's posts, he basically asks:

1. How to monitor that MSN is being used for the allowed purposes
2. How to check if only authorised people are using it.
3. How to monitor what users are doing.

He also mentions "the devil in them", and that they know how to disable the native MSN reporting.

This tells me that the user community is not entirely trusted. We therefore have a situation that is internal where there are 70 Win XP machines that can be locked down, and 5 Win 98 machines where you automatically become local administrator as soon as you power them up. That I see as a security issue, because it is a weak link in a potentially strong chain.

:)

morganlefay

Its a software they used for recording certain data developed by some local company, On WinXP we are unable to run it by clicking the exe file nothing happen.

We are going to implement another software which would be live too and this will take over this win98 thing but that would take 2-3 months, so have to use win98 till complete implmentation.

Nihil

This can be done suspending them not to do anything and wait for few mins. but again the problem is people sometime even if they are not too much busy would say they are doing important work and we should wait.

The situation is few peoples are not fully Cooperative with us, they think this IT will take away there jobs and so they don't want to bring the change. I have been facing this problem throughout my career.


The day i started monitoring i saw people misusing Internet faicility provided to them, like browsing, even i had report of people browsing Pronographic websites after office timing. So i have to put necessary precautions and also F**K those who are doing all these.

At the time of joining the company each employee gets an employee book containing details of rules and other policies, few things are missing relating to IT, i am working on it and will certainly talk and convience the HR regarding this.

HTRegz

Offcourse admin share is by default ON, why shouldn't i think of this before. :dunce: Thanks but still there is one problem now i have to visit those win98 client and manually put files there cause they dont have admin shares enable or atleast i have to go there once and share there main drive so that i can access them. Cool thing I am very glad to hear this.

So far i think i got what i have been looking for, but what about that config.messenger.msn.com , Today's log showing 4 people so far access this all are authroized persons and i have asked them and they said yes they have logged in. So what you think about this. ?

FanacooL

Have you tried this:

http://www.worldstart.com/tips/tips.php/754

:)

Naeh