IT Trenches » tools

Did you see this? – Microsoft updates Security Compliance Management Accelerator toolkit

Troy Tate — Fri, 27 Aug 2010 17:49:04 +0000

In 2008, I blogged about Microsoft’s release of Security Compliance Management Accelerator toolkit. Now two years later Microsoft announces an updated Security Compliance Manager. The Microsoft Security Compliance Manager is the next evolution of the Microsoft Security Compliance Management Toolkit (SCMT) Series. Microsoft has taken extensive guidance and documentation and incorporated it into this new tool, enabling you to access and automate all of your organization’s security baselines in one centralized location. Additionally, this tool provides security baseline management features, a baseline portfolio, customization capabilities, and security baseline export flexibility to accelerate your organization’s ability to efficiently manage the security and compliance process for the most widely used Microsoft technologies. This is a free download that can be accessed from the location below:

http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=5534bee1-3cad-4bf0-b92b-a8e545573a3e

According to the website:

Security Compliance Manager Overview
Take advantage of the experience of Microsoft security professionals, and reduce the time and money required to harden your environment. This end-to-end Solution Accelerator will help you plan, deploy, operate, and manage your security baselines for Windows® client and server operating systems, and Microsoft applications. Access the complete database of Microsoft recommended security settings, customize your baselines, and then choose from multiple formats-including XLS, Group Policy objects (GPOs), Desired Configuration Management (DCM) packs, or Security Content Automation Protocol (SCAP)-to export the baselines to your environment to automate the security baseline deployment and compliance verification process. Use the Security Compliance Manager to achieve a secure, reliable, and centralized IT environment that will help you better balance your organization’s needs for security and functionality.

Key Features and Benefits

Centralized Management and Baseline Portfolio: The centralized management console of the Security Compliance Manager provides you with a unified, end-to-end user experience to plan, customize, and export security baselines. The tool gives you full access to a complete portfolio of recommended baselines for Windows® client and server operating systems, and Microsoft applications. The Security Compliance Manager also enables you to quickly update the latest Microsoft baseline releases and take advantage of baseline version control.
Security Baseline Customization: Customizing, comparing, merging, and reviewing your baselines just got easier. Now you can use the new customization capabilities of the Security Compliance Manager to duplicate any of the recommended baselines from Microsoft-for Windows client and server operating systems, and Microsoft applications-and quickly modify security settings to meet the standards of your organization’s environment.
Multiple Export Capabilities: Export baselines in formats like XLS, Group Policy objects (GPOs), Desired Configuration Management (DCM) packs, or Security Content Automation Protocol (SCAP) to enable automation of deployment and monitoring baseline compliance.
The Security Compliance Manager Getting Started Guide is now available to download. Download this short guide to quickly set up and customize the Security Compliance Manager (SCM) tool. The guide also includes brief instructions on using the SCM tool to deploy and monitor security baselines for the latest server and client operating systems from Microsoft.

Let me and other ITKE readers know if you have tried this tool and how it worked if you did. Thanks for reading and let’s continue to be good network citizens!

Tools I use – Startup Control Panel

Troy Tate — Fri, 23 Oct 2009 17:58:16 +0000

One of the tools I frequently use is called Startup Control Panel. This is a free tool from Mike Lin. It is a portable tool so it does not require any client installation and may be run from a USB memory stick. This tool is similar to the excellent Autoruns & Autorunsc tools from Sysinternals. This is a good method to get at and manage those items that startup when your system starts.

