1. PC Manager Meeting January 25, 2006

2. Today Updates –Next Meeting –Meeting Maker Upgrade –Windows Policy –Training –Licensing –Security –Tool Of The Month This Month: – Event Sentry: CSI Server Logging Ken Fidler

3. Next Meeting Feb. 22 nd –Topic TBD!

4. Meeting Maker Upgrade Upgraded server from 8.5.1 to 8.5.3 (performance improvements) Some clients at 8.5.1 experiencing problems New Clients available –SMS package available –New code on website http://www- css.fnal.gov/csi/meetingmaker/Documentatio n.htm

5. Windows Policy Committee Next Meeting: Feb 1 st, 1:30-2:30pm, WH5SW –Agenda: Outstanding Account Requests Server and Desktop Baseline Review

6. Training and Development Nicole Gee: –Learning Tree Discounts –NIU BIS –Python programming classes scheduled for Feb. and April –Is there interest for EPICS,Perl, Java, and Javascript training?

7. License Updates Request from Microsoft to Patch: –Background: It was recently decided in a court of law that certain portions of code found in Microsoft Office Professional Edition 2003, Microsoft Office Access 2003, Microsoft Office XP Professional and Microsoft Access 2002 infringe a third-party patent. As a result, Microsoft must make available a revised version of these products with the allegedly infringing code replaced. –Action required: As a result of the above ruling, you are required to: Install Microsoft Office 2003 Service Pack 2 (Office 2003 SP2) for all your future deployments of Office Professional Edition 2003 and Office Access 2003 Install the Microsoft Office XP Service Pack 3 Patch (Office XP SP3 Patch) for all your future deployments of Office XP Professional and Access 2002 No required date given. CSS will provide an SMS package!

8. Security Updates Jan 2006, Fermi Windows Base Install CD Highlights –Sav 10.0.2 and Sav 10.0.2.2001 patch –Latest Microsoft patches –JoinDomain script –SMS Agent auto installed by GPO imediately after PC joins domain –ISO Image in \\pseekits\iso$\FermiWin\\pseekits\iso$\FermiWin Free CDs! The future... SMS "Package Bundles" to complete the setup process –Minimal_Desktop_Bundle (Add AcroReader,.NET, MediaPlayer, MtgMkr....etc) –General_Desktop_Bundle (Minimal_Desktop + Office Pro +... etc)

9. Cool Tool of The Month Shortcutsman http://www.nirsoft.net/utils/shman.html –Displays details of shortcuts on desktop and start menu –Highlights broken shortcuts –Ability to delete/resolve –Save shortcut info to HTML/Text/XML file –Small executable –Need admin rights for delete/resolve/reporting

10. Cool Tool of The Month (cont)

11. Main Topic Event Sentry: CSI Server Logging –Ken Fidler

12. EventSentry - What is it? Near real-time monitoring of Windows event logs –Servers/Kiosks/remote systems System Health Monitor –Disk Space –Processes –Services Syslog Client/Server for Windows Temperature and Humidity Monitor

13. EventSentry – Why Use it? Timely analysis of event data Alert admins before there is a serious problem Archive event data for future analysis Detect intrusions

14. EventSentry – Special Features –Export/Import filter sets to additional systems –Multiple Notification avenues E-mail Program Syslog service Write to a file or a database –Monitor when you DO NOT receive key event log messages –No reboot after install or upgrades –Low cost

15. EventSentry – Usage in CSI –Monitor server events –Warn team of disk RAID or hardware failures –Used on test domain controllers Monitor Active Directory –Central windows syslog server –On Central AV server to enhance alerts and logging info from Symantec software

16. EventSentry – Main Screen

17. EventSentry - DEMO

18. EventSentry – Define Notification

19. EventSentry - Variables Runtime variables (just a subset) $HOSTNAME local computer name $COUNT the number of event log records in the email $EVENTTYPE the event type of the first event $FILTER the name of the filter which captured the event

20. EventSentry – User Variables

21. EventSentry – Define Filters

22. EventSentry – Email Output

23. EventSentry – Save to a file

24. EventSentry – Default Notification

25. EventSentry – Default Filter

26. EventSentry – Client Syslog

28. EventSentry – Syslog Server

31. EventSentry - Syslog Server code is only UDP based. Server will accept most Unix systems too Client – verification to UDP based servers does not return any errors

32. EventSentry – Call a Program

34. EventSentry – Monitor Services

35. EventSentry – Monitor Disk Space

36. EventSentry – Monitor Temp

37. Requires special hardware from Netikus –Temp sensory - $80 –Temp and Humidity - $140

38. EventSentry – CSI Futures Interface to Remedy and NGOP Central Controls –Setup Server Groups –Alerts to Application support groups –Use Active Directory Web Interface Syslog to a database Tools to extract data from syslog files

39. EventSentry Miscellaneous Comments/Observations –Central control – Plan a strategy –Low overhead – Lean C++ code –Heartbeat monitor - NGOP –Monitor disk activity – Trend changes –Small company – Very good support

40. EventSentry Initial Cost ~$45/machine FREE Trial version available Maintenance: ~18% More info? –www.netikus.comwww.netikus.com FREE Tools on their site –Windows Security Log Reference Sheet www.ultimatewindowssecurity.com