Symantec™ Enterprise Security Manager Checks Reference

  • Symantec ESM checks for Windows
  • Symantec ESM checks for UNIX
  • Working with Symantec ESM policies
  • Working with Symantec ESM modules
  • Working with Symantec ESM messages


Section I. Symantec ESM checks for Windows

Symantec ESM checks for Windows

This section includes the following topics:

  • Account Information module
  • Account Integrity module
  • Active Directory module
  • Agent Information module
  • Backup Integrity module
  • Discovery module
  • Disk Quota module
  • Encrypted File System module
  • File Attributes module
  • File Find module
  • File System Entitlement module
  • File Watch module
  • Group Policy module
  • Integrated Command Engine module
  • Login Parameters module
  • Network Integrity module
  • OS Patches module
  • Object Integrity module
  • Password Strength module
  • Registry module
  • Startup Files module
  • Symantec Product Info module
  • System Auditing module


Account Information module

This section includes the following topics:

  • About the Account Information module

  • Supported operating systems: Account Information

  • Directly assigned user rights (Windows)

  • Disabled accounts (Windows)

  • Enumerate groups on Domain Controller (Windows)

  • Enumerate groups on member server (Windows)

  • Expired accounts (Windows)

  • File/folder access for accounts (Windows)

  • File/folder access for accounts (cont'd) (Windows)

  • Locked out accounts (Windows)

  • Maximum number of administrators (Windows)

  • Security groups and their users (Windows)

  • Share permissions (Windows)

  • User information (Windows)

  • User information (cont'd) (Windows)

  • User rights for accounts (Windows)

  • Users and their security groups (Windows)

  • Users with administrator privilege (Windows)


About the Account Information module

The Account Information module reports the account information such as locked out accounts, account folder permissions, and users in specified security groups.

For backward compatibility with the applications that require anonymous read access, every user is an implicit member of the Everyone security group. The Everyone group rights are examined as part of the other security group checks.


Supported operating systems: Account Information

The Account Information module is supported on the following operating systems:

  • Windows 2000

  • Windows 2003

  • Windows 2008

  • Windows Vista

  • Windows XP


Directly assigned user rights (Windows)

Module: Account Information

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports directly assigned user rights only. If you need to report directly and indirectly assigned rights use the "User rights for accounts" check.

The following table lists the error message for the check.

Table: Error message for Directly assigned user rights

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_DIRECT_RIGHTS_OF_USER

Category: System Information

  • Windows 2000 (108043)

  • Windows 2003 (208043)

  • Windows 2008 (251043)

  • Windows Vista (231043)

  • Windows XP (203043)

Title: Directly assigned user right

Description:The user has a directly assigned right reported in the Information field.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Disabled accounts (Windows)

Module: Account Information

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports disabled accounts.

The following table lists the error message for the check.

Table: Error message for Disabled accounts

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_DISABLED_ACCOUNTS

Category: System Information

  • Windows 2000 (108035)

  • Windows 2003 (208035)

  • Windows 2008 (251035)

  • Windows Vista (231035)

  • Windows XP (203035)

Title: Disabled account

Description:The account is disabled.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Enumerate groups on Domain Controller (Windows)

Module: Account Information

Supported Platforms: Windows 2000, Windows 2003, Windows 2008

This check works if the check 'Security groups and their users' is enabled. This check reports nested security groups and all users in each group on Domain Controller and trusted domain.


Enumerate groups on member server (Windows)

Module: Account Information

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check works if the check 'Security groups and their users' is enabled. This check reports nested security groups and all users in each group on member server.


Expired accounts (Windows)

Module: Account Information

Supported Platforms: Windows 2000, Windows 2003, Windows 2008

This check only reports accounts that have expired on Windows domain controllers. The check does not report expired accounts on Windows workstations.

The following table lists the error message for the check.

Table: Error message for Expired accounts

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_EXPIRED_ACCOUNTS

Category: System Information

  • Windows 2000 (108036)

  • Windows 2003 (208036)

  • Windows 2008 (251036)

Title: Expired account

Description:The account is expired.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


File/folder access for accounts (Windows)

Module: Account Information

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports account permissions on files and folders. Specify the folders to be examined in the name list. Specify security groups and users to be examined in the "File/folder access for accounts (cont'd)" option.

The following table lists the error messages for the check.

Table: Error messages for File/folder access for accounts

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_DIR_ACCESS

Category: System Information

  • Windows 2000 (108038)

  • Windows 2003 (208038)

  • Windows 2008 (251038)

  • Windows Vista (231038)

  • Windows XP (203038)

Title: Account with folder permissions

Description:The account has the folder permissions reported in the Information field.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Folder: %s; permissions: %s (object), %s (inherit)]

String ID: ESM_FILE_ACCESS

Category: System Information

  • Windows 2000 (108039)

  • Windows 2003 (208039)

  • Windows 2008 (251039)

  • Windows Vista (231039)

  • Windows XP (203039)

Title: Account with file permissions

Description:The account has the file permissions reported in the Information field.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [File: %s; permissions: %s]

String ID: ESM_FILE_LOCKED

Category: System Information

  • Windows 2000 (108041)

  • Windows 2003 (208041)

  • Windows 2008 (251041)

  • Windows Vista (231041)

  • Windows XP (203041)

Title: Locked file

Description:Permissions on the file cannot be reported because it is in use by another process.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: []


File/folder access for accounts (cont'd) (Windows)

Module: Account Information

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This option lets you specify user accounts and security groups that will be excluded or included for the File/folder access for accounts check.


Locked out accounts (Windows)

Module: Account Information

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports locked out accounts.

The following table lists the error message for the check.

Table: Error message for Locked out accounts

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_LOCKED_OUT_ACCOUNTS

Category: System Information

  • Windows 2000 (108034)

  • Windows 2003 (208034)

  • Windows 2008 (251034)

  • Windows Vista (231034)

  • Windows XP (203034)

Title: Locked out account

Description:The account is locked out.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Maximum number of administrators (Windows)

Module: Account Information

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports a problem if the number of users with administrator privileges exceeds the specified number.

The following table lists the error message for the check.

Table: Error message for Maximum number of administrators

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_MAX_ADMIN_ACCOUNTS

Category: System Information

  • Windows 2000 (108042)

  • Windows 2003 (208042)

  • Windows 2008 (251042)

  • Windows Vista (231042)

  • Windows XP (203042)

Title: Maximum admin users exceeded

Description:The number of users with administrator privilege exceeds the maximum defined value.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Security groups and their users (Windows)

Module: Account Information

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports security groups and all users assigned to each group. Use the name list to specify the groups to be excluded or included by the check.

The following table lists the error message for the check.

Table: Error message for Security groups and their users

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_GROUP_AND_USER

Category: System Information

  • Windows 2000 (108030)

  • Windows 2003 (208030)

  • Windows 2008 (251030)

  • Windows Vista (231030)

  • Windows XP (203030)

Title: Security group member

Description:The security group includes the user or group reported in the Information field.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Share permissions (Windows)

Module: Account Information

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports the account permissions of the shared folders.

The following table lists the error message for the check.

Table: Error message for Share permissions

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_SHARE_PERMISSIONS

Category: System Information

  • Windows 2000 (108040)

  • Windows 2003 (208040)

  • Windows 2008 (251040)

  • Windows Vista (231040)

  • Windows XP (203040)

Title: Account with share permissions

Description:The account has the share permissions reported in the Information field.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Share: %s; permissions: %s; path: %s]


User information (Windows)

Module: Account Information

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports user information based on the keys that you enable in the "User information (cont'd)" option.

The following table lists the error message for the check.

Table: Error message for User information

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_USER_INFO

Category: System Information

  • Windows 2000 (108037)

  • Windows 2003 (208037)

  • Windows 2008 (251037)

  • Windows Vista (231037)

  • Windows XP (203037)

Title: User Information

Description:The user information is reported in the Information field.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


User information (cont'd) (Windows)

Module: Account Information

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This option lets you enable keys to select the information reported by the "User information" check. The "Expired account" and "Expiration date" keys are not supported on Windows XP.


User rights for accounts (Windows)

Module: Account Information

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports user rights and how these rights are assigned. They can be assigned directly, or indirectly through local or global security group memberships.

The following table lists the error message for the check.

Table: Error message for User rights for accounts

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_RIGHTS_OF_USER

Category: System Information

  • Windows 2000 (108032)

  • Windows 2003 (208032)

  • Windows 2008 (251032)

  • Windows Vista (231032)

  • Windows XP (203032)

Title: User right

Description:The user has the right reported in the Information field.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Users and their security groups (Windows)

Module: Account Information

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports users and the security groups that they belong to.

The following table lists the error message for the check.

Table: Error message for Users and their security groups

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_USER_AND_GROUP

Category: System Information

  • Windows 2000 (108031)

  • Windows 2003 (208031)

  • Windows 2008 (251031)

  • Windows Vista (231031)

  • Windows XP (203031)

Title: User's security group

Description:The user belongs to the security group reported in the Information field.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Users with administrator privilege (Windows)

Module: Account Information

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports all members of the Administrators security group.

The following table lists the error message for the check.

Table: Error message for Users with administrator privilege

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_USERS_WITH_ADMIN

Category: System Information

  • Windows 2000 (108033)

  • Windows 2003 (208033)

  • Windows 2008 (251033)

  • Windows Vista (231033)

  • Windows XP (203033)

Title: User with administrator privileges

Description:The user is a member of the Administrators security group.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Account Integrity module

This section includes the following topics:

  • About the Account Integrity module

  • Supported operating systems: Account Integrity

  • Access this computer from network (Windows)

  • Accounts that must be disabled (Windows)

  • Accounts that never expire (Windows)

  • Accounts without time restrictions (Windows)

  • Accounts without workstation restrictions (Windows)

  • Act as part of the operating system (Windows)

  • Add workstations to domain (Windows)

  • Adjust memory quotas for a process (Windows)

  • Allow log on locally (Windows)

  • Allow logon through Terminal Services (Windows)

  • Automatically update snapshots (Windows)

  • Back up files and directories (Windows)

  • Bypass traverse checking (Windows)

  • Change the system time (Windows)

  • Changed groups (Windows)

  • Changed users (Windows)

  • Create a pagefile (Windows)

  • Create a token object (Windows)

  • Create global objects (Windows)

  • Create permanent shared objects (Windows)

  • Debug programs (Windows)

  • Deleted groups (Windows)

  • Deleted users (Windows)

  • Deny access to this computer from the network (Windows)

  • Deny logon as a batch job (Windows)

  • Deny logon as a service (Windows)

  • Deny logon locally (Windows)

  • Deny logon through Terminal Services (Windows)

  • Disabled/expired/locked accounts (Windows)

  • Enable computer and user accounts to be trusted for delegation (Windows)

  • Forbidden groups (Windows)

  • Force shutdown from a remote system (Windows)

  • Full/Display name and description required (Windows)

  • Generate security audits (Windows)

  • Group member watch (Windows)

  • Groups guest belongs to (Windows)

  • Impersonate a client after authentication (Windows)

  • Increase scheduling priority (Windows)

  • Load and unload device drivers (Windows)

  • Lock pages in memory (Windows)

  • Log on as a batch job (Windows)

  • Log on as a service (Windows)

  • Manage auditing and security log (Windows)

  • Maximum reported messages (Windows)

  • Modify firmware environment values (Windows)

  • New groups (Windows)

  • New users (Windows)

  • Perform volume maintenance tasks (Windows)

  • Profile single process (Windows)

  • Profile system performance (Windows)

  • Remove computer from docking station (Windows)

  • Rename administrator account (Windows)

  • Rename guest account (Windows)

  • Replace a process level token (Windows)

  • Report excessive number of accounts (Windows)

  • Restore files and directories (Windows)

  • ScreenSaver Timeout (Windows)

  • ScreenSaver password protected (Windows)

  • Shut down the system (Windows)

  • Synchronize directory service data (Windows)

  • Take ownership of files or other objects (Windows)

  • User rights checks (Windows)

  • Users to check (Windows)


About the Account Integrity module

The Account Integrity module reports new, changed, and deleted accounts, account name and rights vulnerabilities, and user rights.


Supported operating systems: Account Integrity

The Account Integrity module is supported on the following operating systems:

  • Windows 2000

  • Windows 2003

  • Windows 2008

  • Windows Vista

  • Windows XP


Access this computer from network (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports accounts with rights to access this system from the network. You can use the name list to include or exclude users or security groups that are not already included or excluded by the Users to check option.

The following table lists the error message for the check.

Table: Error message for Access this computer from network

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_ACCESS_FROM_NETWORK

Category: Policy Compliance

  • Windows 2000 (105930)

  • Windows 2003 (205930)

  • Windows 2008 (248930)

  • Windows Vista (228927)

  • Windows XP (200927)

Title: Access this computer from network

Description:The user or security group has the right to access this computer from the network. If the right is authorized, edit the check's name list. If the right is not authorized, use the Correct feature to revoke it.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Accounts that must be disabled (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports accounts that should be disabled but are not. You can use the name list to specify accounts that should be disabled.

The following table lists the error message for the check.

Table: Error message for Accounts that must be disabled

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_DISABLED_ACCOUNT

Category: Policy Compliance

  • Windows 2000 (105958)

  • Windows 2003 (205958)

  • Windows 2008 (248958)

  • Windows Vista (228951)

  • Windows XP (200951)

Title: Account must be disabled

Description:According to your Symantec ESM security policy, the account must be disabled.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Full name: %s]


Accounts that never expire (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008

This check reports domain accounts that never expire. You can use the name list to exclude accounts that are not excluded by the Users to check option. Because local accounts do not expire, this check does not provide any information unless it is run on a domain controller.

The following table lists the error message for the check.

Table: Error message for Accounts that never expire

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_ACCOUNT_NEVER_EXPIRES

Category: Policy Compliance

  • Windows 2000 (105912)

  • Windows 2003 (205912)

  • Windows 2008 (248912)

Title: Account never expires

Description:The account never expires. Such accounts are more difficult to administer and can be used by former employees for malicious attacks. Set accounts to expire after an appropriate time period has elapsed.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Full/display name: %s]


Accounts without time restrictions (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008

This check reports domain accounts that do not have time restrictions limiting when the account can be used. You can use the name list to exclude accounts that are not excluded by the Users to check option. Because time restrictions apply only to domain accounts, this check does not provide any information unless it is run on a domain controller.

The following table lists the error message for the check.

Table: Error message for Accounts without time restrictions

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_NO_TIME_RESTRICTIONS

Category: Policy Compliance

  • Windows 2000 (105910)

  • Windows 2003 (205910)

  • Windows 2008 (248910)

Title: No account time restrictions

Description:The account does not have time restrictions to limit its use during the week. Accounts without time restrictions can be used to break into the system after business hours. Limit access for these accounts to normal business hours unless authorized users need the additional access time.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Full/display name: %s]


Accounts without workstation restrictions (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008

This check reports domain accounts that are not restricted to specific workstations. You can use the name list to exclude accounts that are not excluded by the Users to check option. Because workstation restrictions apply only to domain accounts, this check does not provide any information unless it is run on a domain controller.

The following table lists the error message for the check.

Table: Error message for Accounts without workstation restrictions

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_NO_WORKSTATION_RESTRICTIONS

Category: Policy Compliance

  • Windows 2000 (105911)

  • Windows 2003 (205911)

  • Windows 2008 (248911)

Title: No workstation restrictions

Description:The account can log on from any workstation in the domain. This makes unauthorized use of accounts easier because account access is not tied to a particular workstation. Restrict users to specific workstations unless the additional access is necessary.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Full/display name: %s]


Act as part of the operating system (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports accounts with rights to act as part of the operating system. Do not assign this right to any account. Run services that require this user right under the Local System account, which always has this right. You can use the name list to exclude or include users or security groups that are not already excluded or included by the Users to check option.

The following table lists the error message for the check.

Table: Error message for Act as part of the operating system

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_ACT_AS_OS

Category: Policy Compliance

  • Windows 2000 (105931)

  • Windows 2003 (205931)

  • Windows 2008 (248931)

  • Windows Vista (228928)

  • Windows XP (200928)

Title: Act as part of the operating system

Description:The user or security group has the right to act as part of the operating system. If the right is authorized, edit the check's name list. If the right is not authorized, use the Correct feature to revoke it.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Add workstations to domain (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008

This check reports accounts with rights to add workstations to a domain. When this right is assigned to an account in the domain controller security policy, the account can add as many as 10 workstations to the domain. Do not grant this user right unless absolutely required. You can use the name list to exclude or include users or security groups that are not already excluded or included by the Users to check option.

The following table lists the error message for the check.

Table: Error message for Add workstations to domain

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_ADD_WORKSTATION

Category: Policy Compliance

  • Windows 2000 (105932)

  • Windows 2003 (205932)

  • Windows 2008 (248932)

Title: Add workstations to domain

Description:The reported user or security group has the right to add workstations to a domain. If the right is authorized, edit the check's name list. If the right is not authorized, use the Correct feature to revoke it.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Adjust memory quotas for a process (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports accounts with rights to increase quotas. Processes running under accounts with this user right can increase the processor quota of other processes. Abuse of this right can aid a denial-ofservice attack. Use the name list to exclude or include users or security groups that are not already excluded or included by the Users to check option.

The following table lists the error message for the check.

Table: Error message for Adjust memory quotas for a process

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_INCREASE_QUOTAS

Category: Policy Compliance

  • Windows 2000 (105939)

  • Windows 2003 (205939)

  • Windows 2008 (248939)

  • Windows Vista (228935)

  • Windows XP (200935)

Title: Adjust memory quotas for a process

Description:The user or security group has the right to increase quotas. On Windows 2000 this is the "Increases quotas" right. Processes running under this account can increase the memory quota of other processes. Abuse of this right can deny services to others. If the right is authorized, edit the check's name list. If the right is not required, use the Correct feature to revoke the right.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Allow log on locally (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports accounts with rights to log on to the system locally at the computer keyboard. You can use the name list to include or exclude users or security groups that are not already included or excluded by the Users to check option.

The following table lists the error message for the check.

Table: Error message for Allow log on locally

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_LOGON_LOCALLY

Category: Policy Compliance

  • Windows 2000 (105943)

  • Windows 2003 (205943)

  • Windows 2008 (248943)

  • Windows Vista (228938)

  • Windows XP (200938)

Title: Allow log on locally

Description:The user or security group has the right to log on locally. If the right is authorized, edit the check's name list. If this right is not authorized, use the Correct feature to revoke it.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Allow logon through Terminal Services (Windows)

Module: Account Integrity

Supported Platforms: Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports accounts with rights to log on to the system through Terminal Services. You can use the name list to exclude or include users or security groups that are not already excluded or included by the Users to check option.

The following table lists the error message for the check.

Table: Error message for Allow logon through Terminal Services

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_LOGON_THROUGH_TERMINAL_SERV

Category: Policy Compliance

  • Windows 2003 (205959)

  • Windows 2008 (248959)

  • Windows Vista (228952)

  • Windows XP (200952)

Title: Allow logon through Terminal Services

Description:The user or security group has been granted the ability to log on through Terminal Services. If the right is authorized, edit the check's name list. If this right is not authorized, use the Correct feature to revoke it.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Full name: %s]


Automatically update snapshots (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

Enable this option to automatically update snapshots with current information.


Back up files and directories (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports accounts with rights to back up files and folders. An account with this right can circumvent file and folder permissions to read any file on the system. You can use the name list to exclude or include users or security groups that are not already excluded or included by the Users to check option.

The following table lists the error message for the check.

Table: Error message for Back up files and directories

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_BACKUP

Category: Policy Compliance

  • Windows 2000 (105902)

  • Windows 2003 (205902)

  • Windows 2008 (248902)

  • Windows Vista (228902)

  • Windows XP (200902)

Title: Back up files and directories

Description:The user or security group has the right to back up files and folders. An account with this right can circumvent file and folder permissions to read any file on the system. If the right is authorized, edit the check's name list. If this right is not authorized, use the Correct feature to revoke it.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Bypass traverse checking (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports accounts with rights to bypass traverse checking. This allows the account to pass through file system or registry folders to which it has no access rights to open a subfolder or object to which it does have access rights. Windows grants this right to Everyone by default. You can use the name list to exclude or include users or security groups that are not already excluded or included by the Users to check option.

The following table lists the error message for the check.

Table: Error message for Bypass traverse checking

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_BYPASS_TRAVERSE_CHECK

Category: Policy Compliance

  • Windows 2000 (105933)

  • Windows 2003 (205933)

  • Windows 2008 (248933)

  • Windows Vista (228929)

  • Windows XP (200929)

Title: Bypass traverse checking

Description:The user or security group has the right to bypass traverse checking. If the right is authorized, edit the check's name list. If the right is not authorized, use the Correct feature to revoke it.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Change the system time (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports accounts with rights to change the system time. Having an accurate system time is critical for auditing and tracing unauthorized activities on the computer system. Modifying the system time can also be used to circumvent software licensing or other time-based controls. You can use the name list to exclude or include users or security groups that are not already excluded or included by the Users to check option.

The following table lists the error message for the check.

Table: Error message for Change the system time

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_SYSTEMTIME

Category: Policy Compliance

  • Windows 2000 (105903)

  • Windows 2003 (205903)

  • Windows 2008 (248903)

  • Windows Vista (228903)

  • Windows XP (200903)

Title: Change the system time

Description:The user or security group has the right to change the system time. If the right is authorized, edit the check's name list. If this right is not authorized, use the Correct feature to revoke it.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Changed groups (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports security groups that were changed after the last group snapshot update. Reported changes include name, members, and user rights. This check does not report security groups that are excluded or not included by the Users to check option.

The following table lists the error messages for the check.

Table: Error messages for Changed groups

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_GROUP_NAME_CHANGED

Category: Policy Compliance

  • Windows 2000 (105922)

  • Windows 2003 (205922)

  • Windows 2008 (248922)

  • Windows Vista (228919)

  • Windows XP (200919)

Title: Group name changed

Description:The group's name changed after the last snapshot update. If the change is authorized, update the snapshot file. If the change is not authorized, restore the previous group name.

Severity: yellow-1

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [Previous name: %s]

String ID: ESM_GROUP_MEMBER_ADDED

Category: Policy Compliance

  • Windows 2000 (105923)

  • Windows 2003 (205923)

  • Windows 2008 (248923)

  • Windows Vista (228920)

  • Windows XP (200920)

Title: Group member added

Description:The account that is reported in the Information field was added to the group after the last snapshot update. If the addition is authorized, update the snapshot file. If it is not authorized, remove the account from the group.

Severity: yellow-1

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [New member: %s]

String ID: ESM_GROUP_MEMBER_REMOVED

Category: Policy Compliance

  • Windows 2000 (105924)

  • Windows 2003 (205924)

  • Windows 2008 (248924)

  • Windows Vista (228921)

  • Windows XP (200921)

Title: Group member removed

Description:The account that is reported in the Information field was removed from the group after the last snapshot update. If the removal is authorized, update the snapshot file. If it is not authorized, restore it to the group.

Severity: yellow-1

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [Removed member: %s]

String ID: ESM_GROUP_PRIV_ADDED

Category: Policy Compliance

  • Windows 2000 (105925)

  • Windows 2003 (205925)

  • Windows 2008 (248925)

  • Windows Vista (228922)

  • Windows XP (200922)

Title: Group right granted

Description:The user right that is specified in the Information field was granted to the group after the last snapshot update. If the change is authorized, update the snapshot file. If this change is not authorized, revoke the user right.

Severity: yellow-1

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [User right: %s]

String ID: ESM_GROUP_PRIV_REMOVED

Category: Policy Compliance

  • Windows 2000 (105926)

  • Windows 2003 (205926)

  • Windows 2008 (248926)

  • Windows Vista (228923)

  • Windows XP (200923)

Title: Group right revoked

Description:The user right that is reported in the Information field was revoked from the group after the last snapshot update. If the change is authorized, update the snapshot file. If it is not authorized, restore the right to the group.

Severity: yellow-1

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [User right: %s]


Changed users (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports user accounts that were changed after the last user snapshot update. Reported changes include name, home folder, group memberships, and user rights. On Windows 2003 domain controllers, only changes in the account User logon name (pre-Windows 2000) are detected. This check does not report users that are excluded by the Users to check option.

The following table lists the error messages for the check.

Table: Error messages for Changed users

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_USER_NAME_CHANGED

Category: Policy Compliance

  • Windows 2000 (105916)

  • Windows 2003 (205916)

  • Windows 2008 (248916)

  • Windows Vista (228913)

  • Windows XP (200913)

Title: Changed user logon name

Description:The user's logon name was changed after the last snapshot update. If the change is authorized, update the snapshot file. If it is not authorized, restore the original logon name.

Severity: yellow-1

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [Full/display name: %s; logon name: %s; previous logon name: %s]

String ID: ESM_USER_HOMEDIR_CHANGED

Category: Policy Compliance

  • Windows 2000 (105917)

  • Windows 2003 (205917)

  • Windows 2008 (248917)

  • Windows Vista (228914)

  • Windows XP (200914)

Title: Changed user home folder

Description:The user's home folder changed after the last snapshot update. If the change is authorized, update the snapshot file. If it is not authorized, reassign the previous folder as the user's home folder.

Severity: yellow-1

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [Full/display name: %s; new home folder: %s; old home folder: %s]

String ID: ESM_USER_ADDED_TO_GROUP

Category: Policy Compliance

  • Windows 2000 (105918)

  • Windows 2003 (205918)

  • Windows 2008 (248918)

  • Windows Vista (228915)

  • Windows XP (200915)

Title: New user in group

Description:The user was added to the group that is reported in the Information field after the last snapshot update. If the addition is authorized, update the snapshot file. If it is not authorized, remove the user from the group.

Severity: yellow-1

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [Full/display name: %s; added to group: %s]

String ID: ESM_USER_REMOVED_FROM_GROUP

Category: Policy Compliance

  • Windows 2000 (105919)

  • Windows 2003 (205919)

  • Windows 2008 (248919)

  • Windows Vista (228916)

  • Windows XP (200916)

Title: User removed from group

Description:The user was removed from the group that is reported in the Information field after the last snapshot update. If the removal is authorized, update the snapshot file. If it is not authorized, restore the user to the group.

Severity: yellow-1

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [Full/display name: %s; removed from group: %s]

String ID: ESM_USER_RIGHT_ADDED

Category: Policy Compliance

  • Windows 2000 (105920)

  • Windows 2003 (205920)

  • Windows 2008 (248920)

  • Windows Vista (228917)

  • Windows XP (200917)

Title: User right granted

Description:The user was granted the user right that is reported in the Information field after the last snapshot update. If the change is authorized, update the snapshot file. If it is not authorized, revoke the right from the user.

Severity: yellow-1

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [Full/display name: %s; user right: %s]

String ID: ESM_USER_RIGHT_REMOVED

Category: Policy Compliance

  • Windows 2000 (105921)

  • Windows 2003 (205921)

  • Windows 2008 (248921)

  • Windows Vista (228918)

  • Windows XP (200918)

Title: User right revoked

Description:The user right that is reported in the Information field was revoked from the user after the last snapshot update. If the change is authorized, update the snapshot file. If it is not authorized, restore the right to the user.

Severity: yellow-1

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [Full/display name: %s; user right: %s]


Create a pagefile (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports accounts with rights to create or change the size of pagefiles. Pagefiles are used to temporarily store portions of the system memory when there is not enough memory for all running applications and services to be loaded simultaneously. Adjusting the pagefile size can affect system performance. You can use the name list to exclude or include users or security groups that are not already excluded or included by the Users to check option.

The following table lists the error message for the check.

Table: Error message for Create a pagefile

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_CREATE_PAGE_FILE

Category: Policy Compliance

  • Windows 2000 (105934)

  • Windows 2003 (205934)

  • Windows 2008 (248934)

  • Windows Vista (228930)

  • Windows XP (200930)

Title: Create a pagefile

Description:The user or security group has the right to create a pagefile. If the right is authorized, edit the check's name list. If the right is not authorized, use the Correct feature to revoke it.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Create a token object (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports accounts with rights to create a token object. When a process requires this right, it should be run under the Local System account, which always has this right. You can use the name list to exclude or include users or security groups that are not already excluded or included by the Users to check option.

The following table lists the error message for the check.

Table: Error message for Create a token object

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_CREATE_TOKEN

Category: Policy Compliance

  • Windows 2000 (105935)

  • Windows 2003 (205935)

  • Windows 2008 (248935)

  • Windows Vista (228931)

  • Windows XP (200931)

Title: Create a token object

Description:The user or security group has the right to create a token object. When a process requires this right, it should be run under the Local System account, which always has the right. Most users and groups do not need this right. If the right is authorized, edit the check's name list. If the right is not required, use the Correct feature to revoke it.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Create global objects (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008

This check reports accounts with rights to create global objects in a terminal services session. You can use the name list to exclude or include users or security groups that are not already excluded or included by the Users to check option.

The following table lists the error message for the check.

Table: Error message for Create global objects

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_CREATE_GLOBAL_OBJECT

Category: Policy Compliance

  • Windows 2000 (105959)

  • Windows 2003 (205962)

  • Windows 2008 (248962)

Title: Create global objects

Description:The user or security group has the right to create global objects in a terminal services session.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Full name: %s]


Create permanent shared objects (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports accounts with rights to create permanent shared objects. Accounts with this right can create directory objects in the Windows object manager to extend the object name space. This is normally used only by kernel-mode components. Because all components that are running in kernel mode automatically have this right, it should not be necessary to directly assign this right to any accounts. You can use the name list to exclude or include users that are not already excluded or included by the Users to check option.

The following table lists the error message for the check.

Table: Error message for Create permanent shared objects

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_CREATE_SHARED

Category: Policy Compliance

  • Windows 2000 (105936)

  • Windows 2003 (205936)

  • Windows 2008 (248936)

  • Windows Vista (228932)

  • Windows XP (200932)

Title: Create permanent shared objects

Description:The user or security group has the right to create permanent shared objects. Accounts with this right can create directory objects in the Windows object manager to extend the object name space. This is normally used only by kernel-mode components. Because all components that are running in kernel mode automatically have this right, it should not be necessary to directly assign this right to any accounts. Use the Correct feature to revoke the right.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Debug programs (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports accounts with rights to debug programs. This right allows an account to attach a debugger to any process, including critical operating system components. You can use the name list to exclude or include users or security groups that are not already excluded or included by the Users to check option.

The following table lists the error message for the check.

Table: Error message for Debug programs

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_DEBUG_PROGRAMS

Category: Policy Compliance

  • Windows 2000 (105937)

  • Windows 2003 (205937)

  • Windows 2008 (248937)

  • Windows Vista (228933)

  • Windows XP (200933)

Title: Debug programs

Description:The user or security group has the right to debug programs. This right lets an account attach a debugger to any process, including critical operating system components. If the right is authorized, edit the check's name list. Use the Correct feature to revoke the right.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Deleted groups (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports security groups that were deleted after the last group snapshot update. This check does not report security groups that are excluded or not included by the Users to check option.

The following table lists the error message for the check.

Table: Error message for Deleted groups

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_GROUP_DELETED

Category: Policy Compliance

  • Windows 2000 (105928)

  • Windows 2003 (205928)

  • Windows 2008 (248928)

  • Windows Vista (228925)

  • Windows XP (200925)

Title: Group deleted

Description:The group was deleted after the last snapshot update. If the deletion is authorized, update the snapshot file. If it is not authorized, restore the group.

Severity: yellow-1

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [%s]


Deleted users (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports user accounts that were deleted after the last user snapshot update. This check does not report users that are excluded or not included by the Users to check option.

The following table lists the error message for the check.

Table: Error message for Deleted users

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_USER_DELETED

Category: Policy Compliance

  • Windows 2000 (105927)

  • Windows 2003 (205927)

  • Windows 2008 (248927)

  • Windows Vista (228924)

  • Windows XP (200924)

Title: User deleted

Description:The user was deleted after the last snapshot update. If the deletion is authorized, update the snapshot file. If it is not authorized, restore the user.

Severity: yellow-1

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [%s]


Deny access to this computer from the network (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports accounts that are denied access to a system from the network. This right takes precedence over the Access this computer from the network right. The Deny right lets you remove access for subsets of groups that have the Access right. You can use the name list to include or exclude users or security groups that are not already included or excluded by the Users to check option.

The following table lists the error message for the check.

Table: Error message for Deny access to this computer from the network

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_DENY_ACCESS_FROM_NETWORK

Category: Policy Compliance

  • Windows 2000 (105951)

  • Windows 2003 (205951)

  • Windows 2008 (248951)

  • Windows Vista (228946)

  • Windows XP (200946)

Title: Deny access to this computer from the network

Description:The user or security group has been denied the right to access this computer from the network. If the user or group should be denied access, edit the check's name list. If the user or group should not be denied access, use the Correct feature to revoke the denial.

Severity: green-0

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Deny logon as a batch job (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports accounts that are denied the right to log on to the system using a batch-queue facility. This right takes precedence over the Log on as a batch job right. The Deny right lets you remove access for subsets of groups that have the Log on right. You can use the name list to include or exclude users or security groups that are not already included or excluded by the Users to check option.

The following table lists the error message for the check.

Table: Error message for Deny logon as a batch job

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_DENY_LOGON_BATCH

Category: Policy Compliance

  • Windows 2000 (105952)

  • Windows 2003 (205952)

  • Windows 2008 (248952)

  • Windows Vista (228947)

  • Windows XP (200947)

Title: Deny logon as a batch job

Description:The user or security group has been denied the right to log on as a batch job. If the user or group should be denied batch logon, edit the check's name list. If the user or group should not be denied batch logon, use the Correct feature to revoke the denial.

Severity: green-0

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Deny logon as a service (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports accounts that are denied the right to log on to the system as a service. This right takes precedence over the Log on as a service right. The Deny right lets you remove access for subsets of groups that have the Log on right. You can use the name list to include or exclude users or security groups that are not already included or excluded by the Users to check option.

The following table lists the error message for the check.

Table: Error message for Deny logon as a service

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_DENY_LOGON_SERVICE

Category: Policy Compliance

  • Windows 2000 (105953)

  • Windows 2003 (205953)

  • Windows 2008 (248953)

  • Windows Vista (228948)

  • Windows XP (200948)

Title: Deny logon as a service

Description:The user or security group has been denied the right to log on as a service. If the user or group should be denied service logon, edit the check's name list. If the user or group should not be denied service logon, use the Correct feature to revoke the denial.

Severity: green-0

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Deny logon locally (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports accounts that are denied the right to log on to the system locally at the computer keyboard. This right takes precedence over the Log on locally right. The Deny right lets you remove access for subsets of groups that have the Log on right. You can use the name list to include or exclude users or security groups that are not already included or excluded by the Users to check option.

The following table lists the error message for the check.

Table: Error message for Deny logon locally

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_DENY_LOGON_LOCALLY

Category: Policy Compliance

  • Windows 2000 (105954)

  • Windows 2003 (205954)

  • Windows 2008 (248954)

  • Windows Vista (228949)

  • Windows XP (200949)

Title: Deny logon locally

Description:The user or security group has been denied the right to log on locally. If the user or group should be denied local logon, edit the check's name list. If the user or group should not be denied local logon, use the Correct feature to revoke the denial.

Severity: green-0

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Deny logon through Terminal Services (Windows)

Module: Account Integrity

Supported Platforms: Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports accounts that are denied the right to log on to the system through Terminal Services. This right takes precedence over the Allow logon through Terminal Services right. The Deny right lets you remove access for subsets of groups that have the Allow right. You can use the name list to include or exclude users or security groups that are not already included or excluded by the Users to check option.

The following table lists the error message for the check.

Table: Error message for Deny logon through Terminal Services

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_DENY_LOGON_TERMINAL_SERVICES

Category: Policy Compliance

  • Windows 2003 (205960)

  • Windows 2008 (248960)

  • Windows Vista (228953)

  • Windows XP (200953)

Title: Deny logon through Terminal Services

Description:The user or security group has the right to log on through Terminal Services. If the right is authorized, edit the check's name list. If this right is not authorized, use the Correct feature to revoke it.

Severity: green-0

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Full name: %s]


Disabled/expired/locked accounts (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports accounts that have been disabled, expired, or locked for longer than the amount of time specified in your policy. Because Windows does not keep track of the date when an account is disabled, the module uses the date that it first detects a disabled account to compute how long the account has been disabled. When this check is not enabled, no disabled, expired, or locked accounts are examined by other checks in this module. You can use the name list to include or exclude users or security groups that are not already included or excluded by the Users to check option.

The following table lists the error message for the check.

Table: Error message for Disabled/expired/locked accounts

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_DISABLED

Category: Policy Compliance

  • Windows 2000 (105929)

  • Windows 2003 (205929)

  • Windows 2008 (248929)

  • Windows Vista (228926)

  • Windows XP (200926)

Title: Disabled, expired, or locked account

Description:The account has been disabled, expired, or locked for the number of days that is reported in the Information field. Activate the account or remove it if it is not required for normal business operations.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Disabled, expired, or locked for: %s days]


Enable computer and user accounts to be trusted for delegation (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008

This check reports accounts with rights to change the Trusted for Delegation setting on a user or computer object in the Active Directory. Delegation is used by multitier client/server applications. An account with this user right may be able to conduct sophisticated attacks to gain access to network resources. You can use the name list to exclude or include users or security groups that are not already excluded or included by the Users to check option.

The following table lists the error message for the check.

Table: Error message for Enable computer and user accounts to be trusted for delegation

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_ENABLE_TRUSTED_DELEGATION

Category: Policy Compliance

  • Windows 2000 (105955)

  • Windows 2003 (205955)

  • Windows 2008 (248955)

Title: Enable computer and user accounts to be trusted for delegation

Description:The reported user or security group has the right to change the Trusted for Delegation setting on a user or computer object in the Active Directory. Delegation is used by multi-tier client/server applications. To revoke this right, right-click the Updatable/Correctable field, then click Correct.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Forbidden groups (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports all groups that are forbidden. Use the name list to specify the forbidden groups to be checked.

The following table lists the error message for the check.

Table: Error message for Forbidden groups

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_FORBIDDEN_GROUP

Category: Policy Compliance

  • Windows 2000 (105966)

  • Windows 2003 (205969)

  • Windows 2008 (248969)

  • Windows Vista (228961)

  • Windows XP (200961)

Title: Forbidden group

Description:According to your Symantec ESM security policy this group account is forbidden.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Force shutdown from a remote system (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports accounts with rights to shut down computers from remote systems. This right could be used by a malicious user to perform a denial-of-service attack. You can use the name list to exclude or include users or security groups that are not already excluded or included by the Users to check option.

The following table lists the error message for the check.

Table: Error message for Force shutdown from a remote system

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_FORCE_REMOTE_SHUTDOWN

Category: Policy Compliance

  • Windows 2000 (105938)

  • Windows 2003 (205938)

  • Windows 2008 (248938)

  • Windows Vista (228934)

  • Windows XP (200934)

Title: Force shutdown from a remote system

Description:The user or security group has the right to force a shutdown from a remote system. This right can be used by a malicious user to perform a denial-of-service attack. Most users and groups do not need this right. Use the Correct feature to revoke the right.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Full/Display name and description required (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports accounts that do not have entries in the Full name and/or Description fields on systems that are not running Active Directory Services (ADS). On systems running ADS, the check examines the Display name and Description fields. All accounts should have entries in these fields to clarify account ownership. Use the name list to exclude users or security groups that are not already excluded by the Users to check option.

The following table lists the error message for the check.

Table: Error message for Full/Display name and description required

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_FULL_NAME

Category: Policy Compliance

  • Windows 2000 (105908)

  • Windows 2003 (205908)

  • Windows 2008 (248908)

  • Windows Vista (228908)

  • Windows XP (200908)

Title: Full/Display Name or Description not provided

Description:The Full/Display name and/or Description fields do not have entries for the user. Specify this information to clarify account ownership. You can use the check's name list to exclude users or groups that are not already excluded by the Users to check option.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Generate security audits (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports accounts with rights to generate entries in the security log. You can use the name list to exclude or include users or security groups that are not already excluded or included by the Users to check option.

The following table lists the error message for the check.

Table: Error message for Generate security audits

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_SECURITY

Category: Policy Compliance

  • Windows 2000 (105904)

  • Windows 2003 (205904)

  • Windows 2008 (248904)

  • Windows Vista (228904)

  • Windows XP (200904)

Title: Generate security audits

Description:The user or security group has the right to generate entries in the security log. If the right is authorized, edit the check's name list. If this right is not authorized, use the Correct feature to revoke it.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Group member watch (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports groups that have prohibited members, or that are prohibited members of a group, as specified in the Group Member Watch template.

The following table lists the error messages for the check.

Table: Error messages for Group member watch

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_INVALID_MEMBER

Category: Policy Compliance

  • Windows 2000 (105961)

  • Windows 2003 (205964)

  • Windows 2008 (248964)

  • Windows Vista (228956)

  • Windows XP (200956)

Title: Prohibited member

Description:The group has prohibited members.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_INVALID_MEMBER_OF

Category: Policy Compliance

  • Windows 2000 (105962)

  • Windows 2003 (205965)

  • Windows 2008 (248965)

  • Windows Vista (228957)

  • Windows XP (200957)

Title: Prohibited member of

Description:The group is a prohibited member of other groups.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Groups guest belongs to (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports groups that the guest account belongs to. By default, the guest account does not have a password, so its system access must be tightly controlled. You can use the name list to exclude groups that the guest account is permitted to belong to, which should not be reported.

The following table lists the error message for the check.

Table: Error message for Groups guest belongs to

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_GUEST_GROUPS

Category: Policy Compliance

  • Windows 2000 (105909)

  • Windows 2003 (205909)

  • Windows 2008 (248909)

  • Windows Vista (228909)

  • Windows XP (200909)

Title: Guest account is a member of unauthorized groups

Description:The guest account is a member of disallowed groups. Users logging on as guest may have too much access to the system. Remove guest membership from the reported groups. You can use the check's name list to exclude authorized groups from the check.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Impersonate a client after authentication (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008

This check reports accounts with rights to impersonate other accounts. You can use the name list to exclude or include users or security groups that are not already excluded or included by the Users to check option.

The following table lists the error message for the check.

Table: Error message for Impersonate a client after authentication

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_IMPERSONATE_NAME

Category: Policy Compliance

  • Windows 2000 (105960)

  • Windows 2003 (205963)

  • Windows 2008 (248963)

Title: Impersonate a client for authentication

Description:The user or security group has the right to impersonate other accounts.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Full name: %s]


Increase scheduling priority (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports accounts with rights to increase scheduling priority. Users with this right can increase the priority of other processes. Abuse of this user right can aid a denial-of-service attack. You can use the name list to exclude or include users or security groups that are not already excluded or included by the Users to check option.

The following table lists the error message for the check.

Table: Error message for Increase scheduling priority

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_INCREASE_PRIORITY

Category: Policy Compliance

  • Windows 2000 (105940)

  • Windows 2003 (205940)

  • Windows 2008 (248940)

  • Windows Vista (228936)

  • Windows XP (200936)

Title: Increase scheduling priority

Description:The user or security group has the right to increase scheduling priority. This account can increase the priority of other processes. Abuse of this user right can deny service to others. If the right is authorized, edit the check's name list. If the right is not authorized, use the Correct feature to revoke it.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Load and unload device drivers (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports accounts with rights to load and unload device drivers for Plug and Play devices. Device drivers run as highly privileged programs. A user could abuse this user right to install malicious code that would have destructive access to resources. You can use the name list to exclude or include users or security groups that are not already excluded or included by the Users to check option.

The following table lists the error message for the check.

Table: Error message for Load and unload device drivers

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_LOAD_DRIVERS

Category: Policy Compliance

  • Windows 2000 (105941)

  • Windows 2003 (205941)

  • Windows 2008 (248941)

  • Windows Vista (228937)

  • Windows XP (200937)

Title: Load and unload device drivers

Description:The user or security group has the right to load and unload device drivers for Plug and Play devices. Device drivers run as highly privileged programs. An intruder could install malicious code with destructive access to resources. If the right is authorized, edit the check's name list. If the right is not authorized, use the Correct feature to revoke it.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Lock pages in memory (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports accounts that are able to lock pages in memory. You can use the name list to exclude or include users or security groups that are not already excluded or included by the Users to check option.

The following table lists the error message for the check.

Table: Error message for Lock pages in memory

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_LOCK_PAGES

Category: Policy Compliance

  • Windows 2000 (105942)

  • Windows 2003 (205942)

  • Windows 2008 (248942)

  • Windows Vista (228955)

  • Windows XP (200955)

Title: Lock pages in memory

Description:The reported users or groups have been granted the ability to lock pages in memory. Use the name list for the Lock pages in memory check to exclude any users or groups that do require this user right.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Log on as a batch job (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports accounts with rights to log on to the system using a batch-queue facility. You can use the name list to exclude or include users or security groups that are not already excluded or included by the Users to check option.

The following table lists the error message for the check.

Table: Error message for Log on as a batch job

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_LOGON_BATCH

Category: Policy Compliance

  • Windows 2000 (105944)

  • Windows 2003 (205944)

  • Windows 2008 (248944)

  • Windows Vista (228939)

  • Windows XP (200939)

Title: Log on as a batch job

Description:The user or security group has the right to log on using a batch-queue facility. If the right is authorized, edit the check's name list. If this right is not authorized, use the Correct feature to revoke it.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Log on as a service (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports accounts with rights to log on to the system as a service. Services can be configured to run under an account only if that account has been granted this right. The Local System account always has this right. You can use the name list to exclude or include users or security groups that are not already excluded or included by the Users to check option.

The following table lists the error message for the check.

