Windows Filtering Platform Audit Noise

Did you know that Windows Server 2008 and 2008 R2, as well as Vista can pump out just as many audit logs as your standard hardware firewall. I can understand some audit trails for file access and user account changes but every single TCP and UPD connection is a little over considering windows is already logging this in the firewall log. If your tracking down security issue on you network and you have an SIM trying to correlate all these logs then most of these additional logs are just noise.

There are a couple of ways of dealing with this little issue, the one machine at a time or the GPO. For me the Group Policy option is a must as I don;t have time to go through every server and every workstation that might have these audit logs turned on. The main one I want to focus on is called the “Audit Filtering Platform Connection”

After much searching on the internet I found a pretty good blog that pointed me in the right direction:

computer configuration –> policies –> windows settings –> security settings –> advanced audit policy configuration –> audit policies –> object access. Then double-click “Audit Filtering Platform Connection” and check only the box next to “configure the following audit events.” DO NOT CLICK THE OTHER TWO BOXES. Repeat for “Audit Filtering Platform Packet Drop”

For the one system solution use these command line options:

auditpol /set /subcategory:”Filtering Platform Packet Drop” /success:disable /failure:disable
auditpol /set /subcategory:”Filtering Platform Connection” /success:disable /failure:disable

References:
http://msdn.microsoft.com/en-us/library/bb309058(VS.85).aspx
http://actualreverend.blogspot.com/2010/11/windows-auditing-can-be-annoying-shut.html

A Function to detect Holidays in your VBS Script

This is basically a function that checks if the current date is listed in a text file and then returns a true or False. The txt file should have a list of holiday dates.

' FileOpen iomode Values 
Const fsoForReading = 1 
  
' holiday Filename 
Const sHolidays = "c:\scripts\holiday.txt" 
  
Function IsHoliday(ByVal vDate) 
  
    Dim fso, file, sLine, bReturn
  
    bReturn = False 

    ' Create FileSystemObejct 
    fso = CreateObject("Scripting.FileSystemObject") 
  
    ' Open text file 
    Set file = fso.OpenTextFile(sHoliday, fsoForReading) 
  
    Do While (Not (file.AtEndOfStream)) And (Not bReturn) 
        sLine = file.ReadLine 
        If IsDate(sLine) Then 
            If DateDiff("d", vDate, CDate(sLine)) = 0 Then 
                bReturn = True 
            End If 
        End If 
    Loop 
    file.Close() 
  
    file = Nothing 
    fso = Nothing 
  
    IsHoliday = bReturn 
  
End Function

Here is how the holiday file should be formatted

25.12.2002
26.12.2002
01.01.2003
18.04.2003
21.04.2003
01.05.2003
11.05.2003
29.05.2003
09.06.2003
03.10.2003
25.12.2003

Adding Multiple Cores in vSphere 4.0 4.1 4.x

Basically you still select the number of vCPUs, but then you would also set in the advanced setting a new row to define how many of these CPUs are divided into a single virtual Socket. This is an advanced setting in vSphere, you add a row for “cpuid.coresPerSocket” and set the value to 2, 4, or 8. In Vmware workstation it is a little more straight forward, but I guess VMware feels that system admins should be comfortable working with vmx files and configuring advanced settings like this.

Example:
If you have 8 vCPUs and you select 2 for the cpuid.coresPerSocket, that would equal 4 sockets with 2 cores each
If you have 8vCPUs and you select 8 for the cpuid.coresPerSocket, that would equal 1 socket with 8 cores
If you have 4vCPUs and you select 4 for the cpuid.coresPerSocket, that would equal 1 socket with 4 cores

Just remember the values need to be 2, 4, 8 in both values and the number of vCPUs needs to be divisible by the number of cores per socket (cpuid.coresPerSocket).

What flexibilities this adds to your Virtual Machine in vSphere is that on standard editions of Windows you can now see up to 8 cores, and most software is per socket not core. So for MS SQL for example you could have running on one socket that has 8 cores and only need one CPU license, otherwise if you don’t do use multicores you would need 8 licenses at around 8k each .

Read this KB for details on how to configure multiple cores and the exact requirements.
http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1010184

The only real down fall is that you need to power off the VM to make this change, other than that it only takes a few second to configure.

Getting MS stuff to work on Ubuntu

This week my personal goal is to find ways to make Microsoft stuff work in Ubuntu. So here are a few projects I have noted and will try to post my progress.

Why is this compatibility so important?

For one, most people use Microsoft Windows, and in order to get more people to use Linux as an OS you have to find workarounds and ways to make the transition smoother, and to allow these new users of Linux to continue to work with their non-linux peers.

Second, if you are a developer you would like to know how to check your code and see what it looks like for your target audience, in this case I would recommend installing Virtual Box with a windows VM.