The Startup Control panel tool window looks like the window below:

Startup Control Panel window

Using the application:

I have successfully run this utility on both XP and Vista. The dialog contains six to seven tabs, depending on your system configuration. Each tab represents one place where a program can be registered to run at system startup. These include:

Startup (user) – the current user’s Startup folder in the Start Menu.
Startup (common) – the common (all users) Startup folder in the Start Menu.
HKLM / Run – the Run registry key located in HKEY_LOCAL_MACHINE. These apply for all users.
HKCU / Run – the Run registry key located in HKEY_CURRENT_USER. These apply for the current user only.
Services – system services that are started before the user logs in. This appears only in Win9x; on NT/2000/XP, use the Services control panel, or the Services item in Computer Management.
Run Once – started once and once only at the next system startup.
Deleted – programs go to the Deleted tab when you remove them from another location. They will not run at system startup, but will merely be stored should you ever want to use them again. If you delete an item from the Deleted tab, it is removed permanently.

Each page contains a list of the programs registered at that location. Use the checkbox to enable or disable individual items. Additional operations are available by right-clicking an item. You can select multiple items using the Shift and Control keys. Options include:

New… – create a new entry. You can also drag & drop files from My Computer or Explorer.
Edit… – edit an existing entry.
Delete – delete the currently selected entry.
Disable / Enable – disable or enable the selected entry. A disabled program will appear in the list with a special icon, and will not run at system startup. You can also use the checkbox next to an item to enable or disable it.
Run Now – executes the program now.
Send To – moves the entry from the current location to another.
Press F5 to refresh the list at any time.

Hope you find this tool as useful as I do. Thanks for reading and let’s continue to be good network citizens.

Free Training – Laura Chappell presents: Wireshark 201 Jumpstart – Filtering on the Good, the Bad, the Ugly

Troy Tate — Thu, 15 Oct 2009 18:44:42 +0000

Laura Chappel, the BitGirl, is at it again with another in her series of Wireshark Jumpstart webinars. The next one is called Wireshark Jumpstart 201: Filtering on the Good, the Bad, the Ugly. It will be held on October 27 – 10:00am-11:00am PDT (GMT-7). If you manage networks or want to manage a network, a good understanding of protocol and packet analysis will help you immensely with your career.

Some things you will learn in this webinar:

Using the Default Capture and Display Filters
Creating a Few Hot Capture Filters
Filtering Tips and Tricks for Troubleshooting
Filtering Tips and Tricks for Security

Even if you are very familiar with Wireshark or other packet capture and protocol decode tools, Laura’s seminars are well worth attending. You might even find out a little tidbit here or there because Repetition is one of the keys of learning. Unfortunately I will not be able to attend this webinar since I will be on a golf vacation in North Carolina. So, if you attend this event, please come back and share with me and other IT Trenches readers what you learned and how valuable the webinar was for you.

Thanks for reading and let’s continue to be good network citizens!

Wireshark quickstart tutorial – learn to capture network traffic

Troy Tate — Mon, 20 Jul 2009 18:36:55 +0000

There are more upcoming sessions in the Laura Chappell seminar series called Wireshark 101Jumpstart tutorials. Check out the schedule at Chappell University website. Some of the things you will learn include:

Wireshark elements and capabilities
Tapping into the wired or wireless network
Capturing and filtering basics
Graphing basics

If you cannot attend the seminar, you can still register and download the seminar notes and gain access to the trace files used in the session. If you manage a network, you should learn this stuff! Be sure to register and attend early. The sessions are limited to 1000 viewers and these fill up FAST!

See my entry

Repetition is one of the keys of learning

for a how attending one of these seminars helped address an issue I was having with using Wireshark.

Thanks for reading and lets continue to be good network citizens!

Microsoft releases SharePoint Designer 2007 for FREE!

Troy Tate — Tue, 26 May 2009 20:41:05 +0000

SharePoint Designer 2007 is Now Free – Office SharePoint Designer 2007 provides the powerful tools you need to deliver compelling and attractive SharePoint sites and quickly build workflow-enabled applications and reporting tools on the SharePoint platform, all in an IT-managed environment. You can use SharePoint Designer 2007 to create and deploy interactive solutions on the SharePoint platform, without having to write code. It also provides the professional-quality design tools you need to create great-looking SharePoint pages that are compatible with a wide range of browsers. Additionally, site administrators and IT managers can control exactly how SharePoint Designer 2007 is used to help ensure information workers have a managed and controlled experience.