Table: Error message for Log on as a service

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_LOGON_SERVICE

Category: Policy Compliance

  • Windows 2000 (105945)

  • Windows 2003 (205945)

  • Windows 2008 (248945)

  • Windows Vista (228940)

  • Windows XP (200940)

Title: Log on as a service

Description:The user or security group has the right to log on as a service. Services can be configured to run under an account only if that account has been granted this right. The Local System account always has this right. If the right is authorized, edit the check's name list. If this right is not authorized, use the Correct feature to revoke it.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Manage auditing and security log (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports accounts with rights to configure auditing on Active Directory objects, files, registry keys, and other resources. Accounts with this user right can also view and clear the security log. You can use the name list to exclude or include users or security groups that are not already excluded or included by the Users to check option.

The following table lists the error message for the check.

Table: Error message for Manage auditing and security log

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_MANAGE_LOG

Category: Policy Compliance

  • Windows 2000 (105946)

  • Windows 2003 (205946)

  • Windows 2008 (248946)

  • Windows Vista (228941)

  • Windows XP (200941)

Title: Manage auditing and security logs

Description:The user or security group has the right to configure auditing on Active Directory objects, files, registry keys, and other resources. Accounts with this user right can also view and clear the security log. Most users and groups do not need this right. Use the Correct feature to revoke it.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Maximum reported messages (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

Enable this option to limit the number of messages returned for each enabled check. Use the value field to specify the maximum number of times a given message should be displayed. Once the maximum number has been reached for a single message, the message will be displayed once more with the number of repeating instances of the message that are not reported.


Modify firmware environment values (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports accounts with rights to modify system environment variables. You can use the name list to exclude or include users or security groups that are not already excluded or included by the Users to check option.

The following table lists the error message for the check.

Table: Error message for Modify firmware environment values

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_MODIFY_FIRMWARE_VALUES

Category: Policy Compliance

  • Windows 2000 (105947)

  • Windows 2003 (205947)

  • Windows 2008 (248947)

  • Windows Vista (228942)

  • Windows XP (200942)

Title: Modify firmware environment values

Description:The user or security group has the right to modify firmware environment values. If the right is authorized, edit the check's name list. If this right is not authorized, use the Correct feature to revoke it.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


New groups (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports security groups that were added after the last group snapshot update. This check does not report security groups that are excluded or not included by the Users to check option.

The following table lists the error message for the check.

Table: Error message for New groups

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_GROUP_ADDED

Category: Policy Compliance

  • Windows 2000 (105915)

  • Windows 2003 (205915)

  • Windows 2008 (248915)

  • Windows Vista (228912)

  • Windows XP (200912)

Title: New group

Description:The security group was added after the last snapshot update. If the addition is authorized, update the snapshot file. If it is not authorized, delete the group.

Severity: yellow-1

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [%s]


New users (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports user accounts that were added after the last user snapshot update. This check does not report users that are excluded or not included by the Users to check option.

The following table lists the error message for the check.

Table: Error message for New users

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_USER_ADDED

Category: Policy Compliance

  • Windows 2000 (105914)

  • Windows 2003 (205914)

  • Windows 2008 (248914)

  • Windows Vista (228911)

  • Windows XP (200911)

Title: New user

Description:The user was added after the last snapshot update. If the addition is authorized, update the snapshot file. If it is not authorized, delete the user.

Severity: yellow-1

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [%s]


Perform volume maintenance tasks (Windows)

Module: Account Integrity

Supported Platforms: Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports accounts with rights to perform volume maintenance tasks. You can use the name list to exclude or include users or security groups that are not already excluded or included by the Users to check option.

The following table lists the error message for the check.

Table: Error message for Perform volume maintenance tasks

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_PERFORM_VOLUME_MAINTENANCE_TASK

Category: Policy Compliance

  • Windows 2003 (205961)

  • Windows 2008 (248961)

  • Windows Vista (228954)

  • Windows XP (200954)

Title: Perform volume maintenance tasks

Description:The user or security group has the right to perform volume maintenance tasks. If the right is authorized, edit the check's name list. If this right is not authorized, use the Correct feature to revoke it.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Full name: %s]


Profile single process (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports accounts with rights to profile a single process. With this right a user can monitor the performance of nonsystem processes. Use the name list to exclude or include users or security groups that are not already excluded or included by the Users to check option.

The following table lists the error message for the check.

Table: Error message for Profile single process

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_PROFILE_PROCESS

Category: Policy Compliance

  • Windows 2000 (105948)

  • Windows 2003 (205948)

  • Windows 2008 (248948)

  • Windows Vista (228943)

  • Windows XP (200943)

Title: Profile single process

Description:The user or security group has the right to profile a single process. With this user right, a user can monitor the performance of nonsystem processes. If the right is authorized, edit the check's name list. If this right is not authorized, use the Correct feature to revoke it.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Profile system performance (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports accounts with rights to profile system performance. With this right, a user can monitor the performance of system processes. You can use the name list to exclude or include users or security groups that are not already excluded or included by the Users to check option.

The following table lists the error message for the check.

Table: Error message for Profile system performance

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_PROFILE_SYSTEM

Category: Policy Compliance

  • Windows 2000 (105949)

  • Windows 2003 (205949)

  • Windows 2008 (248949)

  • Windows Vista (228944)

  • Windows XP (200944)

Title: Profile system performance

Description:The user or security group has the right to profile system performance. With this user right, a user can monitor the performance of system processes. If the right is authorized, edit the check's name list. If this right is not authorized, use the Correct feature to revoke it.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Remove computer from docking station (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports accounts with rights to undock a portable computer. You can use the name list to exclude or include users or security groups that are not already excluded or included by the Users to check option.

The following table lists the error message for the check.

Table: Error message for Remove computer from docking station

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_UNDOCK_COMPUTER

Category: Policy Compliance

  • Windows 2000 (105956)

  • Windows 2003 (205956)

  • Windows 2008 (248956)

  • Windows Vista (228950)

  • Windows XP (200950)

Title: Remove computer from docking station

Description:The user or security group can undock a portable computer. If the right is authorized, edit the check's name list. If this right is not authorized, use the Correct feature to revoke it.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Rename administrator account (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports a problem if the administrator account has a disallowed name. The administrator account should be renamed to prevent it from becoming a break-in target. This account cannot be locked out. Use the name list to specify disallowed administrator account names that should be reported by the check.

The following table lists the error message for the check.

Table: Error message for Rename administrator account

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_RENAME_ADMINISTRATOR

Category: Policy Compliance

  • Windows 2000 (105900)

  • Windows 2003 (205900)

  • Windows 2008 (248900)

  • Windows Vista (228900)

  • Windows XP (200900)

Title: Rename administrator account

Description:Your system has an administrator account with a disallowed name. It can become the target of break-in attempts. Unlike other accounts, this account cannot be locked out because of repeated break-in attempts. Rename the administrator account to a site-specific name.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Rename guest account (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports a problem if the guest account has a disallowed name. The guest account should be renamed to prevent it from becoming a break-in target. Use the name list to specify disallowed guest account names that should be reported.

The following table lists the error message for the check.

Table: Error message for Rename guest account

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_RENAME_GUEST

Category: Policy Compliance

  • Windows 2000 (105901)

  • Windows 2003 (205901)

  • Windows 2008 (248901)

  • Windows Vista (228901)

  • Windows XP (200901)

Title: Rename guest account

Description:Your system has a guest account with a disallowed name. It can become the target of break-in attempts. Rename this account.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Replace a process level token (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports accounts with rights to replace a process level token. A process running under an account with this user right can replace the access token of a child process. You can use the name list to exclude or include users or security groups that are not already excluded or included by the Users to check option.

The following table lists the error message for the check.

Table: Error message for Replace a process level token

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_REPLACE_TOKEN

Category: Policy Compliance

  • Windows 2000 (105950)

  • Windows 2003 (205950)

  • Windows 2008 (248950)

  • Windows Vista (228945)

  • Windows XP (200945)

Title: Replace a process level token

Description:The user or security group has the right to replace a process level token. A process running under an account with this user right can replace the access token of a child process. If the right is authorized, edit the check's name list. If this right is not authorized, use the Correct feature to revoke it.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Report excessive number of accounts (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports a problem if more than the specified number of accounts exists on the system. This check is for systems such as web servers where an excessive number of accounts can be a security risk. Limit the number of accounts on these systems to the minimum required to accomplish system purposes.

The following table lists the error message for the check.

Table: Error message for Report excessive number of accounts

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_TOO_MANY_ACCOUNTS

Category: Policy Compliance

  • Windows 2000 (105913)

  • Windows 2003 (205913)

  • Windows 2008 (248913)

  • Windows Vista (228910)

  • Windows XP (200910)

Title: Too many accounts

Description:The number of accounts on this system does not comply with your policy. Restrict the number of accounts on web servers and other systems where an excessive number of accounts can be a security risk.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Num user accounts: %s]


Restore files and directories (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports accounts with rights to restore files and folders. Accounts with this user right can circumvent file and folder permissions to overwrite or change the owner of any file on the system. You can use the name list to exclude or include users or security groups that are not already excluded or included by the Users to check option.

The following table lists the error message for the check.

Table: Error message for Restore files and directories

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_RESTORE

Category: Policy Compliance

  • Windows 2000 (105905)

  • Windows 2003 (205905)

  • Windows 2008 (248905)

  • Windows Vista (228905)

  • Windows XP (200905)

Title: Restore files and directories

Description:The user or security group has the right to restore files and folders. Accounts with this user right can circumvent file and folder permissions to overwrite or change the owner of any file on the system. If the right is authorized, edit the check's name list. If this right is not authorized, use the Correct feature to revoke it.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


ScreenSaver Timeout (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports accounts where the screen saver timeout exceeds the timeout specified in your policy. This check will also report if the screensaver timeout could not be retrieved because has not been set. This check only applies to domain accounts where a domain policy was pushed to the workstation. You can use the name list to include or exclude users or security groups that are not already included or excluded by the Users to check option.

The following table lists the error messages for the check.

Table: Error messages for ScreenSaver Timeout

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_SCRSVR_TIMEOUT_INVALID

Category: Policy Compliance

  • Windows 2000 (105963)

  • Windows 2003 (205966)

  • Windows 2008 (248966)

  • Windows Vista (228958)

  • Windows XP (200958)

Title: Invalid ScreenSaver Timeout

Description:The screensaver timeout on the specified user is less than the expected one.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_SCRSVR_TIMEOUT_NOT_FOUND

Category: Policy Compliance

  • Windows 2000 (105964)

  • Windows 2003 (205967)

  • Windows 2008 (248967)

  • Windows Vista (228959)

  • Windows XP (200959)

Title: ScreenSaver Timeout not found

Description:The screensaver timeout on the specified user was not found.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_SCRSVR_NOT_ACTIVE

Category: Policy Compliance

  • Windows 2000 (105965)

  • Windows 2003 (205968)

  • Windows 2008 (248968)

  • Windows Vista (228960)

  • Windows XP (200960)

Title: ScreenSaver not active

Description:The screensaver is not active on the specified user and the timeout value cannot be accessed.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_SCRSVR_NOT_CONFIGURED

Category: Policy Compliance

  • Windows 2000 (105969)

  • Windows 2003 (205972)

  • Windows 2008 (248972)

  • Windows Vista (228964)

  • Windows XP (200964)

Title: ScreenSaver not configured by Group Policy

Description:The screensaver is not cofigured by Group Policy.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


ScreenSaver password protected (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports accounts where the screen saver is enabled with password protect on resume. This check will also report if the screensaver password protect could not be retrieved because has not been set. This check only applies to domain accounts where a domain policy was pushed to the workstation. You can use the name list to include or exclude users or security groups that are not already included or excluded by the Users to check option.

The following table lists the error messages for the check.

Table: Error messages for ScreenSaver password protected

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_SCRSVR_PSSWDPROTECT_NOT_ENABLED

Category: Policy Compliance

  • Windows 2000 (105967)

  • Windows 2003 (205970)

  • Windows 2008 (248970)

  • Windows Vista (228962)

  • Windows XP (200962)

Title: ScreenSaver password protect not enabled

Description:The screensaver password protect on resume feature for the specified user is not enabled.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_SCRSVR_PSSWDPROTECT_NOT_FOUND

Category: Policy Compliance

  • Windows 2000 (105968)

  • Windows 2003 (205971)

  • Windows 2008 (248971)

  • Windows Vista (228963)

  • Windows XP (200963)

Title: ScreenSaver password protect not found

Description:The screensaver password protect on resume feature for the specified user was not found.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_SCRSVR_NOT_ACTIVE

Category: Policy Compliance

  • Windows 2000 (105965)

  • Windows 2003 (205968)

  • Windows 2008 (248968)

  • Windows Vista (228960)

  • Windows XP (200960)

Title: ScreenSaver not active

Description:The screensaver is not active on the specified user and the timeout value cannot be accessed.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_SCRSVR_NOT_CONFIGURED

Category: Policy Compliance

  • Windows 2000 (105969)

  • Windows 2003 (205972)

  • Windows 2008 (248972)

  • Windows Vista (228964)

  • Windows XP (200964)

Title: ScreenSaver not configured by Group Policy

Description:The screensaver is not cofigured by Group Policy.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Shut down the system (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports accounts with rights to shut down the system. You can use the name list to exclude or include users or security groups that are not already excluded or included by the Users to check option.

The following table lists the error message for the check.

Table: Error message for Shut down the system

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_SHUTDOWN

Category: Policy Compliance

  • Windows 2000 (105906)

  • Windows 2003 (205906)

  • Windows 2008 (248906)

  • Windows Vista (228906)

  • Windows XP (200906)

Title: Shut down the system

Description:The user or security group has the right to shut down the system. If the right is authorized, edit the check's name list. If this right is not authorized, use the Correct feature to revoke it.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Synchronize directory service data (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008

This check reports domain accounts with rights to synchronize directory service data. This check is relevant only on domain controllers. You can use the name list to exclude or include users or security groups that are not already excluded or included by the Users to check option.

The following table lists the error message for the check.

Table: Error message for Synchronize directory service data

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_SYNC_DIRECTORY_SERVICE

Category: Policy Compliance

  • Windows 2000 (105957)

  • Windows 2003 (205957)

  • Windows 2008 (248957)

Title: Synchronize directory service data

Description:The user or security group has the right to synchronize directory service data. This user right is relevant only on domain controllers. If the right is authorized, edit the check's name list. If the right is not authorized, use the Correct feature to revoke it.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Take ownership of files or other objects (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports accounts with rights to take ownership of Active Directory objects, files, registry keys, printers, or any other securable object on the system. You can use the name list to exclude or include users or security groups that are not already excluded or included by the Users to check option.

The following table lists the error message for the check.

Table: Error message for Take ownership of files or other objects

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_TAKE_OWNERSHIP

Category: Policy Compliance

  • Windows 2000 (105907)

  • Windows 2003 (205907)

  • Windows 2008 (248907)

  • Windows Vista (228907)

  • Windows XP (200907)

Title: Take ownership of files or other objects

Description:The user or security group has the right to take ownership of files or other objects. If the right is authorized, edit the check's name list. If this right is not authorized, use the Correct feature to revoke it.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


User rights checks (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This header identifies checks that report accounts with specific user rights assignments. User rights are defined in Windows security policies and group policy objects.


Users to check (Windows)

Module: Account Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

Use this option to specify the users and security groups that are excluded or included by all Account Integrity security checks. The "%Server Operators%" entry in the name list does not apply to Windows XP.


Active Directory module

This section includes the following topics:

  • About the Active Directory module

  • Supported operating systems: Active Directory

  • Computers with applied GPOs (Windows)

  • Computers without applied GPOs (Windows)

  • DCOM Machine Restriction (Windows)

  • Enforce user logon restrictions (Windows)

  • Maximum lifetime for service ticket (Windows)

  • Maximum lifetime for user ticket (Windows)

  • Maximum lifetime for user ticket renewal (Windows)

  • Maximum tolerance for computer clock synchronization (Windows)

  • Security groups with applied GPOs (Windows)

  • Security groups without applied GPOs (Windows)

  • Security options (Windows)

  • Users with applied GPOs (Windows)

  • Users without applied GPOs (Windows)


About the Active Directory module

The Active Directory module for Windows 2000/Server 2003 reports the group policy objects (GPOs) that apply to users, groups, and computers in the Active Directory Service (ADS).

GPOs are the active directory objects that contain group policies such as the Windows security policy. GPO settings can be applied to Web sites, domains, and organizational units.

This module is not included in any of the default policies that ship with Symantec ESM, but it is available when you edit a policy.


Supported operating systems: Active Directory

The Active Directory module is supported on the following operating systems:

  • Windows 2000

  • Windows 2003

  • Windows 2008

  • Windows Vista

  • Windows XP


Computers with applied GPOs (Windows)

Module: Active Directory

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports group policy objects (GPOs) that apply to the examined computer. Applied GPOs can be inherited from sites, domains, and organizational units.

The following table lists the error message for the check.

Table: Error message for Computers with applied GPOs

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_COMPUTER_GPOS

Category: Policy Compliance

  • Windows 2000 (108130)

  • Windows 2003 (208130)

  • Windows 2008 (251130)

  • Windows Vista (231130)

  • Windows XP (203130)

Title: Computer GPOs

Description:The reported group policy objects (GPOs) are applied to the examined computer. These GPOs are inherited from sites, domains, or organizational units.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Applied GPOs: %s]


Computers without applied GPOs (Windows)

Module: Active Directory

Supported Platforms: Windows 2000, Windows 2003, Windows 2008

This check reports computers that do not have group policy objects (GPOs) applied to them through sites, domains, or organizational units.

The following table lists the error message for the check.

Table: Error message for Computers without applied GPOs

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_COMPUTER_WITHOUT_APPLIED_GPOS

Category: Policy Compliance

  • Windows 2000 (108131)

  • Windows 2003 (208131)

  • Windows 2008 (251131)

Title: Computer without applied GPOs

Description:There are no group policy objects (GPOs) applied to the examined computer through sites, domains, or organizational units. This could mean that your security policy is not enforced on this computer.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


DCOM Machine Restriction (Windows)

Module: Active Directory

Supported Platforms: Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports if the DCOM local policies are enabled or not. Also it reports the difference in security descriptor in comparison with the template. This check is not applicable for Windows 2000, Windows 2003 SP0 and Windows XP SP0 and SP1.

The following table lists the error messages for the check.

Table: Error messages for DCOM Machine Restriction

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_DCOM_INCORRECT_VALUE_G

Category: Policy Compliance

  • Windows 2003 (208148)

  • Windows 2008 (251148)

  • Windows Vista (231148)

  • Windows XP (203148)

Title: Incorrect Policy Value

Description:The actual value in the Policy does not match the expected value in the ESM template.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_DCOM_INCORRECT_VALUE_Y

Category: Policy Compliance

  • Windows 2003 (208149)

  • Windows 2008 (251149)

  • Windows Vista (231149)

  • Windows XP (203149)

Title: Incorrect Policy Value

Description:The actual value in the Policy does not match the expected value in the ESM template.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_DCOM_INCORRECT_VALUE_R

Category: Policy Compliance

  • Windows 2003 (208150)

  • Windows 2008 (251150)

  • Windows Vista (231150)

  • Windows XP (203150)

Title: Incorrect Policy Value

Description:The actual value in the Policy does not match the expected value in the ESM template.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_INVALID_TEMPLATE_ENTRY

Category: Policy Compliance

  • Windows 2003 (208151)

  • Windows 2008 (251151)

  • Windows Vista (231151)

  • Windows XP (203151)

Title: Incorrect Template Entry

Description:Invalid entry in the template

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_POLICY_NOT_SET_R

Category: Policy Compliance

  • Windows 2003 (208152)

  • Windows 2008 (251152)

  • Windows Vista (231152)

  • Windows XP (203152)

Title: DCOM Policy not defined

Description:DCOM Policy is not defined

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_POLICY_NOT_SET_Y

Category: Policy Compliance

  • Windows 2003 (208153)

  • Windows 2008 (251153)

  • Windows Vista (231153)

  • Windows XP (203153)

Title: DCOM Policy not defined

Description:DCOM Policy is not defined

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_POLICY_NOT_SET_G

Category: Policy Compliance

  • Windows 2003 (208154)

  • Windows 2008 (251154)

  • Windows Vista (231154)

  • Windows XP (203154)

Title: DCOM Policy not defined

Description:DCOM Policy is not defined

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_SECDESC_NOT_SET_R

Category: Policy Compliance

  • Windows 2003 (208155)

  • Windows 2008 (251155)

  • Windows Vista (231155)

  • Windows XP (203155)

Title: Security Descriptor not set for DCOM Policy

Description:Security Descriptor not set for DCOM Policy

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_SECDESC_NOT_SET_Y

Category: Policy Compliance

  • Windows 2003 (208156)

  • Windows 2008 (251156)

  • Windows Vista (231156)

  • Windows XP (203156)

Title: Security Descriptor not set for DCOM Policy

Description:Security Descriptor not set for DCOM Policy

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_SECDESC_NOT_SET_G

Category: Policy Compliance

  • Windows 2003 (208157)

  • Windows 2008 (251157)

  • Windows Vista (231157)

  • Windows XP (203157)

Title: Security Descriptor not set for DCOM Policy

Description:Security Descriptor not set for DCOM Policy

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Enforce user logon restrictions (Windows)

Module: Active Directory

Supported Platforms: Windows 2000, Windows 2003, Windows 2008

This check reports a problem if this Kerberos Policy setting is not enabled. This check is intended to run only on domain controllers to produce results for specific domains.

The following table lists the error message for the check.

Table: Error message for Enforce user logon restrictions

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_LOG_RESTRICT_DISABLED

Category: Policy Compliance

  • Windows 2000 (108136)

  • Windows 2003 (208136)

  • Windows 2008 (251136)

Title: User logon restrictions not enforced

Description:When user logon restrictions are not enforced, session tickets for services that users do not have the right to use may be granted to them. It is recommended that the Kerberos Policy value for "Enforce user logon restrictions" be set to "Enabled".

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Maximum lifetime for service ticket (Windows)

Module: Active Directory

Supported Platforms: Windows 2000, Windows 2003, Windows 2008

This check reports a problem if this Kerberos Policy setting is higher than the recommended setting of 600 minutes. This check is intended to run only on domain controllers to produce results for specific domains.

The following table lists the error messages for the check.

Table: Error messages for Maximum lifetime for service ticket

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_SERV_TICK_LIFE_TOO_HIGH

Category: Policy Compliance

  • Windows 2000 (108137)

  • Windows 2003 (208137)

  • Windows 2008 (251137)

Title: Service ticket lifetime too high

Description:When the value for this Kerberos Policy setting is too high, users whose accounts have been disabled might be able to continue to access network services by using valid service tickets that were issued before their accounts were disabled or they might be able to access network resources outside of their logon hours. It is recommended that the value for "Maximum lifetime for service ticket" be set to 600 minutes.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_SERV_TICK_LIFE_NOT_SET

Category: Policy Compliance

  • Windows 2000 (108138)

  • Windows 2003 (208138)

  • Windows 2008 (251138)

Title: Service ticket lifetime not set

Description:When the value for this Kerberos Policy setting is too high, users whose accounts have been disabled might be able to continue to access network services by using valid service tickets that were issued before their accounts were disabled or they might be able to access network resources outside of their logon hours. It is recommended that the value for "Maximum lifetime for service ticket" be set to 600 minutes.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Maximum lifetime for user ticket (Windows)

Module: Active Directory

Supported Platforms: Windows 2000, Windows 2003, Windows 2008

This check reports a problem if this Kerberos Policy setting is higher than the recommended setting of 10 hours. This check is intended to run only on domain controllers to produce results for specific domains.

The following table lists the error messages for the check.

Table: Error messages for Maximum lifetime for user ticket

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_USER_TICK_LIFE_TOO_HIGH

Category: Policy Compliance

  • Windows 2000 (108139)

  • Windows 2003 (208139)

  • Windows 2008 (251139)

Title: User ticket lifetime too high

Description:When the value for this Kerberos Policy setting is too high, users whose accounts have been disabled might be able to continue to access network services by using valid service tickets that were issued before their accounts were disabled or they might be able to access network resources outside of their logon hours. It is recommended that the value for "Maximum lifetime for user ticket" be set to 10 hours.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_USER_TICK_LIFE_NOT_SET

Category: Policy Compliance

  • Windows 2000 (108140)

  • Windows 2003 (208140)

  • Windows 2008 (251140)

Title: User ticket lifetime not set

Description:When the value for this Kerberos Policy setting is too high, users whose accounts have been disabled might be able to continue to access network services by using valid service tickets that were issued before their accounts were disabled or they might be able to access network resources outside of their logon hours. It is recommended that the value for "Maximum lifetime for user ticket" be set to 10 hours.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Maximum lifetime for user ticket renewal (Windows)

Module: Active Directory

Supported Platforms: Windows 2000, Windows 2003, Windows 2008

This check reports a problem if this Kerberos Policy setting is higher than the recommended setting of 7 days. This check is intended to run only on domain controllers to produce results for specific domains.

The following table lists the error messages for the check.

Table: Error messages for Maximum lifetime for user ticket renewal

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_USER_TICK_RENEW_TOO_HIGH

Category: Policy Compliance

  • Windows 2000 (108141)

  • Windows 2003 (208141)

  • Windows 2008 (251141)

Title: User ticket renewal lifetime too high

Description:When the value for this Kerberos Policy setting is too high, users might be able to renew very old user tickets. It is recommended that the value for "Maximum lifetime for user ticket renewal" be set to 7 days.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_USER_TICK_RENEW_NOT_SET

Category: Policy Compliance

  • Windows 2000 (108142)

  • Windows 2003 (208142)

  • Windows 2008 (251142)

Title: User ticket renewal lifetime not set

Description:When the value for this Kerberos Policy setting is too high, users might be able to renew very old user tickets. It is recommended that the value for "Maximum lifetime for user ticket renewal" be set to 7 days.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Maximum tolerance for computer clock synchronization (Windows)

Module: Active Directory

Supported Platforms: Windows 2000, Windows 2003, Windows 2008

This check reports a problem if this Kerberos Policy setting is higher than the recommended setting of 5 minutes. This check is intended to run only on domain controllers to produce results for specific domains.

The following table lists the error message for the check.

Table: Error message for Maximum tolerance for computer clock synchronization

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_CLOCK_SYNCH_TOO_HIGH

Category: Policy Compliance

  • Windows 2000 (108143)

  • Windows 2003 (208143)

  • Windows 2008 (251143)

Title: Clock synchronization tolerance too high

Description:When the value for this Kerberos Policy setting is too high, the possibility that a "replay attack" could occur increases. It is recommended that the value for "Maximum tolerance for computer clock synchronization" be set to 5 minutes.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Security groups with applied GPOs (Windows)

Module: Active Directory

Supported Platforms: Windows 2000, Windows 2003, Windows 2008

This check reports all security groups with applied group policy objects (GPOs) in an ADS domain. This check is intended to run only on domain controllers to produce results for specific domains.

The following table lists the error message for the check.

Table: Error message for Security groups with applied GPOs

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_SECURITY_GROUP_GPOS

Category: Policy Compliance

  • Windows 2000 (108134)

  • Windows 2003 (208134)

  • Windows 2008 (251134)

Title: Security group GPOs

Description:The listed group policy objects (GPOs) are applied to the named security group. These GPOs are inherited from sites, domains, or organizational units.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Applied GPOs: %s]


Security groups without applied GPOs (Windows)

Module: Active Directory

Supported Platforms: Windows 2000, Windows 2003, Windows 2008

This check reports all security groups in an ADS domain that do not have group policy objects (GPOs) applied to them. This check is intended to run only on domain controllers to produce results for specific domains.

The following table lists the error message for the check.

Table: Error message for Security groups without applied GPOs

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_GROUP_WITHOUT_APPLIED_GPOS

Category: Policy Compliance

  • Windows 2000 (108135)

  • Windows 2003 (208135)

  • Windows 2008 (251135)

Title: GPOs are not applied to security groups

Description:There are no group policy objects (GPOs) applied to the named security group through sites, domains, or organizational units. This could mean that your security policy is not enforced for this security group.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Security options (Windows)

Module: Active Directory

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports a problem if a security setting is not set to the value specified in the template. Enable the check by selecting one or more templates.

The following table lists the error messages for the check.

Table: Error messages for Security options

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_SECURITY_OPTION_VIOLATION_G

Category: Policy Compliance

  • Windows 2000 (108144)

  • Windows 2003 (208144)

  • Windows 2008 (251144)

  • Windows Vista (231144)

  • Windows XP (203144)

Title: Security option setting violates policy

Description:The values defined for this security option are out of compliance with the values expected by the explicit policy. The security option needs to be changed on the system or the policy specification needs to be changed in the template.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_SECURITY_OPTION_VIOLATION_Y

Category: Policy Compliance

  • Windows 2000 (108145)

  • Windows 2003 (208145)

  • Windows 2008 (251145)

  • Windows Vista (231145)

  • Windows XP (203145)

Title: Security option setting violates policy

Description:The values defined for this security option are out of compliance with the values expected by the explicit policy. The security option needs to be changed on the system or the policy specification needs to be changed in the template.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_SECURITY_OPTION_VIOLATION_R

Category: Policy Compliance

  • Windows 2000 (108146)

  • Windows 2003 (208146)

  • Windows 2008 (251146)

  • Windows Vista (231146)

  • Windows XP (203146)

Title: Security option setting violates policy

Description:The values defined for this security option are out of compliance with the values expected by the explicit policy. The security option needs to be changed on the system or the policy specification needs to be changed in the template.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_SEC_OPT_TEMPLATE_MISSING

Category: Policy Compliance

  • Windows 2000 (108147)

  • Windows 2003 (208147)

  • Windows 2008 (251147)

  • Windows Vista (231147)

  • Windows XP (203147)

Title: No Security Option template files were specified

Description:The "Security Options" check was run without any template files selected. No security checks were performed. Check your policy to ensure that at least one template file is enabled for the agent's operating system.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Users with applied GPOs (Windows)

Module: Active Directory

Supported Platforms: Windows 2000, Windows 2003, Windows 2008

This check reports all users with applied group policy objects (GPOs) in an ADS domain. This check is intended to run only on domain controllers to produce results for specific domains.

The following table lists the error message for the check.

Table: Error message for Users with applied GPOs

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_USER_GPOS

Category: Policy Compliance

  • Windows 2000 (108132)

  • Windows 2003 (208132)

  • Windows 2008 (251132)

Title: User GPOs

Description:The listed group policy objects (GPOs) are applied to the named user. These GPOs are inherited from sites, domains, or organizational units.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Applied GPOs: %s]


Users without applied GPOs (Windows)

Module: Active Directory

Supported Platforms: Windows 2000, Windows 2003, Windows 2008

This check reports all users in an ADS domain that do not have group policy objects (GPOs) applied to them. This check is intended to run only on domain controllers to produce results for specific domains.

The following table lists the error message for the check.

Table: Error message for Users without applied GPOs

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_USER_WITHOUT_APPLIED_GPOS

Category: Policy Compliance

  • Windows 2000 (108133)

  • Windows 2003 (208133)

  • Windows 2008 (251133)

Title: User without applied GPOs

Description:There are no group policy objects (GPOs) applied to the named user through sites, domains, or organizational units. This could mean that your security policy is not enforced for this user.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Agent Information module

This section includes the following topics:

  • About the Agent Information module

  • Supported operating systems: Agent Information

  • Agent Version (Windows)

  • Agent name (Windows)

  • CPU Information (Windows)

  • DNS Setting (Windows)

  • ESM Application Modules (Windows)

  • OS Information (Windows)

  • Registered to Manager (Windows)

  • SU Version (Windows)


About the Agent Information module

The Agent Information module reports information about the following:

  • Agent's computer

  • Security Update (SU) applied on the agent

  • Application Modules installed on the agent


Supported operating systems: Agent Information

The Agent Information module is supported on the following operating systems:

  • Windows 2000

  • Windows 2003

  • Windows 2008

  • Windows Vista

  • Windows XP


Agent Version (Windows)

Module: Agent Information

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports the version of the ESM agent.

The following table lists the error messages for the check.

Table: Error messages for Agent Version

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_FILE_IS_MISSING

Category: System Information

  • Windows 2000 (108329)

  • Windows 2003 (208329)

  • Windows 2008 (251329)

  • Windows Vista (231329)

  • Windows XP (203329)

Title: File cannot be found

Description:There is an Error locating the referenced file. Either it does not exist or it is corrupted. Please see the information field for more details.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_AGENT_VERSION

Category: System Information

  • Windows 2000 (108334)

  • Windows 2003 (208334)

  • Windows 2008 (251334)

  • Windows Vista (231334)

  • Windows XP (203334)

Title: Agent Version

Description:Please check the information column for the version of installed ESM Agent of the system.It reports the content of the 'version.dat' file found in #esm/bin/#plat directory.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Agent name (Windows)

Module: Agent Information

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports the hostname of ESM agent.

The following table lists the error message for the check.

Table: Error message for Agent name

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_INSTALLED_AGENT

Category: System Information

  • Windows 2000 (108330)

  • Windows 2003 (208330)

  • Windows 2008 (251330)

  • Windows Vista (231330)

  • Windows XP (203330)

Title: ESM Agent's Name

Description:This is agent name as provided during the ESM agent installation.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


CPU Information (Windows)

Module: Agent Information

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports the Processor type, Number of processors and Processor frequency.

The following table lists the error messages for the check.

Table: Error messages for CPU Information

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_CPU_INFO

Category: System Information

  • Windows 2000 (108336)

  • Windows 2003 (208336)

  • Windows 2008 (251336)

  • Windows Vista (231336)

  • Windows XP (203336)

Title: CPU Information

Description:It reports number of prccessors, processor type details on the systems processors.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_CPU_PARAM

Category: System Information

  • Windows 2000 (108337)

  • Windows 2003 (208337)

  • Windows 2008 (251337)

  • Windows Vista (231337)

  • Windows XP (203337)

Title: CPU Parameters

Description:It reports the processor, name, speed, identifier and vendor information of the detected CPU.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


DNS Setting (Windows)

Module: Agent Information

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports the Domain name and DNS servers of the ESM agent.

The following table lists the error messages for the check.

Table: Error messages for DNS Setting

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_REGISTRY_MISSING

Category: System Information

  • Windows 2000 (108333)

  • Windows 2003 (208333)

  • Windows 2008 (251333)

  • Windows Vista (231333)

  • Windows XP (203333)

Title: Missing Registry Entry

Description:A registry key which is required for gathering the concerned information is missing. The information field contains the details of the missing registry entry.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_PRIMARY_DNSSUFFIX

Category: System Information

  • Windows 2000 (108338)

  • Windows 2003 (208338)

  • Windows 2008 (251338)

  • Windows Vista (231338)

  • Windows XP (203338)

Title: Primary DNS Suffix

Description:Specifies the primary Domain Name System (DNS) suffix for the system. The primary DNS suffix is used in DNS name registration and DNS name resolution.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_DNS_SERVERS

Category: System Information

  • Windows 2000 (108339)

  • Windows 2003 (208339)

  • Windows 2008 (251339)

  • Windows Vista (231339)

  • Windows XP (203339)

Title: DNS Servers

Description:Specifies the list of Domain Name System (DNS) servers to which Windows Sockets sends queries when it resolves names for the interface. The interface-specific DNS name server for the system is determined by 'DhcpNameServer' entry, which the Dynamic Host Configuration Protocol (DHCP) configures, and by the 'NameServer' entry, which the user can configure. If the value of NameServer is valid, it takes precedence over the value of DhcpNameServer.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


ESM Application Modules (Windows)

Module: Agent Information

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports all the ESM application modules applied on the agent.

The following table lists the error message for the check.

Table: Error message for ESM Application Modules

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_APPLICATION_MODULE

Category: System Information

  • Windows 2000 (108340)

  • Windows 2003 (208340)

  • Windows 2008 (251340)

  • Windows Vista (231340)

  • Windows XP (203340)

Title: ESM Application Module

Description:The respective ESM application modules has been installed on the ESM agent machine.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


OS Information (Windows)

Module: Agent Information

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports the OS name, OS version, Service pack and Build number of the ESM agent.

The following table lists the error message for the check.

Table: Error message for OS Information

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_OS_INFORMATION

Category: System Information

  • Windows 2000 (108332)

  • Windows 2003 (208332)

  • Windows 2008 (251332)

  • Windows Vista (231332)

  • Windows XP (203332)

Title: OS Information

Description:Please check the information column for the operating system details such as the OS Name, the installed service pack, the OS version and the build number.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Registered to Manager (Windows)

Module: Agent Information

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports all the ESM managers to which the agent is registered. All these managers are listed in the /esm/config/manager.dat file.

The following table lists the error messages for the check.

Table: Error messages for Registered to Manager

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_FILE_IS_MISSING

Category: System Information

  • Windows 2000 (108329)

  • Windows 2003 (208329)

  • Windows 2008 (251329)

  • Windows Vista (231329)

  • Windows XP (203329)

Title: File cannot be found

Description:There is an Error locating the referenced file. Either it does not exist or it is corrupted. Please see the information field for more details.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_REGISTERED_MANAGER

Category: System Information

  • Windows 2000 (108331)

  • Windows 2003 (208331)

  • Windows 2008 (251331)

  • Windows Vista (231331)

  • Windows XP (203331)

Title: Registered to Manager

Description:The system that has been reported is a manager to which the agent is registered. This Manager can remotely access the ESM agent and schedule various policy runs.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


SU Version (Windows)

Module: Agent Information

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports the SU version of the ESM agent.

The following table lists the error messages for the check.

Table: Error messages for SU Version

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_FILE_IS_MISSING

Category: System Information

  • Windows 2000 (108329)

  • Windows 2003 (208329)

  • Windows 2008 (251329)

  • Windows Vista (231329)

  • Windows XP (203329)

Title: File cannot be found

Description:There is an Error locating the referenced file. Either it does not exist or it is corrupted. Please see the information field for more details.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_SU_VERSION

Category: System Information

  • Windows 2000 (108335)

  • Windows 2003 (208335)

  • Windows 2008 (251335)

  • Windows Vista (231335)

  • Windows XP (203335)

Title: SU Version

Description:Please check the information column for the SU version installed on the ESM Agent.It reports the SU version after analysing the manifest file 'manifest.xml' found in '#esm/config' directory.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Backup Integrity module

This section includes the following topics:

  • About the Backup Integrity module

  • Supported operating systems: Backup Integrity

  • Backup Exec backup frequency (Windows)

  • Backup Exec last backup status (Windows)

  • Backup Exec version (Windows)

  • Backups needed (Windows)

  • Folders excluded (Windows)


About the Backup Integrity module

The Backup Integrity module reports files and folders on the local drives that have not been backed up since they were last changed. Backups prevent data loss in the event of a disk or system failure.


Supported operating systems: Backup Integrity

The Backup Integrity module is supported on the following operating systems:

  • Windows 2000

  • Windows 2003

  • Windows 2008

  • Windows Vista

  • Windows XP


Backup Exec backup frequency (Windows)

Module: Backup Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008

This check reports Veritas Backup Exec jobs that have a longer time interval between backups than is specified in the template. This time interval is the time between the end of the previous backup run and the beginning of the next scheduled run. Jobs not listed in the templates will not be reported. This check is not supported on Itanium platforms.

The following table lists the error messages for the check.

Table: Error messages for Backup Exec backup frequency

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_BACKUP_FREQUENCY_GREEN

Category: Policy Compliance

  • Windows 2000 (106436)

  • Windows 2003 (206436)

  • Windows 2008 (249436)

Title: Job run interval too long

Description:The Veritas Backup Exec job has a longer time interval between backups than is specified in the template.

Severity: green-0

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_BACKUP_FREQUENCY_YELLOW

Category: Policy Compliance

  • Windows 2000 (106437)

  • Windows 2003 (206437)

  • Windows 2008 (249437)

Title: Job run interval too long

Description:The Veritas Backup Exec job has a longer time interval between backups than is specified in the template.

Severity: yellow-2

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_BACKUP_FREQUENCY_RED

Category: Policy Compliance

  • Windows 2000 (106438)

  • Windows 2003 (206438)

  • Windows 2008 (249438)

Title: Job run interval too long

Description:The Veritas Backup Exec job has a longer time interval between backups than is specified in the template.

Severity: red-4

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_NO_BACKUP_EXEC

Category: Policy Compliance

  • Windows 2000 (106440)

  • Windows 2003 (206440)

  • Windows 2008 (249440)

Title: Could not connect to Backup Exec

Description:ESM was unable to connect to a Backup Exec server on this agent.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Backup Exec last backup status (Windows)

Module: Backup Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008

This check reports Veritas Backup Exec jobs that completed their last run with an error or unsuccessful status. Use the name list to include or exclude jobs. This check is not supported on Itanium platforms.

The following table lists the error messages for the check.

Table: Error messages for Backup Exec last backup status

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_LAST_BACKUP_FAILED

Category: Policy Compliance

  • Windows 2000 (106435)

  • Windows 2003 (206435)

  • Windows 2008 (249435)

Title: Last backup job failed

Description:The Veritas Backup Exec job finished with an error or unsuccessful status.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_NO_BACKUP_EXEC

Category: Policy Compliance

  • Windows 2000 (106440)

  • Windows 2003 (206440)

  • Windows 2008 (249440)

Title: Could not connect to Backup Exec

Description:ESM was unable to connect to a Backup Exec server on this agent.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Backup Exec version (Windows)

Module: Backup Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008

This check reports if the installed version of Veritas Backup Exec is older than the version specified in the value field. Values must be formatted as: <major version>.<minor version>. If only the major version is specified, then the minor version is assumed to be zero. This check is not supported on Itanium platforms.

The following table lists the error messages for the check.

Table: Error messages for Backup Exec version

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_BACKUP_VERSION

Category: Policy Compliance

  • Windows 2000 (106439)

  • Windows 2003 (206439)

  • Windows 2008 (249439)

Title: Backup Exec version out of date

Description:The installed version of Veritas Backup Exec is older than the version specified in the check.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_NO_BACKUP_EXEC

Category: Policy Compliance

  • Windows 2000 (106440)

  • Windows 2003 (206440)

  • Windows 2008 (249440)

Title: Could not connect to Backup Exec

Description:ESM was unable to connect to a Backup Exec server on this agent.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Backups needed (Windows)

Module: Backup Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check examines file archive bits on local drives and reports the number and names of files that have changed since they were last backed up. Removable drives and drives that are excluded in the name list are not included. In the Max files shown field, specify the maximum number of file names to be reported. A value of -1 (not recommended) reports all file names. A value of 0 reports no names.

The following table lists the error messages for the check.

Table: Error messages for Backups needed

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_A_FEW_FILES

Category: Policy Compliance

  • Windows 2000 (106430)

  • Windows 2003 (206430)

  • Windows 2008 (249430)

  • Windows Vista (229430)

  • Windows XP (201430)

Title: Several files not backed up

Description:Several files on the drive are not backed up. Data can be lost if the disk or system fails. Back up this drive in the near future.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_MORE_FILES

Category: Policy Compliance

  • Windows 2000 (106431)

  • Windows 2003 (206431)

  • Windows 2008 (249431)

  • Windows Vista (229431)

  • Windows XP (201431)

Title: Many files not backed up

Description:Many files on the listed drive were not backed up. Data can be lost if the disk or system fails. Back up this drive within the next few days.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_A_LOT_OF_FILES

Category: Policy Compliance

  • Windows 2000 (106432)

  • Windows 2003 (206432)

  • Windows 2008 (249432)

  • Windows Vista (229432)

  • Windows XP (201432)

Title: Most files not backed up

Description:Most of the files on the drive are not backed up. Data can be lost if the disk or system fails. Back up this drive today or tomorrow.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_THE_WHOLE_DRIVE

Category: Policy Compliance

  • Windows 2000 (106433)

  • Windows 2003 (206433)

  • Windows 2008 (249433)

  • Windows Vista (229433)

  • Windows XP (201433)

Title: All files not backed up

Description:All of the files on the drive are not backed up. Data can be lost if the disk or system fails. Back up this drive today.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_FILE_NOT_BACKUP

Category: Policy Compliance

  • Windows 2000 (106434)

  • Windows 2003 (206434)

  • Windows 2008 (249434)

  • Windows Vista (229434)

  • Windows XP (201434)

Title: File not backed up

Description:The file is not backed up. Data can be lost if the disk or system fails. Back up the file.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Folders excluded (Windows)

Module: Backup Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This option lets you specify folders to be excluded from the Backups needed check. The name list accepts only folders directly under the root. For example, C:\WINNT is a valid listing, but C:\WINNT\SYSTEM32 is not. Folder names may not end with a backslash.


Discovery module

This section includes the following topics:

  • About the Discovery module

  • Supported operating systems: Discovery

  • Profile candidate devices (Windows and UNIX)

  • Profile timeout (Windows and UNIX)

  • Report if found (Windows and UNIX)

  • Scan non-responding addresses (Windows and UNIX)

  • Symantec ESM device status (Windows and UNIX)

  • Symantec Intruder Alert device status (Windows and UNIX)

  • Targets (Windows and UNIX)


About the Discovery module

The Discovery module reports computers that could run Symantec ESM or Symantec Intruder Alert but are not running them. The Discovery module is present in the Queries policy.


Supported operating systems: Discovery

The Discovery module is supported on the following operating systems:

  • UNIX

  • Windows 2000

  • Windows 2003

  • Windows 2008

  • Windows Vista

  • Windows XP


Profile candidate devices (Windows and UNIX)

Module: Discovery

Supported Platforms: UNIX, Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

Enable this option to identify Symantec ESM and Symantec Intruder Alert candidates. Disable the option to report only systems currently running these products. When the option is disabled, all devices that are not running these products are reported as non-candidates. This is a time consuming option. Though it does not tax CPU usage, profiling can take several minutes per IP address. Profiling examines the following ports to determine the type of network device: tcpmux 1, echo 7, discard 9, systat 11, daytime 13, netstat 15, quote 17, ttytst 19, ftp 21, telnet 23, smtp 25, time 37, domain 53, finger 79, http 80, pop-2 109, pop-3 110, rpcbind 111, loc-srv 135, netbios-ssn 139, exec 512, login 513, shell 514, printer 515, uucp 540, and x-server 6000.


