Event log monitoring (how I sleep at night)

When I was first hired on as a Windows Server guy, I was initially tasked with getting Microsoft Operations Manager (MOM) working in our environment. After much work, I felt MOM 2005 had some deal-breaking issues:

1. Event log alerts were only flagged with known alerts. This does not work well when services such as Blackberry Enterprise Server (BES) have a new and undocumented alert every time they decide to stop working. At the time, a management agent was only provided by a third party and it still did not cover every critical event there was.
2. Disk space monitoring. By default, MOM expected every server to have the same free space needs (a percentage, or a hard value). Our servers had very different needs and trying to find one setting to fit all the servers simply didn't work. There was a solution written by some astute guys using vbs and custom settings per server, but it felt like a hack and the central management was no longer applicable.
3. Database management. MOM itself became a monster that required me to constantly tweak the database (due to the 1GB limitation) to keep it working. I would prefer to spend my resources on the production servers, not the watchdog.

I needed something that treated event management from the other direction: alert on all events except the ones I have predetermined to be benign. Also, the filtering needed to be unique per server. Disk space needed to have alert thresholds to also be unique per server and I needed to be able to do historical reporting on the servers so I could get an idea of when we would need to get more disk space.

The solution we found was Power Admin. It met our needs, the developers are approachable, and it seems our requests usually make it into the next version, which I find remarkable. Their pricing structure is very good, especially for SMB's who need to start small and add more servers as they go along.

I recommend their product highly. If you find that it meets your needs as well, drop me a comment and let me know. Thanks for reading.

Windows GPO and trusted Add-Ons

Starting with WinXP SP2, Microsoft now has a feature to only allow explicitly declared Add-Ons in Internet Explorer. For us, this is a great feature. We already have an application whitelist program (Websense Client Policy Manager) that blocks unknown executables, but add-ons such as IE toolbars can still get through. Having control over the IE add-ons completes our goal to "protect the users from themselves."

The steps for implementing Add-on blocking can be found via Google search, so I will not go into them here. For information on initial implementation can be found at How to manage Internet Explorer add-ons in Windows XP Service Pack 2.

At first, it seems deceptively simple. Find a computer with only the add-ons you want (Java, Flash, etc.) and get the CLSID's off of it by clicking manage add-ons in IE, right clicking the column select ClassID so you can see the CLSID, and add those to your GPO whitelist of allowed add-ons, call that project done. Turns out, there are many more add-ons you can not see in add-on management that will not run once you enable the option to only allow whitelisted Add-Ons.

So, here's the symptom: After whitelisting every add-on you can see in the add-on manager, when you attempt to go to certain websites (OWA, Sharepoint, Carpe Diem Web, Java VM test, etc) you will see the blocked add-on icon . You double click the icon to open the add-on manager, yet every add-on still shows as enabled. This affects IE6, IE7, and IE8. IE8's new add-on manager looks nicer, but for what we are trying to do, it offers no more functionality than the others.

MS KB article 555235 is a great place to start to add some of those hidden Add-Ons, most notably, javascript and vbscript. The XML Dom and XML Http add-ons are also important in OWA, else you will have a blank pane where all of your inbox items should be.

Unfortunately, while that should get you a good head start, MS does not list all of the hidden add-ons, and they do not give us an easy method for determining the CLSID for ourselves. MS says you can find the CLSID by looking at the object tag in the html source code. However, on all of the web sites I was testing, not one had an object tag or a CLSID I could get.

To determine what the clsid of the blocked add-on is, you will need a clean (free of malware) pc and a windows account that is part of the add-on blocking GPO.

1. Log onto the clean pc using the windows account
2. Run regedit, browse to HKCU\Windows\CurrentVersion\Ext.
3. Ensuring all IE windows are closed, delete the Settings and Stats keys (they will recreate)
4. Log off / Log back on
5. Open IE and browse to the site that causes the add-on block icon to appear
6. Run regedit, browse to HKCU\Windows\CurrentVersion\Ext\Stats
7. For each CLSID, open the iexplore key, if there is a dword value of "Blocked", then that is one of the CLSID's you need to add to your GPO's whitelist.
   
8. Repeat step 7 until you have found all blocked add-ons.

Once added to the gpo, refresh the user's gpo via gpupdate /force, or just log off and log back on. Attempting to visit that site again should have no problems.

If this has helped you, please add a comment saying so. Thanks for reading.

Hello World.

First post, so I will try not to waste your time. The purpose of this blog is to write about problems that I was not able to find the solution to on Google. I am a Systems Administrator of a law firm in Dallas, TX. We run a fairly typical setup (VMWare, Microsoft, Dell, HP, NetApp, Cisco, etc) so I suspect others may benefit from this as well. Hopefully, Google will pick this up.