Re: tracking admin commands

sounds good. you're using Micrsoft's Log Parser from IIS 6 RK Tools?
"M. Burnett [MVP]" <mb@xxxxxxxx> wrote in message
news:%23gNcu1E%23GHA.1128@xxxxxxxxxxxxxxxxxxxxxxx
You can audit all executables and know when someone runs them, but you
wouldn't know the actual parameters used on the command line.

But yeah, Roger is right, there's not much more you can do other than
install a keylogger or a good host monitoring application.

As a side note about the effects of commands, I do have several
tightly-controlled servers where I need to know EVERYTHING that happens on
them. I have a log parser script that e-mails me a report every 24 hours.
That report includes all new logins, all executables run, all Windows
firewall events that involve new opened ports, a list of all objects that
were accessed (excluding a few high activity dirs), Windows Defender
events, all failed audits, and a few other misc events. It also lists any
errors or warnings that appear in the event logs (filtering out some
non-important events that often show up).

The reports are shorter than you'd think and it just take a moment to scan
for irregularities. It is highly unlikely that anything would happen on
those servers without me knowing. This is a good example of monitoring the
effects of commands. I don't know exactly what someone did at first, but
it alerts me that something has happened.

This is particularly effective for monitoring outside attacks because no
matter what methods they use, their targets will always be the same.


Mark Burnett






"Roger Abell [MVP]" <mvpNoSpam@xxxxxxx> wrote in message
news:#ih9sVE#GHA.4472@xxxxxxxxxxxxxxxxxxxx:

"Rodo" <ralvarado@xxxxxxxxxxx> wrote in message
news:ezbPRiD%23GHA.4404@xxxxxxxxxxxxxxxxxxxxxxx

A trace of commands. From what you said in your previous post, I
assume
results of command would show through auditing objects.


"results" only indirectly
For example, as admin if I issue
xcacls c:\temp /e /g users:f
the results are changes in NTFS permissions on c:\temp
and that acted-on object would have to be auditied to see
the results.
I am aware of no way, short of putting keyloggers on all
admin usable workstations/servers, that you can get an
record of all commands issues by admins (not to mention
that some UI tools do not really issue commands underneith
whereas others do).




"Roger Abell [MVP]" <mvpNoSpam@xxxxxxx> wrote in message
news:OyxyOO$9GHA.4708@xxxxxxxxxxxxxxxxxxxxxxx

So you want to have a trace of the commands, or of the
effects resulting from the commands ?

"Rodo" <ralvarado@xxxxxxxxxxx> wrote in message
news:OYCJ8S49GHA.3392@xxxxxxxxxxxxxxxxxxxxxxx
Windows server hardening
Are system administrator commands traceable back to an individual
user
ID?










.

Relevant Pages

  • Re: 2003 server in a NT4 Domain.
    ... Herb here are the results of the commands you gave me. ... It looks like Auth against the PDC is working as the user account used ... domain and was able to see the shared resources on the 2003 server. ... >Report exact error messages. ...
    (microsoft.public.win2000.active_directory)
  • Re: message: Zoom not available now.
    ... As Rick Brandt wrote... ... For some reason commands that change the report's window size and/or the ... zoom level cannot be called in the Open event of the report itself. ... That code must be in the form/button code that "calls" the report... ...
    (microsoft.public.access.reports)
  • Re: Help!!!
    ... Kill and Dir commands. ... >> Will it suffice to delete the downloaded file after you've ... >> the existance of the downloaded file before you run the report. ...
    (microsoft.public.access.formscoding)
  • Re: Refreshing Report to Accept Printer changes
    ... So setting the orientation works, but setting the paper size does not? ... You could try swapping the commands around (PaperSize first) to see if ... After the report comes up it is in Portrait with Letter size. ... Is there a VBA command to issue after the above commands which would be ...
    (microsoft.public.access.reports)
  • Re: Enabling telnet, ftp, pop3 for root...
    ... *ADMIN* the ability to edit files as root is a REASONABLE thing to do. ... Then your environment does not meet ... you are even afforded security. ... run ALL the commands they want from the script, ...
    (alt.os.linux)