Profile timeout (Windows and UNIX)

Module: Discovery

Supported Platforms: UNIX, Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This option lets you specify the maximum number of seconds that a module spends profiling a candidate system before aborting and going to the next address. The timeout value cannot be less than 15 seconds or greater than 900 seconds (15 minutes).


Report if found (Windows and UNIX)

Module: Discovery

Supported Platforms: UNIX, Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

When this option is enabled, the Symantec ESM and Symantec Intruder Alert device status checks report computers that are running Symantec ESM or Intruder Alert.


Scan non-responding addresses (Windows and UNIX)

Module: Discovery

Supported Platforms: UNIX, Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

When this option is enabled, the Symantec ESM and Symantec Intruder Alert device status checks scan all specified TCP addresses including those that do not respond to a ping. Enabling this option greatly increases the time required to complete the scan.


Symantec ESM device status (Windows and UNIX)

Module: Discovery

Supported Platforms: UNIX, Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check examines the specified TCP ports on targeted devices and reports devices that are not running Symantec ESM. To report computers that could run Symantec ESM but are not (candidates), enable the Profile candidate devices option. To report computers that are running Symantec ESM, enable the Report if found option.

The following table lists the error messages for the check.

Table: Error messages for Symantec ESM device status

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESMM_INV_ADDRQUAL

Category: System Information

  • UNIX (45500)

  • Windows 2000 (45500)

  • Windows 2003 (45500)

  • Windows 2008 (45500)

  • Windows Vista (45500)

  • Windows XP (45500)

Title: Invalid address qualifier

Description:The specified address qualifier is not valid. Each target address has four parts with periods separating the parts, and can represent one or more IP addresses. Each part consists of a number between 1 and 254, a range of numbers, or a wildcard character (* or ?). A range of numbers is specified as n-m where n is the lower limit and m is the upper limit. If the lower limit is not specified (for example, -127), 1 is used. If the upper limit is not specified (for example, 17-), 254 is used. A * represents the range of numbers 1-254. A ? represents the matching part of the agent's IP address. For example, if you specify ?.?.?.* and the executing agent's address is 172.17.7.55, the result is the same as 172.17.7.*.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMM_TIMED_OUT

Category: System Information

  • UNIX (45506)

  • Windows 2000 (45506)

  • Windows 2003 (45506)

  • Windows 2008 (45506)

  • Windows Vista (45506)

  • Windows XP (45506)

Title: Timed out while profiling

Description:Communications with the address/host timed out profiling.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMM_ESM_FOUND

Category: System Information

  • UNIX (45507)

  • Windows 2000 (45507)

  • Windows 2003 (45507)

  • Windows 2008 (45507)

  • Windows Vista (45507)

  • Windows XP (45507)

Title: ESM found

Description:Symantec ESM was found at/on the indicated address/host.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMM_ESM_CANDIDATE

Category: System Information

  • UNIX (45510)

  • Windows 2000 (45510)

  • Windows 2003 (45510)

  • Windows 2008 (45510)

  • Windows Vista (45510)

  • Windows XP (45510)

Title: ESM candidate

Description:Symantec ESM was not found at the address or on the host, and the responding hardware appears to be a candidate for a Symantec ESM installation.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMM_NOT_ESM_CANDIDATE

Category: System Information

  • UNIX (45511)

  • Windows 2000 (45511)

  • Windows 2003 (45511)

  • Windows 2008 (45511)

  • Windows Vista (45511)

  • Windows XP (45511)

Title: Non-ESM candidate

Description:Symantec ESM was not found at the address or on the host, and the responding hardware does not appear to be a candidate for a Symantec ESM installation. Common measures employed to secure computers can prevent the Discovery module from identifying remote operating systems. The more secure a remote computer, the less likely the Discovery module will be able to identify the operating system. If the Discovery module cannot identify the operating system of a remote computer, Symantec ESM reports this message.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Symantec Intruder Alert device status (Windows and UNIX)

Module: Discovery

Supported Platforms: UNIX, Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check examines the specified TCP ports on targeted devices and reports devices that are not running Symantec Intruder Alert. To report computers that could run Symantec Intruder Alert but are not (candidates), enable the Profile candidate devices option. To report computers that are running Symantec Intruder Alert, enable the Report if found option.

The following table lists the error messages for the check.

Table: Error messages for Symantec Intruder Alert device status

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESMM_INV_ADDRQUAL

Category: System Information

  • UNIX (45500)

  • Windows 2000 (45500)

  • Windows 2003 (45500)

  • Windows 2008 (45500)

  • Windows Vista (45500)

  • Windows XP (45500)

Title: Invalid address qualifier

Description:The specified address qualifier is not valid. Each target address has four parts with periods separating the parts, and can represent one or more IP addresses. Each part consists of a number between 1 and 254, a range of numbers, or a wildcard character (* or ?). A range of numbers is specified as n-m where n is the lower limit and m is the upper limit. If the lower limit is not specified (for example, -127), 1 is used. If the upper limit is not specified (for example, 17-), 254 is used. A * represents the range of numbers 1-254. A ? represents the matching part of the agent's IP address. For example, if you specify ?.?.?.* and the executing agent's address is 172.17.7.55, the result is the same as 172.17.7.*.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMM_TIMED_OUT

Category: System Information

  • UNIX (45506)

  • Windows 2000 (45506)

  • Windows 2003 (45506)

  • Windows 2008 (45506)

  • Windows Vista (45506)

  • Windows XP (45506)

Title: Timed out while profiling

Description:Communications with the address/host timed out profiling.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMM_ITA_FOUND

Category: System Information

  • UNIX (45512)

  • Windows 2000 (45512)

  • Windows 2003 (45512)

  • Windows 2008 (45512)

  • Windows Vista (45512)

  • Windows XP (45512)

Title: ITA found

Description:Symantec Intruder Alert was found at the address or on the host.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMM_ITA_CANDIDATE

Category: System Information

  • UNIX (45513)

  • Windows 2000 (45513)

  • Windows 2003 (45513)

  • Windows 2008 (45513)

  • Windows Vista (45513)

  • Windows XP (45513)

Title: ITA candidate

Description:Symantec Intruder Alert was not found at the address or on the host, and the responding hardware appears to be a candidate for a Symantec Intruder Alert installation.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMM_NOT_ITA_CANDIDATE

Category: System Information

  • UNIX (45514)

  • Windows 2000 (45514)

  • Windows 2003 (45514)

  • Windows 2008 (45514)

  • Windows Vista (45514)

  • Windows XP (45514)

Title: Non-ITA candidate

Description:Symantec Intruder Alert was not found at the address or on the host, and the responding hardware does not appear to be a candidate for a Symanec Intruder Alert installation. Common measures employed to secure computers can prevent the Discovery module from identifying remote operating systems. The more secure a remote computer, the less likely the Discovery module will be able to identify the operating system. If the Discovery module cannot identify the operating system of a remote computer, Symantec ESM reports this message.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Targets (Windows and UNIX)

Module: Discovery

Supported Platforms: UNIX, Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This option lets you specify the target TCP addresses to be scanned. Each target address has four parts with periods separating the parts, and can represent one or more IP addresses. Each part consists of a number between 1 and 254, a range of numbers, or a wildcard character (* or ?). A range of numbers is specified as n-m where n is the lower limit and m is the upper limit. If the lower limit is not specified (for example, -127), 1 is used. If the upper limit is not specified (for example, 17-), 254 is used. A * represents the range of numbers 1-254. A ? represents the matching part of the agent's IP address. These numbers, ranges of numbers, and wildcard characters can be used in combinations to specify complex sets of IP addresses. For example, if the range 172.17.10-20.* is specified, the addresses 172.17.10.1, ..., 172.17.10.254, 172.17.11.1, ..., 172.17.11.254, ..., 172.17.20.254 are scanned. The range of IP addresses an agent can scan is limited based on the Class of the agent's IP address.


Disk Quota module

This section includes the following topics:

  • About the Disk Quota module

  • Supported operating systems: Disk Quota

  • User exceeds quota (Windows)

  • User exceeds warning (Windows)

  • User quota not enforced (Windows)

  • Volume quota disabled (Windows)

  • Volume quota enforced (Windows)

  • Volume quota exceeds limit (Windows)

  • Volume quota not enforced (Windows)

  • Volume quota not logged (Windows)

  • Volume quota not supported (Windows)

  • Volume warning exceeds limit (Windows)

  • Volume warning not logged (Windows)


About the Disk Quota module

The Disk Quota module reports how disk quota information is tracked and reports a problem if it is not tracked.


Supported operating systems: Disk Quota

The Disk Quota module is supported on the following operating systems:

  • Windows 2000

  • Windows 2003

  • Windows 2008

  • Windows Vista

  • Windows XP


User exceeds quota (Windows)

Module: Disk Quota

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports users on the volume that have exceeded their disk quota limits.

The following table lists the error message for the check.

Table: Error message for User exceeds quota

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_USER_OVER_QUOTA_LIMIT

Category: System Information

  • Windows 2000 (106839)

  • Windows 2003 (206839)

  • Windows 2008 (249839)

  • Windows Vista (229839)

  • Windows XP (201839)

Title: Quota limit exceeded

Description:The user has exceeded the disk quota limit.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Quota limit: %s; using: %s; volume: %s]


User exceeds warning (Windows)

Module: Disk Quota

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports users on the volume that have exceeded their disk quota warning limits.

The following table lists the error message for the check.

Table: Error message for User exceeds warning

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_USER_OVER_WARNING_LIMIT

Category: System Information

  • Windows 2000 (106840)

  • Windows 2003 (206840)

  • Windows 2008 (249840)

  • Windows Vista (229840)

  • Windows XP (201840)

Title: Quota warning level exceeded

Description:The user has exceeded the disk quota warning level.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Warning level: %s; using: %s; volume: %s]


User quota not enforced (Windows)

Module: Disk Quota

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports users that have no disk quota limits on the volume.

The following table lists the error message for the check.

Table: Error message for User quota not enforced

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_USER_NO_QUOTA

Category: System Information

  • Windows 2000 (106838)

  • Windows 2003 (206838)

  • Windows 2008 (249838)

  • Windows Vista (229838)

  • Windows XP (201838)

Title: User has no quota limit

Description:The user has no disk quota limit on the volume.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Volume: %s]


Volume quota disabled (Windows)

Module: Disk Quota

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports volumes that support disk quota management where quotas are disabled.

The following table lists the error message for the check.

Table: Error message for Volume quota disabled

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_QUOTA_DISABLED

Category: System Information

  • Windows 2000 (106831)

  • Windows 2003 (206831)

  • Windows 2008 (249831)

  • Windows Vista (229831)

  • Windows XP (201831)

Title: Volume quotas not enabled

Description:Disk quotas are not enabled. A user that can fill all disk space can block other users from using the system.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Volume quota enforced (Windows)

Module: Disk Quota

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports volumes with disk quotas that are enabled and that are being enforced.

The following table lists the error message for the check.

Table: Error message for Volume quota enforced

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_QUOTA_ENFORCED

Category: System Information

  • Windows 2000 (106833)

  • Windows 2003 (206833)

  • Windows 2008 (249833)

  • Windows Vista (229833)

  • Windows XP (201833)

Title: Volume quotas enforced

Description:Disk quotas are enforced.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Warning level of default volume: %s; default volume limit: %s]


Volume quota exceeds limit (Windows)

Module: Disk Quota

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports volumes that have disk quota settings that are greater than the value in megabytes that is specified in your Symantec ESM security policy.

The following table lists the error message for the check.

Table: Error message for Volume quota exceeds limit

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_QUOTA_GREATER_THAN_X

Category: System Information

  • Windows 2000 (106834)

  • Windows 2003 (206834)

  • Windows 2008 (249834)

  • Windows Vista (229834)

  • Windows XP (201834)

Title: Quotas greater than value

Description:The default disk quota for the volume is greater than the value that is specified in your Symantec ESM policy.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Default quota: %s]


Volume quota not enforced (Windows)

Module: Disk Quota

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports volumes with disk quotas that are enabled for tracking but are not being enforced.

The following table lists the error message for the check.

Table: Error message for Volume quota not enforced

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_QUOTA_NOT_ENFORCED

Category: System Information

  • Windows 2000 (106832)

  • Windows 2003 (206832)

  • Windows 2008 (249832)

  • Windows Vista (229832)

  • Windows XP (201832)

Title: Tracked quotas not enforced

Description:Disk quotas are being tracked but not enforced. A user that can fill all disk space can block other users from using the volume.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Warning level of default volume: %s; default volume limit: %s]


Volume quota not logged (Windows)

Module: Disk Quota

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports volumes that do not log disk quota violations.

The following table lists the error message for the check.

Table: Error message for Volume quota not logged

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_QUOTA_NOT_LOGGED

Category: System Information

  • Windows 2000 (106836)

  • Windows 2003 (206836)

  • Windows 2008 (249836)

  • Windows Vista (229836)

  • Windows XP (201836)

Title: Volume quota violations not logged

Description:The volume does not log disk quota violations.

Severity: yellow-3

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Volume quota not supported (Windows)

Module: Disk Quota

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports volumes that have file systems that do not support disk quotas. Only NTFS version 5.0 or later supports disk quotas.

The following table lists the error message for the check.

Table: Error message for Volume quota not supported

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_QUOTA_NOT_SUPPORTED

Category: System Information

  • Windows 2000 (106830)

  • Windows 2003 (206830)

  • Windows 2008 (249830)

  • Windows Vista (229830)

  • Windows XP (201830)

Title: Volume quotas not supported

Description:Disk quotas are not enabled because the file system does not support disk quotas.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [File system type: %s]


Volume warning exceeds limit (Windows)

Module: Disk Quota

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports volumes that have disk quota warning settings that are greater than the specified value in megabytes that is specified in your Symantec ESM security policy.

The following table lists the error message for the check.

Table: Error message for Volume warning exceeds limit

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_WARNING_GREATER_THAN_X

Category: System Information

  • Windows 2000 (106835)

  • Windows 2003 (206835)

  • Windows 2008 (249835)

  • Windows Vista (229835)

  • Windows XP (201835)

Title: Quota warning level greater than value

Description:The default disk quota warning level is greater than the value that is specified in your Symantec ESM policy.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Default warning level: %s]


Volume warning not logged (Windows)

Module: Disk Quota

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports volumes that do not log disk quota warning level violations.

The following table lists the error message for the check.

Table: Error message for Volume warning not logged

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_WARNING_NOT_LOGGED

Category: System Information

  • Windows 2000 (106837)

  • Windows 2003 (206837)

  • Windows 2008 (249837)

  • Windows Vista (229837)

  • Windows XP (201837)

Title: Volume warnings not logged

Description:The volume does not log disk quota warning level violations.

Severity: yellow-3

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Encrypted File System module

This section includes the following topics:

  • About the Encrypted File System module

  • Supported operating systems: Encrypted File System

  • EFS not supported (Windows)

  • File recovery agents not authorized (Windows)

  • Files can be decrypted by others (Windows)

  • Percentage of encrypted files (Windows)


About the Encrypted File System module

The Encrypted File System module checks if the Encrypted File System (EFS) is supported and being used. It also reports the different aspects of the EFS configuration.


Supported operating systems: Encrypted File System

The Encrypted File System module is supported on the following operating systems:

  • Windows 2000

  • Windows 2003

  • Windows 2008

  • Windows Vista

  • Windows XP


EFS not supported (Windows)

Module: Encrypted File System

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports volumes with file systems that do not support an Encrypting File System (EFS). Only NT file system (NTFS) version 5.0 or higher supports EFS.

The following table lists the error message for the check.

Table: Error message for EFS not supported

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_EFS_NOT_SUPPORTED

Category: System Information

  • Windows 2000 (106930)

  • Windows 2003 (206930)

  • Windows 2008 (249930)

  • Windows Vista (229930)

  • Windows XP (201930)

Title: EFS not supported

Description:Encrypting File System (EFS) is not supported on this volume. Only NT file system (NTFS) version 5.0 or higher supports EFS.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [File system type: %s]


File recovery agents not authorized (Windows)

Module: Encrypted File System

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports files with recovery agents that are not specified in the name list. The name list can contain user names or certificate thumbprints or both. If the name list is empty, no errors will be detected.

The following table lists the error messages for the check.

Table: Error messages for File recovery agents not authorized

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_EFS_OTHER_RECOVERY_AGENTS

Category: System Information

  • Windows 2000 (106933)

  • Windows 2003 (206933)

  • Windows 2008 (249933)

  • Windows Vista (229933)

  • Windows XP (201933)

Title: Recovery agent name not authorized

Description:The file recovery agent name is not specified in the name list of authorized recovery agents.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Recovery agent: %s]

String ID: ESM_EFS_RECOVERY_AGENTS_THUMBPRINT

Category: System Information

  • Windows 2000 (106934)

  • Windows 2003 (206934)

  • Windows 2008 (249934)

  • Windows Vista (229934)

  • Windows XP (201934)

Title: Recovery agent thumbprint not authorized

Description:The file recovery agent thumbprint is not specified in the name list of authorized recovery agents.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Recovery agent certificate thumbprint: %s]


Files can be decrypted by others (Windows)

Module: Encrypted File System

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

Encrypted files contain an access list of users that can decrypt the file. This check reports files that can be decrypted by users other than the file owner. You can use the name list to exclude files owned by specific users or security groups from being checked.

The following table lists the error messages for the check.

Table: Error messages for Files can be decrypted by others

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_EFS_DECRYPTED_BY_OTHERS

Category: System Information

  • Windows 2000 (106932)

  • Windows 2003 (206932)

  • Windows 2008 (249932)

  • Windows Vista (229932)

  • Windows XP (201932)

Title: File can be decrypted by others

Description:The file can be decrypted by someone other than the file owner.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Owner: %s; can also be decrypted by: %s]

String ID: ESM_EFS_NOSID

Category: System Information

  • Windows 2000 (106935)

  • Windows 2003 (206935)

  • Windows 2008 (249935)

  • Windows Vista (229935)

  • Windows XP (201935)

Title: Certificate does not match any valid user

Description:The file can be decrypted by a certificate with no matching user. Remove this certificate from the access list for the file.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Certificate name: %s]


Percentage of encrypted files (Windows)

Module: Encrypted File System

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports the percentage of encrypted files on each volume.

The following table lists the error message for the check.

Table: Error message for Percentage of encrypted files

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_EFS_PERCENTAGE

Category: System Information

  • Windows 2000 (106931)

  • Windows 2003 (206931)

  • Windows 2008 (249931)

  • Windows Vista (229931)

  • Windows XP (201931)

Title: EFS percentage

Description:This volume contains the indicated percentage of encrypted files.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Percentage of files encrypted: %s (%s files)]


File Attributes module

This section includes the following topics:

  • About the File Attributes module

  • Supported operating systems: File Attributes

  • Allow any privileged account (Windows)

  • Auditing ACL (Windows)

  • Automatically update snapshots (Windows)

  • Changed file (signature) (Windows)

  • Changed file (size) (Windows)

  • Changed file (times) (Windows)

  • Display fully qualified names in Name field (Windows)

  • Do not notify if User/Group in ACL is not on system (Windows)

  • Do not notify if file permissions are increased in security (Windows)

  • Event Log Info (Windows)

  • File ACL (Windows)

  • File and folder attributes (Windows)

  • File and folder ownership (Windows)

  • File and folder permissions (Windows)

  • Files giving all users Full Control (Windows)

  • Hidden files and folders (Windows)

  • Keywords list (Windows)

  • Maximum reported messages (Windows)

  • Template file list (Windows)


About the File Attributes module

The security checks in the File Attributes module compare the current settings with the File template records and report changes in file ownership, size, creation time, and modification. The module also reports changes in the access control lists (ACLs), results of checksum checks, and folders for which the Everyone group has full control permissions.

Some messages report messages that you can use to update the template or snapshot files to match the current agent settings.

Other checks report the messages that you can use to reverse agent settings or disable user accounts.

Updatable and correctable messages are identified as TU, SU, or C types in the descriptions of checks that use them.

When you run a policy that contains the File Attributes module, the module compares current file attributes to records in File templates before it runs enabled security checks.

Note:

The module examines the File Keywords template for the file path names that are identified by variable keywords. The keywords are enclosed in percent (%) signs in the File template. When the module does not find a match, it handles the path name as it would if it did not contain a keyword. If the file is mandatory and the module cannot match the file name, it reports the Mandatory file does not exist message.


Supported operating systems: File Attributes

The File Attributes module is supported on the following operating systems:

  • Windows 2000

  • Windows 2003

  • Windows 2008

  • Windows Vista

  • Windows XP


Allow any privileged account (Windows)

Module: File Attributes

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

When this option is enabled, the File ownership and ACL checks treat all privileged accounts identically. Privileged accounts are members of the Administrators security group. Usually, ownership or access to system files by any privileged account is acceptable. For example, if the template specifies that a file should be owned by Administrator, privileged account owners are not reported. This option lets you accommodate variations in ownership between different versions or installations of the same operating system without changing templates.

The following table lists the error messages for the check.

Table: Error messages for Allow any privileged account

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESMT_ADDITIONAL_ENTRY

Category: Policy Compliance

  • Windows 2000 (105534)

  • Windows 2003 (205534)

  • Windows 2008 (248534)

  • Windows Vista (228534)

  • Windows XP (200534)

Title: Additional ACL entry

Description:The file's access permissions include an account that is not listed in the template. If the account is authorized to access the file, manually update the template. If it is not authorized, remove the account's access to the file, then run the Changed file (signature) check. It is possible to modify a file without changing the modification time.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMT_DIFFERENT_ENTRY

Category: Policy Compliance

  • Windows 2000 (105535)

  • Windows 2003 (205535)

  • Windows 2008 (248535)

  • Windows Vista (228535)

  • Windows XP (200535)

Title: Different ACL entry

Description:The file's access permissions do not match the template. If the current setting is authorized, manually update the template. If it is not authorized, set the ACLs to match the template, then run the Changed file (signature) check. It is possible to modify a file without changing the modification time.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMT_MISSING_ENTRY

Category: Policy Compliance

  • Windows 2000 (105536)

  • Windows 2003 (205536)

  • Windows 2008 (248536)

  • Windows Vista (228536)

  • Windows XP (200536)

Title: Missing ACL entry

Description:The file's ACLs do not give access to an account that is specified in template. If the account should not have access, manually update the template. If the account should have access, set the ACLs to match the template, then run the Changed file (signature) check. It is possible for an intruder to modify a file without changing the modification time.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMT_ADDITIONAL_SACL_ENTRY

Category: Policy Compliance

  • Windows 2000 (105542)

  • Windows 2003 (205542)

  • Windows 2008 (248542)

  • Windows Vista (228542)

  • Windows XP (200542)

Title: Additional SACL entry

Description:The file is being audited for an account that is not specified in the template. If auditing should be performed for this account, add the account to the template. If it should not be performed, remove the account from the file's auditing settings.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMT_DIFFERENT_SACL_ENTRY

Category: Policy Compliance

  • Windows 2000 (105540)

  • Windows 2003 (205540)

  • Windows 2008 (248540)

  • Windows Vista (228540)

  • Windows XP (200540)

Title: Different SACL entry

Description:The current audit setting for the file does not match the File template setting. If the current setting is correct, manually update the template. If the setting is incorrect, change the file's auditing settings to match the template.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMT_MISSING_SACL_ENTRY

Category: Policy Compliance

  • Windows 2000 (105541)

  • Windows 2003 (205541)

  • Windows 2008 (248541)

  • Windows Vista (228541)

  • Windows XP (200541)

Title: Missing SACL entry

Description:The file is not audited for the account that is specified in the Information field. If auditing should not be performed for this account, manually update the template. If it should be performed, change the file's auditing settings to match the template.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Auditing ACL (Windows)

Module: File Attributes

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports a problem if auditing settings (or System ACLs) do not match the values in their associated template records.

The following table lists the error messages for the check.

Table: Error messages for Auditing ACL

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESMT_DIFFERENT_SACL_ENTRY

Category: Policy Compliance

  • Windows 2000 (105540)

  • Windows 2003 (205540)

  • Windows 2008 (248540)

  • Windows Vista (228540)

  • Windows XP (200540)

Title: Different SACL entry

Description:The current audit setting for the file does not match the File template setting. If the current setting is correct, manually update the template. If the setting is incorrect, change the file's auditing settings to match the template.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMT_MISSING_SACL_ENTRY

Category: Policy Compliance

  • Windows 2000 (105541)

  • Windows 2003 (205541)

  • Windows 2008 (248541)

  • Windows Vista (228541)

  • Windows XP (200541)

Title: Missing SACL entry

Description:The file is not audited for the account that is specified in the Information field. If auditing should not be performed for this account, manually update the template. If it should be performed, change the file's auditing settings to match the template.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMT_ADDITIONAL_SACL_ENTRY

Category: Policy Compliance

  • Windows 2000 (105542)

  • Windows 2003 (205542)

  • Windows 2008 (248542)

  • Windows Vista (228542)

  • Windows XP (200542)

Title: Additional SACL entry

Description:The file is being audited for an account that is not specified in the template. If auditing should be performed for this account, add the account to the template. If it should not be performed, remove the account from the file's auditing settings.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMT_EVENT_LOG_INFO

Category: Policy Compliance

  • Windows 2000 (105559)

  • Windows 2003 (205559)

  • Windows 2008 (248559)

  • Windows Vista (228559)

  • Windows XP (200559)

Title: File or folder Event Log Entry

Description:An entry in the Security Audit Event Log occurred for this file or folder.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMT_AUDIT_ACL_DISABLED_ACCOUNTS

Category: Policy Compliance

  • Windows 2000 (105561)

  • Windows 2003 (205561)

  • Windows 2008 (248561)

  • Windows Vista (228561)

  • Windows XP (200561)

Title: Disabled Accounts in Auditing ACL

Description:List of disabled accounts in Auditing ACL.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Automatically update snapshots (Windows)

Module: File Attributes

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

Enable this option to automatically update snapshots with current information.


Changed file (signature) (Windows)

Module: File Attributes

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports changes in file signatures since the last snapshot update. In the Signature field of the File template, select a signature type to perform (CRC and/or MD5). Signature checks provide the highest degree of vulnerability detection. They are also among the most time-intensive checks. If the module takes too long, carefully consider which files warrant the most careful scrutiny and exclude the others by selecting None for them in the Signature field. Instead of the Changed file (signature) check, use the Changed file (times) or Changed file (size) checks for these files.

The following table lists the error messages for the check.

Table: Error messages for Changed file (signature)

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESMT_SNAPSHOT_MISMATCH

Category: Policy Compliance

  • Windows 2000 (105530)

  • Windows 2003 (205530)

  • Windows 2008 (248530)

  • Windows Vista (228530)

  • Windows XP (200530)

Title: File has changed

Description:The file has changed since the last snapshot update. If the change is authorized, update the snapshot file. If the change is not authorized, restore the file from a backup copy or from the original distribution media, then run the Changed file (signature) check. It is possible to modify a file without changing the modification time.

Severity: yellow-1

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [%s]

String ID: ESMT_EVENT_LOG_INFO

Category: Policy Compliance

  • Windows 2000 (105559)

  • Windows 2003 (205559)

  • Windows 2008 (248559)

  • Windows Vista (228559)

  • Windows XP (200559)

Title: File or folder Event Log Entry

Description:An entry in the Security Audit Event Log occurred for this file or folder.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Changed file (size) (Windows)

Module: File Attributes

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports changes in file size since the last snapshot update if the Size option is checked in the file's associated template record.

The following table lists the error message for the check.

Table: Error message for Changed file (size)

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESMT_SNAPSHOT_MISMATCH

Category: Policy Compliance

  • Windows 2000 (105530)

  • Windows 2003 (205530)

  • Windows 2008 (248530)

  • Windows Vista (228530)

  • Windows XP (200530)

Title: File has changed

Description:The file has changed since the last snapshot update. If the change is authorized, update the snapshot file. If the change is not authorized, restore the file from a backup copy or from the original distribution media, then run the Changed file (signature) check. It is possible to modify a file without changing the modification time.

Severity: yellow-1

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [%s]


Changed file (times) (Windows)

Module: File Attributes

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports changes in file creation and modification times since the last snapshot update if the Create time or Modify time options are checked in the file's associated template record.

The following table lists the error message for the check.

Table: Error message for Changed file (times)

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESMT_SNAPSHOT_MISMATCH

Category: Policy Compliance

  • Windows 2000 (105530)

  • Windows 2003 (205530)

  • Windows 2008 (248530)

  • Windows Vista (228530)

  • Windows XP (200530)

Title: File has changed

Description:The file has changed since the last snapshot update. If the change is authorized, update the snapshot file. If the change is not authorized, restore the file from a backup copy or from the original distribution media, then run the Changed file (signature) check. It is possible to modify a file without changing the modification time.

Severity: yellow-1

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [%s]


Display fully qualified names in Name field (Windows)

Module: File Attributes

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

Enable this option to display the fully qualified names when they are available.

The following table lists the error messages for the check.

Table: Error messages for Display fully qualified names in Name field

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESMT_FILEAT_OWNER_MMAT

Category: Policy Compliance

  • Windows 2000 (105531)

  • Windows 2003 (205531)

  • Windows 2008 (248531)

  • Windows Vista (228531)

  • Windows XP (200531)

Title: Different file ownership

Description:The file owner does not match the template. If the owner is authorized, update the template. If the owner is not authorized, correct the file owner, then run the Changed file (signature) check.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: true

Information Field Format: [%s]

String ID: ESMT_FOLDERAT_OWNER_MMAT

Category: Policy Compliance

  • Windows 2000 (105554)

  • Windows 2003 (205554)

  • Windows 2008 (248554)

  • Windows Vista (228554)

  • Windows XP (200554)

Title: Different folder ownership

Description:The folder owner does not match the template. If the owner is authorized, update the template. If the owner is not authorized, correct the folder owner.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: true

Information Field Format: [%s]

String ID: ESMT_DIRECTORY_PERMS

Category: Policy Compliance

  • Windows 2000 (105545)

  • Windows 2003 (205545)

  • Windows 2008 (248545)

  • Windows Vista (228545)

  • Windows XP (200545)

Title: Folder permissions

Description:The account has the folder permissions that are reported in the Information field.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMT_FILE_PERMS

Category: Policy Compliance

  • Windows 2000 (105546)

  • Windows 2003 (205546)

  • Windows 2008 (248546)

  • Windows Vista (228546)

  • Windows XP (200546)

Title: File permissions

Description:The account has the file permissions that are reported in the Information field.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMT_FILEAT_OWNER_NOT_FOUND

Category: Policy Compliance

  • Windows 2000 (105552)

  • Windows 2003 (205552)

  • Windows 2008 (248552)

  • Windows Vista (228552)

  • Windows XP (200552)

Title: Specified owner not found

Description:The file's owner does not match the owner that is specified in the File template and the owner that is specified in the template does not exist. If the current owner is authorized, manually update the template. If the current owner is not authorized, restore the owner's user account and file ownership, then run the Changed file (signature) check.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMT_ADDITIONAL_ENTRY

Category: Policy Compliance

  • Windows 2000 (105534)

  • Windows 2003 (205534)

  • Windows 2008 (248534)

  • Windows Vista (228534)

  • Windows XP (200534)

Title: Additional ACL entry

Description:The file's access permissions include an account that is not listed in the template. If the account is authorized to access the file, manually update the template. If it is not authorized, remove the account's access to the file, then run the Changed file (signature) check. It is possible to modify a file without changing the modification time.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMT_DIFFERENT_ENTRY

Category: Policy Compliance

  • Windows 2000 (105535)

  • Windows 2003 (205535)

  • Windows 2008 (248535)

  • Windows Vista (228535)

  • Windows XP (200535)

Title: Different ACL entry

Description:The file's access permissions do not match the template. If the current setting is authorized, manually update the template. If it is not authorized, set the ACLs to match the template, then run the Changed file (signature) check. It is possible to modify a file without changing the modification time.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMT_MISSING_ENTRY

Category: Policy Compliance

  • Windows 2000 (105536)

  • Windows 2003 (205536)

  • Windows 2008 (248536)

  • Windows Vista (228536)

  • Windows XP (200536)

Title: Missing ACL entry

Description:The file's ACLs do not give access to an account that is specified in template. If the account should not have access, manually update the template. If the account should have access, set the ACLs to match the template, then run the Changed file (signature) check. It is possible for an intruder to modify a file without changing the modification time.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMT_ADDITIONAL_SACL_ENTRY

Category: Policy Compliance

  • Windows 2000 (105542)

  • Windows 2003 (205542)

  • Windows 2008 (248542)

  • Windows Vista (228542)

  • Windows XP (200542)

Title: Additional SACL entry

Description:The file is being audited for an account that is not specified in the template. If auditing should be performed for this account, add the account to the template. If it should not be performed, remove the account from the file's auditing settings.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMT_DIFFERENT_SACL_ENTRY

Category: Policy Compliance

  • Windows 2000 (105540)

  • Windows 2003 (205540)

  • Windows 2008 (248540)

  • Windows Vista (228540)

  • Windows XP (200540)

Title: Different SACL entry

Description:The current audit setting for the file does not match the File template setting. If the current setting is correct, manually update the template. If the setting is incorrect, change the file's auditing settings to match the template.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMT_MISSING_SACL_ENTRY

Category: Policy Compliance

  • Windows 2000 (105541)

  • Windows 2003 (205541)

  • Windows 2008 (248541)

  • Windows Vista (228541)

  • Windows XP (200541)

Title: Missing SACL entry

Description:The file is not audited for the account that is specified in the Information field. If auditing should not be performed for this account, manually update the template. If it should be performed, change the file's auditing settings to match the template.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Do not notify if User/Group in ACL is not on system (Windows)

Module: File Attributes

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

When this option is enabled, the ACL check ignores user names that are specified in the template ACL sublist but do not exist in the system. When this option is disabled, the ACL check reports these users as users that do not exist on the system.

The following table lists the error message for the check.

Table: Error message for Do not notify if User/Group in ACL is not on system

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESMT_NOOWNER

Category: Policy Compliance

  • Windows 2000 (105553)

  • Windows 2003 (205553)

  • Windows 2008 (248553)

  • Windows Vista (228553)

  • Windows XP (200553)

Title: Account specified in template does not exist on system

Description:An account that is specified in a template ACL sublist does not exist. If the account should exist, add it to the system. If it should not exist, manually update the template.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Do not notify if file permissions are increased in security (Windows)

Module: File Attributes

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

When this option is enabled, the ACL check reports only file permissions changes that increase file accesses (which decreases security). When this option is disabled, all changes to file permissions are reported.


Event Log Info (Windows)

Module: File Attributes

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

Enable this option to get file access information from the Windows Event logs. The edit field is used for checks that do not use snapshots, it specifies the number of days back to search in the event log.


File ACL (Windows)

Module: File Attributes

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports a problem if file and folder permissions do not match the values in their associated template records.

The following table lists the error messages for the check.

Table: Error messages for File ACL

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESMT_ADDITIONAL_ENTRY

Category: Policy Compliance

  • Windows 2000 (105534)

  • Windows 2003 (205534)

  • Windows 2008 (248534)

  • Windows Vista (228534)

  • Windows XP (200534)

Title: Additional ACL entry

Description:The file's access permissions include an account that is not listed in the template. If the account is authorized to access the file, manually update the template. If it is not authorized, remove the account's access to the file, then run the Changed file (signature) check. It is possible to modify a file without changing the modification time.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMT_DIFFERENT_ENTRY

Category: Policy Compliance

  • Windows 2000 (105535)

  • Windows 2003 (205535)

  • Windows 2008 (248535)

  • Windows Vista (228535)

  • Windows XP (200535)

Title: Different ACL entry

Description:The file's access permissions do not match the template. If the current setting is authorized, manually update the template. If it is not authorized, set the ACLs to match the template, then run the Changed file (signature) check. It is possible to modify a file without changing the modification time.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMT_MISSING_ENTRY

Category: Policy Compliance

  • Windows 2000 (105536)

  • Windows 2003 (205536)

  • Windows 2008 (248536)

  • Windows Vista (228536)

  • Windows XP (200536)

Title: Missing ACL entry

Description:The file's ACLs do not give access to an account that is specified in template. If the account should not have access, manually update the template. If the account should have access, set the ACLs to match the template, then run the Changed file (signature) check. It is possible for an intruder to modify a file without changing the modification time.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMT_NOACL

Category: Policy Compliance

  • Windows 2000 (105539)

  • Windows 2003 (205539)

  • Windows 2008 (248539)

  • Windows Vista (228539)

  • Windows XP (200539)

Title: File stored on volume that does not support ACLs

Description:One or more files that are specified in a File template are stored on a volume that does not support persistent ACLs. There is little or no control over who can access these files. Convert all volumes with FAT file systems to NTFS to implement support for ACLs.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMT_NOOWNER

Category: Policy Compliance

  • Windows 2000 (105553)

  • Windows 2003 (205553)

  • Windows 2008 (248553)

  • Windows Vista (228553)

  • Windows XP (200553)

Title: Account specified in template does not exist on system

Description:An account that is specified in a template ACL sublist does not exist. If the account should exist, add it to the system. If it should not exist, manually update the template.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMT_EVENT_LOG_INFO

Category: Policy Compliance

  • Windows 2000 (105559)

  • Windows 2003 (205559)

  • Windows 2008 (248559)

  • Windows Vista (228559)

  • Windows XP (200559)

Title: File or folder Event Log Entry

Description:An entry in the Security Audit Event Log occurred for this file or folder.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMT_FILE_ACL_DISABLED_ACCOUNTS

Category: Policy Compliance

  • Windows 2000 (105560)

  • Windows 2003 (205560)

  • Windows 2008 (248560)

  • Windows Vista (228560)

  • Windows XP (200560)

Title: Disabled Accounts in File ACL

Description:List of disabled accounts in File ACL.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


File and folder attributes (Windows)

Module: File Attributes

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports a problem if the current Read-Only, Hidden, and System attributes of the file or folder do not match the values specified in the template.

The following table lists the error messages for the check.

Table: Error messages for File and folder attributes

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESMT_ATTRIB_MISMATCH

Category: Policy Compliance

  • Windows 2000 (105532)

  • Windows 2003 (205532)

  • Windows 2008 (248532)

  • Windows Vista (228532)

  • Windows XP (200532)

Title: Different file attributes

Description:The file attributes do not match the template. If the current setting is authorized, update the template. If the attributes are not authorized, use the Correct feature to revert the settings, then run the Changed file (signature) check.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: true

Information Field Format: [%s]

String ID: ESMT_FOLDER_ATTRIB_MISMATCH

Category: Policy Compliance

  • Windows 2000 (105555)

  • Windows 2003 (205555)

  • Windows 2008 (248555)

  • Windows Vista (228555)

  • Windows XP (200555)

Title: Different folder attributes

Description:The folder attributes do not match the template. If the current setting is authorized, update the template. If the attributes are not authorized, use the Correct feature to revert the settings.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: true

Information Field Format: [%s]

String ID: ESMT_EVENT_LOG_INFO

Category: Policy Compliance

  • Windows 2000 (105559)

  • Windows 2003 (205559)

  • Windows 2008 (248559)

  • Windows Vista (228559)

  • Windows XP (200559)

Title: File or folder Event Log Entry

Description:An entry in the Security Audit Event Log occurred for this file or folder.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


File and folder ownership (Windows)

Module: File Attributes

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports a problem if the current file or folder owner does not match the owner specified in the template.

The following table lists the error messages for the check.

Table: Error messages for File and folder ownership

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESMT_FILEAT_OWNER_MMAT

Category: Policy Compliance

  • Windows 2000 (105531)

  • Windows 2003 (205531)

  • Windows 2008 (248531)

  • Windows Vista (228531)

  • Windows XP (200531)

Title: Different file ownership

Description:The file owner does not match the template. If the owner is authorized, update the template. If the owner is not authorized, correct the file owner, then run the Changed file (signature) check.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: true

Information Field Format: [%s]

String ID: ESMT_FOLDERAT_OWNER_MMAT

Category: Policy Compliance

  • Windows 2000 (105554)

  • Windows 2003 (205554)

  • Windows 2008 (248554)

  • Windows Vista (228554)

  • Windows XP (200554)

Title: Different folder ownership

Description:The folder owner does not match the template. If the owner is authorized, update the template. If the owner is not authorized, correct the folder owner.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: true

Information Field Format: [%s]

String ID: ESMT_FILEAT_OWNER_NOT_FOUND

Category: Policy Compliance

  • Windows 2000 (105552)

  • Windows 2003 (205552)

  • Windows 2008 (248552)

  • Windows Vista (228552)

  • Windows XP (200552)

Title: Specified owner not found

Description:The file's owner does not match the owner that is specified in the File template and the owner that is specified in the template does not exist. If the current owner is authorized, manually update the template. If the current owner is not authorized, restore the owner's user account and file ownership, then run the Changed file (signature) check.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMT_EVENT_LOG_INFO

Category: Policy Compliance

  • Windows 2000 (105559)

  • Windows 2003 (205559)

  • Windows 2008 (248559)

  • Windows Vista (228559)

  • Windows XP (200559)

Title: File or folder Event Log Entry

Description:An entry in the Security Audit Event Log occurred for this file or folder.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


File and folder permissions (Windows)

Module: File Attributes

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports file and folder permissions. Enter the files/folders to be checked in name list.

The following table lists the error messages for the check.

Table: Error messages for File and folder permissions

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESMT_DIRECTORY_PERMS

Category: Policy Compliance

  • Windows 2000 (105545)

  • Windows 2003 (205545)

  • Windows 2008 (248545)

  • Windows Vista (228545)

  • Windows XP (200545)

Title: Folder permissions

Description:The account has the folder permissions that are reported in the Information field.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMT_FILE_PERMS

Category: Policy Compliance

  • Windows 2000 (105546)

  • Windows 2003 (205546)

  • Windows 2008 (248546)

  • Windows Vista (228546)

  • Windows XP (200546)

Title: File permissions

Description:The account has the file permissions that are reported in the Information field.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMT_FILE_LOCKED

Category: Policy Compliance

  • Windows 2000 (105550)

  • Windows 2003 (205550)

  • Windows 2008 (248550)

  • Windows Vista (228550)

  • Windows XP (200550)

Title: Locked file

Description:File permissions cannot be reported because the file is being used by another process.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: []

String ID: ESMT_FILE_NOT_FOUND

Category: Policy Compliance

  • Windows 2000 (105551)

  • Windows 2003 (205551)

  • Windows 2008 (248551)

  • Windows Vista (228551)

  • Windows XP (200551)

Title: File or folder not found

Description:The file or folder was not found.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: []

String ID: ESMT_FILEANDFOLDER_DISABLED_ACCOUNTS

Category: Policy Compliance

  • Windows 2000 (105562)

  • Windows 2003 (205562)

  • Windows 2008 (248562)

  • Windows Vista (228562)

  • Windows XP (200562)

Title: Disabled Accounts in File/Folder permissions

Description:List of disabled accounts in File and Folder permissions.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Files giving all users Full Control (Windows)

Module: File Attributes

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports files and folders that give Full Control to the Everyone security group. All users have Full Control of these files and folders unless access is specifically denied. Enter the files and/or folders to be checked in name list.

The following table lists the error messages for the check.

Table: Error messages for Files giving all users Full Control

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESMT_FILES_WITH_ALL_ACCESS

Category: Policy Compliance

  • Windows 2000 (105549)

  • Windows 2003 (205549)

  • Windows 2008 (248549)

  • Windows Vista (228549)

  • Windows XP (200549)

Title: File or folder giving all users Full Control

Description:The file or folder gives the local Everyone group Full Control. If this is correct, remove the file or folder from the check's name list. If it is incorrect, remove the Everyone group from the file or folder access list.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: []

String ID: ESMT_FILE_LOCKED

Category: Policy Compliance

  • Windows 2000 (105550)

  • Windows 2003 (205550)

  • Windows 2008 (248550)

  • Windows Vista (228550)

  • Windows XP (200550)

Title: Locked file

Description:File permissions cannot be reported because the file is being used by another process.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: []

String ID: ESMT_FILE_NOT_FOUND

Category: Policy Compliance

  • Windows 2000 (105551)

  • Windows 2003 (205551)

  • Windows 2008 (248551)

  • Windows Vista (228551)

  • Windows XP (200551)

Title: File or folder not found

Description:The file or folder was not found.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: []


Hidden files and folders (Windows)

Module: File Attributes

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports hidden files and folders. Enter the files/folders to be checked in the name list.

The following table lists the error messages for the check.

Table: Error messages for Hidden files and folders

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESMT_HIDDEN_DIRECTORY

Category: Policy Compliance

  • Windows 2000 (105543)

  • Windows 2003 (205543)

  • Windows 2008 (248543)

  • Windows Vista (228543)

  • Windows XP (200543)

Title: Hidden folder

Description:The folder is hidden.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: []

String ID: ESMT_HIDDEN_FILE

Category: Policy Compliance

  • Windows 2000 (105544)

  • Windows 2003 (205544)

  • Windows 2008 (248544)

  • Windows Vista (228544)

  • Windows XP (200544)

Title: Hidden file

Description:The file is hidden.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: []

String ID: ESMT_FILE_LOCKED

Category: Policy Compliance

  • Windows 2000 (105550)

  • Windows 2003 (205550)

  • Windows 2008 (248550)

  • Windows Vista (228550)

  • Windows XP (200550)

Title: Locked file

Description:File permissions cannot be reported because the file is being used by another process.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: []

String ID: ESMT_FILE_NOT_FOUND

Category: Policy Compliance

  • Windows 2000 (105551)

  • Windows 2003 (205551)

  • Windows 2008 (248551)

  • Windows Vista (228551)

  • Windows XP (200551)

Title: File or folder not found

Description:The file or folder was not found.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: []

String ID: ESMT_ERR_FILEATT

Category: Policy Compliance

  • Windows 2000 (105563)

  • Windows 2003 (205563)

  • Windows 2008 (248563)

  • Windows Vista (228563)

  • Windows XP (200563)

Title: Error reading File Attributes

Description:Error reading File Attributes.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Keywords list (Windows)

Module: File Attributes

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This option lets you enable or disable File Keywords templates that File templates use to locate file paths according to registry values. The windows.fkl File Keywords template must be enabled when using any of the Windows File templates.