If you are interested in learning more about SharePoint Designer 2007, please be sure to check out:

· Microsoft Office Sharepoint Designer 2007 Product Overview

· SharePoint Designer demos

· SharePoint Designer webcasts

· Help for SharePoint Designer 2007

· Future direction of Sharepoint Designer 2007: video

Repetition is one of the keys of learning

Troy Tate — Tue, 26 May 2009 19:34:32 +0000

I recently posted an update about Laura Chappell’s Chappell University Online seminars. I attended one of these seminars today. What a great experience! I always try to attend Laura’s events and always pickup a tidbit that makes my life as a network manager easier. She gives you information about tools you can use to fight the battle of “the network is down”. Most of the time the network is behaving as designed. It’s poorly written applications or too high user expectations that create issues. So, if you want be the expert on fighting the network is “bad” syndrome – check out Laura’s presentations – I did and I learned something new…

There are many options in Wireshark that go unused or require some understanding and practice to use. Laura is great about going under the covers and revealing exactly what you need to use and how to use it. I have used ethereal (Wireshark’s predecessor) and Wireshark for several years now. It is only with continued education by Laura on the features that I am gaining a better understanding of this network analysis tool and the ins and outs of using it. For example, the Statistics – TCP Stream Graph – Round Trip Time Graph option. I thought my copy of Wireshark was flawed as I never received any results in the graph. Today, Laura’s online seminar showed me that I was likely reversing the results and ending up with an empty result set. Now I know! You can almost always learn something new about something old. Just keep digging! Thanks Laura for the tip.

In case you have missed any previous postings about Laura, here’s a few for you to check out.

Is protocol analysis or network management your thing?

ARP as a network auditing tool

Did you see this? – Latest Laura Chappell Newsletter

Did you see this? – the viral bitgirl

Thanks for reading & let’s continue to be good network citizens.

Master key tasks for network troubleshooting – Chappell University Online Seminars

Troy Tate — Thu, 21 May 2009 12:57:02 +0000

I’m a huge fan of Laura Chappell. She has a great sense of humor and is a great educator about all things packet oriented. Previous posts about Laura have included:

Is protocol analysis or network management your thing?

ARP as a network auditing tool

Did you see this? – Latest Laura Chappell Newsletter

Did you see this? – the viral bitgirl

She has now started a new online seminar series. Some of the presentation are free and others are accessible for a fee of $99. If you cannot get away for education, then this is an excellent alternative and you can gain a great amount of knowledge from this packet analysis expert. I recommend that you visit Chappell Online University and sign up for the free Wireshark Jumpstart: Master Key Tasks for Network Troubleshooting seminar to get a feel for the seminars.

Thanks for reading and let’s continue to be good network citizens!

Did you see this? – Free Wireless LAN planning, deployment and management tools

Troy Tate — Wed, 29 Apr 2009 12:25:36 +0000

Xirrus is a WLAN equipment manufacturer. They have some very cool products and if you have not checked them out and are looking for installing, adding or replacing any WLAN network gear, then I suggest you take a look at their offerings before making a decision.

Xirrus has a page on their website where they offer some cool free tools for planning, deploying and managing wireless networks. The tools will work on any 802.11 wireless network as well as on wired networks. Some of the tools available include:

Xirrus Wi-Fi Inspector
The Xirrus Wi-Fi Inspector is a powerful tool for managing and troubleshooting the Wi-Fi on a Windows XP or Vista laptop. Built in tests enable you to characterize the integrity and performance of your Wi-Fi connection.