Some packages and projects that make this transition easier:

wine – This allows you to run some windows programs in windows

likewise open – allows you to join a windows domain with ease and if you want GPOs then look into likewise enterprise.

moonlight – open source port of Silverlight

The Mono Project – allows cross-platform compatibility of .Net framework

VLC Player – allows you to play multiple video audio file formats

Check out the https://help.ubuntu.com/community/Medibuntu

After completing the commands at the above link to enable the mediabuntu then install

sudo apt-get install gecko-mediaplayer

Final as a last resort use Virtual Box and create a windows VM on your ubuntu machine, you can even use seemless mode to make it look like the widows apps are on your ubuntu desktop.

Changing Static DNS Search List Using a VBS login Script

This script is fuctional, but rare occurance of no DNS servers has happen when either the delete takes longer then expected or something happens at login that inerupts the completion of the login script. This is why I added a pre-check to see if the change is even needed in the first place.

The only Values needed to be changed are arrNewDNSServerSearchOrder which is the list of new DNS server you wish to add, strOneOfTheOldDNSServers which is a common DNS server already used that you may wish to change or add to, and strOneOfTheNewDNSServers which is one of the new DNS servers you plan to add so the script does not need to fully run at every login (only when change is needed).

If there are any ideas for fixing the rare “No DNS issue” or a better way to do this in PowerShell, please comment. Otherwise enjoy.

'==============================================================
'Script to update DNS settings (Such as adding more then one DNS server to the targeted NIC)
'
'By Paul - https://networksavy.wordpress.com
'Date: 08/23/2010
'==============================================================

'====================================================
'New List of DNS Servers to Apply
'====================================================
arrNewDNSServerSearchOrder = Array( "192.168.1.2", _
                                    "192.168.2.2", _
                                    "192.168.3.2"  )
                                    
'to find the right adapter(s) to change:
' This is the value that checks the right nic (A common DNS server that is already used)
strOneOfTheOldDNSServers = "192.168.2.19"
' This is to check if a value is already correct (So the replacement does not run again if not needed)
strOneOfTheNewDNSServers = "192.168.1.19"


strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")


Set colNetCards = objWMIService.ExecQuery _
    ("Select DNSServerSearchOrder From Win32_NetworkAdapterConfiguration")

'============================================
'
' Test if the script even needs to be applied
' If the new DNS server exists then the script quits
'
'============================================
For Each objNetCard in colNetCards
  blnFound = 0
  arrDNSServerSearchOrder = objNetCard.DNSServerSearchOrder
  	If Not IsNull(arrDNSServerSearchOrder) Then
    	For i = 0 to UBound(arrDNSServerSearchOrder)
      		If (arrDNSServerSearchOrder(i) = strOneOfTheNewDNSServers) Then
				WScript.Quit
        Exit For
      End If
    Next    
  End If
Next

'============================================
'
' Replaces DNS Servers with new servers
'
'============================================
For Each objNetCard in colNetCards
  blnFound = 0
  arrDNSServerSearchOrder = objNetCard.DNSServerSearchOrder
  If Not IsNull(arrDNSServerSearchOrder) Then
    For i = 0 to UBound(arrDNSServerSearchOrder)
      If (arrDNSServerSearchOrder(i) = strOneOfTheOldDNSServers) Then
        arrDNSServerSearchOrder = Array()
        objNetCard.SetDNSServerSearchOrder(arrDNSServerSearchOrder)
        wscript.sleep 600
        arrDNSServerSearchOrder = arrNewDNSServerSearchOrder
        objNetCard.SetDNSServerSearchOrder(arrDNSServerSearchOrder)
        Exit For
      End If
    Next    
  End If
Next

WScript.Quit

Windows Computer Power Configurations GPO

This one seems to be a moving target for most so I’ll post a Microsft KB for XP and some additional info for 2008 domains:

Windows XP – The meat and potatos of this KB is to give permissions to two registery keys to your users so your login scrip with work. If you take a look at the key in regedit you may get your own ideas on how to fix them, but just be careful and make backups and test your settings.

http://support.microsoft.com/kb/915160

 Windows XP/Vista/7 On 2008 Domains – the easy GPO setting

There is a new section of the GPO introduced in 2008 Domains when managing with a Vista or Windows 7 machine called Preferences, Control Panel Settings, here you will find it even easier to manage those pesky power settings and even configure new custom ones if you would like, and of course set which one is active.

Lansweeper – Network Auditing and mangement

http://www.lansweeper.com

I like to call Lansweeper the google search of network management. The ease of setting up custom remote actions on the system, is by far the best part of this very useful utility. Also I should metion the price is low, free even for those light users. When I first tried the free version, I was so impressed I spent the little extra to go pro. Now the price is a little higher now then when I first started just using it over a year ago, but I’m sure you will find it worth more then you pay for.

I should also add that if you want to create custom reports about your network and have them e-mailed to you every morning, this is the tool for you.

The user forum is useful as well, it almost has the feeling of Open Source because everyone has some bit of code to help add some value to the program.

When you pay for the pro version you gain access to what I like to call the Lansweeper Tool Suite – many helpful tools that help you to remotely manage your computers and network devices.