Maximum reported messages (Windows)

Module: File Attributes

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

Enable this option to limit the number of messages returned for each enabled check. Use the value field to specify the maximum number of times a given message should be displayed. Once the maximum number has been reached for a single message, the message will be displayed once more with the number of repeating instances of the message that are not reported.


Template file list (Windows)

Module: File Attributes

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This option lets you enable and disable the File template files that are used to check file attributes.

The following table lists the error messages for the check.

Table: Error messages for Template file list

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESMT_FILE_MISSING

Category: Policy Compliance

  • Windows 2000 (105533)

  • Windows 2003 (205533)

  • Windows 2008 (248533)

  • Windows Vista (228533)

  • Windows XP (200533)

Title: No template files specified

Description:The File Attributes module was run without any template files. No security checks were performed. Check your policy to ensure that at least one template file is enabled for the agent's operating system.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMT_NOEXIST

Category: Policy Compliance

  • Windows 2000 (105537)

  • Windows 2003 (205537)

  • Windows 2008 (248537)

  • Windows Vista (228537)

  • Windows XP (200537)

Title: Mandatory file does not exist

Description:The mandatory file does not exist. If the file is not mandatory, manually update the template. If the file is mandatory, add the file to the system.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMT_FORBID

Category: Policy Compliance

  • Windows 2000 (105538)

  • Windows 2003 (205538)

  • Windows 2008 (248538)

  • Windows Vista (228538)

  • Windows XP (200538)

Title: Forbidden file exists

Description:A forbidden file exists. If it should not be forbidden, manually update the template. If the file is forbidden, remove the file.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMT_NOEXISTWC

Category: Policy Compliance

  • Windows 2000 (105547)

  • Windows 2003 (205547)

  • Windows 2008 (248547)

  • Windows Vista (228547)

  • Windows XP (200547)

Title: Mandatory wild card entry

Description:Wildcard characters are not allowed in the path of mandatory files. Enter full folder and file path names for mandatory folders and files in the template.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMT_FORBIDWC

Category: Policy Compliance

  • Windows 2000 (105548)

  • Windows 2003 (205548)

  • Windows 2008 (248548)

  • Windows Vista (228548)

  • Windows XP (200548)

Title: Forbidden wild card file exists

Description:A forbidden file exists. The file matches the specified wildcard pattern. If the file should not be forbidden, manually update the template. If it is forbidden, delete the file.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMT_FILE_NOT_FOUND

Category: Policy Compliance

  • Windows 2000 (105551)

  • Windows 2003 (205551)

  • Windows 2008 (248551)

  • Windows Vista (228551)

  • Windows XP (200551)

Title: File or folder not found

Description:The file or folder was not found.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: []

String ID: ESMT_NO_FILE_VERSION

Category: Policy Compliance

  • Windows 2000 (105557)

  • Windows 2003 (205557)

  • Windows 2008 (248557)

  • Windows Vista (228557)

  • Windows XP (200557)

Title: No file version information

Description:File version information was not supplied in or not able to retrieve from the specified file.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMT_UNMATCH_FILE_VERSION

Category: Policy Compliance

  • Windows 2000 (105558)

  • Windows 2003 (205558)

  • Windows 2008 (248558)

  • Windows Vista (228558)

  • Windows XP (200558)

Title: Unmatched file version information

Description:File version information was not matched in the specified file version defined in the template file.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


File Find module

This section includes the following topics:

  • About the File Find module

  • Supported operating systems: File Find

  • Filefind Keywords list (Windows)

  • Maximum reported messages (Windows)

  • Windows file content search (Windows)


About the File Find module

The File Find module examines certain file attributes and settings, uneven permissions, specified text strings, and unowned files.

The File Find module creates and maintains the filefind.dat snapshot file to detect the changes in the setuid and setgid attributes. You must run the File Find module one time to create a baseline snapshot file on an agent before you rerun the module to detect changes.


Supported operating systems: File Find

The File Find module is supported on the following operating systems:

  • Windows 2000

  • Windows 2003

  • Windows 2008

  • Windows Vista

  • Windows XP


Filefind Keywords list (Windows)

Module: File Find

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This option lets you enable or disable FileFind Keywords templates that FileFind templates use to locate file paths according to registry values. The windows.ffk File Keywords template must be enabled when using the Windows file content search check and associated templates.


Maximum reported messages (Windows)

Module: File Find

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

Enable this option to limit the number of messages returned for each enabled check. Use the value field to specify the maximum number of times a given message should be displayed. Once the maximum number has been reached for a single message, the message will be displayed once more with the number of repeating instances of the message that are not reported.


Windows file content search (Windows)

Module: File Find

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports files with contents that match text or text patterns that are defined in File Content Search templates. Use the name list to enable or disable the File Content Search templates.

The following table lists the error messages for the check.

Table: Error messages for Windows file content search

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_FCS_GREEN

Category: ESM Error

  • Windows 2000 (108230)

  • Windows 2003 (208230)

  • Windows 2008 (251230)

  • Windows Vista (231230)

  • Windows XP (203230)

Title: Green level content search matched

Description:Text items that were defined in the File Content Search template were matched. Please see the Info field for detailed information.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_FCS_YELLOW

Category: ESM Error

  • Windows 2000 (108231)

  • Windows 2003 (208231)

  • Windows 2008 (251231)

  • Windows Vista (231231)

  • Windows XP (203231)

Title: Yellow level content search matched

Description:Text items that were defined in the File Content Search template were matched. Please see the Info field for detailed information.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_FCS_RED

Category: ESM Error

  • Windows 2000 (108232)

  • Windows 2003 (208232)

  • Windows 2008 (251232)

  • Windows Vista (231232)

  • Windows XP (203232)

Title: Red level content search matched

Description:Text items that were defined in the File Content Search template were matched. Please see the Info field for detailed information.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_INVALID_FCS_ENTRY

Category: ESM Error

  • Windows 2000 (108233)

  • Windows 2003 (208233)

  • Windows 2008 (251233)

  • Windows Vista (231233)

  • Windows XP (203233)

Title: No block specified for 2nd pattern

Description:No block was specified for the 2nd pattern match in the File List sublist of the File Content Search template. When a 2nd pattern is specified, the B, E, or G Delimiter options must be used to define the text block that is searched.

Severity: yellow-3

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_INVALID_FCS_REGEX

Category: ESM Error

  • Windows 2000 (108234)

  • Windows 2003 (208234)

  • Windows 2008 (251234)

  • Windows Vista (231234)

  • Windows XP (203234)

Title: Invalid regex syntax

Description:The regular expression has syntax error.

Severity: yellow-3

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


File System Entitlement module

This section includes the following topics:

  • About the File System Entitlement module

  • Supported operating systems: File System Entitlement

  • Alternate Domain Controllers (Windows)

  • Entitlement folders and shares (Windows)

  • Exceptions only (Windows)

  • List Shares (Windows)

  • Maximum reported messages (Windows)

  • Preload User Information (Windows)

  • Prevent group expansion (Windows)

  • Report alternate path perms (Windows)

  • Report alternate share paths (Windows)

  • System information (Windows)

  • User and group information (Windows)

  • Users to report (Windows)


About the File System Entitlement module

The File System Entitlement module queries the effective permissions for folders and shares and reports the detailed user, group, and server information.

Note:

The ESM agent must be running as either an enterprise administrator or a domain administrator. The user that you decide to use must have at least read level access to each share that is scanned. The enterprise administrator is the suggested configuration. If the agent is running as a domain administrator, it is limited in its ability to gather data from other domains.


Supported operating systems: File System Entitlement

The File System Entitlement module is supported on the following operating systems:

  • Windows 2000

  • Windows 2003

  • Windows 2008


Alternate Domain Controllers (Windows)

Module: File System Entitlement

Supported Platforms: Windows 2000, Windows 2003, Windows 2008

Use this option to specify a list of Domain Controllers that should be used when looking up users in the Active Directory. Name list entries may use the format domain:controller where domain is a domain name and controller is the name of a domain controller. If this format is used, then the name list entry will only be used to query users belonging to that domain. If only the domain controller name is specified, it is assumed to be the name of a global catalog.


Entitlement folders and shares (Windows)

Module: File System Entitlement

Supported Platforms: Windows 2000, Windows 2003, Windows 2008

This option lets you enable and disable the File System Entitlement templates that will be used by this module. Available templates will be listed in the Enabled and Disabled lists. The template files are used to specify folder and share paths, as well as details such as the type of permissions to be reported.

The following table lists the error messages for the check.

Table: Error messages for Entitlement folders and shares

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: FE_FOLDER_PERMS

Category: ESM Error

  • Windows 2000 (109853)

  • Windows 2003 (209853)

  • Windows 2008 (252853)

Title: Folder effective permissions

Description:The specified user has the listed effective permissions for the folder. These permissions are those available to the user when the folder is accessed locally, and do not take into account any share permissions. If the user inherits these permissions, then the inheritance trail to the group granting the permissions is also displayed.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: FE_SHARE_PERMS

Category: ESM Error

  • Windows 2000 (109854)

  • Windows 2003 (209854)

  • Windows 2008 (252854)

Title: Share effective permissions

Description:The specified user has the listed effective permissions for the share. These permissions do not take into account any local permission the user may have to folders on the share. If the user inherits these permissions, then the inheritance trail to the group granting the permissions is also displayed.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: FE_TOTAL_PERMS

Category: ESM Error

  • Windows 2000 (109855)

  • Windows 2003 (209855)

  • Windows 2008 (252855)

Title: Total effective permissions

Description:The specified user has the listed total effective permissions for the folder. These permissions are those available to the user when the folder is accessed through the reported share. If the user inherits these permissions, then the inheritance trail to the group granting the permissions is also displayed.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: FE_MACHINE_PERMS

Category: ESM Error

  • Windows 2000 (109856)

  • Windows 2003 (209856)

  • Windows 2008 (252856)

Title: Machine permissions

Description:The specified user has the listed machine permissions on the machine being scanned. If the user inherits these permissions, then the inheritance trail to the group granting the permissions is also displayed.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: FE_SHARE_DENIED

Category: ESM Error

  • Windows 2000 (109858)

  • Windows 2003 (209858)

  • Windows 2008 (252858)

Title: Access denied to share

Description:The ESM agent does not have access to the share reported in the name field.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: FE_NOTEMPLATES

Category: ESM Error

  • Windows 2000 (109859)

  • Windows 2003 (209859)

  • Windows 2008 (252859)

Title: No template files specified

Description:The File System Entitlement module was run without any template files. No entitlement checks were performed. Check your policy to ensure that at least one template file is enabled for this agent's operating system and rerun the module.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: FE_MACHINE_DENIED

Category: ESM Error

  • Windows 2000 (109860)

  • Windows 2003 (209860)

  • Windows 2008 (252860)

Title: Access denied to machine privileges

Description:The ESM agent does not have access to read machine privilege information for the privilege reported in the name field.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: FE_SHARE_NOT_FOUND

Category: ESM Error

  • Windows 2000 (109862)

  • Windows 2003 (209862)

  • Windows 2008 (252862)

Title: Specified share not found

Description:The ESM agent does not have access to the share reported in the name field.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: FE_FILE_NOT_FOUND

Category: ESM Error

  • Windows 2000 (109863)

  • Windows 2003 (209863)

  • Windows 2008 (252863)

Title: Specified file/folder not found

Description:Specified file/folder doesn't exist on agent.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Exceptions only (Windows)

Module: File System Entitlement

Supported Platforms: Windows 2000, Windows 2003, Windows 2008

Enable this option to report only ranges where the Exceptions Only check is selected in the template.


List Shares (Windows)

Module: File System Entitlement

Supported Platforms: Windows 2000, Windows 2003, Windows 2008

Enable this check to report all folders shared by the hosts listed in the name list.

The following table lists the error messages for the check.

Table: Error messages for List Shares

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: FE_SHARE

Category: ESM Error

  • Windows 2000 (109861)

  • Windows 2003 (209861)

  • Windows 2008 (252861)

Title: Share

Description:The folder listed in the name field is shared by the host specified in the information field.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: FE_SHARE_DENIED

Category: ESM Error

  • Windows 2000 (109858)

  • Windows 2003 (209858)

  • Windows 2008 (252858)

Title: Access denied to share

Description:The ESM agent does not have access to the share reported in the name field.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Maximum reported messages (Windows)

Module: File System Entitlement

Supported Platforms: Windows 2000, Windows 2003, Windows 2008

Enable this option to limit the number of messages returned for each enabled check. Use the value field to specify the maximum number of times a given message should be displayed. Once the maximum number has been reached for a single message, the message will be displayed once more with the number of repeating instances of the message that are not reported.


Preload User Information (Windows)

Module: File System Entitlement

Supported Platforms: Windows 2000, Windows 2003, Windows 2008

If this option is enabled, then only one request will be made to each of the Active Directory Domain controllers specified in the name list and all user information will be collected at the beginning of the policy run. If no Domain Controllers are specified in the name list, or if the Domain Controllers specified cannot be contacted, then the module will behave as though this option were not enabled.


Prevent group expansion (Windows)

Module: File System Entitlement

Supported Platforms: Windows 2000, Windows 2003, Windows 2008

Enable this option to prevent the groups listed in the name list from being expanded when reporting effective permissions. When this option is enabled, effective permissions are reported only for the specified group and not for each of the individual members of the group. Use this option to reduce the number of messages generated from large global groups.


Report alternate path perms (Windows)

Module: File System Entitlement

Supported Platforms: Windows 2000, Windows 2003, Windows 2008

Enable this check to report the effective share permissions for shares specified in enabled templates and to report total effective permissions for folders when either is accessed through an alternate share path. The alternate share may be a shared parent folder, or an alternate share name for the same folder.

The following table lists the error messages for the check.

Table: Error messages for Report alternate path perms

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: FE_SHARE_PERMS

Category: ESM Error

  • Windows 2000 (109854)

  • Windows 2003 (209854)

  • Windows 2008 (252854)

Title: Share effective permissions

Description:The specified user has the listed effective permissions for the share. These permissions do not take into account any local permission the user may have to folders on the share. If the user inherits these permissions, then the inheritance trail to the group granting the permissions is also displayed.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: FE_TOTAL_PERMS

Category: ESM Error

  • Windows 2000 (109855)

  • Windows 2003 (209855)

  • Windows 2008 (252855)

Title: Total effective permissions

Description:The specified user has the listed total effective permissions for the folder. These permissions are those available to the user when the folder is accessed through the reported share. If the user inherits these permissions, then the inheritance trail to the group granting the permissions is also displayed.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Report alternate share paths (Windows)

Module: File System Entitlement

Supported Platforms: Windows 2000, Windows 2003, Windows 2008

This check reports shares specified in enabled templates that can also be accessed from an alternate share. The alternate share may be a shared parent folder, or an alternate share name for the same folder.

The following table lists the error message for the check.

Table: Error message for Report alternate share paths

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: FE_NESTED_SHARE

Category: ESM Error

  • Windows 2000 (109857)

  • Windows 2003 (209857)

  • Windows 2008 (252857)

Title: Alternate share path

Description:The share reported in the name field can also be accessed through the share displayed in the information field. Nested shares may provide a less secure path to folders on the agent system.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


System information (Windows)

Module: File System Entitlement

Supported Platforms: Windows 2000, Windows 2003, Windows 2008

This check displays the agent system information. This information will include the systems distinguished name, GUID, domain, and a registry key value. Use the value field to specify the location in the Windows registry where they key value is to be retrieved.

The following table lists the error message for the check.

Table: Error message for System information

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: FE_AGENT_INFO

Category: ESM Error

  • Windows 2000 (109850)

  • Windows 2003 (209850)

  • Windows 2008 (252850)

Title: Agent system information

Description:The agent system's distinguished name, GUID, domain name, and key are reported in the information field of this message.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


User and group information (Windows)

Module: File System Entitlement

Supported Platforms: Windows 2000, Windows 2003, Windows 2008

This check displays information about the users and groups that have either directly assigned or inherited permissions to the folder and shares specified in the enabled templates. This check will display the user or group distinguished name, GUID, domain and SAM Account Name.

The following table lists the error messages for the check.

Table: Error messages for User and group information

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: FE_USER_INFO

Category: ESM Error

  • Windows 2000 (109851)

  • Windows 2003 (209851)

  • Windows 2008 (252851)

Title: User information

Description:The specified user's distinguished name, GUID, and domain name are reported in the information field of this message.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: FE_GROUP_INFO

Category: ESM Error

  • Windows 2000 (109852)

  • Windows 2003 (209852)

  • Windows 2008 (252852)

Title: Group information

Description:The specified group's distinguished name, GUID, and domain name are reported in the information field of this message.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Users to report (Windows)

Module: File System Entitlement

Supported Platforms: Windows 2000, Windows 2003, Windows 2008

Use this option to specify the users and groups that will be included or excluded by all File System Entitlement checks. An empty list will cause the module to report effective permissions for all users and groups.


File Watch module

This section includes the following topics:

  • About the File Watch module

  • Supported operating systems: File Watch

  • Automatically update snapshots (Windows)

  • Changed files (ownership) (Windows)

  • Changed files (signature) (Windows)

  • Event Log Info (Windows)

  • Files/folders to watch (Windows)

  • Ignore Directories (Windows)

  • Invalid signature (Windows)

  • Keywords list (Windows)

  • Malicious files (Windows)

  • New files (Windows)

  • Removed files (Windows)


About the File Watch module

The File Watch module reports changes to files since the last snapshot update and violations of template settings.

Most module security checks use File Watch templates, which define the files, folders, and operating systems that are watched, the depth of folder traversal, and the types of changes that are reported. These templates have .fw file extensions.

The Malicious files security check uses Malicious File Watch templates, which define known attack files and signature patterns. These files have .mfw extensions.

The Changed file (signature) security check uses File Signatures templates to compare the file signatures on the agent with the signatures that are stored in templates on Symantec ESM 5.1 and 5.5 managers. These templates have .fs file extensions.

You can use some File Watch messages to update snapshot or template files to match current agent settings. Updatable messages are identified as TU or SU types in the descriptions of checks that use them.

The File Watch messages that are not mapped to specific security checks are generated by the following:

  • The function that creates the baseline snapshot file the first time when the File Watch module is run on an agent

  • Checks and options that require enabled templates that are specified in the Files/ directories to watch option, the Malicious files check, and the Invalid signature check

  • Security checks that cannot locate, and therefore cannot check, a file or a directory that is listed in a template

  • Security checks that find a template entry for a remote file or directory that cannot be checked because the Local disks only option is enabled on a UNIX agent


Supported operating systems: File Watch

The File Watch module is supported on the following operating systems:

  • Windows 2000

  • Windows 2003

  • Windows 2008

  • Windows Vista

  • Windows XP


Automatically update snapshots (Windows)

Module: File Watch

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

Enable this option to automatically update snapshots with current information.


Changed files (ownership) (Windows)

Module: File Watch

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports ownership changes that affect files and subfolders within the folders that are watched.

The following table lists the error messages for the check.

Table: Error messages for Changed files (ownership)

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESMM_DIFF_OWN

Category: Policy Compliance

  • Windows 2000 (45933)

  • Windows 2003 (215333)

  • Windows 2008 (215833)

  • Windows Vista (215533)

  • Windows XP (49133)

Title: File ownership modified

Description:The file's ownership changed after the last snapshot update. If the change is authorized, update the snapshot. If it is not authorized, restore ownership to the previous owner.

Severity: yellow-1

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [%s]

String ID: ESMM_DIFF_OWN_GREEN

Category: Policy Compliance

  • Windows 2000 (45950)

  • Windows 2003 (215350)

  • Windows 2008 (215850)

  • Windows Vista (215550)

  • Windows XP (49150)

Title: File ownership modified (Green level)

Description:The file's ownership changed after the last snapshot update. If the change is authorized, update the snapshot. If it is not authorized, restore ownership to the previous owner.

Severity: green-0

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [%s]

String ID: ESMM_DIFF_OWN_YELLOW

Category: Policy Compliance

  • Windows 2000 (45951)

  • Windows 2003 (215351)

  • Windows 2008 (215851)

  • Windows Vista (215551)

  • Windows XP (49151)

Title: File ownership modified (Yellow level)

Description:The file's ownership changed after the last snapshot update. If the change is authorized, update the snapshot. If it is not authorized, restore ownership to the previous owner.

Severity: yellow-2

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [%s]

String ID: ESMM_DIFF_OWN_RED

Category: Policy Compliance

  • Windows 2000 (45952)

  • Windows 2003 (215352)

  • Windows 2008 (215852)

  • Windows Vista (215552)

  • Windows XP (49152)

Title: File ownership modified (Red level)

Description:The file's ownership changed after the last snapshot update. If the change is authorized, update the snapshot. If it is not authorized, restore ownership to the previous owner.

Severity: red-4

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [%s]


Changed files (signature) (Windows)

Module: File Watch

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check performs signature checks and compares current signatures against snapshot values to detect changed files in the folders being watched.

The following table lists the error messages for the check.

Table: Error messages for Changed files (signature)

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESMM_MODIFIED

Category: Policy Compliance

  • Windows 2000 (45934)

  • Windows 2003 (215334)

  • Windows 2008 (215834)

  • Windows Vista (215534)

  • Windows XP (49134)

Title: File modified

Description:The file changed after the last snapshot update. If the changes are authorized, update the snapshot. If they are not authorized, restore to the file from a backup.

Severity: yellow-1

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [%s]

String ID: ESMM_MODIFIED_GREEN

Category: Policy Compliance

  • Windows 2000 (45953)

  • Windows 2003 (215353)

  • Windows 2008 (215853)

  • Windows Vista (215553)

  • Windows XP (49153)

Title: File modified (Green level)

Description:The file changed after the last snapshot update. If the changes are authorized, update the snapshot. If they are not authorized, restore to the file from a backup.

Severity: green-0

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [%s]

String ID: ESMM_MODIFIED_YELLOW

Category: Policy Compliance

  • Windows 2000 (45954)

  • Windows 2003 (215354)

  • Windows 2008 (215854)

  • Windows Vista (215554)

  • Windows XP (49154)

Title: File modified (Yellow level)

Description:The file changed after the last snapshot update. If the changes are authorized, update the snapshot. If they are not authorized, restore to the file from a backup.

Severity: yellow-2

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [%s]

String ID: ESMM_MODIFIED_RED

Category: Policy Compliance

  • Windows 2000 (45955)

  • Windows 2003 (215355)

  • Windows 2008 (215855)

  • Windows Vista (215555)

  • Windows XP (49155)

Title: File modified (Red level)

Description:The file changed after the last snapshot update. If the changes are authorized, update the snapshot. If they are not authorized, restore to the file from a backup.

Severity: red-4

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [%s]


Event Log Info (Windows)

Module: File Watch

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

Enable this option to get file access information from the Windows Event logs. Use the Access option field to specify type of access, 0 is default for all access and 1 for modify access.

The following table lists the error message for the check.

Table: Error message for Event Log Info

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESMM_EVENT_LOG_INFO

Category: Policy Compliance

  • Windows 2000 (45956)

  • Windows 2003 (215356)

  • Windows 2008 (215856)

  • Windows Vista (215556)

  • Windows XP (49156)

Title: File or folder Event Log Entry

Description:An entry in the Security Audit Event Log occurred for this file or folder.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Files/folders to watch (Windows)

Module: File Watch

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This option lets you enable and disable templates that specify files and folders to be watched for changes. These .fw templates are cross-platform with platform designations specified within the template files themselves.

The following table lists the error messages for the check.

Table: Error messages for Files/folders to watch

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESMM_SNAPSHOT_TAKEN

Category: Policy Compliance

  • Windows 2000 (45930)

  • Windows 2003 (215330)

  • Windows 2008 (215830)

  • Windows Vista (215530)

  • Windows XP (49130)

Title: Snapshot taken

Description:A snapshot of the folder has been created. This message should only be reported the first time that the module is run with this folder in the name list. If this message is unexpected, the previous snapshot may have been deleted to conceal unauthorized changes.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMM_FILE_NOT_CHECKED

Category: Policy Compliance

  • Windows 2000 (45942)

  • Windows 2003 (215342)

  • Windows 2008 (215842)

  • Windows Vista (215542)

  • Windows XP (49142)

Title: File not checked

Description:The file or folder was not examined for the reason that is reported in the Information field.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMM_NO_TEMPLATE

Category: Policy Compliance

  • Windows 2000 (45943)

  • Windows 2003 (215343)

  • Windows 2008 (215843)

  • Windows Vista (215543)

  • Windows XP (49143)

Title: No template specified

Description:No template was enabled, so the listed check or option could not be executed. Enable a template with the appropriate file extension and rerun the module.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Ignore Directories (Windows)

Module: File Watch

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This option enables file watch security checks to ignore directories to file systems.


Invalid signature (Windows)

Module: File Watch

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports files with CRC, MD5, or combined file signatures that do not match signatures and signature types that are defined in the File Signatures template. Use the name list to enable or disable the selected File Signatures templates. These templates are identified by .fs file extensions.

The following table lists the error messages for the check.

Table: Error messages for Invalid signature

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESMM_SIG_NOTMATCH

Category: Policy Compliance

  • Windows 2000 (45939)

  • Windows 2003 (215339)

  • Windows 2008 (215839)

  • Windows Vista (215539)

  • Windows XP (49139)

Title: File signature does not match template

Description:The file signature does not match the signature that is specified in the File Signatures template. If the change is authorized, update the template file. If the change is not authorized, restore the file from a backup.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: true

Information Field Format: [%s]

String ID: ESMM_FILE_NOTEXIST

Category: Policy Compliance

  • Windows 2000 (45941)

  • Windows 2003 (215341)

  • Windows 2008 (215841)

  • Windows Vista (215541)

  • Windows XP (49141)

Title: Mandatory file does not exist

Description:The file is defined as mandatory in the File Signatures template, but it does not exist. Add the missing file to the system or change the requirement for the file in the template.

Severity: yellow-3

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMM_NO_TEMPLATE

Category: Policy Compliance

  • Windows 2000 (45943)

  • Windows 2003 (215343)

  • Windows 2008 (215843)

  • Windows Vista (215543)

  • Windows XP (49143)

Title: No template specified

Description:No template was enabled, so the listed check or option could not be executed. Enable a template with the appropriate file extension and rerun the module.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Keywords list (Windows)

Module: File Watch

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This option lets you enable or disable File Watch Keywords templates that File Watch templates use to locate file paths according to keyword values that correspond to registry locations or folder paths.


Malicious files (Windows)

Module: File Watch

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports files with signatures that match attack signatures that are defined in Malicious File Watch templates. Use the name list to enable or disable Malicious File Watch templates that are identified by .mfw file extensions.

The following table lists the error messages for the check.

Table: Error messages for Malicious files

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESMM_MALICIOUS_FILE

Category: Policy Compliance

  • Windows 2000 (45935)

  • Windows 2003 (215335)

  • Windows 2008 (215835)

  • Windows Vista (215535)

  • Windows XP (49135)

Title: Possible malicious file found

Description:The file signature matches the malicious file signature pattern that is reported in the Information field. Investigate the file to determine if it is malicious. Compare it with a known good copy if possible. If the file is found to be malicious, remove it from the system and follow the procedures specified by your company's security policy.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Name: %s; probability: %s%%; description: %s]

String ID: ESMM_MFW_TEMPLATE_ERR

Category: Policy Compliance

  • Windows 2000 (45936)

  • Windows 2003 (215336)

  • Windows 2008 (215836)

  • Windows Vista (215536)

  • Windows XP (49136)

Title: MFW template error

Description:The Malicious File Watch template file contains the error that is reported in the Information field. Correct the error manually, then rerun the check.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMM_MFW_ACCESS_BLOCKED

Category: Policy Compliance

  • Windows 2000 (45937)

  • Windows 2003 (215337)

  • Windows 2008 (215837)

  • Windows Vista (215537)

  • Windows XP (49137)

Title: File access blocked

Description:The file could not be examined by the Malicious files check. Access may be blocked by some application running on the system. (eg. anti-virus application etc.)

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMM_MALICIOUS_RUN_PROCESS

Category: Policy Compliance

  • Windows 2000 (45938)

  • Windows 2003 (215338)

  • Windows 2008 (215838)

  • Windows Vista (215538)

  • Windows XP (49138)

Title: Possible malicious run process found

Description:The run program matches a signature pattern of the malicious process that is specified in the Information field. Take appropriate action immediately.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Name: %s; probability: %s%%; description: %s]

String ID: ESMM_NO_TEMPLATE

Category: Policy Compliance

  • Windows 2000 (45943)

  • Windows 2003 (215343)

  • Windows 2008 (215843)

  • Windows Vista (215543)

  • Windows XP (49143)

Title: No template specified

Description:No template was enabled, so the listed check or option could not be executed. Enable a template with the appropriate file extension and rerun the module.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


New files (Windows)

Module: File Watch

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports files and subfolders that were added to the watched folders after the last snapshot update.

The following table lists the error messages for the check.

Table: Error messages for New files

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESMM_NEW

Category: Policy Compliance

  • Windows 2000 (45931)

  • Windows 2003 (215331)

  • Windows 2008 (215831)

  • Windows Vista (215531)

  • Windows XP (49131)

Title: New file or folder

Description:The file or folder was added after the last snapshot update. If the addition is authorized, update the snapshot. If it is not authorized, delete the file or folder.

Severity: yellow-1

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [%s]

String ID: ESMM_NEW_GREEN

Category: Policy Compliance

  • Windows 2000 (45944)

  • Windows 2003 (215344)

  • Windows 2008 (215844)

  • Windows Vista (215544)

  • Windows XP (49144)

Title: New file or folder (Green level)

Description:The file or folder was added after the last snapshot update. If the addition is authorized, update the snapshot. If it is not authorized, delete the file or folder.

Severity: green-0

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [%s]

String ID: ESMM_NEW_YELLOW

Category: Policy Compliance

  • Windows 2000 (45945)

  • Windows 2003 (215345)

  • Windows 2008 (215845)

  • Windows Vista (215545)

  • Windows XP (49145)

Title: New file or folder (Yellow level)

Description:The file or folder was added after the last snapshot update. If the addition is authorized, update the snapshot. If it is not authorized, delete the file or folder.

Severity: yellow-2

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [%s]

String ID: ESMM_NEW_RED

Category: Policy Compliance

  • Windows 2000 (45946)

  • Windows 2003 (215346)

  • Windows 2008 (215846)

  • Windows Vista (215546)

  • Windows XP (49146)

Title: New file or folder (Red level)

Description:The file or folder was added after the last snapshot update. If the addition is authorized, update the snapshot. If it is not authorized, delete the file or folder.

Severity: red-4

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [%s]


Removed files (Windows)

Module: File Watch

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports files and subfolders that were removed from the watched folders after the last snapshot update.

The following table lists the error messages for the check.

Table: Error messages for Removed files

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESMM_REMOVED

Category: Policy Compliance

  • Windows 2000 (45932)

  • Windows 2003 (215332)

  • Windows 2008 (215832)

  • Windows Vista (215532)

  • Windows XP (49132)

Title: File or folder removed

Description:The file or folder was removed after the last snapshot update. If the removal is authorized, update the snapshot. If it is not authorized, restore the file or folder from a backup.

Severity: yellow-1

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [%s]

String ID: ESMM_REMOVED_GREEN

Category: Policy Compliance

  • Windows 2000 (45947)

  • Windows 2003 (215347)

  • Windows 2008 (215847)

  • Windows Vista (215547)

  • Windows XP (49147)

Title: File or folder removed (Green level)

Description:The file or folder was removed after the last snapshot update. If the removal is authorized, update the snapshot. If it is not authorized, restore the file or folder from a backup.

Severity: green-0

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [%s]

String ID: ESMM_REMOVED_YELLOW

Category: Policy Compliance

  • Windows 2000 (45948)

  • Windows 2003 (215348)

  • Windows 2008 (215848)

  • Windows Vista (215548)

  • Windows XP (49148)

Title: File or folder removed (Yellow level)

Description:The file or folder was removed after the last snapshot update. If the removal is authorized, update the snapshot. If it is not authorized, restore the file or folder from a backup.

Severity: yellow-2

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [%s]

String ID: ESMM_REMOVED_RED

Category: Policy Compliance

  • Windows 2000 (45949)

  • Windows 2003 (215349)

  • Windows 2008 (215849)

  • Windows Vista (215549)

  • Windows XP (49149)

Title: File or folder removed (Red level)

Description:The file or folder was removed after the last snapshot update. If the removal is authorized, update the snapshot. If it is not authorized, restore the file or folder from a backup.

Severity: red-4

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [%s]


Group Policy module

This section includes the following topics:

  • About the Group Policy module

  • Supported operating systems: Group Policy

  • Account Policies - Account Lockout Policy (Windows)

  • Account Policies - Kerberos Policy (Windows)

  • Account Policies - Password Policy (Windows)

  • Event Log (Windows)

  • File System (Windows)

  • Local Policies - Audit Policy (Windows)

  • Local Policies - Security Options (Windows)

  • Local Policies - User Rights Assignment (Windows)

  • Registry (Windows)

  • Restricted Groups (Windows)

  • System Services (Windows)


About the Group Policy module

The Group Policy module reports the discrepancies between the Group Policy security settings and your security policy defined in Symantec ESM. This module contains eleven checks and eleven template files that correspond to and are enabled by each check.

The Group Policy module provides increased support for Active Directory by comparing these security settings to ESM policy settings. The ESM Group Policy templates relate directly to the Windows Group Policies. The majority of the templates are pre-populated with default values. Do not create new templates from the original, pre-populated templates. Instead, you must copy the original template and then make your modifications.


Supported operating systems: Group Policy

The Group Policy module is supported on the following operating systems:

  • Windows 2000

  • Windows 2003

  • Windows 2008


Account Policies - Account Lockout Policy (Windows)

Module: Group Policy

Supported Platforms: Windows 2000, Windows 2003, Windows 2008

This option lets you enable and disable the template files that the module uses to validate account lockout policies.

The following table lists the error messages for the check.

Table: Error messages for Account Policies - Account Lockout Policy

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_GPO_POLICY_NOT_DEFINED_G

Category: ESM Error

  • Windows 2000 (109630)

  • Windows 2003 (209630)

  • Windows 2008 (252630)

Title: Group Policy Not Defined

Description:This policy is defined in your ESM template but is not defined in the Group Policy.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_NOT_DEFINED_Y

Category: ESM Error

  • Windows 2000 (109631)

  • Windows 2003 (209631)

  • Windows 2008 (252631)

Title: Group Policy Not Defined

Description:This policy is defined in your ESM template but is not defined in the Group Policy.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_NOT_DEFINED_R

Category: ESM Error

  • Windows 2000 (109632)

  • Windows 2003 (209632)

  • Windows 2008 (252632)

Title: Group Policy Not Defined

Description:This policy is defined in your ESM template but is not defined in the Group Policy.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_DEFINED_G

Category: ESM Error

  • Windows 2000 (109633)

  • Windows 2003 (209633)

  • Windows 2008 (252633)

Title: Group Policy Defined

Description:This policy is not defined in your ESM template but is defined in the Group Policy.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_DEFINED_Y

Category: ESM Error

  • Windows 2000 (109634)

  • Windows 2003 (209634)

  • Windows 2008 (252634)

Title: Group Policy Defined

Description:This policy is not defined in your ESM template but is defined in the Group Policy.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_DEFINED_R

Category: ESM Error

  • Windows 2000 (109635)

  • Windows 2003 (209635)

  • Windows 2008 (252635)

Title: Group Policy Defined

Description:This policy is not defined in your ESM template but is defined in the Group Policy.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_INCORRECT_VALUE_G

Category: ESM Error

  • Windows 2000 (109636)

  • Windows 2003 (209636)

  • Windows 2008 (252636)

Title: Incorrect Group Policy Value

Description:The actual value in the Group Policy does not match the expected value in the ESM template.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_INCORRECT_VALUE_Y

Category: ESM Error

  • Windows 2000 (109637)

  • Windows 2003 (209637)

  • Windows 2008 (252637)

Title: Incorrect Group Policy Value

Description:The actual value in the Group Policy does not match the expected value in the ESM template.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_INCORRECT_VALUE_R

Category: ESM Error

  • Windows 2000 (109638)

  • Windows 2003 (209638)

  • Windows 2008 (252638)

Title: Incorrect Group Policy Value

Description:The actual value in the Group Policy does not match the expected value in the ESM template.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Account Policies - Kerberos Policy (Windows)

Module: Group Policy

Supported Platforms: Windows 2000, Windows 2003, Windows 2008

This option lets you enable and disable the template files that the module uses to validate kerberos policies.

The following table lists the error messages for the check.

Table: Error messages for Account Policies - Kerberos Policy

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_GPO_POLICY_NOT_DEFINED_G

Category: ESM Error

  • Windows 2000 (109630)

  • Windows 2003 (209630)

  • Windows 2008 (252630)

Title: Group Policy Not Defined

Description:This policy is defined in your ESM template but is not defined in the Group Policy.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_NOT_DEFINED_Y

Category: ESM Error

  • Windows 2000 (109631)

  • Windows 2003 (209631)

  • Windows 2008 (252631)

Title: Group Policy Not Defined

Description:This policy is defined in your ESM template but is not defined in the Group Policy.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_NOT_DEFINED_R

Category: ESM Error

  • Windows 2000 (109632)

  • Windows 2003 (209632)

  • Windows 2008 (252632)

Title: Group Policy Not Defined

Description:This policy is defined in your ESM template but is not defined in the Group Policy.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_DEFINED_G

Category: ESM Error

  • Windows 2000 (109633)

  • Windows 2003 (209633)

  • Windows 2008 (252633)

Title: Group Policy Defined

Description:This policy is not defined in your ESM template but is defined in the Group Policy.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_DEFINED_Y

Category: ESM Error

  • Windows 2000 (109634)

  • Windows 2003 (209634)

  • Windows 2008 (252634)

Title: Group Policy Defined

Description:This policy is not defined in your ESM template but is defined in the Group Policy.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_DEFINED_R

Category: ESM Error

  • Windows 2000 (109635)

  • Windows 2003 (209635)

  • Windows 2008 (252635)

Title: Group Policy Defined

Description:This policy is not defined in your ESM template but is defined in the Group Policy.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_INCORRECT_VALUE_G

Category: ESM Error

  • Windows 2000 (109636)

  • Windows 2003 (209636)

  • Windows 2008 (252636)

Title: Incorrect Group Policy Value

Description:The actual value in the Group Policy does not match the expected value in the ESM template.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_INCORRECT_VALUE_Y

Category: ESM Error

  • Windows 2000 (109637)

  • Windows 2003 (209637)

  • Windows 2008 (252637)

Title: Incorrect Group Policy Value

Description:The actual value in the Group Policy does not match the expected value in the ESM template.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_INCORRECT_VALUE_R

Category: ESM Error

  • Windows 2000 (109638)

  • Windows 2003 (209638)

  • Windows 2008 (252638)

Title: Incorrect Group Policy Value

Description:The actual value in the Group Policy does not match the expected value in the ESM template.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Account Policies - Password Policy (Windows)

Module: Group Policy

Supported Platforms: Windows 2000, Windows 2003, Windows 2008

This option lets you enable and disable the template files that the module uses to validate password policies.

The following table lists the error messages for the check.

Table: Error messages for Account Policies - Password Policy

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_GPO_POLICY_NOT_DEFINED_G

Category: ESM Error

  • Windows 2000 (109630)

  • Windows 2003 (209630)

  • Windows 2008 (252630)

Title: Group Policy Not Defined

Description:This policy is defined in your ESM template but is not defined in the Group Policy.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_NOT_DEFINED_Y

Category: ESM Error

  • Windows 2000 (109631)

  • Windows 2003 (209631)

  • Windows 2008 (252631)

Title: Group Policy Not Defined

Description:This policy is defined in your ESM template but is not defined in the Group Policy.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_NOT_DEFINED_R

Category: ESM Error

  • Windows 2000 (109632)

  • Windows 2003 (209632)

  • Windows 2008 (252632)

Title: Group Policy Not Defined

Description:This policy is defined in your ESM template but is not defined in the Group Policy.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_DEFINED_G

Category: ESM Error

  • Windows 2000 (109633)

  • Windows 2003 (209633)

  • Windows 2008 (252633)

Title: Group Policy Defined

Description:This policy is not defined in your ESM template but is defined in the Group Policy.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_DEFINED_Y

Category: ESM Error

  • Windows 2000 (109634)

  • Windows 2003 (209634)

  • Windows 2008 (252634)

Title: Group Policy Defined

Description:This policy is not defined in your ESM template but is defined in the Group Policy.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_DEFINED_R

Category: ESM Error

  • Windows 2000 (109635)

  • Windows 2003 (209635)

  • Windows 2008 (252635)

Title: Group Policy Defined

Description:This policy is not defined in your ESM template but is defined in the Group Policy.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_INCORRECT_VALUE_G

Category: ESM Error

  • Windows 2000 (109636)

  • Windows 2003 (209636)

  • Windows 2008 (252636)

Title: Incorrect Group Policy Value

Description:The actual value in the Group Policy does not match the expected value in the ESM template.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_INCORRECT_VALUE_Y

Category: ESM Error

  • Windows 2000 (109637)

  • Windows 2003 (209637)

  • Windows 2008 (252637)

Title: Incorrect Group Policy Value

Description:The actual value in the Group Policy does not match the expected value in the ESM template.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_INCORRECT_VALUE_R

Category: ESM Error

  • Windows 2000 (109638)

  • Windows 2003 (209638)

  • Windows 2008 (252638)

Title: Incorrect Group Policy Value

Description:The actual value in the Group Policy does not match the expected value in the ESM template.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Event Log (Windows)

Module: Group Policy

Supported Platforms: Windows 2000, Windows 2003, Windows 2008

This option lets you enable and disable the template files that the module uses to event log policies.

The following table lists the error messages for the check.

Table: Error messages for Event Log

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_GPO_POLICY_NOT_DEFINED_G

Category: ESM Error

  • Windows 2000 (109630)

  • Windows 2003 (209630)

  • Windows 2008 (252630)

Title: Group Policy Not Defined

Description:This policy is defined in your ESM template but is not defined in the Group Policy.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_NOT_DEFINED_Y

Category: ESM Error

  • Windows 2000 (109631)

  • Windows 2003 (209631)

  • Windows 2008 (252631)

Title: Group Policy Not Defined

Description:This policy is defined in your ESM template but is not defined in the Group Policy.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_NOT_DEFINED_R

Category: ESM Error

  • Windows 2000 (109632)

  • Windows 2003 (209632)

  • Windows 2008 (252632)

Title: Group Policy Not Defined

Description:This policy is defined in your ESM template but is not defined in the Group Policy.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_DEFINED_G

Category: ESM Error

  • Windows 2000 (109633)

  • Windows 2003 (209633)

  • Windows 2008 (252633)

Title: Group Policy Defined

Description:This policy is not defined in your ESM template but is defined in the Group Policy.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_DEFINED_Y

Category: ESM Error

  • Windows 2000 (109634)

  • Windows 2003 (209634)

  • Windows 2008 (252634)

Title: Group Policy Defined

Description:This policy is not defined in your ESM template but is defined in the Group Policy.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_DEFINED_R

Category: ESM Error

  • Windows 2000 (109635)

  • Windows 2003 (209635)

  • Windows 2008 (252635)

Title: Group Policy Defined

Description:This policy is not defined in your ESM template but is defined in the Group Policy.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_INCORRECT_VALUE_G

Category: ESM Error

  • Windows 2000 (109636)

  • Windows 2003 (209636)

  • Windows 2008 (252636)

Title: Incorrect Group Policy Value

Description:The actual value in the Group Policy does not match the expected value in the ESM template.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_INCORRECT_VALUE_Y

Category: ESM Error

  • Windows 2000 (109637)

  • Windows 2003 (209637)

  • Windows 2008 (252637)

Title: Incorrect Group Policy Value

Description:The actual value in the Group Policy does not match the expected value in the ESM template.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_INCORRECT_VALUE_R

Category: ESM Error

  • Windows 2000 (109638)

  • Windows 2003 (209638)

  • Windows 2008 (252638)

Title: Incorrect Group Policy Value

Description:The actual value in the Group Policy does not match the expected value in the ESM template.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


File System (Windows)

Module: Group Policy

Supported Platforms: Windows 2000, Windows 2003, Windows 2008

This option lets you enable and disable the template files that the module uses to file system policies.

The following table lists the error messages for the check.

Table: Error messages for File System

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_GPO_POLICY_NOT_DEFINED_G

Category: ESM Error

  • Windows 2000 (109630)

  • Windows 2003 (209630)

  • Windows 2008 (252630)

Title: Group Policy Not Defined

Description:This policy is defined in your ESM template but is not defined in the Group Policy.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_NOT_DEFINED_Y

Category: ESM Error

  • Windows 2000 (109631)

  • Windows 2003 (209631)

  • Windows 2008 (252631)

Title: Group Policy Not Defined

Description:This policy is defined in your ESM template but is not defined in the Group Policy.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_NOT_DEFINED_R

Category: ESM Error

  • Windows 2000 (109632)

  • Windows 2003 (209632)

  • Windows 2008 (252632)

Title: Group Policy Not Defined

Description:This policy is defined in your ESM template but is not defined in the Group Policy.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_DEFINED_G

Category: ESM Error

  • Windows 2000 (109633)

  • Windows 2003 (209633)

  • Windows 2008 (252633)

Title: Group Policy Defined

Description:This policy is not defined in your ESM template but is defined in the Group Policy.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_DEFINED_Y

Category: ESM Error

  • Windows 2000 (109634)

  • Windows 2003 (209634)

  • Windows 2008 (252634)

Title: Group Policy Defined

Description:This policy is not defined in your ESM template but is defined in the Group Policy.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_DEFINED_R

Category: ESM Error

  • Windows 2000 (109635)

  • Windows 2003 (209635)

  • Windows 2008 (252635)

Title: Group Policy Defined

Description:This policy is not defined in your ESM template but is defined in the Group Policy.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_INCORRECT_VALUE_G

Category: ESM Error

  • Windows 2000 (109636)

  • Windows 2003 (209636)

  • Windows 2008 (252636)

Title: Incorrect Group Policy Value

Description:The actual value in the Group Policy does not match the expected value in the ESM template.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_INCORRECT_VALUE_Y

Category: ESM Error

  • Windows 2000 (109637)

  • Windows 2003 (209637)

  • Windows 2008 (252637)

Title: Incorrect Group Policy Value

Description:The actual value in the Group Policy does not match the expected value in the ESM template.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_INCORRECT_VALUE_R

Category: ESM Error

  • Windows 2000 (109638)

  • Windows 2003 (209638)

  • Windows 2008 (252638)

Title: Incorrect Group Policy Value

Description:The actual value in the Group Policy does not match the expected value in the ESM template.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Local Policies - Audit Policy (Windows)

Module: Group Policy

Supported Platforms: Windows 2000, Windows 2003, Windows 2008

This option lets you enable and disable the template files that the module uses to validate audit policies.