Xirrus Wi-Fi Monitor Gadgets/Widgets
The Xirrus Wi-Fi Monitor allows you to monitor your Wi-Fi environment and connection in real time from your desktop in an easy-to-use mini-application. Nine different color skins allow you customize the Wi-Fi Monitor to your desktop

Iperf
Iperf is an easy to use and very popular tool that every IT professional should have that measures maximum throughput. Iperf provides you the data to tune TCP and UDP characteristics. Iperf reports throughput, delay jitter, and datagram loss in easy to understand tables and graphs. You can run Iperf from and command line or a GUI interface.

Qcheck
Qcheck is a must have and handy tool for any IT professional. It does much more than the traditional “ping” command

Other tools are available on this excellent website. I recommend that you take a few minutes, review the offerings and add to your toolbox those tools of value to you.

Thanks for reading and let’s continue to be good network citizens.

Doing Microsoft packet analysis? – Microsoft releases Network Monitor 3.3

Troy Tate — Wed, 29 Apr 2009 12:11:02 +0000

If you do packet capture or analysis in a Microsoft environment, then you are probably already familiar with Microsoft Network Monitor. If not, please read my real-world use of it for PROTOCOL analysis vs protocol analysis (with a small p). Microsoft has updated Network Monitor to v3.3. The announcement of its release can be found on the Technet blog. Some of the new features listed are:

· Ability to capture WWAN (mobile broadband) and Tunnel traffic on Windows 7.

· Full Hyper-V support on Windows Server 2008

· Right-click-add-to-alias: Right-click a frame in the Frame Summary window with an IPv4, IPv6 or MAC address to add that address as a new alias. This is one of those little things that simplifies your work-flow.

· Right-click-go-to-definition: Have you ever wondered where and how the protocols fields you see in the Frame Details are defined in our in-built parsers? Wonder no more. Introducing right-click-go-to-definition: right-click a field in the Frame Details window and select Go To Data Field Definition or Go To Data Type Definition to see where the field is defined in the NPL parsers.

· Autoscroll: Another one of those little, but priceless things … auto-scroll. See the most recent traffic as it comes in. In a live capture, click the AutoScroll button on the main toolbar to have the Frame Summary window automatically scroll down to display the most recent frames as they come in. Click Autoscroll again to freeze the view in its present location.

Several other new features are described in the Technet blog. If you capture packets on a Microsoft network, then you should get this upgraded version to add to your toolbox.

Thanks for reading and let’s continue to be good network citizens.

Simple is not always easy – SNMP for network management

Troy Tate — Mon, 27 Apr 2009 13:29:15 +0000

SNMP – Simple Network Management Protocol has been around since the late 1980′s (RFC 1065, 1066, 1067). It has moved from SNMPv1 to the current SNMPv3 (RFC 3411 – 3418). Older versions are considered obsolete or historical.

SNMP is available on almost every network device such as switches, routers, servers, desktops and laptops. It is a feature provided by the operating system on these devices. Since it is so prevalent and across so many platforms, it is a significant risk to an environment if the SNMP configuration is enabled and the defaults are not changed, a malicious hacker could gain a lot of information and possibly control an organization’s infrastructure with little or no notice by the affected organization.

It is critical that each sysadmin and netadmin understand this service/protocol. It is not something to be taken lightly. Device configurations can be changed using SNMP. Data can be sniffed, redirected and decoded using SNMP. The upside of SNMP is it can be used effectively as a warning system of system/network issues. Thresholds can be monitored and notifications sent before the users detect any issues. Trend analysis can be performed based on historical data.

Here’s a sampling of some SNMP resources to help you gain a better understanding of this protocol/service that is likely already running on your network but not being monitored.

SNMP Link Org – a portal to all things SNMP; has news, software, appliance information and other SNMP related resources.

SNMP Wikipedia article – a great page with links to many SNMP resources

GetIF – a nice free SNMP tool that I use occasionally to quickly watch some SNMP MIBs on devices

What SNMP tools do you like that are easy to use and available for other administrators to use?

Thanks for reading & let’s continue to be good network citizens.