Re: detect intruders with WMI

From: [MS] Scott McNairy (scotmc@online.microsoft.com)
Date: 12/17/02 

From: "[MS] Scott McNairy" <scotmc@online.microsoft.com>
Date: Tue, 17 Dec 2002 10:10:25 -0800

I don't know if this will help you out or not but WMI returns macAddress
properties within the Win32_NetworkAdapter and the
win32_NetworkAdapterConfiguration classes in the root\cimv2 namespace. I
don't know how you would go about determining if a MAC address is spoofed or
not, but if you have a way to determine this we might be able to come up
with a way to detect it by using WMI... 

-- 
[MS] Scott McNairy
WMI Test Engineer
This posting is provided "As Is" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm
"A. Tolga KILINĒ" <kilinc@tis.havelsan.com.tr> wrote in message
news:Ow30NRepCHA.2384@TK2MSFTNGP09...
> Hi,
> How can I use WMI scripting to detect internal intruder machines in
> LAN/domain? Can I utilize WMI scripts or other techniques to detect
spoofed
> MAC addresses...etc?
> Regards,
> Tolga
>
>

Relevant Pages

  • Re: WBEM Implementations in Windows
    ... WMI Scripting layer supports JScript, ... It connects to Windows Management ... I couldn't get the WMI ODBC link in Microsoft ...
    (microsoft.public.win32.programmer.wmi)
  • Re: WMI --> Remote access to directories
    ... to B you have "wasted" your first NTLM Authentication hop, ... See my earlier post about "WMI and ASP" for the gory details. ... Bala wrote: ... > I am new to WMI scripting. ...
    (microsoft.public.win32.programmer.wmi)
  • Re: WBEM Implementations in Windows
    ... There are no plans to update the ODBC driver for WMI. ... >> WMI Scripting layer supports JScript, ... It connects to Windows ... > and the ability to do WMI updates even better. ...
    (microsoft.public.win32.programmer.wmi)
  • WMI & VB6
    ... I have been wading through the mountains of documentation for WMI scripting, ... of Win32_ComputerSystem in a regular VB6 application. ...
    (microsoft.public.vb.syntax)
  • Re: convert wmi script to .net
    ... .Net has classes to work with WMI. ... In .Net SDK help look ".Net Framework ... Vassiliev V. V. ... > explains how to use integrate WMI scripting in .NET-based programs? ...
    (microsoft.public.windows.server.scripting)