The following table lists the error messages for the check.

Table: Error messages for Local Policies - Audit Policy

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_GPO_POLICY_NOT_DEFINED_G

Category: ESM Error

  • Windows 2000 (109630)

  • Windows 2003 (209630)

  • Windows 2008 (252630)

Title: Group Policy Not Defined

Description:This policy is defined in your ESM template but is not defined in the Group Policy.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_NOT_DEFINED_Y

Category: ESM Error

  • Windows 2000 (109631)

  • Windows 2003 (209631)

  • Windows 2008 (252631)

Title: Group Policy Not Defined

Description:This policy is defined in your ESM template but is not defined in the Group Policy.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_NOT_DEFINED_R

Category: ESM Error

  • Windows 2000 (109632)

  • Windows 2003 (209632)

  • Windows 2008 (252632)

Title: Group Policy Not Defined

Description:This policy is defined in your ESM template but is not defined in the Group Policy.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_DEFINED_G

Category: ESM Error

  • Windows 2000 (109633)

  • Windows 2003 (209633)

  • Windows 2008 (252633)

Title: Group Policy Defined

Description:This policy is not defined in your ESM template but is defined in the Group Policy.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_DEFINED_Y

Category: ESM Error

  • Windows 2000 (109634)

  • Windows 2003 (209634)

  • Windows 2008 (252634)

Title: Group Policy Defined

Description:This policy is not defined in your ESM template but is defined in the Group Policy.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_DEFINED_R

Category: ESM Error

  • Windows 2000 (109635)

  • Windows 2003 (209635)

  • Windows 2008 (252635)

Title: Group Policy Defined

Description:This policy is not defined in your ESM template but is defined in the Group Policy.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_INCORRECT_VALUE_G

Category: ESM Error

  • Windows 2000 (109636)

  • Windows 2003 (209636)

  • Windows 2008 (252636)

Title: Incorrect Group Policy Value

Description:The actual value in the Group Policy does not match the expected value in the ESM template.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_INCORRECT_VALUE_Y

Category: ESM Error

  • Windows 2000 (109637)

  • Windows 2003 (209637)

  • Windows 2008 (252637)

Title: Incorrect Group Policy Value

Description:The actual value in the Group Policy does not match the expected value in the ESM template.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_INCORRECT_VALUE_R

Category: ESM Error

  • Windows 2000 (109638)

  • Windows 2003 (209638)

  • Windows 2008 (252638)

Title: Incorrect Group Policy Value

Description:The actual value in the Group Policy does not match the expected value in the ESM template.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Local Policies - Security Options (Windows)

Module: Group Policy

Supported Platforms: Windows 2000, Windows 2003, Windows 2008

This option lets you enable and disable the template files that the module uses to security options policies.

The following table lists the error messages for the check.

Table: Error messages for Local Policies - Security Options

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_GPO_POLICY_NOT_DEFINED_G

Category: ESM Error

  • Windows 2000 (109630)

  • Windows 2003 (209630)

  • Windows 2008 (252630)

Title: Group Policy Not Defined

Description:This policy is defined in your ESM template but is not defined in the Group Policy.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_NOT_DEFINED_Y

Category: ESM Error

  • Windows 2000 (109631)

  • Windows 2003 (209631)

  • Windows 2008 (252631)

Title: Group Policy Not Defined

Description:This policy is defined in your ESM template but is not defined in the Group Policy.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_NOT_DEFINED_R

Category: ESM Error

  • Windows 2000 (109632)

  • Windows 2003 (209632)

  • Windows 2008 (252632)

Title: Group Policy Not Defined

Description:This policy is defined in your ESM template but is not defined in the Group Policy.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_DEFINED_G

Category: ESM Error

  • Windows 2000 (109633)

  • Windows 2003 (209633)

  • Windows 2008 (252633)

Title: Group Policy Defined

Description:This policy is not defined in your ESM template but is defined in the Group Policy.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_DEFINED_Y

Category: ESM Error

  • Windows 2000 (109634)

  • Windows 2003 (209634)

  • Windows 2008 (252634)

Title: Group Policy Defined

Description:This policy is not defined in your ESM template but is defined in the Group Policy.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_DEFINED_R

Category: ESM Error

  • Windows 2000 (109635)

  • Windows 2003 (209635)

  • Windows 2008 (252635)

Title: Group Policy Defined

Description:This policy is not defined in your ESM template but is defined in the Group Policy.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_INCORRECT_VALUE_G

Category: ESM Error

  • Windows 2000 (109636)

  • Windows 2003 (209636)

  • Windows 2008 (252636)

Title: Incorrect Group Policy Value

Description:The actual value in the Group Policy does not match the expected value in the ESM template.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_INCORRECT_VALUE_Y

Category: ESM Error

  • Windows 2000 (109637)

  • Windows 2003 (209637)

  • Windows 2008 (252637)

Title: Incorrect Group Policy Value

Description:The actual value in the Group Policy does not match the expected value in the ESM template.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_INCORRECT_VALUE_R

Category: ESM Error

  • Windows 2000 (109638)

  • Windows 2003 (209638)

  • Windows 2008 (252638)

Title: Incorrect Group Policy Value

Description:The actual value in the Group Policy does not match the expected value in the ESM template.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Local Policies - User Rights Assignment (Windows)

Module: Group Policy

Supported Platforms: Windows 2000, Windows 2003, Windows 2008

This option lets you enable and disable the template files that the module uses to validate user rights assignments.

The following table lists the error messages for the check.

Table: Error messages for Local Policies - User Rights Assignment

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_GPO_POLICY_NOT_DEFINED_G

Category: ESM Error

  • Windows 2000 (109630)

  • Windows 2003 (209630)

  • Windows 2008 (252630)

Title: Group Policy Not Defined

Description:This policy is defined in your ESM template but is not defined in the Group Policy.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_NOT_DEFINED_Y

Category: ESM Error

  • Windows 2000 (109631)

  • Windows 2003 (209631)

  • Windows 2008 (252631)

Title: Group Policy Not Defined

Description:This policy is defined in your ESM template but is not defined in the Group Policy.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_NOT_DEFINED_R

Category: ESM Error

  • Windows 2000 (109632)

  • Windows 2003 (209632)

  • Windows 2008 (252632)

Title: Group Policy Not Defined

Description:This policy is defined in your ESM template but is not defined in the Group Policy.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_DEFINED_G

Category: ESM Error

  • Windows 2000 (109633)

  • Windows 2003 (209633)

  • Windows 2008 (252633)

Title: Group Policy Defined

Description:This policy is not defined in your ESM template but is defined in the Group Policy.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_DEFINED_Y

Category: ESM Error

  • Windows 2000 (109634)

  • Windows 2003 (209634)

  • Windows 2008 (252634)

Title: Group Policy Defined

Description:This policy is not defined in your ESM template but is defined in the Group Policy.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_DEFINED_R

Category: ESM Error

  • Windows 2000 (109635)

  • Windows 2003 (209635)

  • Windows 2008 (252635)

Title: Group Policy Defined

Description:This policy is not defined in your ESM template but is defined in the Group Policy.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_INCORRECT_VALUE_G

Category: ESM Error

  • Windows 2000 (109636)

  • Windows 2003 (209636)

  • Windows 2008 (252636)

Title: Incorrect Group Policy Value

Description:The actual value in the Group Policy does not match the expected value in the ESM template.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_INCORRECT_VALUE_Y

Category: ESM Error

  • Windows 2000 (109637)

  • Windows 2003 (209637)

  • Windows 2008 (252637)

Title: Incorrect Group Policy Value

Description:The actual value in the Group Policy does not match the expected value in the ESM template.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_INCORRECT_VALUE_R

Category: ESM Error

  • Windows 2000 (109638)

  • Windows 2003 (209638)

  • Windows 2008 (252638)

Title: Incorrect Group Policy Value

Description:The actual value in the Group Policy does not match the expected value in the ESM template.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Registry (Windows)

Module: Group Policy

Supported Platforms: Windows 2000, Windows 2003, Windows 2008

This option lets you enable and disable the template files that the module uses to registry policies.

The following table lists the error messages for the check.

Table: Error messages for Registry

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_GPO_POLICY_NOT_DEFINED_G

Category: ESM Error

  • Windows 2000 (109630)

  • Windows 2003 (209630)

  • Windows 2008 (252630)

Title: Group Policy Not Defined

Description:This policy is defined in your ESM template but is not defined in the Group Policy.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_NOT_DEFINED_Y

Category: ESM Error

  • Windows 2000 (109631)

  • Windows 2003 (209631)

  • Windows 2008 (252631)

Title: Group Policy Not Defined

Description:This policy is defined in your ESM template but is not defined in the Group Policy.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_NOT_DEFINED_R

Category: ESM Error

  • Windows 2000 (109632)

  • Windows 2003 (209632)

  • Windows 2008 (252632)

Title: Group Policy Not Defined

Description:This policy is defined in your ESM template but is not defined in the Group Policy.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_DEFINED_G

Category: ESM Error

  • Windows 2000 (109633)

  • Windows 2003 (209633)

  • Windows 2008 (252633)

Title: Group Policy Defined

Description:This policy is not defined in your ESM template but is defined in the Group Policy.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_DEFINED_Y

Category: ESM Error

  • Windows 2000 (109634)

  • Windows 2003 (209634)

  • Windows 2008 (252634)

Title: Group Policy Defined

Description:This policy is not defined in your ESM template but is defined in the Group Policy.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_DEFINED_R

Category: ESM Error

  • Windows 2000 (109635)

  • Windows 2003 (209635)

  • Windows 2008 (252635)

Title: Group Policy Defined

Description:This policy is not defined in your ESM template but is defined in the Group Policy.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_INCORRECT_VALUE_G

Category: ESM Error

  • Windows 2000 (109636)

  • Windows 2003 (209636)

  • Windows 2008 (252636)

Title: Incorrect Group Policy Value

Description:The actual value in the Group Policy does not match the expected value in the ESM template.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_INCORRECT_VALUE_Y

Category: ESM Error

  • Windows 2000 (109637)

  • Windows 2003 (209637)

  • Windows 2008 (252637)

Title: Incorrect Group Policy Value

Description:The actual value in the Group Policy does not match the expected value in the ESM template.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_INCORRECT_VALUE_R

Category: ESM Error

  • Windows 2000 (109638)

  • Windows 2003 (209638)

  • Windows 2008 (252638)

Title: Incorrect Group Policy Value

Description:The actual value in the Group Policy does not match the expected value in the ESM template.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Restricted Groups (Windows)

Module: Group Policy

Supported Platforms: Windows 2000, Windows 2003, Windows 2008

This option lets you enable and disable the template files that the module uses to restricted groups policies.

The following table lists the error messages for the check.

Table: Error messages for Restricted Groups

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_GPO_POLICY_NOT_DEFINED_G

Category: ESM Error

  • Windows 2000 (109630)

  • Windows 2003 (209630)

  • Windows 2008 (252630)

Title: Group Policy Not Defined

Description:This policy is defined in your ESM template but is not defined in the Group Policy.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_NOT_DEFINED_Y

Category: ESM Error

  • Windows 2000 (109631)

  • Windows 2003 (209631)

  • Windows 2008 (252631)

Title: Group Policy Not Defined

Description:This policy is defined in your ESM template but is not defined in the Group Policy.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_NOT_DEFINED_R

Category: ESM Error

  • Windows 2000 (109632)

  • Windows 2003 (209632)

  • Windows 2008 (252632)

Title: Group Policy Not Defined

Description:This policy is defined in your ESM template but is not defined in the Group Policy.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_DEFINED_G

Category: ESM Error

  • Windows 2000 (109633)

  • Windows 2003 (209633)

  • Windows 2008 (252633)

Title: Group Policy Defined

Description:This policy is not defined in your ESM template but is defined in the Group Policy.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_DEFINED_Y

Category: ESM Error

  • Windows 2000 (109634)

  • Windows 2003 (209634)

  • Windows 2008 (252634)

Title: Group Policy Defined

Description:This policy is not defined in your ESM template but is defined in the Group Policy.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_DEFINED_R

Category: ESM Error

  • Windows 2000 (109635)

  • Windows 2003 (209635)

  • Windows 2008 (252635)

Title: Group Policy Defined

Description:This policy is not defined in your ESM template but is defined in the Group Policy.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_INCORRECT_VALUE_G

Category: ESM Error

  • Windows 2000 (109636)

  • Windows 2003 (209636)

  • Windows 2008 (252636)

Title: Incorrect Group Policy Value

Description:The actual value in the Group Policy does not match the expected value in the ESM template.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_INCORRECT_VALUE_Y

Category: ESM Error

  • Windows 2000 (109637)

  • Windows 2003 (209637)

  • Windows 2008 (252637)

Title: Incorrect Group Policy Value

Description:The actual value in the Group Policy does not match the expected value in the ESM template.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_INCORRECT_VALUE_R

Category: ESM Error

  • Windows 2000 (109638)

  • Windows 2003 (209638)

  • Windows 2008 (252638)

Title: Incorrect Group Policy Value

Description:The actual value in the Group Policy does not match the expected value in the ESM template.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


System Services (Windows)

Module: Group Policy

Supported Platforms: Windows 2000, Windows 2003, Windows 2008

This option lets you enable and disable the template files that the module uses to system services policies.

The following table lists the error messages for the check.

Table: Error messages for System Services

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_GPO_POLICY_NOT_DEFINED_G

Category: ESM Error

  • Windows 2000 (109630)

  • Windows 2003 (209630)

  • Windows 2008 (252630)

Title: Group Policy Not Defined

Description:This policy is defined in your ESM template but is not defined in the Group Policy.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_NOT_DEFINED_Y

Category: ESM Error

  • Windows 2000 (109631)

  • Windows 2003 (209631)

  • Windows 2008 (252631)

Title: Group Policy Not Defined

Description:This policy is defined in your ESM template but is not defined in the Group Policy.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_NOT_DEFINED_R

Category: ESM Error

  • Windows 2000 (109632)

  • Windows 2003 (209632)

  • Windows 2008 (252632)

Title: Group Policy Not Defined

Description:This policy is defined in your ESM template but is not defined in the Group Policy.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_DEFINED_G

Category: ESM Error

  • Windows 2000 (109633)

  • Windows 2003 (209633)

  • Windows 2008 (252633)

Title: Group Policy Defined

Description:This policy is not defined in your ESM template but is defined in the Group Policy.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_DEFINED_Y

Category: ESM Error

  • Windows 2000 (109634)

  • Windows 2003 (209634)

  • Windows 2008 (252634)

Title: Group Policy Defined

Description:This policy is not defined in your ESM template but is defined in the Group Policy.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_POLICY_DEFINED_R

Category: ESM Error

  • Windows 2000 (109635)

  • Windows 2003 (209635)

  • Windows 2008 (252635)

Title: Group Policy Defined

Description:This policy is not defined in your ESM template but is defined in the Group Policy.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_INCORRECT_VALUE_G

Category: ESM Error

  • Windows 2000 (109636)

  • Windows 2003 (209636)

  • Windows 2008 (252636)

Title: Incorrect Group Policy Value

Description:The actual value in the Group Policy does not match the expected value in the ESM template.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_INCORRECT_VALUE_Y

Category: ESM Error

  • Windows 2000 (109637)

  • Windows 2003 (209637)

  • Windows 2008 (252637)

Title: Incorrect Group Policy Value

Description:The actual value in the Group Policy does not match the expected value in the ESM template.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_GPO_INCORRECT_VALUE_R

Category: ESM Error

  • Windows 2000 (109638)

  • Windows 2003 (209638)

  • Windows 2008 (252638)

Title: Incorrect Group Policy Value

Description:The actual value in the Group Policy does not match the expected value in the ESM template.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_POLICY_NOT_FOUND

Category: ESM Error

  • Windows 2000 (109641)

  • Windows 2003 (209641)

  • Windows 2008 (252641)

Title: Group policy not found on the system

Description:Group policy given in the template is not found. Group Policy Name given in template is case sensitive.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Integrated Command Engine module

This section includes the following topics:

  • About the Integrated Command Engine module

  • Supported operating systems: Integrated Command Engine

  • Check Return Code (Windows and UNIX)

  • Command Engine templates (Windows and UNIX)

  • Copy Scripts (Windows and UNIX)

  • Display messages in order (Windows and UNIX)

  • Failed messages (Windows and UNIX)

  • Information messages (Windows and UNIX)

  • Not applicable messages (Windows and UNIX)

  • Not available messages (Windows and UNIX)

  • Overwrite Scripts (Windows and UNIX)

  • Passed messages (Windows and UNIX)

  • Redirect Stderr to Stdout (Windows and UNIX)

  • Report All Stderr messages (Windows and UNIX)

  • Script missing messages (Windows and UNIX)

  • Unmapped messages (Windows and UNIX)

  • User 1/0 messages (Windows and UNIX)

  • User 1/1 messages (Windows and UNIX)

  • User 1/2 messages (Windows and UNIX)

  • User 1/3 messages (Windows and UNIX)

  • User 1/4 messages (Windows and UNIX)

  • User 2/0 messages (Windows and UNIX)

  • User 2/1 messages (Windows and UNIX)

  • User 2/2 messages (Windows and UNIX)

  • User 2/3 messages (Windows and UNIX)

  • User 2/4 messages (Windows and UNIX)

  • User 3/0 messages (Windows and UNIX)

  • User 3/1 messages (Windows and UNIX)

  • User 3/2 messages (Windows and UNIX)

  • User 3/3 messages (Windows and UNIX)

  • User 3/4 messages (Windows and UNIX)


About the Integrated Command Engine module

The Integrated Command Engine (ICE) in the Dynamic Assessment policy adds the client/server-based functions. The executable programs and the scripts that you integrate through ICE template directives function as security checks.

You can use the ICE options to do the following:

  • Enable and disable ICE templates

  • Enable and disable the messages that identify missing scripts and unmapped messages for debugging purposes

  • Enable and disable messages that are mapped to the output of integrated executables and scripts in ICE templates


Supported operating systems: Integrated Command Engine

The Integrated Command Engine module is supported on the following operating systems:

  • UNIX

  • Windows 2000

  • Windows 2003

  • Windows 2008

  • Windows Vista

  • Windows XP


Check Return Code (Windows and UNIX)

Module: Integrated Command Engine

Supported Platforms: UNIX, Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This option enables checking the return code from scripts.

The following table lists the error message for the check.

Table: Error message for Check Return Code

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESMM_RETCODE

Category: ICE

  • UNIX (46571)

  • Windows 2000 (46771)

  • Windows 2003 (215271)

  • Windows 2008 (216371)

  • Windows Vista (215671)

  • Windows XP (49271)

Title: Return code does not match

Description:The script's return code does not match the expected return code.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Command Engine templates (Windows and UNIX)

Module: Integrated Command Engine

Supported Platforms: UNIX, Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This option lists available template files that the Integrated Command Engine module can use. ICE templates are cross platform with platform designations specified within the template files themselves.

The following table lists the error messages for the check.

Table: Error messages for Command Engine templates

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESMM_ILLEGALBASEPATH

Category: ICE

  • UNIX (46545)

  • Windows 2000 (46745)

  • Windows 2003 (215245)

  • Windows 2008 (216345)

  • Windows Vista (215645)

  • Windows XP (49245)

Title: Illegal base path

Description:A parent relative path definition (..) cannot be used within a base path specification. This base path has been disallowed to prevent programs outside of the Symantec ESM directory tree from being run directly by the ICE module. Any program that is executed by the ICE module must be contained within the Symantec ESM tree.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMM_ILLEGALPATHINSCRIPT

Category: ICE

  • UNIX (46546)

  • Windows 2000 (46746)

  • Windows 2003 (215246)

  • Windows 2008 (216346)

  • Windows Vista (215646)

  • Windows XP (49246)

Title: Illegal path in script

Description:A parent relative path definition (..) cannot be used within a script path specification. This script has been disallowed to prevent programs outside of the Symantec ESM directory tree from being run directly by the ICE module. Any program that is executed by the ICE module must be contained within the Symantec ESM tree.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMM_SCRIPTERROR

Category: ICE

  • UNIX (46548)

  • Windows 2000 (46748)

  • Windows 2003 (215248)

  • Windows 2008 (216348)

  • Windows Vista (215648)

  • Windows XP (49248)

Title: Script error

Description:Unable to execute or read output from the specified script. The problem may conceal a security concern. Check the script for location, name, permissions, and expected functionality.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Copy Scripts (Windows and UNIX)

Module: Integrated Command Engine

Supported Platforms: UNIX, Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check copies the scripts encoded in the enabled templates to the agent.

The following table lists the error messages for the check.

Table: Error messages for Copy Scripts

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESMM_FILEEXISTS

Category: ICE

  • UNIX (46572)

  • Windows 2000 (46772)

  • Windows 2003 (215272)

  • Windows 2008 (216372)

  • Windows Vista (215672)

  • Windows XP (49272)

Title: File exists

Description:The listed script could not be copied to the agent because a file by that name already exists and does not match the checksum in the template.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMM_FILEBAD

Category: ICE

  • UNIX (46573)

  • Windows 2000 (46773)

  • Windows 2003 (215273)

  • Windows 2008 (216373)

  • Windows Vista (215673)

  • Windows XP (49273)

Title: Could not copy script

Description:The listed script could not be copied to the agent for the reasons listed in the information field.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMM_FILECOPIED

Category: ICE

  • UNIX (46574)

  • Windows 2000 (46774)

  • Windows 2003 (215274)

  • Windows 2008 (216374)

  • Windows Vista (215674)

  • Windows XP (49274)

Title: File copied successfully

Description:The listed script was successfully copied to the agent.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMM_COPYSCRIPT_DISABLED

Category: ICE

  • UNIX (46575)

  • Windows 2000 (46775)

  • Windows 2003 (215275)

  • Windows 2008 (216375)

  • Windows Vista (215675)

  • Windows XP (49275)

Title: Copy Script disabled

Description:This agent is configured to not accept ICE script copies. To enable ICE script copies, edit the ice.dat file found in the config directory under the ESM install path.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Display messages in order (Windows and UNIX)

Module: Integrated Command Engine

Supported Platforms: UNIX, Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This option causes the messages to be displayed in order. It should be run along with either mapped or unmapped messages.


Failed messages (Windows and UNIX)

Module: Integrated Command Engine

Supported Platforms: UNIX, Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This option enables Failed messages.

The following table lists the error message for the check.

Table: Error message for Failed messages

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESMM_FAILED

Category: ICE

  • UNIX (46551)

  • Windows 2000 (46751)

  • Windows 2003 (215251)

  • Windows 2008 (216351)

  • Windows Vista (215651)

  • Windows XP (49251)

Title: Test failed

Description:Test failed.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Information messages (Windows and UNIX)

Module: Integrated Command Engine

Supported Platforms: UNIX, Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This option enables Information messages.

The following table lists the error message for the check.

Table: Error message for Information messages

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESMM_INFORMATIONAL

Category: ICE

  • UNIX (46552)

  • Windows 2000 (46752)

  • Windows 2003 (215252)

  • Windows 2008 (216352)

  • Windows Vista (215652)

  • Windows XP (49252)

Title: User test information

Description:User test information.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Not applicable messages (Windows and UNIX)

Module: Integrated Command Engine

Supported Platforms: UNIX, Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This option enables Not Applicable messages.

The following table lists the error message for the check.

Table: Error message for Not applicable messages

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESMM_NOTAPPLICABLE

Category: ICE

  • UNIX (46553)

  • Windows 2000 (46753)

  • Windows 2003 (215253)

  • Windows 2008 (216353)

  • Windows Vista (215653)

  • Windows XP (49253)

Title: User test not applicable

Description:User test not applicable.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Not available messages (Windows and UNIX)

Module: Integrated Command Engine

Supported Platforms: UNIX, Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This option enables Not Available messages.

The following table lists the error message for the check.

Table: Error message for Not available messages

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESMM_NOTAVAILABLE

Category: ICE

  • UNIX (46554)

  • Windows 2000 (46754)

  • Windows 2003 (215254)

  • Windows 2008 (216354)

  • Windows Vista (215654)

  • Windows XP (49254)

Title: User test not available

Description:User test not available.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Overwrite Scripts (Windows and UNIX)

Module: Integrated Command Engine

Supported Platforms: UNIX, Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This option causes the Copy Scripts check to overwrite scripts that already exist.


Passed messages (Windows and UNIX)

Module: Integrated Command Engine

Supported Platforms: UNIX, Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This option enables Passed messages.

The following table lists the error message for the check.

Table: Error message for Passed messages

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESMM_PASSED

Category: ICE

  • UNIX (46550)

  • Windows 2000 (46750)

  • Windows 2003 (215250)

  • Windows 2008 (216350)

  • Windows Vista (215650)

  • Windows XP (49250)

Title: User test passed

Description:User test passed.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Redirect Stderr to Stdout (Windows and UNIX)

Module: Integrated Command Engine

Supported Platforms: UNIX, Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This option enables mapping Stderr to defined messages maps. This option will override the option of Report All Stderr messages.

The following table lists the error messages for the check.

Table: Error messages for Redirect Stderr to Stdout

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESMM_SCRIPTMISSING

Category: ICE

  • UNIX (46547)

  • Windows 2000 (46747)

  • Windows 2003 (215247)

  • Windows 2008 (216347)

  • Windows Vista (215647)

  • Windows XP (49247)

Title: Script missing

Description:Unable to locate the specified script. The problem may conceal a security concern. Check the script for location, name, permissions, and expected functionality.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMM_SCRIPTERROR

Category: ICE

  • UNIX (46548)

  • Windows 2000 (46748)

  • Windows 2003 (215248)

  • Windows 2008 (216348)

  • Windows Vista (215648)

  • Windows XP (49248)

Title: Script error

Description:Unable to execute or read output from the specified script. The problem may conceal a security concern. Check the script for location, name, permissions, and expected functionality.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMM_UNMAPPED

Category: ICE

  • UNIX (46549)

  • Windows 2000 (46749)

  • Windows 2003 (215249)

  • Windows 2008 (216349)

  • Windows Vista (215649)

  • Windows XP (49249)

Title: Unmapped message

Description:Unable to identify output from the script specified. The message maps provided do not identify the output received when the script is executed. Check the script for expected functionality.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMM_PASSED

Category: ICE

  • UNIX (46550)

  • Windows 2000 (46750)

  • Windows 2003 (215250)

  • Windows 2008 (216350)

  • Windows Vista (215650)

  • Windows XP (49250)

Title: User test passed

Description:User test passed.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMM_FAILED

Category: ICE

  • UNIX (46551)

  • Windows 2000 (46751)

  • Windows 2003 (215251)

  • Windows 2008 (216351)

  • Windows Vista (215651)

  • Windows XP (49251)

Title: Test failed

Description:Test failed.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMM_INFORMATIONAL

Category: ICE

  • UNIX (46552)

  • Windows 2000 (46752)

  • Windows 2003 (215252)

  • Windows 2008 (216352)

  • Windows Vista (215652)

  • Windows XP (49252)

Title: User test information

Description:User test information.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMM_NOTAPPLICABLE

Category: ICE

  • UNIX (46553)

  • Windows 2000 (46753)

  • Windows 2003 (215253)

  • Windows 2008 (216353)

  • Windows Vista (215653)

  • Windows XP (49253)

Title: User test not applicable

Description:User test not applicable.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMM_NOTAVAILABLE

Category: ICE

  • UNIX (46554)

  • Windows 2000 (46754)

  • Windows 2003 (215254)

  • Windows 2008 (216354)

  • Windows Vista (215654)

  • Windows XP (49254)

Title: User test not available

Description:User test not available.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMM_USER_1_0

Category: ICE

  • UNIX (46555)

  • Windows 2000 (46755)

  • Windows 2003 (215255)

  • Windows 2008 (216355)

  • Windows Vista (215655)

  • Windows XP (49255)

Title: User defined #1 w/value of 0

Description:User defined test #1 with a value of 0.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMM_USER_2_0

Category: ICE

  • UNIX (46556)

  • Windows 2000 (46756)

  • Windows 2003 (215256)

  • Windows 2008 (216356)

  • Windows Vista (215656)

  • Windows XP (49256)

Title: User defined #2 w/value of 0

Description:User defined test #2 with a value of 0.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMM_USER_3_0

Category: ICE

  • UNIX (46557)

  • Windows 2000 (46757)

  • Windows 2003 (215257)

  • Windows 2008 (216357)

  • Windows Vista (215657)

  • Windows XP (49257)

Title: User defined #3 w/value of 0

Description:User defined test #3 with a value of 0.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMM_USER_1_1

Category: ICE

  • UNIX (46558)

  • Windows 2000 (46758)

  • Windows 2003 (215258)

  • Windows 2008 (216358)

  • Windows Vista (215658)

  • Windows XP (49258)

Title: User defined #1 w/value of 1

Description:User defined test #1 with a value of 1.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMM_USER_2_1

Category: ICE

  • UNIX (46559)

  • Windows 2000 (46759)

  • Windows 2003 (215259)

  • Windows 2008 (216359)

  • Windows Vista (215659)

  • Windows XP (49259)

Title: User defined #2 w/value of 1

Description:User defined test #2 with a value of 1.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMM_USER_3_1

Category: ICE

  • UNIX (46560)

  • Windows 2000 (46760)

  • Windows 2003 (215260)

  • Windows 2008 (216360)

  • Windows Vista (215660)

  • Windows XP (49260)

Title: User defined #3 w/value of 1

Description:User defined test #3 with a value of 1.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMM_USER_1_2

Category: ICE

  • UNIX (46561)

  • Windows 2000 (46761)

  • Windows 2003 (215261)

  • Windows 2008 (216361)

  • Windows Vista (215661)

  • Windows XP (49261)

Title: User defined #1 w/value of 2

Description:User defined test #1 with a value of 2.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMM_USER_2_2

Category: ICE

  • UNIX (46562)

  • Windows 2000 (46762)

  • Windows 2003 (215262)

  • Windows 2008 (216362)

  • Windows Vista (215662)

  • Windows XP (49262)

Title: User defined #2 w/value of 2

Description:User defined test #2 with a value of 2.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMM_USER_3_2

Category: ICE

  • UNIX (46563)

  • Windows 2000 (46763)

  • Windows 2003 (215263)

  • Windows 2008 (216363)

  • Windows Vista (215663)

  • Windows XP (49263)

Title: User defined #3 w/value of 2

Description:User defined test #3 with a value of 2.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMM_USER_1_3

Category: ICE

  • UNIX (46564)

  • Windows 2000 (46764)

  • Windows 2003 (215264)

  • Windows 2008 (216364)

  • Windows Vista (215664)

  • Windows XP (49264)

Title: User defined #1 w/value of 3

Description:User defined test #1 with a value of 3.

Severity: yellow-3

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMM_USER_2_3

Category: ICE

  • UNIX (46565)

  • Windows 2000 (46765)

  • Windows 2003 (215265)

  • Windows 2008 (216365)

  • Windows Vista (215665)

  • Windows XP (49265)

Title: User defined #2 w/value of 3

Description:User defined test #2 with a value of 3.

Severity: yellow-3

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMM_USER_3_3

Category: ICE

  • UNIX (46566)

  • Windows 2000 (46766)

  • Windows 2003 (215266)

  • Windows 2008 (216366)

  • Windows Vista (215666)

  • Windows XP (49266)

Title: User defined #3 w/value of 3

Description:User defined test #3 with a value of 3.

Severity: yellow-3

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMM_USER_1_4

Category: ICE

  • UNIX (46567)

  • Windows 2000 (46767)

  • Windows 2003 (215267)

  • Windows 2008 (216367)

  • Windows Vista (215667)

  • Windows XP (49267)

Title: User defined #1 w/value of 4

Description:User defined test #1 with a value of 4.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMM_USER_2_4

Category: ICE

  • UNIX (46568)

  • Windows 2000 (46768)

  • Windows 2003 (215268)

  • Windows 2008 (216368)

  • Windows Vista (215668)

  • Windows XP (49268)

Title: User defined #2 w/value of 4

Description:User defined test #2 with a value of 4.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESMM_USER_3_4

Category: ICE

  • UNIX (46569)

  • Windows 2000 (46769)

  • Windows 2003 (215269)

  • Windows 2008 (216369)

  • Windows Vista (215669)

  • Windows XP (49269)

Title: User defined #3 w/value of 4

Description:User defined test #3 with a value of 4.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Report All Stderr messages (Windows and UNIX)

Module: Integrated Command Engine

Supported Platforms: UNIX, Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This option enables reporting all Stderr messages.

The following table lists the error message for the check.

Table: Error message for Report All Stderr messages

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESMM_STDERRMSG

Category: ICE

  • UNIX (46570)

  • Windows 2000 (46770)

  • Windows 2003 (215270)

  • Windows 2008 (216370)

  • Windows Vista (215670)

  • Windows XP (49270)

Title: Stderr message

Description:The stderr messages are from the script.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Script missing messages (Windows and UNIX)

Module: Integrated Command Engine

Supported Platforms: UNIX, Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This option enables Script Missing messages.

The following table lists the error message for the check.

Table: Error message for Script missing messages

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESMM_SCRIPTMISSING

Category: ICE

  • UNIX (46547)

  • Windows 2000 (46747)

  • Windows 2003 (215247)

  • Windows 2008 (216347)

  • Windows Vista (215647)

  • Windows XP (49247)

Title: Script missing

Description:Unable to locate the specified script. The problem may conceal a security concern. Check the script for location, name, permissions, and expected functionality.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Unmapped messages (Windows and UNIX)

Module: Integrated Command Engine

Supported Platforms: UNIX, Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This option enables Unmapped messages.

The following table lists the error message for the check.

Table: Error message for Unmapped messages

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESMM_UNMAPPED

Category: ICE

  • UNIX (46549)

  • Windows 2000 (46749)

  • Windows 2003 (215249)

  • Windows 2008 (216349)

  • Windows Vista (215649)

  • Windows XP (49249)

Title: Unmapped message

Description:Unable to identify output from the script specified. The message maps provided do not identify the output received when the script is executed. Check the script for expected functionality.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


User 1/0 messages (Windows and UNIX)

Module: Integrated Command Engine

Supported Platforms: UNIX, Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This option enables User defined #1 w/value of 0 messages.

The following table lists the error message for the check.

Table: Error message for User 1/0 messages

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESMM_USER_1_0

Category: ICE

  • UNIX (46555)

  • Windows 2000 (46755)

  • Windows 2003 (215255)

  • Windows 2008 (216355)

  • Windows Vista (215655)

  • Windows XP (49255)

Title: User defined #1 w/value of 0

Description:User defined test #1 with a value of 0.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


User 1/1 messages (Windows and UNIX)

Module: Integrated Command Engine

Supported Platforms: UNIX, Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This option enables User defined #1 w/value of 1 messages.

The following table lists the error message for the check.

Table: Error message for User 1/1 messages

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESMM_USER_1_1

Category: ICE

  • UNIX (46558)

  • Windows 2000 (46758)

  • Windows 2003 (215258)

  • Windows 2008 (216358)

  • Windows Vista (215658)

  • Windows XP (49258)

Title: User defined #1 w/value of 1

Description:User defined test #1 with a value of 1.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


User 1/2 messages (Windows and UNIX)

Module: Integrated Command Engine

Supported Platforms: UNIX, Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This option enables User defined #1 w/value of 2 messages.

The following table lists the error message for the check.

Table: Error message for User 1/2 messages

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESMM_USER_1_2

Category: ICE

  • UNIX (46561)

  • Windows 2000 (46761)

  • Windows 2003 (215261)

  • Windows 2008 (216361)

  • Windows Vista (215661)

  • Windows XP (49261)

Title: User defined #1 w/value of 2

Description:User defined test #1 with a value of 2.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


User 1/3 messages (Windows and UNIX)

Module: Integrated Command Engine

Supported Platforms: UNIX, Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This option enables User defined #1 w/value of 3 messages.

The following table lists the error message for the check.

Table: Error message for User 1/3 messages

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESMM_USER_1_3

Category: ICE

  • UNIX (46564)

  • Windows 2000 (46764)

  • Windows 2003 (215264)

  • Windows 2008 (216364)

  • Windows Vista (215664)

  • Windows XP (49264)

Title: User defined #1 w/value of 3

Description:User defined test #1 with a value of 3.

Severity: yellow-3

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


User 1/4 messages (Windows and UNIX)

Module: Integrated Command Engine

Supported Platforms: UNIX, Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This option enables User defined #1 w/value of 4 messages.

The following table lists the error message for the check.

Table: Error message for User 1/4 messages

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESMM_USER_1_4

Category: ICE

  • UNIX (46567)

  • Windows 2000 (46767)

  • Windows 2003 (215267)

  • Windows 2008 (216367)

  • Windows Vista (215667)

  • Windows XP (49267)

Title: User defined #1 w/value of 4

Description:User defined test #1 with a value of 4.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


User 2/0 messages (Windows and UNIX)

Module: Integrated Command Engine

Supported Platforms: UNIX, Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This option enables User defined #2 w/value of 0 messages.

The following table lists the error message for the check.

Table: Error message for User 2/0 messages

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESMM_USER_2_0

Category: ICE

  • UNIX (46556)

  • Windows 2000 (46756)

  • Windows 2003 (215256)

  • Windows 2008 (216356)

  • Windows Vista (215656)

  • Windows XP (49256)

Title: User defined #2 w/value of 0

Description:User defined test #2 with a value of 0.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


User 2/1 messages (Windows and UNIX)

Module: Integrated Command Engine

Supported Platforms: UNIX, Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This option enables User defined #2 w/value of 1 messages.

The following table lists the error message for the check.

Table: Error message for User 2/1 messages

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESMM_USER_2_1

Category: ICE

  • UNIX (46559)

  • Windows 2000 (46759)

  • Windows 2003 (215259)

  • Windows 2008 (216359)

  • Windows Vista (215659)

  • Windows XP (49259)

Title: User defined #2 w/value of 1

Description:User defined test #2 with a value of 1.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


User 2/2 messages (Windows and UNIX)

Module: Integrated Command Engine

Supported Platforms: UNIX, Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This option enables User defined #2 w/value of 2 messages.

The following table lists the error message for the check.

Table: Error message for User 2/2 messages

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESMM_USER_2_2

Category: ICE

  • UNIX (46562)

  • Windows 2000 (46762)

  • Windows 2003 (215262)

  • Windows 2008 (216362)

  • Windows Vista (215662)

  • Windows XP (49262)

Title: User defined #2 w/value of 2

Description:User defined test #2 with a value of 2.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


User 2/3 messages (Windows and UNIX)

Module: Integrated Command Engine

Supported Platforms: UNIX, Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This option enables User defined #2 w/value of 3 messages.

The following table lists the error message for the check.

Table: Error message for User 2/3 messages

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESMM_USER_2_3

Category: ICE

  • UNIX (46565)

  • Windows 2000 (46765)

  • Windows 2003 (215265)

  • Windows 2008 (216365)

  • Windows Vista (215665)

  • Windows XP (49265)

Title: User defined #2 w/value of 3

Description:User defined test #2 with a value of 3.

Severity: yellow-3

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


User 2/4 messages (Windows and UNIX)

Module: Integrated Command Engine

Supported Platforms: UNIX, Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This option enables User defined #2 w/value of 4 messages.

The following table lists the error message for the check.

Table: Error message for User 2/4 messages

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESMM_USER_2_4

Category: ICE

  • UNIX (46568)

  • Windows 2000 (46768)

  • Windows 2003 (215268)

  • Windows 2008 (216368)

  • Windows Vista (215668)

  • Windows XP (49268)

Title: User defined #2 w/value of 4

Description:User defined test #2 with a value of 4.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


User 3/0 messages (Windows and UNIX)

Module: Integrated Command Engine

Supported Platforms: UNIX, Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This option enables User defined #3 w/value of 0 messages.

The following table lists the error message for the check.

Table: Error message for User 3/0 messages

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESMM_USER_3_0

Category: ICE

  • UNIX (46557)

  • Windows 2000 (46757)

  • Windows 2003 (215257)

  • Windows 2008 (216357)

  • Windows Vista (215657)

  • Windows XP (49257)

Title: User defined #3 w/value of 0

Description:User defined test #3 with a value of 0.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


User 3/1 messages (Windows and UNIX)

Module: Integrated Command Engine

Supported Platforms: UNIX, Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This option enables User defined #3 w/value of 1 messages.

The following table lists the error message for the check.

Table: Error message for User 3/1 messages

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESMM_USER_3_1

Category: ICE

  • UNIX (46560)

  • Windows 2000 (46760)

  • Windows 2003 (215260)

  • Windows 2008 (216360)

  • Windows Vista (215660)

  • Windows XP (49260)

Title: User defined #3 w/value of 1

Description:User defined test #3 with a value of 1.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


User 3/2 messages (Windows and UNIX)

Module: Integrated Command Engine

Supported Platforms: UNIX, Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This option enables User defined #3 w/value of 2 messages.

The following table lists the error message for the check.

Table: Error message for User 3/2 messages

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESMM_USER_3_2

Category: ICE

  • UNIX (46563)

  • Windows 2000 (46763)

  • Windows 2003 (215263)

  • Windows 2008 (216363)

  • Windows Vista (215663)

  • Windows XP (49263)

Title: User defined #3 w/value of 2

Description:User defined test #3 with a value of 2.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


User 3/3 messages (Windows and UNIX)

Module: Integrated Command Engine

Supported Platforms: UNIX, Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This option enables User defined #3 w/value of 3 messages.

The following table lists the error message for the check.

Table: Error message for User 3/3 messages

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESMM_USER_3_3

Category: ICE

  • UNIX (46566)

  • Windows 2000 (46766)

  • Windows 2003 (215266)

  • Windows 2008 (216366)

  • Windows Vista (215666)

  • Windows XP (49266)

Title: User defined #3 w/value of 3

Description:User defined test #3 with a value of 3.

Severity: yellow-3

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


User 3/4 messages (Windows and UNIX)

Module: Integrated Command Engine

Supported Platforms: UNIX, Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This option enables User defined #3 w/value of 4 messages.

The following table lists the error message for the check.

Table: Error message for User 3/4 messages

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESMM_USER_3_4

Category: ICE

  • UNIX (46569)

  • Windows 2000 (46769)

  • Windows 2003 (215269)

  • Windows 2008 (216369)

  • Windows Vista (215669)

  • Windows XP (49269)

Title: User defined #3 w/value of 4

Description:User defined test #3 with a value of 4.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Login Parameters module

This section includes the following topics:

  • About the Login Parameters module

  • Supported operating systems: Login Parameters

  • Account lockout duration (Windows)

  • Account lockout threshold (Windows)

  • Autologon disabled (Windows)

  • Bad logon counter reset (Windows)

  • Display fully qualified names (Windows)

  • Expired logon hours disconnect (Windows)

  • Inactive accounts (Windows)

  • Inactive accounts timeout (Windows)

  • Inactive accounts with unchanged passwords (Windows)

  • Last user name hidden (Windows)

  • Legal notice (Windows)

  • Maximum reported messages (Windows)

  • Shutdown without logon (Windows)


About the Login Parameters module

The Login Parameters module reports problems if the following are true:

  • Previous user name is displayed on the logon screen

  • Shutdown is possible without logon

  • Automatic logons are allowed

The module also reports old or unused accounts and accounts that are not locked out after a specified number of failed logon attempts.

Note:

Securing your computers from logon vulnerabilities may require modifying the Windows registry. Changing the registry incorrectly can cause serious, network-wide problems. Update the Windows Emergency Repair disk before making any changes.


Supported operating systems: Login Parameters

The Login Parameters module is supported on the following operating systems:

  • Windows 2000

  • Windows 2003

  • Windows 2008

  • Windows Vista

  • Windows XP


Account lockout duration (Windows)

Module: Login Parameters

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports a problem if the account lockout time setting is less than the time that is specified in your policy. Set the policy value to zero if accounts should be locked out until they are reset by the administrator.

The following table lists the error messages for the check.

Table: Error messages for Account lockout duration

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_ACCOUNT_LOCKOUT_DISABLED

Category: Policy Compliance

  • Windows 2000 (105234)

  • Windows 2003 (205234)

  • Windows 2008 (248234)

  • Windows Vista (228234)

  • Windows XP (200234)

Title: Account lockout is disabled

Description:The account lockout function is disabled. Accounts will not be locked out after any number of bad logon attempts and are vunerable to brute force logon attacks.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_LOCKOUT_TIME_TOO_LOW

Category: Policy Compliance

  • Windows 2000 (105232)

  • Windows 2003 (205232)

  • Windows 2008 (248232)

  • Windows Vista (228232)

  • Windows XP (200232)

Title: Lockout time too short

Description:The time an account will remain locked out is shorter than the time specified in your policy. Logon attempts to a locked out account may resume too soon. This increases the chances of a successful brute force logon attack.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Lockout time: %s; expected: %s]


Account lockout threshold (Windows)

Module: Login Parameters

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check verifies that account lockout is enabled and set to lock out an account after a specified maximum number of bad logon attempts.

The following table lists the error messages for the check.

Table: Error messages for Account lockout threshold

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_FAILED_ATTEMPTS_TOO_LOW

Category: Policy Compliance

  • Windows 2000 (105230)

  • Windows 2003 (205230)

  • Windows 2008 (248230)

  • Windows Vista (228230)

  • Windows XP (200230)

Title: Number of bad logon attempts is set too low

Description:The number of bad logon attempts allowed before the system locks out an account is lower than the number specified in the current policy. This lower setting can cause unnecessary account lockouts.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Attempts allowed: %s; expected: %s]

String ID: ESM_ACCOUNT_LOCKOUT_DISABLED

Category: Policy Compliance

  • Windows 2000 (105234)

  • Windows 2003 (205234)

  • Windows 2008 (248234)

  • Windows Vista (228234)

  • Windows XP (200234)

Title: Account lockout is disabled

Description:The account lockout function is disabled. Accounts will not be locked out after any number of bad logon attempts and are vunerable to brute force logon attacks.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_FAILED_ATTEMPTS_TOO_HIGH

Category: Policy Compliance

  • Windows 2000 (105235)

  • Windows 2003 (205235)

  • Windows 2008 (248235)

  • Windows Vista (228235)

  • Windows XP (200235)

Title: Number of bad logon attempts is higher than your policy

Description:The number of bad logon attempts allowed before the system locks out an account is higher than the number specified in your policy. This increases the chances of a successful brute force logon attack.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Attempts allowed: %s; expected: %s]


Autologon disabled (Windows)

Module: Login Parameters

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check verifies that the system does not bypass the logon process by using a default name and password.

The following table lists the error message for the check.

Table: Error message for Autologon disabled

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_AUTOLOGON_ENABLED

Category: Policy Compliance

  • Windows 2000 (105241)

  • Windows 2003 (205241)

  • Windows 2008 (248241)

  • Windows Vista (228241)

  • Windows XP (200241)

Title: Autologon is enabled

Description:The autologon feature is enabled. This feature completely bypasses the logon procedure. Disable the feature by setting the following registry value to 0: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoAdminLogon.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Bad logon counter reset (Windows)

Module: Login Parameters

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports a problem when the bad logon lockout counter can be reset to zero before the time that is specified in your policy has elapsed.

The following table lists the error messages for the check.

Table: Error messages for Bad logon counter reset

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_COUNTER_TIME_TOO_LOW

Category: Policy Compliance

  • Windows 2000 (105233)

  • Windows 2003 (205233)

  • Windows 2008 (248233)

  • Windows Vista (228233)

  • Windows XP (200233)

Title: Counter reset time too low

Description:The bad logon counter reset time is shorter than the time specified in your policy. Logon attempts to a locked out account may resume too soon. This increases the chances of a successful brute force logon attack. Set the bad logon counter reset time to at least 20 minutes.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Reset time: %s; expected: %s]

String ID: ESM_ACCOUNT_LOCKOUT_DISABLED

Category: Policy Compliance

  • Windows 2000 (105234)

  • Windows 2003 (205234)

  • Windows 2008 (248234)

  • Windows Vista (228234)

  • Windows XP (200234)

Title: Account lockout is disabled

Description:The account lockout function is disabled. Accounts will not be locked out after any number of bad logon attempts and are vunerable to brute force logon attacks.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Display fully qualified names (Windows)

Module: Login Parameters

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

Enable this option to display the fully qualified names when they are available.


Expired logon hours disconnect (Windows)

Module: Login Parameters

Supported Platforms: Windows 2000, Windows 2003, Windows 2008

This check verifies that remote users will be forcibly disconnected from the server when logon hours expire. This check applies only to domain controllers.

The following table lists the error message for the check.

Table: Error message for Expired logon hours disconnect

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_NO_FORCIBLE_LOGOUT

Category: Policy Compliance

  • Windows 2000 (105231)

  • Windows 2003 (205231)

  • Windows 2008 (248231)

Title: System without forcible disconnect

Description:The system does not forcibly disconnect users when logon hours expire. Users can remain connected for as long as they like.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Inactive accounts (Windows)

Module: Login Parameters

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports accounts that have never logged on to the system and accounts that have not logged on for the specified number of days. Use the name list to include or exclude specified user accounts from the check.

The following table lists the error message for the check.

Table: Error message for Inactive accounts

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_W2KLASTLOG

Category: Policy Compliance

  • Windows 2000 (105236)

  • Windows 2003 (205236)

  • Windows 2008 (248236)

  • Windows Vista (228236)

  • Windows XP (200236)

Title: Inactive account

Description:The user has not logged onto this account for the number of days specified by your policy. An inactive account can be an easy target for intruders trying to break into your system. Remove or disable the inactive account.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Inactive accounts timeout (Windows)

Module: Login Parameters

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This value specifies the allowed run time in minutes for the Inactive Accounts and Inactive accounts with unchanged passwords checks.


Inactive accounts with unchanged passwords (Windows)

Module: Login Parameters

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports accounts that are both inactive and have not had a password change within the specified number of days. Use the "Login/Password:" field to specify the allowed number of inactive days followed by a slash and the allowed number of days since a password change. Use the name list to include or exclude specified user accounts from the check.

The following table lists the error message for the check.

Table: Error message for Inactive accounts with unchanged passwords

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_LASTLOG_PSWDCHANGE

Category: Policy Compliance

  • Windows 2000 (105242)

  • Windows 2003 (205242)

  • Windows 2008 (248242)

  • Windows Vista (228242)

  • Windows XP (200242)

Title: Inactive accounts with unchanged password

Description:The user account is inactive and the password has not been changed within the specified number of days.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Last user name hidden (Windows)

Module: Login Parameters

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check verifies that the last input user name is not displayed in the Logon dialog box. This protects the user name from unauthorized use.

The following table lists the error message for the check.

Table: Error message for Last user name hidden

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_USERID_NOT_HIDDEN

Category: Policy Compliance

  • Windows 2000 (105238)

  • Windows 2003 (205238)

  • Windows 2008 (248238)

  • Windows Vista (228238)

  • Windows XP (200238)

Title: Previous user name displayed

Description:The previous user account name appears in the Logon dialog box. This gives away half of the User name/Password combination that is intended to protect the account from unauthorized access. To hide the previous user name, set the following registry value to 1: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\dontdisplaylastusername.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Legal notice (Windows)

Module: Login Parameters

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check verifies that a user defined legal access notice is displayed before users log on to the system. The notice provides legal protection against unauthorized users. If a notice is defined, it will be displayed in the ESM report.

The following table lists the error messages for the check.

Table: Error messages for Legal notice

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_LEGALMESSAGE

Category: Policy Compliance

  • Windows 2000 (105239)

  • Windows 2003 (205239)

  • Windows 2008 (248239)

  • Windows Vista (228239)

  • Windows XP (200239)

Title: Legal message displayed

Description:This is the legal warning displayed to users before they log on.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_NOLEGALMESSAGE

Category: Policy Compliance

  • Windows 2000 (105240)

  • Windows 2003 (205240)

  • Windows 2008 (248240)

  • Windows Vista (228240)

  • Windows XP (200240)

Title: No legal notice defined

Description:Your system does not display a legal access notice before users log on. Legal notices increase the legal liability of unauthorized users who access the system. To display a legal notice you must define a title and message text by editing the Windows registry keys HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Maximum reported messages (Windows)

Module: Login Parameters

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

Enable this option to limit the number of messages returned for each enabled check. Use the value field to specify the maximum number of times a given message should be displayed. Once the maximum number has been reached for a single message, the message will be displayed once more with the number of repeating instances of the message that are not reported.


Shutdown without logon (Windows)

Module: Login Parameters

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check verifies that the Shutdown button is disabled in the Logon screen. This prevents unauthorized users from shutting down the system without logging on to the system.

The following table lists the error messages for the check.

Table: Error messages for Shutdown without logon

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_SHUTDOWN_FROM_LOGON

Category: Policy Compliance

  • Windows 2000 (105237)

  • Windows 2003 (205237)

  • Windows 2008 (248237)

  • Windows Vista (228237)

  • Windows XP (200237)

Title: Shutdown from Logon dialog box is enabled

Description:A user can shut down the system without logging on. This allows anyone to interrupt system operations. Disable this function if the system is secure from power interruptions. Set the following registry value to 0: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\shutdownwithoutlogon.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_NO_SHUTDOWN_FROM_LOGON

Category: Policy Compliance

  • Windows 2000 (105243)

  • Windows 2003 (205243)

  • Windows 2008 (248243)

  • Windows Vista (228243)

  • Windows XP (200243)

Title: Shutdown from Logon not defined

Description:The registry value is not defined for Shutdown from Logon option.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Network Integrity module

This section includes the following topics:

  • About the Network Integrity module

  • Supported operating systems: Network Integrity

  • Anonymous LanMan access disabled (Windows)

  • Anonymous SID/name translation (Windows)

  • Authorized ICF/ICS exposed services (Windows)

  • Automatically update snapshots (Windows)

  • Deleted listening TCP ports (Windows)

  • Deleted listening UDP ports (Windows)

  • Deleted network shares (Windows)

  • File security more restrictive than share security (Windows)

  • Hidden shares (Windows)

  • ICMP messages (Windows)

  • IP Security Policies (Windows)

  • IPv6 Protocol (Windows)

  • Internet Connection Firewall (Windows)

  • Internet Connection Sharing (Windows)

  • Listening TCP ports (Windows)

  • Listening UDP ports (Windows)

  • Local groups (Windows)

  • Modified network shares (Windows)

  • NetBIOS info via SNMP (Windows)

  • New listening TCP ports (Windows)

  • New listening UDP ports (Windows)

  • New network shares (Windows)

  • Permitted IP protocols (Windows)

  • Permitted TCP ports (Windows)

  • Permitted UDP ports (Windows)

  • Plain text authentication (Windows)

  • Prohibited shared folders (Windows)

  • RRAS NetBIOS gateway disabled (Windows)

  • RRAS enabled (Windows)

  • RRAS requires account callbacks (Windows)

  • RRAS requires preset number for callback (Windows)

  • Share permissions (Windows)

  • Shared folders (Windows)

  • Shared folders granting access to all users (Windows)

  • Shared printers (Windows)

  • Trusted domains (Windows)


About the Network Integrity module

The Network Integrity module on Windows reports the vulnerabilities of domains, including global security groups and folder and printer shares. The module also reports CD-ROM and floppy disk drives that can be accessed by network users, and it evaluates Microsoft's Routing and Remote Access Service (RRAS), which is called Remote Access Service (RAS).

Note:

Changing the registry incorrectly can cause serious, network-wide problems. Update the Windows Emergency Repair disk before you make any changes.


Supported operating systems: Network Integrity

The Network Integrity module is supported on the following operating systems:

  • Windows 2000

  • Windows 2003

  • Windows 2008

  • Windows Vista

  • Windows XP


Anonymous LanMan access disabled (Windows)

Module: Network Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports a problem if the Anonymous user has access to LanMan information such as user names and shares.

The following table lists the error message for the check.

Table: Error message for Anonymous LanMan access disabled

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_ANONYMOUS_LANMAN

Category: Change Notification

  • Windows 2000 (106340)

  • Windows 2003 (206340)

  • Windows 2008 (249340)

  • Windows Vista (229340)

  • Windows XP (201340)

Title: Anonymous LAN Manager information access enabled

Description:Access to LAN Manager information is granted to Anonymous. Remote users can get information about shares and accounts, including the name of a renamed Administrator account. To disable Anonymous LanMan information access, use the rbfix utility that ships with Symantec ESM. Disabling Anonymous LAN Manager information access can prevent legitimate information gathering by some remote configuration tools.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Anonymous SID/name translation (Windows)

Module: Network Integrity

Supported Platforms: Windows 2003, Windows 2008

This check reports the Group Policy setting which allows anonymous SID/name translation.

The following table lists the error message for the check.

Table: Error message for Anonymous SID/name translation

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_ANONYMOUS_SID_NAME_TRANSLATION

Category: Change Notification

  • Windows 2003 (206359)

  • Windows 2008 (249359)

Title: Anonymous SID/name translation allowed

Description:This security setting determines if an anonymous user can request security identifier (SID) attributes for another user. If this policy is enabled, a user with knowledge of an administrator's SID could contact a computer that has this policy enabled and use the SID to get the administrator's name.

Severity: yellow-3

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Authorized ICF/ICS exposed services (Windows)

Module: Network Integrity

Supported Platforms: Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports unauthorized local services that are accessible to external users through Internet Connection Firewall/Sharing. To authorize a service to be exposed to external users, enter its information in an "Authorized Services" template and enable that template. All other exposed services will be reported as policy violations. This information is currently not available on Itanium based systems.

The following table lists the error message for the check.

Table: Error message for Authorized ICF/ICS exposed services

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_ICS_EXPOSURE_VIOLATION

Category: Change Notification

  • Windows 2003 (206367)

  • Windows 2008 (249367)

  • Windows Vista (229366)

  • Windows XP (201366)

Title: Unauthorized exposure of a network or host service

Description:An unauthorized network or host service is accessable to external users through the Windows Internet Connection Firewall/Sharing service. You should disable the exposed service or enter its information in an "Authorized Services" template and enable that template.

Severity: yellow-3

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Automatically update snapshots (Windows)

Module: Network Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows XP

Enable this option to automatically update snapshots with current information.


Deleted listening TCP ports (Windows)

Module: Network Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports closed TCP ports that were closed for listening after the last snapshot update.

The following table lists the error message for the check.

Table: Error message for Deleted listening TCP ports

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_DELETED_LISTENING_TCP_PORT

Category: Change Notification

  • Windows 2000 (106353)

  • Windows 2003 (206353)

  • Windows 2008 (249353)

  • Windows Vista (229353)

  • Windows XP (201353)

Title: Deleted listening TCP port

Description:The deleted TCP port was listening when the snapshot was last updated. If the port is not needed, update the snapshot. If it is needed, reopen the port.

Severity: yellow-3

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [%s]


Deleted listening UDP ports (Windows)

Module: Network Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports UDP ports that were closed after the last snapshot update.

The following table lists the error message for the check.

Table: Error message for Deleted listening UDP ports

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_DELETED_LISTENING_UDP_PORT

Category: Change Notification

  • Windows 2000 (106356)

  • Windows 2003 (206356)

  • Windows 2008 (249356)

  • Windows Vista (229356)

  • Windows XP (201356)

Title: Deleted listening UDP port

Description:The deleted UDP port was open when the snapshot was last updated. If the port is not needed, update the snapshot file. If it is needed, reopen the port.

Severity: yellow-3

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [%s]


Deleted network shares (Windows)

Module: Network Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports network shares that were deleted after the last snapshot update.

The following table lists the error message for the check.

Table: Error message for Deleted network shares

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_DELETED_NETWORK_SHARE

Category: Change Notification

  • Windows 2000 (106351)

  • Windows 2003 (206351)

  • Windows 2008 (249351)

  • Windows Vista (229351)

  • Windows XP (201351)

Title: Deleted network share

Description:The share was deleted after the last snapshot update. If the deletion is authorized, update the snapshot file. If it should not have been deleted, restore the share.

Severity: yellow-3

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [%s]


File security more restrictive than share security (Windows)

Module: Network Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports a problem if file permissions are weaker than share permissions. Enable keys to specify the scope of the check. If neither key is enabled, the check examines only folders in the top-level of the shared folder. If only the Check Files key is enabled, the check examines both files and folders in the top-level of the shared folder. If only the Traverse Directory Tree key is enabled, the check examines all folders on the share. If both keys are enabled, the check examines all files and folders on the share.

The following table lists the error message for the check.

Table: Error message for File security more restrictive than share security

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_SHARE_FILE_PERMISSIONS

Category: Change Notification

  • Windows 2000 (106342)

  • Windows 2003 (206342)

  • Windows 2008 (249342)

  • Windows Vista (229342)

  • Windows XP (201342)

Title: Share permissions are more restrictive than file permissions

Description:The share permissions that are reported in the Information field are more restrictive than the file permissions on the shared file or folder. Users may be able to access the file locally or through another share with less restrictive security.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [File/folder: %s; account: %s; share permissions: %s; file/folder permissions: %s]


Hidden shares (Windows)

Module: Network Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports hidden shares.

The following table lists the error message for the check.

Table: Error message for Hidden shares

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_HIDDEN_SHARES

Category: Change Notification

  • Windows 2000 (106338)

  • Windows 2003 (206338)

  • Windows 2008 (249338)

  • Windows Vista (229338)

  • Windows XP (201338)

Title: Hidden Shares

Description:The shared folder is hidden.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Resource: %s; remark: %s]


ICMP messages (Windows)

Module: Network Integrity

Supported Platforms: Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports ICMP messages that are accessible to external users through the Internet Connection Firewall (ICF). To check for an ICMP message, enable the key. If the firewall is disabled, the ICMP check is ignored. This information is currently not available on Itanium based systems.

The following table lists the error message for the check.

Table: Error message for ICMP messages

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_ICMP_VIOLATION

Category: Change Notification

  • Windows 2003 (206368)

  • Windows 2008 (249368)

  • Windows Vista (229367)

  • Windows XP (201367)

Title: Unauthorized exposure of an ICMP message

Description:An unauthorized ICMP message is accessable to external users through the Internet Connection Firewall (ICF). You should disable the ICMP message on the system.

Severity: yellow-3

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


IP Security Policies (Windows)

Module: Network Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008

This check reports IP Security Policies that exist for Active Directory on domain controllers. The check reports if the policy is assigned, if IP Security Rules exist but are not selected, and if the Check for policy changes text box is set to greater than four minutes.

The following table lists the error messages for the check.

Table: Error messages for IP Security Policies

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_IP_SECPOLICY_DEFAULT

Category: Change Notification

  • Windows 2000 (106359)

  • Windows 2003 (206360)

  • Windows 2008 (249360)

Title: IP Security Policy is not assigned

Description:The IP Security Policies on Active Directory is NOT assigned.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [IPSec Policy: NONE]

String ID: ESM_IP_SECURITY_POLICY_DEFAULT

Category: Change Notification

  • Windows 2000 (106360)

  • Windows 2003 (206361)

  • Windows 2008 (249361)

Title: IP Security Policy is assigned

Description:The IP Security Policies on Active Directory is assigned.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [IPSec Policy: %s;]

String ID: ESM_IP_SECURITY_RULE_NOT_SELECTED

Category: Change Notification

  • Windows 2000 (106361)

  • Windows 2003 (206362)

  • Windows 2008 (249362)

Title: IP Security Policy Rule is not selected

Description:The IP Security Policy Rule on Active Directory is not selected.

Severity: yellow-3

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [IPSec Policy Rule is not selected: %s;]

String ID: ESM_IP_SECURITY_REFRESH

Category: Change Notification

  • Windows 2000 (106362)

  • Windows 2003 (206363)

  • Windows 2008 (249363)

Title: Check for policy changes setting is set too high

Description:The IP Security Policy Rule timer is set too high.

Severity: yellow-3

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [IPSec Policy check policy refresh is set high]


IPv6 Protocol (Windows)

Module: Network Integrity

Supported Platforms: Windows 2003, Windows 2008, Windows Vista, Windows XP

This check allows you to specify whether IPv6 protocol is required or forbidden on the host. If the "IPv6" key is disabled and IPv6 is installed, the host is out of compliance with the policy. If the "IPv6" key is enabled and IPv6 is not installed, the host is out of compliance.

The following table lists the error message for the check.

Table: Error message for IPv6 Protocol

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_IPV6_VIOLATION

Category: Change Notification

  • Windows 2003 (206364)

  • Windows 2008 (249364)

  • Windows Vista (229363)

  • Windows XP (201363)

Title: IPv6 protocol policy violation

Description:The state of the IPv6 protocol does not comply with the policy for this host. See the information field for instructions.

Severity: yellow-3

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Internet Connection Firewall (Windows)

Module: Network Integrity

Supported Platforms: Windows 2003, Windows 2008, Windows Vista, Windows XP

This check allows you to specify whether Windows basic Internet Connection Firewall (ICF) is required or forbidden on the host. To require the firewall, enable the key. To forbid it, disable the key. A message is reported if the policy is violated. This information is currently not available on Itanium based systems.

The following table lists the error message for the check.

Table: Error message for Internet Connection Firewall

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_ICF_VIOLATION

Category: Change Notification

  • Windows 2003 (206365)

  • Windows 2008 (249365)

  • Windows Vista (229364)

  • Windows XP (201364)

Title: Internet Connection Firewall policy violation

Description:The configuration of Internet Connection Firewall (ICF) (Windows basic firewall) does not comply with the policy for this host. See the information field.

Severity: yellow-3

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Internet Connection Sharing (Windows)

Module: Network Integrity

Supported Platforms: Windows 2003, Windows 2008, Windows Vista, Windows XP

This check allows you to specify whether Internet Connection Sharing (ICS) is required or forbidden on the host. To require the service, enable the key. To forbid it, disable the key. A message is reported if the policy is violated. This information is currently not available on Itanium based systems.

The following table lists the error message for the check.

Table: Error message for Internet Connection Sharing

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_ICS_VIOLATION

Category: Change Notification

  • Windows 2003 (206366)

  • Windows 2008 (249366)

  • Windows Vista (229365)

  • Windows XP (201365)

Title: Internet Connection Sharing policy violation

Description:The configuration of Internet Connection Sharing (ICS) does not comply with the policy for this host. See the information field.

Severity: yellow-3

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Listening TCP ports (Windows)

Module: Network Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports listening TCP ports. In the name list, enter the numbers of ports that you do not want to be reported.

The following table lists the error message for the check.

Table: Error message for Listening TCP ports

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_OPEN_PORT

Category: Change Notification

  • Windows 2000 (106345)

  • Windows 2003 (206345)

  • Windows 2008 (249345)

  • Windows Vista (229345)

  • Windows XP (201345)

Title: Port is listening

Description:The port is listening. Close it if it is not needed.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Listening UDP ports (Windows)

Module: Network Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports listening UDP ports. In the name list, enter the numbers of ports that you do not want to be reported.

The following table lists the error message for the check.

Table: Error message for Listening UDP ports

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_OPEN_PORT

Category: Change Notification

  • Windows 2000 (106345)

  • Windows 2003 (206345)

  • Windows 2008 (249345)

  • Windows Vista (229345)

  • Windows XP (201345)

Title: Port is listening

Description:The port is listening. Close it if it is not needed.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Local groups (Windows)

Module: Network Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports local security groups that exist on your computer.

The following table lists the error message for the check.

Table: Error message for Local groups

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_LOCAL_GROUP

Category: Change Notification

  • Windows 2000 (106330)

  • Windows 2003 (206330)

  • Windows 2008 (249330)

  • Windows Vista (229330)

  • Windows XP (201330)

Title: Local groups

Description:The group exists locally on the agent. The Information field reports group privileges and other comments.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Modified network shares (Windows)

Module: Network Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports network shares that changed after the last snapshot update.

The following table lists the error message for the check.

Table: Error message for Modified network shares

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_MODIFIED_NETWORK_SHARE

Category: Change Notification

  • Windows 2000 (106350)

  • Windows 2003 (206350)

  • Windows 2008 (249350)

  • Windows Vista (229350)

  • Windows XP (201350)

Title: Modified network share

Description:The share property is different than the property recorded in the last snapshot update. If the change is authorized, update the snapshot file. If it is not authorized, restore the previous property.

Severity: yellow-3

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [%s]


NetBIOS info via SNMP (Windows)

Module: Network Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports the NetBIOS information is available via SNMP.

The following table lists the error message for the check.

Table: Error message for NetBIOS info via SNMP

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_NETBIOS_VIA_SNMP

Category: Change Notification

  • Windows 2000 (106358)

  • Windows 2003 (206358)

  • Windows 2008 (249358)

  • Windows Vista (229358)

  • Windows XP (201358)

Title: NetBIOS info via SNMP

Description:The NetBIOS information is available via SNMP, the private or public community is not set to 1.

Severity: yellow-3

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


New listening TCP ports (Windows)

Module: Network Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports listening TCP ports that were opened for listening after the last snapshot update.

The following table lists the error message for the check.

Table: Error message for New listening TCP ports

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_NEW_LISTENING_TCP_PORT

Category: Change Notification

  • Windows 2000 (106352)

  • Windows 2003 (206352)

  • Windows 2008 (249352)

  • Windows Vista (229352)

  • Windows XP (201352)

Title: New listening TCP port

Description:The listening TCP port was not listening when the snapshot was last updated. If the current service is authorized, update the snapshot file. If it is not authorized, close the port.

Severity: red-4

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [%s]


New listening UDP ports (Windows)

Module: Network Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports open UDP ports that were opened after the last snapshot update.

The following table lists the error message for the check.

Table: Error message for New listening UDP ports

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_NEW_LISTENING_UDP_PORT

Category: Change Notification

  • Windows 2000 (106355)

  • Windows 2003 (206355)

  • Windows 2008 (249355)

  • Windows Vista (229355)

  • Windows XP (201355)

Title: New listening UDP port

Description:The UDP port is open. It was closed when the snapshot was last updated. If the port is authorized to be open, update the snapshot file. If it is not authorized, close the port.

Severity: red-4

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [%s]


New network shares (Windows)

Module: Network Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports network shares that were shared after the last snapshot update.

The following table lists the error message for the check.

Table: Error message for New network shares

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_NEW_NETWORK_SHARE

Category: Change Notification

  • Windows 2000 (106349)

  • Windows 2003 (206349)

  • Windows 2008 (249349)

  • Windows Vista (229349)

  • Windows XP (201349)

Title: New network share

Description:The network share was added after the last snapshot update. If the share is authorized, update the snapshot file. If the share is not authorized, remove it.

Severity: red-4

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [%s]


Permitted IP protocols (Windows)

Module: Network Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports permitted IP protocol numbers. Specify the numbers of protocols that you want to examine in the name list. To specify a range, use a hyphen. For example, 100-255 specifies protocol numbers 100 through 255. Valid protocol numbers are 1-255. The file %SYSTEMROOT%\system32\drivers\etc\protocol maps protocol names to protocol numbers. Filtering out unneeded protocols increases security.

The following table lists the error message for the check.

Table: Error message for Permitted IP protocols

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_ALLOWED_PORT_OR_PROTOCOL

Category: Change Notification

  • Windows 2000 (106343)

  • Windows 2003 (206343)

  • Windows 2008 (249343)

  • Windows Vista (229343)

  • Windows XP (201343)

Title: Port or protocol is permitted

Description:The system permits connections through the reported protocol or port.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Adapter: %s]


Permitted TCP ports (Windows)

Module: Network Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports TCP ports that are permitted to receive incoming connections through Windows TCP/IP security settings. Specify ports that you want to examine in the name list. To specify a range, use a hyphen. For example, 100-5000 specifies ports 100 through 5000. Valid port numbers are 1-65535. Filtering out unneeded ports increases security.

The following table lists the error message for the check.

Table: Error message for Permitted TCP ports

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_ALLOWED_PORT_OR_PROTOCOL

Category: Change Notification

  • Windows 2000 (106343)

  • Windows 2003 (206343)

  • Windows 2008 (249343)

  • Windows Vista (229343)

  • Windows XP (201343)

Title: Port or protocol is permitted

Description:The system permits connections through the reported protocol or port.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Adapter: %s]


Permitted UDP ports (Windows)

Module: Network Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports UDP ports that are permitted to receive incoming connections through Windows TCP/IP security settings. Specify ports that you want to examine in the name list. To specify a range, use a hyphen. For example, 100-5000 specifies ports 100 through 5000. Valid port numbers are 1-65535. Filtering out unneeded ports increases security.

The following table lists the error message for the check.

Table: Error message for Permitted UDP ports

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_ALLOWED_PORT_OR_PROTOCOL

Category: Change Notification

  • Windows 2000 (106343)

  • Windows 2003 (206343)

  • Windows 2008 (249343)

  • Windows Vista (229343)

  • Windows XP (201343)

Title: Port or protocol is permitted

Description:The system permits connections through the reported protocol or port.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Adapter: %s]


Plain text authentication (Windows)

Module: Network Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check examines the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkStation\Parameters\enableplaintextpassword registry value and reports a problem if the value is 1 (plain text enabled).

The following table lists the error message for the check.

Table: Error message for Plain text authentication

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_PLAIN_TEXT_ENABLED

Category: Change Notification

  • Windows 2000 (106339)

  • Windows 2003 (206339)

  • Windows 2008 (249339)

  • Windows Vista (229339)

  • Windows XP (201339)

Title: Plain text authentication is enabled

Description:Plain text password authentication is enabled. Account passwords are transmitted without encryption. To disable plain text authentication, set the registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanworkstation\parameters\enableplaintextpassword to 0. Some third-party applications require plain text authentication.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Prohibited shared folders (Windows)

Module: Network Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports prohibited shared folders.

The following table lists the error message for the check.

Table: Error message for Prohibited shared folders

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_PROHIBITED_SHARED_FOLDERS

Category: Change Notification

  • Windows 2000 (106372)

  • Windows 2003 (206372)

  • Windows 2008 (249372)

  • Windows Vista (229372)

  • Windows XP (201372)

Title: Prohibited shared folders

Description:The folder is shared and prohibited. The Information field reports the folder path and comments.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Resource: %s; remark: %s]


RRAS NetBIOS gateway disabled (Windows)

Module: Network Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check works if Routing and Remote Access (RRAS) service is running and this service is cofigured to function like a NETBIOS gateway. This check reports a problem only if check "RRAS enabled" is selected and the NetBIOS gateway is enabled. If the registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Parameters\Ip\allownetworkaccess is not 0, a problem is reported. This lets RRAS server users access network resources.

The following table lists the error message for the check.

Table: Error message for RRAS NetBIOS gateway disabled

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_RRAS_NETBIOS_ENABLED

Category: Change Notification

  • Windows 2000 (106337)

  • Windows 2003 (206337)

  • Windows 2008 (249337)

  • Windows Vista (229337)

  • Windows XP (201337)

Title: RRAS NetBIOS gateway is enabled

Description:The RRAS NetBIOS gateway is enabled. This lets remote users access network resources. To disable the gateway, set the registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Parameters\Ip\AllowNetworkAccess to 0.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


RRAS enabled (Windows)

Module: Network Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports a problem if Microsoft's Routing and Remote Access Service (RRAS) is enabled.

The following table lists the error message for the check.

Table: Error message for RRAS enabled

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_RRAS_ENABLED

Category: Change Notification

  • Windows 2000 (106344)

  • Windows 2003 (206344)

  • Windows 2008 (249344)

  • Windows Vista (229344)

  • Windows XP (201344)

Title: RRAS is enabled

Description:RRAS is enabled. Remote callers can access the system. Disable RRAS unless it is required.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


RRAS requires account callbacks (Windows)

Module: Network Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports accounts that do not require callback for Microsoft's Routing and Remote Access Service (RRAS).

The following table lists the error message for the check.

Table: Error message for RRAS requires account callbacks

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_RRAS_CALLBACK_USER_DISABLED

Category: Change Notification

  • Windows 2000 (106335)

  • Windows 2003 (206335)

  • Windows 2008 (249335)

  • Windows Vista (229335)

  • Windows XP (201335)

Title: RRAS callback set by user is disabled

Description:The callback set by user function is disabled. The system does not call back remote callers. If RRAS is enabled, enable callback, preferably to a preset number.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


RRAS requires preset number for callback (Windows)

Module: Network Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports accounts that are not required to use a preset callback number for Microsoft's Routing and Remote Access Service (RRAS).

The following table lists the error message for the check.

Table: Error message for RRAS requires preset number for callback

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_RRAS_CALLBACK_PRESET_DISABLED

Category: Change Notification

  • Windows 2000 (106336)

  • Windows 2003 (206336)

  • Windows 2008 (249336)

  • Windows Vista (229336)

  • Windows XP (201336)

Title: RRAS callback preset is disabled

Description:The callback to a preset number function is disabled. Set the system to call back to a preset number if RRAS is enabled.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Share permissions (Windows)

Module: Network Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports permissions on all shares.

The following table lists the error message for the check.

Table: Error message for Share permissions

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_ACCOUNT_SHARE_PERMISSIONS

Category: Change Notification

  • Windows 2000 (106341)

  • Windows 2003 (206341)

  • Windows 2008 (249341)

  • Windows Vista (229341)

  • Windows XP (201341)

Title: Share permissions

Description:The account permissions exist on the shared folder. The Information field reports the account permission and share path.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Account: %s; permissions: %s; resource: %s]


Shared folders (Windows)

Module: Network Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports shared folders.

The following table lists the error message for the check.

Table: Error message for Shared folders

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_SHARED_DIRECTORIES

Category: Change Notification

  • Windows 2000 (106331)

  • Windows 2003 (206331)

  • Windows 2008 (249331)

  • Windows Vista (229331)

  • Windows XP (201331)

Title: Shared folders

Description:The folder is shared. The Information field reports the folder path and comments.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Resource: %s; remark: %s]


Shared folders granting access to all users (Windows)

Module: Network Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports shared folders that give Full Control, Change Control, and Read Control to the Everyone security group. Only users that are specifically restricted do not have the specified Control. Use the name list to include or exclude shared names of shared folders for this check.

The following table lists the error messages for the check.

Table: Error messages for Shared folders granting access to all users

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_SHARED_DIRS_WITH_ALL_ACCESS

Category: Change Notification

  • Windows 2000 (106334)

  • Windows 2003 (206334)

  • Windows 2008 (249334)

  • Windows Vista (229334)

  • Windows XP (201334)

Title: Shared folders giving all users Full Control

Description:The Everyone group has full control of the shared folder. Members of the Everyone group who are not explicity denied access can write, read, delete, or otherwise modify the files in the folder. Remove the Everyone group from the folder's access list.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Resource: %s]

String ID: ESM_SHARED_DIRS_WITH_CHANGE_ACCESS

Category: Change Notification

  • Windows 2000 (106363)

  • Windows 2003 (206369)

  • Windows 2008 (249369)

  • Windows Vista (229368)

  • Windows XP (201368)

Title: Shared folders giving all users Change Control

Description:The Everyone group has change control of the shared folder. Members of the Everyone group who are not explicity denied access can read and modify the files in the folder. Remove the Everyone group from the folder's access list.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Resource: %s]

String ID: ESM_SHARED_DIRS_WITH_READ_ACCESS

Category: Change Notification

  • Windows 2000 (106364)

  • Windows 2003 (206370)

  • Windows 2008 (249370)

  • Windows Vista (229369)

  • Windows XP (201369)

Title: Shared folders giving all users Read Control

Description:The Everyone group has read control of the shared folder. Members of the Everyone group who are not explicity denied access can read the files in the folder. Remove the Everyone group from the folder's access list.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Resource: %s]

String ID: ESM_SHARED_DIRS_WITH_UNKNOWN_ACCESS

Category: Change Notification

  • Windows 2000 (106365)

  • Windows 2003 (206371)

  • Windows 2008 (249371)

  • Windows Vista (229370)

  • Windows XP (201370)

Title: Shared folders giving all users Unknown Control

Description:The Everyone group has unknown control of the shared folder. Remove the Everyone group from the folder's access list.

Severity: red-4

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Resource: %s]


Shared printers (Windows)

Module: Network Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports printers that are shared.

The following table lists the error message for the check.

Table: Error message for Shared printers

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_SHARED_PRINTERS

Category: Change Notification

  • Windows 2000 (106332)

  • Windows 2003 (206332)

  • Windows 2008 (249332)

  • Windows Vista (229332)

  • Windows XP (201332)

Title: Shared printers

Description:The printer is shared. The Information field reports the resource path and comments.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Resource: %s; remark: %s]


Trusted domains (Windows)

Module: Network Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008

This check reports the domains that are trusted by your domain. A secure channel exists between your domain controller and trusted domains so that they may share privileged user account information. The check works only with Windows domain controllers.

The following table lists the error message for the check.

Table: Error message for Trusted domains

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_TRUSTED_DOMAINS

Category: Change Notification

  • Windows 2000 (106333)

  • Windows 2003 (206333)

  • Windows 2008 (249333)

Title: Trusted domains

Description:The domain is trusted by this domain controller.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


OS Patches module

This section includes the following topics:

  • About the OS Patches module

  • Supported operating systems: OS Patches

  • Comparisons: (Windows)

  • Disable module (Windows)

  • File dates (Windows)

  • File versions (Windows)

  • Installed patches (Windows)

  • Patch Keywords templates (Windows)

  • Patch not installed and process not running (Windows)

  • Patch results summary (Windows)

  • Patch templates (Windows)

  • Registry keys (Windows)

  • Relaxed (Windows)

  • Strict (Windows)

  • Superseded (Windows)


About the OS Patches module

The OS Patches module reports patches that have been released for Windows by Microsoft Corporation but are not found on the agent. The released patches are defined in the template files. New patch templates are available bi-monthly through LiveUpdate.


Supported operating systems: OS Patches

The OS Patches module is supported on the following operating systems:

  • Windows 2000

  • Windows 2003

  • Windows 2008

  • Windows Vista

  • Windows XP


Comparisons: (Windows)

Module: OS Patches

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

The OS Patches module reports a problem when a patch that is defined in the template is missing from the agent. It also reports a problem when the registry key, version number, or file date attribute of the agent patch does not match the attribute specified in the Patch template. Not all patches can be detected by all detection methods. For example, the Registry key option does not detect F (file-only) patches. Therefore, you may want to enable two or more comparison options. The module first uses the enabled option that most accurately detects patches. File version is the most accurate method, followed by File date and Registry key.

The following table lists the error message for the check.

Table: Error message for Comparisons:

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_NO_COMPARISON_SPECIFIED

Category: Policy Compliance

  • Windows 2000 (45443)

  • Windows 2003 (215143)

  • Windows 2008 (216043)

  • Windows Vista (215743)

  • Windows XP (49043)

Title: No comparison type specified

Description:The OS Patches module was run with no comparison options enabled. No security checks were performed. Enable one or more comparison options.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Disable module (Windows)

Module: OS Patches

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

The module can take a long time to run. To save time, enable this option if you recently ran the module.


File dates (Windows)

Module: OS Patches

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

Enable this option to use file dates to determine whether a patch has been installed. File dates are stored in Files sublists of the Patch template.

The following table lists the error message for the check.

Table: Error message for File dates

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_BAD_DATE_OR_VER

Category: Policy Compliance

  • Windows 2000 (45445)

  • Windows 2003 (215145)

  • Windows 2008 (216045)

  • Windows Vista (215745)

  • Windows XP (49045)

Title: Invalid date or version value

Description:The patch has a Files sublist entry with an invalid date/version. Use the format YYYY/MM/DD. Versions must consist of a v followed by a version number. For example, v1.0.2.3a.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Filename: %s; value: %s]


File versions (Windows)

Module: OS Patches

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

Enable this option to use file versions to determine whether a patch has been installed. File versions are stored in Files sublists of the Patch template.

The following table lists the error message for the check.

Table: Error message for File versions

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_BAD_DATE_OR_VER

Category: Policy Compliance

  • Windows 2000 (45445)

  • Windows 2003 (215145)

  • Windows 2008 (216045)

  • Windows Vista (215745)

  • Windows XP (49045)

Title: Invalid date or version value

Description:The patch has a Files sublist entry with an invalid date/version. Use the format YYYY/MM/DD. Versions must consist of a v followed by a version number. For example, v1.0.2.3a.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Filename: %s; value: %s]


Installed patches (Windows)

Module: OS Patches

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

Enable this option to view all the installed patches that are checked by ESM.

The following table lists the error message for the check.

Table: Error message for Installed patches

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_INSTALLED_PATCH

Category: Policy Compliance

  • Windows 2000 (45464)

  • Windows 2003 (215164)

  • Windows 2008 (216064)

  • Windows Vista (215764)

  • Windows XP (49064)

Title: Patch installed

Description:This patch is installed and checked by ESM.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Patch Keywords templates (Windows)

Module: OS Patches

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

Use this option to specify Patch Keywords template files. Keywords enclosed in % characters represent part of a file path that may vary from one agent to another. For example, %SYSTEMROOT% may represent C:\winnt on one computer and D:\windows on another. You can define additional keywords in the Patch Keywords template. The windows.pkl Patch Keyword template must be enabled when Patch templates are enabled for Windows operating systems.

The following table lists the error message for the check.

Table: Error message for Patch Keywords templates

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_NO_COMPARISON_SPECIFIED

Category: Policy Compliance

  • Windows 2000 (45443)

  • Windows 2003 (215143)

  • Windows 2008 (216043)

  • Windows Vista (215743)

  • Windows XP (49043)

Title: No comparison type specified

Description:The OS Patches module was run with no comparison options enabled. No security checks were performed. Enable one or more comparison options.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Patch not installed and process not running (Windows)

Module: OS Patches

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

Enable this check to report patches that are not installed and not checked because the service or daemon that they would patch is not running. Missing patches are not reported if the running process condition is configured in the template and the process corresponding to the patch is not running. This check enables you to see missing patches that would otherwise not be reported as a result of this condition.

The following table lists the error message for the check.

Table: Error message for Patch not installed and process not running

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_MITIGATED_PATCH

Category: Policy Compliance

  • Windows 2000 (45463)

  • Windows 2003 (215163)

  • Windows 2008 (216063)

  • Windows Vista (215763)

  • Windows XP (49063)

Title: Patch not installed and process not running

Description:This patch is not installed, and the corresponding process is not running. Since the missing patch applies to a program that is not currently running, this may not pose an immediate risk. Refer to your security policy to determine if this patch should be installed.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Patch results summary (Windows)

Module: OS Patches

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

Enable this option to list the total number of available patches, checked patches, missing patches, and forbidden patches. Total available patches are the patches that apply to this operating system and architecture. Total checked patches are patches that apply and have not been skipped. Patches can be skipped due to an unsatisfied sublist condition or when they apply to an application that is not installed. Total missing patches are patches that were supposed to be installed on the system, but are not present. Total forbidden patches are patches that were present, but are not allowed.

The following table lists the error message for the check.

Table: Error message for Patch results summary

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_PATCH_SUMMARY

Category: Policy Compliance

  • Windows 2000 (45462)

  • Windows 2003 (215162)

  • Windows 2008 (216062)

  • Windows Vista (215762)

  • Windows XP (49062)

Title: Patch results summary

Description:This summary lists total number of available patches, checked patches, missing patches, and forbidden patches. Total available patches are the patches that apply to this operating system and architecture. Total checked patches are patches that apply and have not been skipped. Patches can be skipped due to an unsatisfied sublist condition or when they apply to an application that is not installed. Total missing patches are patches that were supposed to be installed on the system, but are not present. Total forbidden patches are patches that were present, but are not allowed.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Patch templates (Windows)

Module: OS Patches

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

Use this option to specify OS Patches template files. Only enabled template files that match the agent's operating system are used. For example, agents running Windows 2000 use only enabled Windows Server 2003 templates.

The following table lists the error messages for the check.

Table: Error messages for Patch templates

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: STKU_PATCHINSTALLED_AND_CHECKED

Category: Policy Compliance

  • Windows 2000 (45429)

  • Windows 2003 (215129)

  • Windows 2008 (216029)

  • Windows Vista (215729)

  • Windows XP (49029)

Title: Patch Installed

Description:This patch is installed. It fixes a problem that gives unauthorized access to your system or certain files. Search for patch information at the Microsoft Web site (www.microsoft.com). Install the patch or implement a workaround.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s;MS Knowledge Base ID: %s; Date Issued: %s; Description: %s %s]

String ID: STKU_PATCHNOTINS3

Category: Policy Compliance

  • Windows 2000 (45430)

  • Windows 2003 (215130)

  • Windows 2008 (216030)

  • Windows Vista (215730)

  • Windows XP (49030)

Title: Patch not installed

Description:This patch is not installed. It fixes a problem that gives unauthorized access to your system or certain files. Search for patch information at the Microsoft Web site (www.microsoft.com). Install the patch or implement a workaround.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [MS Knowledge Base ID: %s; Date Issued: %s; Description: %s %s]

String ID: STKU_PATCHNOTINS2

Category: Policy Compliance

  • Windows 2000 (45431)

  • Windows 2003 (215131)

  • Windows 2008 (216031)

  • Windows Vista (215731)

  • Windows XP (49031)

Title: Patch not installed

Description:This patch is not installed. It fixes a problem that lets unauthorized users cause denial of service to legitimate users. Search for patch information at the Microsoft Web site (www.microsoft.com). Install the patch or implement a workaround.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [MS Knowledge Base ID: %s; Date Issued: %s; Description: %s %s]

String ID: STKU_PATCHNOTINS1

Category: Policy Compliance

  • Windows 2000 (45432)

  • Windows 2003 (215132)

  • Windows 2008 (216032)

  • Windows Vista (215732)

  • Windows XP (49032)

Title: Patch not installed

Description:This patch is not installed. It fixes a functionality problem, not a security problem. Search for patch information at the Microsoft Web site (www.microsoft.com). Install the patch or implement a workaround.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [MS Knowledge Base ID: %s; Date Issued: %s; Description: %s %s]

String ID: STKU_PATCHNOTINS0

Category: Policy Compliance

  • Windows 2000 (45433)

  • Windows 2003 (215133)

  • Windows 2008 (216033)

  • Windows Vista (215733)

  • Windows XP (49033)

Title: Patch not installed

Description:This patch is not installed. The message is informational only. Search for patch information at the Microsoft Web site (www.microsoft.com). Install the patch or implement a workaround.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [MS Knowledge Base ID: %s; Date Issued: %s; Description: %s %s]

String ID: STKU_PATCHNOTAVAIL3

Category: Policy Compliance

  • Windows 2000 (45434)

  • Windows 2003 (215134)

  • Windows 2008 (216034)

  • Windows Vista (215734)

  • Windows XP (49034)

Title: Patch not available

Description:A CERT advisory has been issued for a problem that can compromise access to your computer or files. When the advisory was issued, Microsoft was working on a patch for the problem. Read the CERT advisory at www.cert.org. Implement suggested workarounds and contact your OS vendor to obtain the patch that addresses the problem as soon as it is available.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Date Issued: %s; Description: %s]

String ID: STKU_PATCHNOTAVAIL2

Category: Policy Compliance

  • Windows 2000 (45435)

  • Windows 2003 (215135)

  • Windows 2008 (216035)

  • Windows Vista (215735)

  • Windows XP (49035)

Title: Patch not available

Description:A CERT advisory has been issued for a problem that can lead to denial of service for legitimate users. When the advisory was issued, Microsoft was working on a patch for the problem. Read the CERT advisory at www.cert.org. Implement suggested workarounds and contact your OS vendor to obtain the patch that addresses the problem as soon as it is available.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Date Issued: %s; Description: %s]

String ID: STKU_INVALID_OSVER

Category: Policy Compliance

  • Windows 2000 (45437)

  • Windows 2003 (215137)

  • Windows 2008 (216037)

  • Windows Vista (215737)

  • Windows XP (49037)

Title: Invalid OS version

Description:The OSVer/SPVer field of the Patch template uses an invalid format. The correct format is #.#-SP#, where the first # is the major OS version and the second # is the minor version. The -SP# identifies a service pack. For all service packs, omit -SP. For example, 5.2, 5.2-SP1, or 5.2-SP2 are valid entries.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: []

String ID: STKU_INVALID_SPVER

Category: Policy Compliance

  • Windows 2000 (45438)

  • Windows 2003 (215138)

  • Windows 2008 (216038)

  • Windows Vista (215738)

  • Windows XP (49038)

Title: Invalid service pack version

Description:The OSVer/SPVer field of the Patch template uses an invalid format. The correct format is #.#-SP#, where the first # is the major OS version and the second # is the minor version. The -SP# identifies a service pack. For all service packs, omit -SP. For example, 5.2, 5.2-SP1, or 5.2-SP2 are valid entries.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: []

String ID: STKU_INVALID_ARCHITECTURE

Category: Policy Compliance

  • Windows 2000 (45441)

  • Windows 2003 (215141)

  • Windows 2008 (216041)

  • Windows Vista (215741)

  • Windows XP (49041)

Title: Invalid architecture

Description:The Architecture field of the Patch template is incorrect. It must be ix86.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: []

String ID: ESM_NO_TEMPLATE_SPECIFIED

Category: Policy Compliance

  • Windows 2000 (45442)

  • Windows 2003 (215142)

  • Windows 2008 (216042)

  • Windows Vista (215742)

  • Windows XP (49042)

Title: No applicable template files specified

Description:The OS Patches module was run without applicable template files. No security checks were performed. Make sure that at least one template file is enabled for the agent's operating system and version.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_NO_COMPARISON_SPECIFIED

Category: Policy Compliance

  • Windows 2000 (45443)

  • Windows 2003 (215143)

  • Windows 2008 (216043)

  • Windows Vista (215743)

  • Windows XP (49043)

Title: No comparison type specified

Description:The OS Patches module was run with no comparison options enabled. No security checks were performed. Enable one or more comparison options.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_UNKNOWN_PATCH_ID

Category: Policy Compliance

  • Windows 2000 (45447)

  • Windows 2003 (215147)

  • Windows 2008 (216047)

  • Windows Vista (215747)

  • Windows XP (49047)

Title: Patch is not a registry or file-only patch

Description:Patch IDs must begin with a Q, q, KB, kb, F, f, M, or S. Patches with IDs that begin with F or f are file-only patches. Patches with IDs that begin with Q, q, KB, kb, M, or S can be identified either through the registry or by using file dates/versions.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_FORBIDDEN_PATCH_3

Category: Policy Compliance

  • Windows 2000 (45448)

  • Windows 2003 (215148)

  • Windows 2008 (216048)

  • Windows Vista (215748)

  • Windows XP (49048)

Title: Forbidden patch found

Description:This patch is installed. According to the template, it is forbidden. Remove it and install the previous version of the patch if one is available.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [MS Knowledge Base ID: %s; Date Issued: %s; Description: %s %s]

String ID: ESM_FORBIDDEN_PATCH_2

Category: Policy Compliance

  • Windows 2000 (45449)

  • Windows 2003 (215149)

  • Windows 2008 (216049)

  • Windows Vista (215749)

  • Windows XP (49049)

Title: Forbidden patch found

Description:This patch is installed. According to the template, it is forbidden. Remove it and install the previous version of the patch if one is available.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [MS Knowledge Base ID: %s; Date Issued: %s; Description: %s %s]

String ID: ESM_FORBIDDEN_PATCH_1

Category: Policy Compliance

  • Windows 2000 (45450)

  • Windows 2003 (215150)

  • Windows 2008 (216050)

  • Windows Vista (215750)

  • Windows XP (49050)

Title: Forbidden patch found

Description:This patch is installed. According to the template, it is forbidden. Remove it and install the previous version of the patch if one is available.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [MS Knowledge Base ID: %s; Date Issued: %s; Description: %s %s]

String ID: ESM_FORBIDDEN_PATCH_0

Category: Policy Compliance

  • Windows 2000 (45451)

  • Windows 2003 (215151)

  • Windows 2008 (216051)

  • Windows Vista (215751)

  • Windows XP (49051)

Title: Forbidden patch found

Description:This patch is installed. According to the template, it is forbidden. Remove it and install the previous version of the patch if one is available.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [MS Knowledge Base ID: %s; Date Issued: %s; Description: %s %s]

String ID: ESM_OPTIONAL_PATCH_NO_SUPERSEDE

Category: Policy Compliance

  • Windows 2000 (45452)

  • Windows 2003 (215152)

  • Windows 2008 (216052)

  • Windows Vista (215752)

  • Windows XP (49052)

Title: Optional patch supersedes nothing

Description:The patch cannot be Optional unless it supersedes at least one other patch.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_INVALID_VALUE_OPERATOR

Category: Policy Compliance

  • Windows 2000 (45453)

  • Windows 2003 (215153)

  • Windows 2008 (216053)

  • Windows Vista (215753)

  • Windows XP (49053)

Title: Registry value comparison operator is invalid

Description:The comparison operator being used is invalid. Valid operators include: = != < > <= >= =~

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_INVALID_REG_VALUE_FORMAT

Category: Policy Compliance

  • Windows 2000 (45454)

  • Windows 2003 (215154)

  • Windows 2008 (216054)

  • Windows Vista (215754)

  • Windows XP (49054)

Title: Incorrect format for registry value condition

Description:The registry value string contains formatting errors. The correct format is: [path to registry value][comparison operator]"[value to be compared]" Where [comparison operator] can be any of the following: = != < > <= >= =~ For example: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\somevalue="testdata" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\somevalue<"15" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\somevalue=~".*"

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_NA_PATCH_STATUS

Category: Policy Compliance

  • Windows 2000 (45459)

  • Windows 2003 (215159)

  • Windows 2008 (216059)

  • Windows Vista (215759)

  • Windows XP (49059)

Title: Cannot determine patch status

Description:Cannot determine patch status because template information is incorrect, incomplete, or comparison options selected are not supported for this patch.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_INVALID_VERSION_VALUE_FORMAT

Category: Policy Compliance

  • Windows 2000 (45461)

  • Windows 2003 (215161)

  • Windows 2008 (216061)

  • Windows Vista (215761)

  • Windows XP (49061)

Title: Incorrect format for file version value condition

Description:The file version string contains formatting errors. The correct format is: [path to file][comparison operator]"[value to be compared]" Where [comparison operator] can be any of the following: = != < > <= >= =~ For example: c:\\WINNT\\system32\\myfile.sys="6.3.3" c:\\WINNT\\system32\\myfile.sys>"6" c:\\WINNT\\system32\\myfile.sys=~"6\\.3\\..*" Notice that every backslash must be backslashed.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Registry keys (Windows)

Module: OS Patches

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

Enable this option to use registry values to determine if a patch that begins with Q or KB has been installed. F (file) patches are not validated.

The following table lists the error message for the check.

Table: Error message for Registry keys

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_INVALID_REG_VALUE_FORMAT

Category: Policy Compliance

  • Windows 2000 (45454)

  • Windows 2003 (215154)

  • Windows 2008 (216054)

  • Windows Vista (215754)

  • Windows XP (49054)

Title: Incorrect format for registry value condition

Description:The registry value string contains formatting errors. The correct format is: [path to registry value][comparison operator]"[value to be compared]" Where [comparison operator] can be any of the following: = != < > <= >= =~ For example: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\somevalue="testdata" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\somevalue<"15" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\somevalue=~".*"

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Relaxed (Windows)

Module: OS Patches

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

Enable this option to report a problem if none of the enabled comparison options discover an installed patch. The Relaxed and Strict options are mutually exclusive.

The following table lists the error messages for the check.

Table: Error messages for Relaxed

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_NO_COMPARISON_SPECIFIED

Category: Policy Compliance

  • Windows 2000 (45443)

  • Windows 2003 (215143)

  • Windows 2008 (216043)

  • Windows Vista (215743)

  • Windows XP (49043)

Title: No comparison type specified

Description:The OS Patches module was run with no comparison options enabled. No security checks were performed. Enable one or more comparison options.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_CHECKING_TYPE_UNCLEAR

Category: Policy Compliance

  • Windows 2000 (45455)

  • Windows 2003 (215155)

  • Windows 2008 (216055)

  • Windows Vista (215755)

  • Windows XP (49055)

Title: Incompatible checking modes specified

Description:The OS Patches module was run with both the Strict option and the Relaxed option specified. No security checks were performed. One or neither option may be selected.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Strict (Windows)

Module: OS Patches

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

Enable this option to report a problem if one or more enabled comparison options cannot find the patch that is defined in the template. The Relaxed and Strict options are mutually exclusive.

The following table lists the error messages for the check.

Table: Error messages for Strict

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_NO_COMPARISON_SPECIFIED

Category: Policy Compliance

  • Windows 2000 (45443)

  • Windows 2003 (215143)

  • Windows 2008 (216043)

  • Windows Vista (215743)

  • Windows XP (49043)

Title: No comparison type specified

Description:The OS Patches module was run with no comparison options enabled. No security checks were performed. Enable one or more comparison options.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_CHECKING_TYPE_UNCLEAR

Category: Policy Compliance

  • Windows 2000 (45455)

  • Windows 2003 (215155)

  • Windows 2008 (216055)

  • Windows Vista (215755)

  • Windows XP (49055)

Title: Incompatible checking modes specified

Description:The OS Patches module was run with both the Strict option and the Relaxed option specified. No security checks were performed. One or neither option may be selected.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Superseded (Windows)

Module: OS Patches

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

Enable this option to report a patch and its superseding patches if the patch and all of its superseding patches are missing.

The following table lists the error messages for the check.

Table: Error messages for Superseded

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_NO_COMPARISON_SPECIFIED

Category: Policy Compliance

  • Windows 2000 (45443)

  • Windows 2003 (215143)

  • Windows 2008 (216043)

  • Windows Vista (215743)

  • Windows XP (49043)

Title: No comparison type specified

Description:The OS Patches module was run with no comparison options enabled. No security checks were performed. Enable one or more comparison options.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_SUPERSEDED_PATCH_NOT_INSTALLED

Category: Policy Compliance

  • Windows 2000 (45460)

  • Windows 2003 (215160)

  • Windows 2008 (216060)

  • Windows Vista (215760)

  • Windows XP (49060)

Title: Superseded patch not installed

Description:The listed patch is not installed. However, this patch has been replaced by the patch or patches listed in the Information field. You can install this patch or install one of the superseding patches.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Superseding patches:%s; MS Knowledge Base ID:%s;Date Issued:%s;Description:%s %s]


Object Integrity module

This section includes the following topics:

  • About the Object Integrity module

  • Supported operating systems: Object Integrity

  • Local accounts (Windows)

  • Volumes without ACL control (Windows)


About the Object Integrity module

Security checks in the Object Integrity module examine ACL support for changes in ownership, permissions, the logical-name table, rights identifiers, and other software objects or device-specific files in the system device directory. The module also detects new devices, deleted devices, and device changes between policy runs.


Supported operating systems: Object Integrity

The Object Integrity module is supported on the following operating systems:

  • Windows 2000

  • Windows 2003

  • Windows 2008

  • Windows Vista

  • Windows XP


Local accounts (Windows)

Module: Object Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check lists all local accounts (users and groups) that exist on Windows systems that are capable of being configured as primary or backup domain controllers, but are not. Since all accounts created on a domain controller are domain accounts, this check is not meant to be used on domain controllers. Accounts should be served by your domain server. Use the name list to exclude accounts such as Guest and Administrator.

The following table lists the error message for the check.

Table: Error message for Local accounts

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_NOLOCAL

Category: Policy Compliance

  • Windows 2000 (106230)

  • Windows 2003 (206230)

  • Windows 2008 (249230)

  • Windows Vista (229230)

  • Windows XP (201230)

Title: User or group defined on local system

Description:The user or group is defined locally on your system. In a domain, you may want to restrict users and groups to those defined on the domain server. This allows tighter control over who has access to your system. Use the name list to exclude any authorized local users or groups from the check.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Volumes without ACL control (Windows)

Module: Object Integrity

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check lists all volumes, including FAT volumes, with file systems that do not have file allocation table ACL support. These volumes are inherently insecure. Use the name list to exclude volume names such as MYDISK, file systems such as HPFS, or root directories such as C:\ from this check.

The following table lists the error message for the check.

Table: Error message for Volumes without ACL control

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_NOACL

Category: Policy Compliance

  • Windows 2000 (106231)

  • Windows 2003 (206231)

  • Windows 2008 (249231)

  • Windows Vista (229231)

  • Windows XP (201231)

Title: Volume with file system that does not support ACLs

Description:The volume has a file system that does not support persistent ACLs. There is little or no control over who can access these files. You should convert all volumes with FAT file systems to NTFS. The name list can be used to exclude volume names such as MYDISK, file systems such as HPFS, or root directories such as C:\ from this check.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [File system: %s; volume name: %s]


Password Strength module

This section includes the following topics:

  • Supported operating systems: Password Strength

  • Accounts without passwords (Windows)

  • Display name as distinguished name (Windows)

  • Double occurrences (Windows)

  • Hide guessed password details (Windows)

  • MD4 hashes (Windows)

  • Maximum password age (Windows)

  • Maximum reported messages (Windows)

  • Minimum password age (Windows)

  • Minimum password length (Windows)

  • Password = any username (Windows)

  • Password = username (Windows)

  • Password = wordlist word (Windows)

  • Password changes (Windows)

  • Password must expire (Windows)

  • Password stored using reversible encryption (Windows)

  • Password uniqueness (Windows)

  • Passwords must meet complexity requirements (Windows)

  • Plural (Windows)

  • Prefix (Windows)

  • Reverse order (Windows)

  • Reversible Encryption - Windows Policy Only (Windows)

  • Suffix (Windows)

  • Syskey encryption (Windows)

  • Users to check (Windows)


Supported operating systems: Password Strength

The Password Strength module is supported on the following operating systems:

  • Windows 2000

  • Windows 2003

  • Windows 2008

  • Windows Vista

  • Windows XP


Accounts without passwords (Windows)

Module: Password Strength

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports user accounts that can be accessed without entering a password. Use the name list to specify the users that will be excluded or included by this check. This check is currently not supported on Itanium based and 64-bit server systems.

The following table lists the error messages for the check.

Table: Error messages for Accounts without passwords

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_PASSNOUSERPASS

Category: Policy Compliance

  • Windows 2000 (105338)

  • Windows 2003 (205338)

  • Windows 2008 (248338)

  • Windows Vista (228338)

  • Windows XP (200338)

Title: No password

Description:This account does not have a password. Anyone who knows this user name can access this account. Immediately assign a secure password to the account. Instruct the account owner to log on using the assigned password, and then to change the password. A secure password should have six to eight characters with at least one non-alphabetic character. A secure password should not match an account or host name, and should not be found in any dictionary.

Severity: red-4

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_DISABLED_PASSNOUSERPASS

Category: Policy Compliance

  • Windows 2000 (105343)

  • Windows 2003 (205343)

  • Windows 2008 (248343)

  • Windows Vista (228343)

  • Windows XP (200343)

Title: No password on disabled account

Description:This disabled account does not have a password. This can be a security problem if the account is re-activated. Immediately assign a secure password to this account or remove it. A secure password should have six to eight characters with at least one non-alphabetic character. A secure password should not match an account or host name, and should not be found in any dictionary.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Display name as distinguished name (Windows)

Module: Password Strength

Supported Platforms: Windows 2000, Windows 2003, Windows 2008

Enable this option to have password checks report the users' distinguished name (DN) in the console's Name field (e.g., "/UserName1/Users/company/corp/com" for DC and "machine_name\username" for member server.).


Double occurrences (Windows)

Module: Password Strength

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

Enable this option to check for passwords that match double occurrences of user names and wordlist words (e.g., golf -> golfgolf). This option affects the behavior of "Password = username", "Password = any username", and "Password = wordlist word". This check is currently not supported on Itanium based and 64-bit server systems.


Hide guessed password details (Windows)

Module: Password Strength

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

When this option is enabled, the security checks no longer display the details of the guessed password in the console.


MD4 hashes (Windows)

Module: Password Strength

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

When this option is enabled, Symantec ESM uses both the NT (MD4) hash and the LAN Manager hash to guess passwords. This option increases module run time but can crack passwords that would otherwise not be cracked. In some cases, accounts do not have LAN Manager hashes for their passwords, so their passwords can be cracked only with the more time-consuming NT hash. For example, accounts with passwords longer than 14 characters do not have LAN Manager hashes. This check is currently not supported on Itanium based and 64-bit server systems.


Maximum password age (Windows)

Module: Password Strength

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check verifies that the Windows password age setting has a maximum age that does not exceed the number of days specified in your policy. The valid range of maximum password age is 0 to 999 days.

The following table lists the error message for the check.

Table: Error message for Maximum password age

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_MAX_PASSWD_AGE_TOO_HIGH

Category: Policy Compliance

  • Windows 2000 (105330)

  • Windows 2003 (205330)

  • Windows 2008 (248330)

  • Windows Vista (228330)

  • Windows XP (200330)

Title: Maximum password age too high

Description:The maximum password age is set too high. Infrequent password changes allow anyone with a stolen password long term access to your system. The recommended maximum password age is 60 days.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Max age: %s; expected: %s]


Maximum reported messages (Windows)

Module: Password Strength

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

Enable this option to limit the number of messages returned for each enabled check. Use the value field to specify the maximum number of times a given message should be displayed. Once the maximum number has been reached for a single message, the message will be displayed once more with the number of repeating instances of the message that are not reported.


Minimum password age (Windows)

Module: Password Strength

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check verifies that the Windows password settings include a minimum age and that a password cannot be changed before the specified number of days has elapsed since the previous password change. The valid range of minimum password age is 0 to 998 days.

The following table lists the error message for the check.

Table: Error message for Minimum password age

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_MIN_PASSWD_AGE_TOO_LOW

Category: Policy Compliance

  • Windows 2000 (105332)

  • Windows 2003 (205332)

  • Windows 2008 (248332)

  • Windows Vista (228332)

  • Windows XP (200332)

Title: Minimum password age too low

Description:The minimum password age is set too low. Users have trouble remembering passwords that change too often. Users may cause security breaches by writing down passwords instead of memorizing them. The recommended minimum password age is 14 days.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Min age: %s; expected: %s]


Minimum password length (Windows)

Module: Password Strength

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports a problem if the effective minimum password length is shorter than the specified number of characters. The valid range of minimum password length is 0 to 14 characters.

The following table lists the error messages for the check.

Table: Error messages for Minimum password length

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_MIN_PASSWD_LEN_TOO_LOW

Category: Policy Compliance

  • Windows 2000 (105331)

  • Windows 2003 (205331)

  • Windows 2008 (248331)

  • Windows Vista (228331)

  • Windows XP (200331)

Title: Minimum password length too low

Description:The minimum password length is set too low. Short passwords are easier to guess. This makes them targets for brute force cracking attempts. The recommended minimum password length is eight characters.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Min length: %s; expected: %s]

String ID: ESM_PASSNOPASS

Category: Policy Compliance

  • Windows 2000 (105336)

  • Windows 2003 (205336)

  • Windows 2008 (248336)

  • Windows Vista (228336)

  • Windows XP (200336)

Title: System allows blank passwords

Description:Your system allows accounts without passwords. Anyone can log on to these accounts. In Windows, increase the value for the minimum password length setting to greater than 0.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: []


Password = any username (Windows)

Module: Password Strength

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check iterates through all user accounts and reports when a password matches any username. This check is currently not supported on Itanium based and 64-bit server systems.

The following table lists the error messages for the check.

Table: Error messages for Password = any username

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_GUESSPASS

Category: Policy Compliance

  • Windows 2000 (105337)

  • Windows 2003 (205337)

  • Windows 2008 (248337)

  • Windows Vista (228337)

  • Windows XP (200337)

Title: Guessed user password

Description:Symantec ESM guessed the account password. An intruder can also guess this password while trying to break into your system. Immediately assign a secure password to this account. Instruct the user to log on using the secure password and then to change the password again. A secure password should have six to eight characters with at least one non-alphabetic character. A secure password should not match an account or host name, and should not be found in any dictionary.

Severity: red-4

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_DISABLED_GUESSPASS

Category: Policy Compliance

  • Windows 2000 (105342)

  • Windows 2003 (205342)

  • Windows 2008 (248342)

  • Windows Vista (228342)

  • Windows XP (200342)

Title: Guessed user password on disabled account

Description:Symantec ESM guessed the password of this disabled account. This can be a security problem if the account is re-activated. Assign a secure password to this account or remove it. A secure password should have six to eight characters with at least one non-alphabetic character. A secure password should not match an account or host name, and should not be found in any dictionary.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Password = username (Windows)

Module: Password Strength

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check iterates through all user accounts and reports when a password and username are identical. The check is not as rigorous as "Password = any username" and is provided for systems with a large number of user accounts. If an audit using "Password = any username" takes too long or is too CPU intensive, you might want to use this check on a daily basis, and "Password = any username" on the weekends. This check is currently not supported on Itanium based and 64-bit server systems.

The following table lists the error messages for the check.

Table: Error messages for Password = username

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_GUESSPASS

Category: Policy Compliance

  • Windows 2000 (105337)

  • Windows 2003 (205337)

  • Windows 2008 (248337)

  • Windows Vista (228337)

  • Windows XP (200337)

Title: Guessed user password

Description:Symantec ESM guessed the account password. An intruder can also guess this password while trying to break into your system. Immediately assign a secure password to this account. Instruct the user to log on using the secure password and then to change the password again. A secure password should have six to eight characters with at least one non-alphabetic character. A secure password should not match an account or host name, and should not be found in any dictionary.

Severity: red-4

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_DISABLED_GUESSPASS

Category: Policy Compliance

  • Windows 2000 (105342)

  • Windows 2003 (205342)

  • Windows 2008 (248342)

  • Windows Vista (228342)

  • Windows XP (200342)

Title: Guessed user password on disabled account

Description:Symantec ESM guessed the password of this disabled account. This can be a security problem if the account is re-activated. Assign a secure password to this account or remove it. A secure password should have six to eight characters with at least one non-alphabetic character. A secure password should not match an account or host name, and should not be found in any dictionary.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Password = wordlist word (Windows)

Module: Password Strength

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check iterates through all user accounts and reports when a password matches a word in the word list (e.g., golf -> golf). The word files list lets you enable and disable the word files that are used for this check. For shorter run times, in the Percent of words per policy run text box, type a number less than 100. This defines the percentage of words that are examined during each run. Each run starts at the place in the word list where the previous run ended. This check is currently not supported on Itanium based and 64-bit server systems.

The following table lists the error messages for the check.

Table: Error messages for Password = wordlist word

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_GUESSPASS

Category: Policy Compliance

  • Windows 2000 (105337)

  • Windows 2003 (205337)

  • Windows 2008 (248337)

  • Windows Vista (228337)

  • Windows XP (200337)

Title: Guessed user password

Description:Symantec ESM guessed the account password. An intruder can also guess this password while trying to break into your system. Immediately assign a secure password to this account. Instruct the user to log on using the secure password and then to change the password again. A secure password should have six to eight characters with at least one non-alphabetic character. A secure password should not match an account or host name, and should not be found in any dictionary.

Severity: red-4

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_NOWORDFILES

Category: Policy Compliance

  • Windows 2000 (105339)

  • Windows 2003 (205339)

  • Windows 2008 (248339)

  • Windows Vista (228339)

  • Windows XP (200339)

Title: No word files specified

Description:"Password = wordlist word" was enabled but no word files were specified. Change your policy so that at least one word file is enabled.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_DISABLED_GUESSPASS

Category: Policy Compliance

  • Windows 2000 (105342)

  • Windows 2003 (205342)

  • Windows 2008 (248342)

  • Windows Vista (228342)

  • Windows XP (200342)

Title: Guessed user password on disabled account

Description:Symantec ESM guessed the password of this disabled account. This can be a security problem if the account is re-activated. Assign a secure password to this account or remove it. A secure password should have six to eight characters with at least one non-alphabetic character. A secure password should not match an account or host name, and should not be found in any dictionary.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Password changes (Windows)

Module: Password Strength

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check iterates through all user accounts in the user list and verifies that users are able to change the passwords on their accounts. The user list lets you exclude users or user groups that should be excepted from the check.

The following table lists the error message for the check.

Table: Error message for Password changes

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_CHANGE_PASSWORD

Category: Policy Compliance

  • Windows 2000 (105334)

  • Windows 2003 (205334)

  • Windows 2008 (248334)

  • Windows Vista (228334)

  • Windows XP (200334)

Title: User cannot change password

Description:This user cannot change the account password. Anyone with a stolen password can have long term access to such an account. In Windows deselect the setting "User cannot change password". In the "Password changes" check, use the name list to exclude any excepted users and security groups from the check.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Password must expire (Windows)

Module: Password Strength

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check iterates through all user accounts and reports a problem if passwords do not expire on the agent computer. If the system does expire passwords, the check reports user accounts that have enabled the user properties setting, Password never expires. By default, this check does not report users who cannot change their passwords. If you want the check to report users who cannot change their passwords, enter Yes in the Yes or No text box. Use the name list to exclude users and security groups from the check.

The following table lists the error messages for the check.

Table: Error messages for Password must expire

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_PASSWORDS_EXPIRE

Category: Policy Compliance

  • Windows 2000 (105335)

  • Windows 2003 (205335)

  • Windows 2008 (248335)

  • Windows Vista (228335)

  • Windows XP (200335)

Title: User password never expires

Description:The password for this account does not expire. Anyone with a stolen password can have long term access to such an account. In Windows deselect the setting "Password never expires". In the "Password must expire" check, use the name list to exclude any excepted users and security groups from the check. Note that this check reports only users who can change their passwords.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_ACCTPOLICY_PASSWORDS_EXPIRE

Category: Policy Compliance

  • Windows 2000 (105341)

  • Windows 2003 (205341)

  • Windows 2008 (248341)

  • Windows Vista (228341)

  • Windows XP (200341)

Title: Passwords do not expire on system

Description:Passwords do not expire on this system. Anyone with a stolen password can have long term access to user accounts. Increase the value for the maximum password age setting in Windows to greater than 0.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: []


Password stored using reversible encryption (Windows)

Module: Password Strength

Supported Platforms: Windows 2000, Windows 2003, Windows 2008

This check reports if the "store password using reversible encryption for all users" setting is enabled in the Password Policy. The check also reports the domain users whose "Password stored using reversible encryption" setting is enabled.

The following table lists the error messages for the check.

Table: Error messages for Password stored using reversible encryption

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_REVERSIBLE_ENCRYPTION

Category: Policy Compliance

  • Windows 2000 (105344)

  • Windows 2003 (205344)

  • Windows 2008 (248344)

Title: Password stored using reversible encryption

Description:The password for this account is stored using an easily reversible encryption.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_REVERSIBLE_ENCRYPTION_ENABLED

Category: Policy Compliance

  • Windows 2000 (105346)

  • Windows 2003 (205346)

  • Windows 2008 (248346)

Title: Reversible Encryption enabled in Password Policy

Description:The setting "store password using reversible encryption for all users" is enabled.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Password uniqueness (Windows)

Module: Password Strength

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check verifies that the Windows password settings require a specified number of passwords to be retained as password history. These passwords cannot be reused when a password is changed. The valid range of password history is 0 to 24 passwords.

The following table lists the error message for the check.

Table: Error message for Password uniqueness

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_MIN_PASSWD_HIST_TOO_LOW

Category: Policy Compliance

  • Windows 2000 (105333)

  • Windows 2003 (205333)

  • Windows 2008 (248333)

  • Windows Vista (228333)

  • Windows XP (200333)

Title: Minimum password history too low

Description:The number of passwords required to be retained as password history is set too low. This lets users recycle expired passwords too quickly and defeats the requirement to change passwords on a regular basis. A password history setting of at least 10 is recommended.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Min history: %s; expected: %s]


Passwords must meet complexity requirements (Windows)

Module: Password Strength

Supported Platforms: Windows 2000, Windows 2003, Windows 2008

This check reports when the entry "Passwords must meet complexity requirements" is disabled.

The following table lists the error messages for the check.

Table: Error messages for Passwords must meet complexity requirements

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_PASSWORD_COMPLEXITY

Category: Policy Compliance

  • Windows 2000 (105345)

  • Windows 2003 (205345)

  • Windows 2008 (248345)

Title: Passwords must meet complexity requirements

Description:The entry "Passwords must meet complexity requirements" is disabled.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_PASSWORD_COMPLEXITY_NOTDEFINED

Category: Policy Compliance

  • Windows 2000 (105347)

  • Windows 2003 (205347)

  • Windows 2008 (248347)

Title: Passwords must meet complexity requirements Not Defined

Description:The entry "Passwords must meet complexity requirements" is not defined in the Domain Security Policy.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Plural (Windows)

Module: Password Strength

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

Enable this option to check for passwords that match the plural forms of user names and wordlist words (e.g., golf -> golfs). This option affects the behavior of "Password = username", "Password = any username", and "Password = wordlist word". This check is currently not supported on Itanium based and 64-bit server systems.


Prefix (Windows)

Module: Password Strength

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

Enable this option to check for passwords that match specifed prefixes that are added to user names and wordlist words to guess passwords (e.g., golf -> progolf). This option affects the behavior of "Password = username", "Password = any username", and "Password = wordlist word". Use the name list to specify the prefixes to be used. This check is currently not supported on Itanium based and 64-bit server systems.


Reverse order (Windows)

Module: Password Strength

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

Enable this option to check for passwords that match the reverse spelling of user names and wordlist words (e.g., golf -> flog). This option affects the behavior of "Password = username", "Password = any username", and "Password = wordlist word". This check is currently not supported on Itanium based and 64-bit server systems.


Reversible Encryption - Windows Policy Only (Windows)

Module: Password Strength

Supported Platforms: Windows 2000, Windows 2003, Windows 2008

Enable this option to have the "Password stored using reversible encryption" check only verify whether the Windows Password Policy has the "store password using reversible encryption for all users" setting enabled. The check does not report the individual accounts that use reversible encryption.

The following table lists the error message for the check.

Table: Error message for Reversible Encryption - Windows Policy Only

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_REVERSIBLE_ENCRYPTION_ENABLED

Category: Policy Compliance

  • Windows 2000 (105346)

  • Windows 2003 (205346)

  • Windows 2008 (248346)

Title: Reversible Encryption enabled in Password Policy

Description:The setting "store password using reversible encryption for all users" is enabled.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Suffix (Windows)

Module: Password Strength

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

Enable this option to check for passwords that match specifed suffixes that are added to user names and wordlist words to guess passwords (e.g., golf -> golfball). This option affects the behavior of "Password = username", "Password = any username", and "Password = wordlist word". Use the name list to specify the suffixes to be used. This check is currently not supported on Itanium based and 64-bit server systems.


Syskey encryption (Windows)

Module: Password Strength

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check verifies that syskey encryption is enabled. If the value of registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SecureBoot is 1(key in registry), 2(Enter manually at startup) or 3(key on floppy), password database on this machine is syskey encrypted. This check reports when the key is not present or key value is other than 1, 2 or 3.

The following table lists the error message for the check.

Table: Error message for Syskey encryption

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_SYSKEY_NOT_ENABLED

Category: Policy Compliance

  • Windows 2000 (105340)

  • Windows 2003 (205340)

  • Windows 2008 (248340)

  • Windows Vista (228340)

  • Windows XP (200340)

Title: Passwords not encrypted with syskey

Description:The password database on this machine has not been encrypted with syskey.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Users to check (Windows)

Module: Password Strength

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This option lets you specify the users and user groups that will be excluded or included by all Password Strength security checks that examine user accounts.


Registry module

This section includes the following topics:

  • About the Registry module

  • Supported operating systems: Registry

  • Allow any privileged account (Windows)

  • Auditing permissions (Windows)

  • Automatically update snapshots (Windows)

  • Changed key (time) (Windows)

  • Changed value (signature) (Windows)

  • Changed value (size) (Windows)

  • Do not notify if key permissions are increased in security (Windows)

  • Key and value existence (Windows)

  • Key ownership (Windows)

  • Key permissions (Windows)

  • Template file list (Windows)


About the Registry module

Security checks in the Registry module compare the current settings with the Registry template records and report changes in registry key ownership, registry keys and values, and last write times of registry keys.

Some module messages can be used to update snapshots to match current agent settings.

Note:

Changing the registry incorrectly can cause serious, network-wide problems. Update the Windows Emergency Repair disk before you make any changes.

When you run a policy that contains the Registry module, the module compares current registry information with the Registry templates before any checks are run. Registry templates are enabled in the Template file list option.


Supported operating systems: Registry

The Registry module is supported on the following operating systems:

  • Windows 2000

  • Windows 2003

  • Windows 2008

  • Windows Vista

  • Windows XP


Allow any privileged account (Windows)

Module: Registry

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

When this option is enabled, all privileged accounts are treated identically by the permissions and ownership checks. For example, if the template specifies key ownership by Administrator, ownership by any privileged account is allowed. Privileged accounts are those that belong to the Administrators group. In most situations, ownership of system registry keys by any privileged account is acceptable. This option lets you accommodate variations in ownership between different versions or installations of the same operating system without changing templates.


Auditing permissions (Windows)

Module: Registry

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This option reports a problem if auditing permissions (or System ACLs) do not match the values in their associated template records.

The following table lists the error messages for the check.

Table: Error messages for Auditing permissions

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_DIFFERENT_SACL_ENTRY

Category: System Information

  • Windows 2000 (106747)

  • Windows 2003 (206747)

  • Windows 2008 (249747)

  • Windows Vista (229747)

  • Windows XP (201747)

Title: Incorrect auditing settings

Description:The key's auditing settings for the user do not match the template. Change the settings to match the template or update the template manually.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Account: %s; type: %s; events audited: %s; expected: %s]

String ID: ESM_MISSING_SACL_ENTRY

Category: System Information

  • Windows 2000 (106748)

  • Windows 2003 (206748)

  • Windows 2008 (249748)

  • Windows Vista (229748)

  • Windows XP (201748)

Title: Key not audited for account

Description:The key is not audited for the account as specified in the template. Update the auditing settings to match the template or remove the account's entry from the Auditing sublist.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Account: %s]

String ID: ESM_ADDITIONAL_SACL_ENTRY

Category: System Information

  • Windows 2000 (106749)

  • Windows 2003 (206749)

  • Windows 2008 (249749)

  • Windows Vista (229749)

  • Windows XP (201749)

Title: Auditing settings exceed policy

Description:The key is audited for the account. The template specifies no auditing settings on this key for the account. Update the auditing settings to match the template or remove the account's entry from the Auditing sublist.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Account: %s; success events: %s; failure events: %s]

String ID: ESM_CANNOT_GET_AUDITING_INFO

Category: System Information

  • Windows 2000 (106752)

  • Windows 2003 (206752)

  • Windows 2008 (249752)

  • Windows Vista (229752)

  • Windows XP (201752)

Title: Auditing ACL not checked

Description:The key's auditing settings could not be read for the reason that is reported in the Information field. Review the auditing settings for this key in the registry.

Severity: yellow-3

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Error: %s]

String ID: ESMT_AUDIT_DISABLED_ACCOUNTS

Category: System Information

  • Windows 2000 (106764)

  • Windows 2003 (206764)

  • Windows 2008 (249764)

  • Windows Vista (229764)

  • Windows XP (201764)

Title: Disabled Accounts in Auditing permissions

Description:List of disabled accounts in Auditing permissions.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Automatically update snapshots (Windows)

Module: Registry

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

Enable this option to automatically update snapshots with current information.


Changed key (time) (Windows)

Module: Registry

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This option reports registry keys that changed, according to the last write time, after the last snapshot update. The Check Time check box in the associated template record must be checked.

The following table lists the error message for the check.

Table: Error message for Changed key (time)

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_KEY_LAST_WRITE

Category: System Information

  • Windows 2000 (106730)

  • Windows 2003 (206730)

  • Windows 2008 (249730)

  • Windows Vista (229730)

  • Windows XP (201730)

Title: Registry key last write time has changed

Description:The registry key's last write time changed after the last snapshot update. If the change is authorized, update the snapshot file. If the change is not authorized, restore the registry key to its previous state.

Severity: yellow-1

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [Last write time: %s; expected: %s; comment: %s]


Changed value (signature) (Windows)

Module: Registry

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This option reports registry values that changed, according to value data signatures (CRC and/or MD5), after the last snapshot update. The Signature option in the associated template record must not be None. This option is difficult for hackers to circumvent, but the Registry module runs faster when this option is disabled.

The following table lists the error messages for the check.

Table: Error messages for Changed value (signature)

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_VALUE_SIGNATURE_CHANGED

Category: System Information

  • Windows 2000 (106733)

  • Windows 2003 (206733)

  • Windows 2008 (249733)

  • Windows Vista (229733)

  • Windows XP (201733)

Title: Registry value signature has changed

Description:The registry value's signature changed after the last snapshot update. If the change is authorized, update the snapshot. If the change is not authorized, restore the registry key to its previous state.

Severity: yellow-1

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [Signature: %s; expected: %s; comment: %s]

String ID: ESM_VALUE_TYPE_CHANGED

Category: System Information

  • Windows 2000 (106732)

  • Windows 2003 (206732)

  • Windows 2008 (249732)

  • Windows Vista (229732)

  • Windows XP (201732)

Title: Registry value type has changed

Description:The registry value's type changed after the last snapshot update. If the change is authorized, update the snapshot. If the change is not authorized, restore the registry value to its previous type.

Severity: yellow-1

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [Type: %s; expected: %s; comment: %s]


Changed value (size) (Windows)

Module: Registry

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This option reports registry values that changed, according to the value data size, after the last snapshot update. The Value Size check box in the associated template record must be checked.

The following table lists the error messages for the check.

Table: Error messages for Changed value (size)

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_VALUE_SIZE_CHANGED

Category: System Information

  • Windows 2000 (106731)

  • Windows 2003 (206731)

  • Windows 2008 (249731)

  • Windows Vista (229731)

  • Windows XP (201731)

Title: Registry value size has changed

Description:The registry value's size changed after the last snapshot update. If the change is authorized, update the snapshot. If the change is not authorized, restore the registry value to its previous state.

Severity: yellow-1

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [Size: %s; expected: %s; comment: %s]

String ID: ESM_VALUE_TYPE_CHANGED

Category: System Information

  • Windows 2000 (106732)

  • Windows 2003 (206732)

  • Windows 2008 (249732)

  • Windows Vista (229732)

  • Windows XP (201732)

Title: Registry value type has changed

Description:The registry value's type changed after the last snapshot update. If the change is authorized, update the snapshot. If the change is not authorized, restore the registry value to its previous type.

Severity: yellow-1

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [Type: %s; expected: %s; comment: %s]


Do not notify if key permissions are increased in security (Windows)

Module: Registry

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

When this option is enabled, the permissions check reports only permission changes that increase registry key access and decrease security. When this option is disabled, the check reports all changes to registry permissions.


Key and value existence (Windows)

Module: Registry

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This option reports mandatory keys and values that do not exist, and forbidden keys and values that do exist.

The following table lists the error messages for the check.

Table: Error messages for Key and value existence

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_NOEXISTKEY

Category: System Information

  • Windows 2000 (106740)

  • Windows 2003 (206740)

  • Windows 2008 (249740)

  • Windows Vista (229740)

  • Windows XP (201740)

Title: Mandatory registry key does not exist

Description:The mandatory registry key does not exist. If the key is mandatory, create it on the agent. If it is not mandatory, update the template manually.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Comment: %s]

String ID: ESM_FORBIDKEY

Category: System Information

  • Windows 2000 (106742)

  • Windows 2003 (206742)

  • Windows 2008 (249742)

  • Windows Vista (229742)

  • Windows XP (201742)

Title: Forbidden registry key exists

Description:The forbidden registry key exists on the agent. If the key is forbidden, delete it from the agent. If it is not forbidden, update the template manually.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Comment: %s]

String ID: ESM_FORBIDVALUE

Category: System Information

  • Windows 2000 (106743)

  • Windows 2003 (206743)

  • Windows 2008 (249743)

  • Windows Vista (229743)

  • Windows XP (201743)

Title: Forbidden registry value exists

Description:The forbidden registry value exists on the agent. If the value is forbidden, delete it from the agent. If it is not forbidden, update the template manually.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Sublist: %s; comment: %s]

String ID: ESM_NOEXISTVALUE

Category: System Information

  • Windows 2000 (106741)

  • Windows 2003 (206741)

  • Windows 2008 (249741)

  • Windows Vista (229741)

  • Windows XP (201741)

Title: Mandatory registry value does not exist

Description:The mandatory registry value does not exist. If the value is mandatory, create it on the agent. Set the value data to match the regular expression format that is reported in the Information field. If it is not mandatory, update the template manually.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Sublist: %s; expected data to match: %s; comment: %s]

String ID: ESM_NOEXISTVALUE_YELLOW

Category: System Information

  • Windows 2000 (106753)

  • Windows 2003 (206753)

  • Windows 2008 (249753)

  • Windows Vista (229753)

  • Windows XP (201753)

Title: Mandatory registry value does not exist

Description:The mandatory registry value does not exist. If the value is mandatory, create it on the agent. Set the value data to match the regular expression format that is reported in the Information field. If it is not mandatory, update the template manually.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Sublist: %s; expected data to match: %s; comment: %s]

String ID: ESM_NOEXISTVALUE_GREEN

Category: System Information

  • Windows 2000 (106754)

  • Windows 2003 (206754)

  • Windows 2008 (249754)

  • Windows Vista (229754)

  • Windows XP (201754)

Title: Mandatory registry value does not exist

Description:The mandatory registry value does not exist. If the value is mandatory, create it on the agent. Set the value data to match the regular expression format that is reported in the Information field. If it is not mandatory, update the template manually.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Sublist: %s; expected data to match: %s; comment: %s]


Key ownership (Windows)

Module: Registry

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This option reports registry key ownership that does not match the template.

The following table lists the error messages for the check.

Table: Error messages for Key ownership

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_WRONG_KEY_OWNER

Category: System Information

  • Windows 2000 (106734)

  • Windows 2003 (206734)

  • Windows 2008 (249734)

  • Windows Vista (229734)

  • Windows XP (201734)

Title: Different key ownership

Description:The owner of the registry key does not match the owner that is specified in the template. If the change is authorized update the template manually. If the change is not authorized, restore the original key ownership.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Owner: %s; expected: %s; comment: %s]

String ID: ESM_NOOWNER

Category: System Information

  • Windows 2000 (106736)

  • Windows 2003 (206736)

  • Windows 2008 (249736)

  • Windows Vista (229736)

  • Windows XP (201736)

Title: Account specified in template does not exist on system

Description:The account does not exist on this agent. Add the account to the agent or change the owner in the template.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_NOMATCH_PRIV_ENTRY

Category: System Information

  • Windows 2000 (106751)

  • Windows 2003 (206751)

  • Windows 2008 (249751)

  • Windows Vista (229751)

  • Windows XP (201751)

Title: Privileged user ACL entry does not match

Description:The privileged account's permissions on the key do not match those of any privileged user in the template. If the account's permissions are not authorized, change them to match the permissions of one of the privileged users in the template. If they are authorized, update the template manually. This message is reported only if the Allow any privileged account option is enabled.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Account: %s; permissions: %s; comment: %s]


Key permissions (Windows)

Module: Registry

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This option reports registry key permissions that do not match the permissions that are specified in the template.

The following table lists the error messages for the check.

Table: Error messages for Key permissions

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_ADDITIONAL_ENTRY

Category: System Information

  • Windows 2000 (106737)

  • Windows 2003 (206737)

  • Windows 2008 (249737)

  • Windows Vista (229737)

  • Windows XP (201737)

Title: Additional ACL entry

Description:The account has permissions on the registry key. The template specifies no permissions on this key for the account. If the permissions are authorized, manually update the template. If they are not authorized, remove them.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Account: %s; permissions: %s; comment: %s]

String ID: ESM_DIFFERENT_ENTRY

Category: System Information

  • Windows 2000 (106738)

  • Windows 2003 (206738)

  • Windows 2008 (249738)

  • Windows Vista (229738)

  • Windows XP (201738)

Title: Different ACL entry

Description:The account's permissions on the key do not match the template. If the account's permissions are authorized, update the template manually. If they are not authorized, change the permissions to match the template.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Account: %s; permissions: %s; expected: %s; comment: %s]

String ID: ESM_MISSING_ENTRY

Category: System Information

  • Windows 2000 (106739)

  • Windows 2003 (206739)

  • Windows 2008 (249739)

  • Windows Vista (229739)

  • Windows XP (201739)

Title: Missing ACL entry

Description:The account does not have permissions on the registry key. The template specifies permissions on this key for the account. If the permissions are authorized, grant them to the account. If they are not authorized, remove them from the template.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Account: %s; comment: %s]

String ID: ESM_NOMATCH_PRIV_ENTRY

Category: System Information

  • Windows 2000 (106751)

  • Windows 2003 (206751)

  • Windows 2008 (249751)

  • Windows Vista (229751)

  • Windows XP (201751)

Title: Privileged user ACL entry does not match

Description:The privileged account's permissions on the key do not match those of any privileged user in the template. If the account's permissions are not authorized, change them to match the permissions of one of the privileged users in the template. If they are authorized, update the template manually. This message is reported only if the Allow any privileged account option is enabled.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Account: %s; permissions: %s; comment: %s]

String ID: ESMT_KEY_DISABLED_ACCOUNTS

Category: System Information

  • Windows 2000 (106763)

  • Windows 2003 (206763)

  • Windows 2008 (249763)

  • Windows Vista (229763)

  • Windows XP (201763)

Title: Disabled Accounts in Key permissions

Description:List of disabled accounts in Key permissions.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Template file list (Windows)

Module: Registry

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This option lets you enable and disable the template files that the module uses to validate current registry settings. It also reports registry information and incorrect registry values.

The following table lists the error messages for the check.

Table: Error messages for Template file list

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_FILE_MISSING

Category: System Information

  • Windows 2000 (106735)

  • Windows 2003 (206735)

  • Windows 2008 (249735)

  • Windows Vista (229735)

  • Windows XP (201735)

Title: No template files specified

Description:No Registry template files for this agent's operating system were enabled. No security checks were performed. Enable at least one Registry template file for the operating system.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_WRONG_TYPE

Category: System Information

  • Windows 2000 (106744)

  • Windows 2003 (206744)

  • Windows 2008 (249744)

  • Windows Vista (229744)

  • Windows XP (201744)

Title: Registry value set to incorrect type

Description:The registry value's type does not match the template. Change the type to match the template or update the template manually.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Type: %s; expected: %s; comment: %s]

String ID: ESM_WRONG_TYPE_YELLOW

Category: System Information

  • Windows 2000 (106755)

  • Windows 2003 (206755)

  • Windows 2008 (249755)

  • Windows Vista (229755)

  • Windows XP (201755)

Title: Registry value set to incorrect type

Description:The registry value's type does not match the template. Change the type to match the template or update the template manually.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Type: %s; expected: %s; comment: %s]

String ID: ESM_WRONG_TYPE_GREEN

Category: System Information

  • Windows 2000 (106756)

  • Windows 2003 (206756)

  • Windows 2008 (249756)

  • Windows Vista (229756)

  • Windows XP (201756)

Title: Registry value set to incorrect type

Description:The registry value's type does not match the template. Change the type to match the template or update the template manually.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Type: %s; expected: %s; comment: %s]

String ID: ESM_WRONG_DATA

Category: System Information

  • Windows 2000 (106745)

  • Windows 2003 (206745)

  • Windows 2008 (249745)

  • Windows Vista (229745)

  • Windows XP (201745)

Title: Registry value set to incorrect data

Description:The registry value's data does not match the regular expression that is specified in the template. Change the data to match the regular expression or update the template manually.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Data: %s; expected data to match regular expression: %s; comment: %s]

String ID: ESM_WRONG_DATA_YELLOW

Category: System Information

  • Windows 2000 (106757)

  • Windows 2003 (206757)

  • Windows 2008 (249757)

  • Windows Vista (229757)

  • Windows XP (201757)

Title: Registry value set to incorrect data

Description:The registry value's data does not match the regular expression that is specified in the template. Change the data to match the regular expression or update the template manually.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Data: %s; expected data to match regular expression: %s; comment: %s]

String ID: ESM_WRONG_DATA_GREEN

Category: System Information

  • Windows 2000 (106758)

  • Windows 2003 (206758)

  • Windows 2008 (249758)

  • Windows Vista (229758)

  • Windows XP (201758)

Title: Registry value set to incorrect data

Description:The registry value's data does not match the regular expression that is specified in the template. Change the data to match the regular expression or update the template manually.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Data: %s; expected data to match regular expression: %s; comment: %s]

String ID: ESM_INFO

Category: System Information

  • Windows 2000 (106746)

  • Windows 2003 (206746)

  • Windows 2008 (249746)

  • Windows Vista (229746)

  • Windows XP (201746)

Title: Registry information

Description:The data reported in the Information field was requested in a Value Info Queries sublist entry.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Data: %s; comment: %s]

String ID: ESM_INFO_YELLOW

Category: System Information

  • Windows 2000 (106761)

  • Windows 2003 (206761)

  • Windows 2008 (249761)

  • Windows Vista (229761)

  • Windows XP (201761)

Title: Registry information

Description:The data reported in the Information field was requested in a Value Info Queries sublist entry.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Data: %s; comment: %s]

String ID: ESM_INFO_RED

Category: System Information

  • Windows 2000 (106762)

  • Windows 2003 (206762)

  • Windows 2008 (249762)

  • Windows Vista (229762)

  • Windows XP (201762)

Title: Registry information

Description:The data reported in the Information field was requested in a Value Info Queries sublist entry.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Data: %s; comment: %s]

String ID: ESM_FORBIDDEN_DATA

Category: System Information

  • Windows 2000 (106750)

  • Windows 2003 (206750)

  • Windows 2008 (249750)

  • Windows Vista (229750)

  • Windows XP (201750)

Title: Registry value set to forbidden data

Description:The registry value data is forbidden by the template. If the value is forbidden, delete it from the registry. If it is not forbidden, update the template manually.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Forbidden data: %s; must not match: %s; comment: %s]

String ID: ESM_FORBIDDEN_DATA_YELLOW

Category: System Information

  • Windows 2000 (106759)

  • Windows 2003 (206759)

  • Windows 2008 (249759)

  • Windows Vista (229759)

  • Windows XP (201759)

Title: Registry value set to forbidden data

Description:The registry value data is forbidden by the template. If the value is forbidden, delete it from the registry. If it is not forbidden, update the template manually.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Forbidden data: %s; must not match: %s; comment: %s]

String ID: ESM_FORBIDDEN_DATA_GREEN

Category: System Information

  • Windows 2000 (106760)

  • Windows 2003 (206760)

  • Windows 2008 (249760)

  • Windows Vista (229760)

  • Windows XP (201760)

Title: Registry value set to forbidden data

Description:The registry value data is forbidden by the template. If the value is forbidden, delete it from the registry. If it is not forbidden, update the template manually.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Forbidden data: %s; must not match: %s; comment: %s]


Startup Files module

This section includes the following topics:

  • About the Startup Files module

  • Supported operating systems: Startup Files

  • Automatically update snapshots (Windows)

  • Changed services (Windows)

  • Contents of Run keys (Windows)

  • Data Execution Prevention (Hardware) (Windows)

  • Data Execution Prevention (Software) (Windows)

  • Deleted services (Windows)

  • Disallowed services (Windows)

  • Disallowed services cont. (Windows)

  • Filter disallowed services not running (Windows)

  • Installed services (Windows)

  • Maximum reported messages (Windows)

  • New services (Windows)

  • Remote Procedure Call (RPC) Disabled (Windows)

  • Remote registry access (Windows)

  • Remote registry access (non-Administrators) (Windows)

  • Required services (Windows)

  • Services Security Options (Windows)

  • Services using specified user accounts to run (Windows)

  • Services using system account to run (Windows)

  • Unknown services (Windows)


About the Startup Files module

The Startup Files module reports information about system services, run keys, and remote registry access.

Some messages report messages that you can use to update template or snapshot files to match current agent settings.

Other checks report the messages that you can use to reverse agent settings or disable user accounts.

Updatable and correctable messages are identified as TU, SU, or C type messages in the descriptions of checks that use them.


Supported operating systems: Startup Files

The Startup Files module is supported on the following operating systems:

  • Windows 2000

  • Windows 2003

  • Windows 2008

  • Windows Vista

  • Windows XP


Automatically update snapshots (Windows)

Module: Startup Files

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

Enable this option to automatically update snapshots with current information.


Changed services (Windows)

Module: Startup Files

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports service configurations that changed after the last snapshot update. Changes in service type, status, startup type, logon account, executable path, and permissions are reported.

The following table lists the error message for the check.

Table: Error message for Changed services

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_CHGSERVICE

Category: System Information

  • Windows 2000 (105837)

  • Windows 2003 (205837)

  • Windows 2008 (248837)

  • Windows Vista (228837)

  • Windows XP (200837)

Title: Changed service

Description:The service was changed after the last snapshot update. If the change is authorized, update the snapshot. If the change is not authorized, restore the previous setting.

Severity: yellow-1

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [%s]


Contents of Run keys (Windows)

Module: Startup Files

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports the contents of registry Run keys. Programs listed in Run keys execute automatically at startup. Use the file list to specify the file names of programs to be excluded.

The following table lists the error message for the check.

Table: Error message for Contents of Run keys

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_RUN_KEY_ENTRY

Category: System Information

  • Windows 2000 (105842)

  • Windows 2003 (205842)

  • Windows 2008 (248842)

  • Windows Vista (228842)

  • Windows XP (200842)

Title: Run key entry

Description:The program executes automatically at startup. If the program is not authorized, remove the value from the registry key that is reported in the Information field. If the program is authorized, add the program file name to the name list.

Severity: green-0

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Key: %s]


Data Execution Prevention (Hardware) (Windows)

Module: Startup Files

Supported Platforms: Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports on the setting of data execution prevention. This check reports if DEP is set to prevent overrun attacks by stopping the execution of the code and reports if DEP set on drivers.

The following table lists the error messages for the check.

Table: Error messages for Data Execution Prevention (Hardware)

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_DEPAVAILABLE

Category: System Information

  • Windows 2003 (205847)

  • Windows 2008 (248847)

  • Windows Vista (228847)

  • Windows XP (200847)

Title: DEP Available

Description:Data execution prevention to prevent buffer overrun attacks by stopping the execution of code on data-type memory pages has not been set.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_DEPDRIVERS

Category: System Information

  • Windows 2003 (205848)

  • Windows 2008 (248848)

  • Windows Vista (228848)

  • Windows XP (200848)

Title: DEP Drivers

Description:Data execution prevention feature is not set to work for drivers

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Data Execution Prevention (Software) (Windows)

Module: Startup Files

Supported Platforms: Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports on the setting of data execution prevention. This check reports on which DEP setting applied (Always Off, Always On, Opt In or Opt Out)

The following table lists the error messages for the check.

Table: Error messages for Data Execution Prevention (Software)

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_DEPSUPPOLICY

Category: System Information

  • Windows 2003 (205849)

  • Windows 2008 (248849)

  • Windows Vista (228849)

  • Windows XP (200849)

Title: DEP Support Policy

Description:Indicates which Data Execution Prevention (DEP) setting is applied. The DEP setting specifies the extent to which DEP applies to 32-bit applications on the system. DEP is always applied to the Windows kernel

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_DEPSUPPOLICY_G

Category: System Information

  • Windows 2003 (205859)

  • Windows 2008 (248859)

  • Windows Vista (228859)

  • Windows XP (200859)

Title: DEP Support Policy

Description:Indicates which Data Execution Prevention (DEP) setting is applied. The DEP setting specifies the extent to which DEP applies to 32-bit applications on the system. DEP is always applied to the Windows kernel

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Deleted services (Windows)

Module: Startup Files

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports services that were deleted after the last snapshot update.

The following table lists the error message for the check.

Table: Error message for Deleted services

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_DELSERVICE

Category: System Information

  • Windows 2000 (105836)

  • Windows 2003 (205836)

  • Windows 2008 (248836)

  • Windows Vista (228836)

  • Windows XP (200836)

Title: Deleted service

Description:The service was deleted after the last snapshot update. If the deletion is authorized, update the snapshot. If it should not have been deleted, restore the service.

Severity: green-0

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [%s]


Disallowed services (Windows)

Module: Startup Files

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports a problem if disallowed services are running. Use the name list to specify disallowed services.

The following table lists the error messages for the check.

Table: Error messages for Disallowed services

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_DISALLOWRUN

Category: System Information

  • Windows 2000 (105833)

  • Windows 2003 (205833)

  • Windows 2008 (248833)

  • Windows Vista (228833)

  • Windows XP (200833)

Title: Disallowed services running

Description:The service is disallowed, but is installed and running. Use the Correct feature to stop the service and uninstall it. If the service should be allowed, remove it from the Disallowed Services name list.

Severity: red-4

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_DISALLOWNOTRUN

Category: System Information

  • Windows 2000 (105834)

  • Windows 2003 (205834)

  • Windows 2008 (248834)

  • Windows Vista (228834)

  • Windows XP (200834)

Title: Disallowed services installed

Description:The service is disallowed, but is installed. Uninstall the service or remove it from the Disallowed Services name list.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_DUPSVCNAME

Category: System Information

  • Windows 2000 (105844)

  • Windows 2003 (205844)

  • Windows 2008 (248844)

  • Windows Vista (228844)

  • Windows XP (200844)

Title: Service named by more than one name list

Description:The service exists in more than one of the following name lists: Required services, Disallowed services, and Unknown services. Remove the service from all but one of the name lists, then rerun the audit.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Found in both %s and %s lists]


Disallowed services cont. (Windows)

Module: Startup Files

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports a problem if disallowed services are running. Use the template to specify disallowed services.

The following table lists the error messages for the check.

Table: Error messages for Disallowed services cont.

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_DISALLOWRUN

Category: System Information

  • Windows 2000 (105833)

  • Windows 2003 (205833)

  • Windows 2008 (248833)

  • Windows Vista (228833)

  • Windows XP (200833)

Title: Disallowed services running

Description:The service is disallowed, but is installed and running. Use the Correct feature to stop the service and uninstall it. If the service should be allowed, remove it from the Disallowed Services name list.

Severity: red-4

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_DISALLOWNOTRUN

Category: System Information

  • Windows 2000 (105834)

  • Windows 2003 (205834)

  • Windows 2008 (248834)

  • Windows Vista (228834)

  • Windows XP (200834)

Title: Disallowed services installed

Description:The service is disallowed, but is installed. Uninstall the service or remove it from the Disallowed Services name list.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_DUPSVCNAME

Category: System Information

  • Windows 2000 (105844)

  • Windows 2003 (205844)

  • Windows 2008 (248844)

  • Windows Vista (228844)

  • Windows XP (200844)

Title: Service named by more than one name list

Description:The service exists in more than one of the following name lists: Required services, Disallowed services, and Unknown services. Remove the service from all but one of the name lists, then rerun the audit.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Found in both %s and %s lists]


Filter disallowed services not running (Windows)

Module: Startup Files

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

Enable this option to report only the disallowed services that are running. This option filters disallowed services that are installed but not running from the name list or template. This option only applies if one or both Disallowed services checks are enabled.

The following table lists the error message for the check.

Table: Error message for Filter disallowed services not running

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_DISALLOWRUN

Category: System Information

  • Windows 2000 (105833)

  • Windows 2003 (205833)

  • Windows 2008 (248833)

  • Windows Vista (228833)

  • Windows XP (200833)

Title: Disallowed services running

Description:The service is disallowed, but is installed and running. Use the Correct feature to stop the service and uninstall it. If the service should be allowed, remove it from the Disallowed Services name list.

Severity: red-4

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Installed services (Windows)

Module: Startup Files

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports all installed services.

The following table lists the error message for the check.

Table: Error message for Installed services

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_LIST

Category: System Information

  • Windows 2000 (105830)

  • Windows 2003 (205830)

  • Windows 2008 (248830)

  • Windows Vista (228830)

  • Windows XP (200830)

Title: List installed services

Description:The service is installed.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Maximum reported messages (Windows)

Module: Startup Files

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

Enable this option to limit the number of messages returned for each enabled check. Use the value field to specify the maximum number of times a given message should be displayed. Once the maximum number has been reached for a single message, the message will be displayed once more with the number of repeating instances of the message that are not reported.


New services (Windows)

Module: Startup Files

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports services that were added after the last snapshot update.

The following table lists the error message for the check.

Table: Error message for New services

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_NEWSERVICE

Category: System Information

  • Windows 2000 (105835)

  • Windows 2003 (205835)

  • Windows 2008 (248835)

  • Windows Vista (228835)

  • Windows XP (200835)

Title: New service installed

Description:The service was added after the last snapshot update. If the service is authorized, update the snapshot. If it is not authorized, uninstall it.

Severity: yellow-1

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [%s]


Remote Procedure Call (RPC) Disabled (Windows)

Module: Startup Files

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports a problem if either the Remote Procedure Call (RPC) or the Remote Procedure Call (RPC) Locator service is installed and not disabled.

The following table lists the error message for the check.

Table: Error message for Remote Procedure Call (RPC) Disabled

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_RPCENABLE

Category: System Information

  • Windows 2000 (105839)

  • Windows 2003 (205839)

  • Windows 2008 (248839)

  • Windows Vista (228839)

  • Windows XP (200839)

Title: Remote Procedure Call (RPC) enabled

Description:Either the Remote Procedure Call (RPC) service or the Remote Procedure Call (RPC) Locator service is enabled. This lets the system execute remote requests. If RPC is required, apply the latest RPC patch to resolve known vulnerabilities. Otherwise, disable the services.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Remote registry access (Windows)

Module: Startup Files

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports accounts that can access the registry remotely. Any user with Read or Write access to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg key has remote access to the registry. After a user has established a remote connection to the registry, only the security on individual keys restricts the user's access, regardless of what permissions the user is granted on the Winreg key. Use the name list to specify accounts that are to be included or excluded for this check.

The following table lists the error message for the check.

Table: Error message for Remote registry access

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_RMTREGISTRY_PERMISSIONS

Category: System Information

  • Windows 2000 (105841)

  • Windows 2003 (205841)

  • Windows 2008 (248841)

  • Windows Vista (228841)

  • Windows XP (200841)

Title: Users/groups found with remote registry permissions

Description:The account can remotely read or modify registry contents. If the access is not authorized, revoke all permissions for this account from the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg registry key. If the access is authorized, update the name list. Limit remote registry access to trusted accounts only.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Remote registry access (non-Administrators) (Windows)

Module: Startup Files

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports a problem if any account other than the Administrators security group can remotely access the registry. Any user granted Read or Write access to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg key has remote access to the registry. After a user has established a remote connection to the registry, only the security on individual keys restricts the user's access, regardless of what permissions the user is granted on the Winreg key.

The following table lists the error message for the check.

Table: Error message for Remote registry access (non-Administrators)

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_RMTREGISTRY

Category: System Information

  • Windows 2000 (105840)

  • Windows 2003 (205840)

  • Windows 2008 (248840)

  • Windows Vista (228840)

  • Windows XP (200840)

Title: Remote registry access enabled

Description:At least one account other than the Administrators security group can remotely access the registry. Use the Correct feature to revoke remote access from all accounts except the Administrators group. To correct the problem manually, revoke all permissions from the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg registry key for all accounts except the Administrators group. If the key does not exist, create it. Disabling remote registry access can prevent legitimate remote administration of the system or prevent remote software upgrades.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Required services (Windows)

Module: Startup Files

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports a problem if required services are not running. Use the name list to specify required services.

The following table lists the error messages for the check.

Table: Error messages for Required services

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_REQNOTFND

Category: System Information

  • Windows 2000 (105831)

  • Windows 2003 (205831)

  • Windows 2008 (248831)

  • Windows Vista (228831)

  • Windows XP (200831)

Title: Required services not installed

Description:The service is required, but is not installed. Install and start it or remove it from the Required Services name list.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_REQNOTRUN

Category: System Information

  • Windows 2000 (105832)

  • Windows 2003 (205832)

  • Windows 2008 (248832)

  • Windows Vista (228832)

  • Windows XP (200832)

Title: Required services not running

Description:The service is required. It is installed but is not running. Use the Correct feature to start the service or remove it from the Required Services name list.

Severity: red-4

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_DUPSVCNAME

Category: System Information

  • Windows 2000 (105844)

  • Windows 2003 (205844)

  • Windows 2008 (248844)

  • Windows Vista (228844)

  • Windows XP (200844)

Title: Service named by more than one name list

Description:The service exists in more than one of the following name lists: Required services, Disallowed services, and Unknown services. Remove the service from all but one of the name lists, then rerun the audit.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Found in both %s and %s lists]


Services Security Options (Windows)

Module: Startup Files

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports a problem if a system services security setting is not set to the value specified in the template. Enable the check by selecting one or more templates.

The following table lists the error messages for the check.

Table: Error messages for Services Security Options

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_INVALID_TEMPLATE_ENTRY

Category: System Information

  • Windows 2000 (105850)

  • Windows 2003 (205850)

  • Windows 2008 (248850)

  • Windows Vista (228850)

  • Windows XP (200850)

Title: Incorrect Template Entry

Description:Invalid entry in the template

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_SERVICE_ACL_ERROR

Category: System Information

  • Windows 2000 (105851)

  • Windows 2003 (205851)

  • Windows 2008 (248851)

  • Windows Vista (228851)

  • Windows XP (200851)

Title: Error reporting system services ACL

Description:Error reporting ACL for system services

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_TEMPLATE_NOT_FOUND

Category: System Information

  • Windows 2000 (105852)

  • Windows 2003 (205852)

  • Windows 2008 (248852)

  • Windows Vista (228852)

  • Windows XP (200852)

Title: Template file not found

Description:Template file not found

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_INCORRECT_VALUE_G

Category: System Information

  • Windows 2000 (105853)

  • Windows 2003 (205853)

  • Windows 2008 (248853)

  • Windows Vista (228853)

  • Windows XP (200853)

Title: Security Services Options Incorrect Value

Description:The actual value does not match the expected value in the ESM template.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_INCORRECT_VALUE_Y

Category: System Information

  • Windows 2000 (105854)

  • Windows 2003 (205854)

  • Windows 2008 (248854)

  • Windows Vista (228854)

  • Windows XP (200854)

Title: Security Services Options Incorrect Value

Description:The actual value does not match the expected value in the ESM template.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_INCORRECT_VALUE_R

Category: System Information

  • Windows 2000 (105855)

  • Windows 2003 (205855)

  • Windows 2008 (248855)

  • Windows Vista (228855)

  • Windows XP (200855)

Title: Security Services Options Incorrect Value

Description:The actual value does not match the expected value in the ESM template.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_SERVICE_STARTUP_ERROR

Category: System Information

  • Windows 2000 (105856)

  • Windows 2003 (205856)

  • Windows 2008 (248856)

  • Windows Vista (228856)

  • Windows XP (200856)

Title: Error reporting system services startup

Description:Error reporting startup type for system services

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_INVALID_SERVICE

Category: System Information

  • Windows 2000 (105857)

  • Windows 2003 (205857)

  • Windows 2008 (248857)

  • Windows Vista (228857)

  • Windows XP (200857)

Title: Service does not exist

Description:Service does not exist

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_FILE_MISSING

Category: System Information

  • Windows 2000 (105858)

  • Windows 2003 (205858)

  • Windows 2008 (248858)

  • Windows Vista (228858)

  • Windows XP (200858)

Title: No template files specified

Description:The startup module was run without any template files. No security checks were performed. Check your policy to ensure that at least one template file is enabled for the agent's operating system.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Services using specified user accounts to run (Windows)

Module: Startup Files

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports services that run as specified user accounts. Use the name list to specify the users and user groups that are to be included or excluded by this check.

The following table lists the error message for the check.

Table: Error message for Services using specified user accounts to run

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_SVCUSERACC

Category: System Information

  • Windows 2000 (105843)

  • Windows 2003 (205843)

  • Windows 2008 (248843)

  • Windows Vista (228843)

  • Windows XP (200843)

Title: Service using specified user account to run

Description:The service runs as the user account that is reported in the Information field.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [User account: %s]


Services using system account to run (Windows)

Module: Startup Files

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports services that run as the Local System account.

The following table lists the error message for the check.

Table: Error message for Services using system account to run

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_SVCSYSACC

Category: System Information

  • Windows 2000 (105838)

  • Windows 2003 (205838)

  • Windows 2008 (248838)

  • Windows Vista (228838)

  • Windows XP (200838)

Title: Service using System account to run

Description:The service runs as the Local System account. If this is not correct, run the service as a different account.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Unknown services (Windows)

Module: Startup Files

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports installed services that are not already specified in the Required services or Disallowed services name lists. Use the name list to exclude known optional services. If this check is enabled, Required services and Disallowed services must also be enabled or these services will be reported as unknown.

The following table lists the error messages for the check.

Table: Error messages for Unknown services

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_DUPSVCNAME

Category: System Information

  • Windows 2000 (105844)

  • Windows 2003 (205844)

  • Windows 2008 (248844)

  • Windows Vista (228844)

  • Windows XP (200844)

Title: Service named by more than one name list

Description:The service exists in more than one of the following name lists: Required services, Disallowed services, and Unknown services. Remove the service from all but one of the name lists, then rerun the audit.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Found in both %s and %s lists]

String ID: ESM_UNKNOWNRUN

Category: System Information

  • Windows 2000 (105845)

  • Windows 2003 (205845)

  • Windows 2008 (248845)

  • Windows Vista (228845)

  • Windows XP (200845)

Title: Unknown service running

Description:The service is running, but is not specified as required, disallowed, or optional. If the service is not needed, uninstall it. Otherwise, add it to the Required Services or Optional Services name list.

Severity: red-4

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_UNKNOWNNOTRUN

Category: System Information

  • Windows 2000 (105846)

  • Windows 2003 (205846)

  • Windows 2008 (248846)

  • Windows Vista (228846)

  • Windows XP (200846)

Title: Unknown service installed

Description:The service is installed, but is not specified as required, disallowed, or optional. If the service is not needed, uninstall it. Otherwise, add it to the Required Services or Optional Services name list.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Symantec Product Info module

This section includes the following topics:

  • About the Symantec Product Info module

  • Supported operating systems: Symantec Product Info

  • Abnormal termination (Windows)

  • Blank screen after connection (Windows)

  • Block failed IP (Windows)

  • Callers (Windows)

  • Case Sensitive Passwords (Windows)

  • Disconnect if inactive (Windows)

  • Disconnect on timeout (Windows)

  • Either Symantec AntiVirus CE or Norton AntiVirus (Windows)

  • Encryption algorithm (Windows)

  • Encryption level (Windows)

  • Event log enabled (Windows)

  • Events to log (Windows)

  • File System Auto-Protected (Windows)

  • Hosts to check (Windows)

  • Keyboard/Mouse on host (Windows)

  • Keyboard/Mouse on remote (Windows)

  • LiveUpdate frequency (Windows)

  • LiveUpdate frequency (Windows)

  • Log generation enabled (Windows)

  • Login timeout (Windows)

  • Maximum Virus Definition File age (Windows)

  • Maximum Virus Definition File age (Windows)

  • Maximum login attempts (Windows)

  • Minimum version (Windows)

  • Minimum version (Windows)

  • Minimum version (Windows)

  • Normal termination (Windows)

  • Norton AntiVirus (Windows)

  • Password required to execute (Windows)

  • Password required to modify (Windows)

  • Password required to view (Windows)

  • Prompt to confirm connection (Windows)

  • Record event log locally (Windows)

  • Record event log on server (Windows)

  • Record log locally (Windows)

  • Record log on server (Windows)

  • Remotes w/ different algorithm (Windows)

  • Remotes with lower encryption (Windows)

  • SNMP traps enabled (Windows)

  • Scan frequency (Windows)

  • Scan frequency (Windows)

  • Secure abnormal termination (Windows)

  • Secure after connection (Windows)

  • Secure normal termination (Windows)

  • Symantec AntiVirus Corporate Edition (Windows)

  • Symantec pcAnywhere (Windows)


About the Symantec Product Info module

The Symantec Product Info module reports a problem if Symantec AntiVirus Corporate Edition or Norton AntiVirus is not installed on the agent. It also reports a problem if their version number, last scan time, or last LiveUpdate time are not within the limits that you specify. Symantec AntiVirus Enterprise Edition is a stand-alone product and is also included in Symantec AntiVirus Enterprise Edition.

In the Symantec ESM console, the checks for this module are organized under Symantec AntiVirus Corporate Edition and Norton AntiVirus headers. Checks are named Minimum version, LiveUpdate frequency, and Scan frequency under each header. In this document, the checks are accompanied with the product names in parentheses for easy reference.


Supported operating systems: Symantec Product Info

The Symantec Product Info module is supported on the following operating systems:

  • Windows 2000

  • Windows 2003

  • Windows 2008

  • Windows Vista

  • Windows XP


Abnormal termination (Windows)

Module: Symantec Product Info

Supported Platforms: Windows 2000, Windows 2003, Windows XP

This check reports pcAnywhere hosts that are not configured to handle abnormal terminations using one of the methods enabled in the name list or that have an abnormal termination timeout value greater than what is specified in the name list.

The following table lists the error messages for the check.

Table: Error messages for Abnormal termination

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: PCA_ABNORMAL_TERM

Category: Policy Compliance

  • Windows 2000 (109087)

  • Windows 2003 (209087)

  • Windows XP (204087)

Title: Forbidden abnormal termination mechanism

Description:The listed pcAnywhere host is configured to handle abnormal terminations using a forbidden method.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: PCA_ABNORMAL_TIMEOUT

Category: Policy Compliance

  • Windows 2000 (109088)

  • Windows 2003 (209088)

  • Windows XP (204088)

Title: Abnormal termination timeout too long

Description:The listed pcAnywhere host is configured to use a timeout value for allowing the current user to reconnect after an abnormal termination that is longer than the value specified.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: PCA_NOT_INSTALLED

Category: Policy Compliance

  • Windows 2000 (109912)

  • Windows 2003 (209912)

  • Windows XP (204912)

Title: pcAnywhere not installed

Description:pcAnywhere is not installed on the agent machine.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Blank screen after connection (Windows)

Module: Symantec Product Info

Supported Platforms: Windows 2000, Windows 2003, Windows XP

This check reports pcAnywhere hosts that are not configured to blank the PC screen after connection.

The following table lists the error messages for the check.

Table: Error messages for Blank screen after connection

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: PCA_BLANK_SCREEN

Category: Policy Compliance

  • Windows 2000 (109097)

  • Windows 2003 (209097)

  • Windows XP (204097)

Title: Host does not blank screen

Description:The listed pcAnywhere host is not configured to blank the PC screen afer connection.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: PCA_NOT_INSTALLED

Category: Policy Compliance

  • Windows 2000 (109912)

  • Windows 2003 (209912)

  • Windows XP (204912)

Title: pcAnywhere not installed

Description:pcAnywhere is not installed on the agent machine.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Block failed IP (Windows)

Module: Symantec Product Info

Supported Platforms: Windows 2000, Windows 2003, Windows XP

This check reports pcAnywhere hosts that are not configured to block failed IP addresses. Specify the minimum block duration in the value field.

The following table lists the error messages for the check.

Table: Error messages for Block failed IP

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: PCA_IP_NOT_BLOCKED

Category: Policy Compliance

  • Windows 2000 (109908)

  • Windows 2003 (209908)

  • Windows XP (204908)

Title: Host not configured to block failed IP addresses

Description:The listed pcAnywhere host is not configured to block failed IP addresses.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: PCA_IP_BLOCKTIME

Category: Policy Compliance

  • Windows 2000 (109909)

  • Windows 2003 (209909)

  • Windows XP (204909)

Title: Failed IP addresses block time too short

Description:The block failed IP addresses setting for the listed pcAnywhere host is smaller than the value specified.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: PCA_NOT_INSTALLED

Category: Policy Compliance

  • Windows 2000 (109912)

  • Windows 2003 (209912)

  • Windows XP (204912)

Title: pcAnywhere not installed

Description:pcAnywhere is not installed on the agent machine.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Callers (Windows)

Module: Symantec Product Info

Supported Platforms: Windows 2000, Windows 2003, Windows XP

This check reports pcAnywhere hosts that are configured to allow unapproved callers. Use the name list to include or exclude approved callers.

The following table lists the error messages for the check.

Table: Error messages for Callers

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: PCA_FORBIDDEN_CALLER

Category: Policy Compliance

  • Windows 2000 (109086)

  • Windows 2003 (209086)

  • Windows XP (204086)

Title: pcAnywhere host allows forbidden caller

Description:The listed pcAnywhere host is configured to allow a forbidden caller.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: PCA_NOT_INSTALLED

Category: Policy Compliance

  • Windows 2000 (109912)

  • Windows 2003 (209912)

  • Windows XP (204912)

Title: pcAnywhere not installed

Description:pcAnywhere is not installed on the agent machine.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Case Sensitive Passwords (Windows)

Module: Symantec Product Info

Supported Platforms: Windows 2000, Windows 2003, Windows XP

This check reports pcAnywhere hosts that are not configured to use case sensitive passwords.

The following table lists the error messages for the check.

Table: Error messages for Case Sensitive Passwords

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: PCA_CASE_INSENSITIVE

Category: Policy Compliance

  • Windows 2000 (109903)

  • Windows 2003 (209903)

  • Windows XP (204903)

Title: Host uses case insensitive passwords

Description:The listed pcAnywhere host is not configured to use case sensitive passwords.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: PCA_NOT_INSTALLED

Category: Policy Compliance

  • Windows 2000 (109912)

  • Windows 2003 (209912)

  • Windows XP (204912)

Title: pcAnywhere not installed

Description:pcAnywhere is not installed on the agent machine.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Disconnect if inactive (Windows)

Module: Symantec Product Info

Supported Platforms: Windows 2000, Windows 2003, Windows XP

This check reports pcAnywhere hosts that are not configured to disconnect if the remote host has been inactive, or that are configured to use a timeout value greater than the value specified in the name list.

The following table lists the error messages for the check.

Table: Error messages for Disconnect if inactive

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: PCA_INACTIVE_DISCONNECT

Category: Policy Compliance

  • Windows 2000 (109901)

  • Windows 2003 (209901)

  • Windows XP (204901)

Title: Host not configured to disconnect if inactive

Description:The listed pcAnywhere host is not configured to disconnect if inactive.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: PCA_INACTIVE_TIMEOUT

Category: Policy Compliance

  • Windows 2000 (109902)

  • Windows 2003 (209902)

  • Windows XP (204902)

Title: Inactive timeout too long

Description:The Disconnect if inactive setting for the listed pcAnywhere host is larger than the value specified.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: PCA_NOT_INSTALLED

Category: Policy Compliance

  • Windows 2000 (109912)

  • Windows 2003 (209912)

  • Windows XP (204912)

Title: pcAnywhere not installed

Description:pcAnywhere is not installed on the agent machine.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Disconnect on timeout (Windows)

Module: Symantec Product Info

Supported Platforms: Windows 2000, Windows 2003, Windows XP

This check reports pcAnywhere hosts that are not configured to disconnect if a timeout occurs while waiting for a connection confirmation.

The following table lists the error messages for the check.

Table: Error messages for Disconnect on timeout

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: PCA_DISCONNECT_TIMEOUT

Category: Policy Compliance

  • Windows 2000 (109096)

  • Windows 2003 (209096)

  • Windows XP (204096)

Title: Host does not disconnect on timeout

Description:The listed pcAnywhere host is not configured to disconnect if a timeout occurs while waiting for a connection confirmation.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: PCA_NOT_INSTALLED

Category: Policy Compliance

  • Windows 2000 (109912)

  • Windows 2003 (209912)

  • Windows XP (204912)

Title: pcAnywhere not installed

Description:pcAnywhere is not installed on the agent machine.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Either Symantec AntiVirus CE or Norton AntiVirus (Windows)

Module: Symantec Product Info

Supported Platforms: Windows 2000, Windows XP

Enable this option if your security policy allows either Norton AntiVirus or Symantec AntiVirus Corporate Edition to be installed on your systems. This option is used in combination with the checks for Norton AntiVirus and Symantec AntiVirus Corporate Edition to report systems that are not in compliance with the configured check settings above. If this option is enabled, checks enabled under Norton AntiVirus should also be enabled under Symantec Antivirus Corporate Edition for proper reporting of system compliance.

The following table lists the error messages for the check.

Table: Error messages for Either Symantec AntiVirus CE or Norton AntiVirus

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_AV_AND_AVCE_VERSION_VIOLATION

Category: Policy Compliance

  • Windows 2000 (109060)

  • Windows XP (204060)

Title: Installed SAVCE and/or NAV version outdated

Description:The version of installed Symantec AntiVirus Corporate Edition and/or Norton Antivirus is older than what is allowed by your policy.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_AV_NOR_AVCE_NOT_INSTALLED

Category: Policy Compliance

  • Windows 2000 (109061)

  • Windows XP (204061)

Title: Either SAVCE or NAV not installed

Description:This system does not have either Symantec AntiVirus Corporate Edition or Norton AntiVirus installed.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_AV_AND_AVCE_LU_VIOLATION

Category: Policy Compliance

  • Windows 2000 (109062)

  • Windows XP (204062)

Title: Installed SAVCE and/or NAV LiveUpdate overdue

Description:A LiveUpdate for installed Symantec AntiVirus Corporate Edition and/or Norton AntiVirus has not been completed within the number of days required by your policy.

Severity: yellow-3

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_AV_AND_AVCE_LASTSCAN_VIOLATION

Category: Policy Compliance

  • Windows 2000 (109063)

  • Windows XP (204063)

Title: Installed SAVCE and/or NAV scan overdue

Description:Installed Symantec AntiVirus Corporate Edition and/or Norton AntiVirus has not completed a virus scan within the number of days required by your policy.

Severity: yellow-3

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_AV_AND_AVCE_VIRUSDEF_VIOLATION

Category: Policy Compliance

  • Windows 2000 (109066)

  • Windows XP (204066)

Title: Installed SAVCE and/or NAV Virus Definition File overdue

Description:The date of the Virus Definition File for installed Symantec AntiVirus Corporate Edition and/or Norton AntiVirus is older than the maximum age in days specified by your policy.

Severity: yellow-3

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Encryption algorithm (Windows)

Module: Symantec Product Info

Supported Platforms: Windows 2000, Windows 2003, Windows XP

This check reports PC Anywhere hosts that are not configured to use one of the encryption algorithms specified in the name list. Hosts using a key length smaller than the value specified in the value field will also be reported.

The following table lists the error messages for the check.

Table: Error messages for Encryption algorithm

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: PCA_ENCRYPTION_ALGORITHM

Category: Policy Compliance

  • Windows 2000 (109079)

  • Windows 2003 (209079)

  • Windows XP (204079)

Title: pcAnywhere host using forbidden encryption algorithm

Description:The listed pcAnywhere host is configured to use a forbidden encryption algorithm.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: PCA_ENCRYPTION_LENGTH

Category: Policy Compliance

  • Windows 2000 (109080)

  • Windows 2003 (209080)

  • Windows XP (204080)

Title: pcAnywhere host encryption key size too small

Description:The listed pcAnywhere host is configured to use a key length smaller than the value specified.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: PCA_NOT_INSTALLED

Category: Policy Compliance

  • Windows 2000 (109912)

  • Windows 2003 (209912)

  • Windows XP (204912)

Title: pcAnywhere not installed

Description:pcAnywhere is not installed on the agent machine.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Encryption level (Windows)

Module: Symantec Product Info

Supported Platforms: Windows 2000, Windows 2003, Windows XP

This check reports pcAnywhere hosts that are not configured to use one of the encryption levels specified in the name list.

The following table lists the error messages for the check.

Table: Error messages for Encryption level

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: PCA_ENCRYPTION_LEVEL

Category: Policy Compliance

  • Windows 2000 (109078)

  • Windows 2003 (209078)

  • Windows XP (204078)

Title: pcAnywhere host using forbidden encryption level

Description:The listed pcAnywhere host is configured to use a forbidden encryption level.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: PCA_NOT_INSTALLED

Category: Policy Compliance

  • Windows 2000 (109912)

  • Windows 2003 (209912)

  • Windows XP (204912)

Title: pcAnywhere not installed

Description:pcAnywhere is not installed on the agent machine.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Event log enabled (Windows)

Module: Symantec Product Info

Supported Platforms: Windows 2000, Windows 2003, Windows XP

This check reports if pcAnywhere is not configured to generate NT event log entries.

The following table lists the error messages for the check.

Table: Error messages for Event log enabled

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: PCA_LOG_DISABLED_EVT

Category: Policy Compliance

  • Windows 2000 (109071)

  • Windows 2003 (209071)

  • Windows XP (204071)

Title: pcAnywhere event logging disabled

Description:pcAnywhere is not configured to generate NT event logs.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: PCA_NOT_INSTALLED

Category: Policy Compliance

  • Windows 2000 (109912)

  • Windows 2003 (209912)

  • Windows XP (204912)

Title: pcAnywhere not installed

Description:pcAnywhere is not installed on the agent machine.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Events to log (Windows)

Module: Symantec Product Info

Supported Platforms: Windows 2000, Windows 2003, Windows XP

This check reports events that are enabled in the keyword name list below, but are not configured to be logged by pcAnywere.

The following table lists the error messages for the check.

Table: Error messages for Events to log

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: PCA_REQUIRED_EVENT

Category: Policy Compliance

  • Windows 2000 (109075)

  • Windows 2003 (209075)

  • Windows XP (204075)

Title: Required pcAnywhere event not logged

Description:pcAnywhere is not configured to log the event shown in the name field.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: PCA_NOT_INSTALLED

Category: Policy Compliance

  • Windows 2000 (109912)

  • Windows 2003 (209912)

  • Windows XP (204912)

Title: pcAnywhere not installed

Description:pcAnywhere is not installed on the agent machine.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


File System Auto-Protected (Windows)

Module: Symantec Product Info

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports a problem if a Symantec AntiVirus Corporate Edition Auto-Protect (Realtime Protection) is not turned on for File System.

The following table lists the error messages for the check.

Table: Error messages for File System Auto-Protected

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_AVCE_AP_VIOLATION

Category: Policy Compliance

  • Windows 2000 (109059)

  • Windows 2003 (209059)

  • Windows 2008 (252059)

  • Windows Vista (232059)

  • Windows XP (204059)

Title: Symantec AntiVirus Corporate Edition Auto-Protect not enabled

Description:Symantec AntiVirus Corporate Edition's Auto-Protect (Realtime Protection) for File System is not enabled.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_AVCE_NOT_INSTALLED

Category: Policy Compliance

  • Windows 2000 (109055)

  • Windows 2003 (209055)

  • Windows 2008 (252055)

  • Windows Vista (232055)

  • Windows XP (204055)

Title: Symantec AntiVirus Corporate Edition not installed

Description:This system does not have Symantec AntiVirus Corporate Edition installed.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Hosts to check (Windows)

Module: Symantec Product Info

Supported Platforms: Windows 2000, Windows 2003, Windows XP

Use the name list to specify Symantec pcAnywhere hosts that should be included or excluded for all checks listed below.


Keyboard/Mouse on host (Windows)

Module: Symantec Product Info

Supported Platforms: Windows 2000, Windows 2003, Windows XP

This check reports pcAnywhere hosts that are configured to activate the keyboard and mouse on the host.

The following table lists the error messages for the check.

Table: Error messages for Keyboard/Mouse on host

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: PCA_KB_HOST

Category: Policy Compliance

  • Windows 2000 (109099)

  • Windows 2003 (209099)

  • Windows XP (204099)

Title: Keyboard/Mouse enabled on host

Description:The listed pcAnywhere host is configured to activate the keyboard/mouse on the host.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: PCA_NOT_INSTALLED

Category: Policy Compliance

  • Windows 2000 (109912)

  • Windows 2003 (209912)

  • Windows XP (204912)

Title: pcAnywhere not installed

Description:pcAnywhere is not installed on the agent machine.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Keyboard/Mouse on remote (Windows)

Module: Symantec Product Info

Supported Platforms: Windows 2000, Windows 2003, Windows XP

This check reports pcAnywhere hosts that are configured to activate the keyboard and mouse on the remote.

The following table lists the error messages for the check.

Table: Error messages for Keyboard/Mouse on remote

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: PCA_KB_REMOTE

Category: Policy Compliance

  • Windows 2000 (109900)

  • Windows 2003 (209900)

  • Windows XP (204900)

Title: Keyboard/Mouse enabled on remote

Description:The listed pcAnywhere host is configured to activate keyboard/mouse on the remote.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: PCA_NOT_INSTALLED

Category: Policy Compliance

  • Windows 2000 (109912)

  • Windows 2003 (209912)

  • Windows XP (204912)

Title: pcAnywhere not installed

Description:pcAnywhere is not installed on the agent machine.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


LiveUpdate frequency (Windows)

Module: Symantec Product Info

Supported Platforms: Windows XP, Windows 2000

This check reports a problem if LiveUpdate has not been run for Norton AntiVirus within the required number of days.

The following table lists the error messages for the check.

Table: Error messages for LiveUpdate frequency

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_AV_LU_VIOLATION

Category: Policy Compliance

  • Windows 2000 (109052)

  • Windows XP (204052)

Title: Norton AntiVirus LiveUpdate overdue

Description:A LiveUpdate for Norton AntiVirus has not been completed within the number of days required by your policy.

Severity: yellow-3

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_AV_NOT_INSTALLED

Category: Policy Compliance

  • Windows 2000 (109051)

  • Windows XP (204051)

Title: Norton Antivirus not installed

Description:This system does not have Norton AntiVirus installed.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


LiveUpdate frequency (Windows)

Module: Symantec Product Info

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports a problem if LiveUpdate has not been run for Symantec AntiVirus Corporate Edition within the required number of days by this check.

The following table lists the error messages for the check.

Table: Error messages for LiveUpdate frequency

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_AVCE_LU_VIOLATION

Category: Policy Compliance

  • Windows 2000 (109056)

  • Windows 2003 (209056)

  • Windows 2008 (252056)

  • Windows Vista (232056)

  • Windows XP (204056)

Title: Symantec AntiVirus Corporate Edition LiveUpdate overdue

Description:A LiveUpdate for Symantec AntiVirus Corporate Edition has not been completed within the number of days required by your policy.

Severity: yellow-3

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_AVCE_NOT_INSTALLED

Category: Policy Compliance

  • Windows 2000 (109055)

  • Windows 2003 (209055)

  • Windows 2008 (252055)

  • Windows Vista (232055)

  • Windows XP (204055)

Title: Symantec AntiVirus Corporate Edition not installed

Description:This system does not have Symantec AntiVirus Corporate Edition installed.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Log generation enabled (Windows)

Module: Symantec Product Info

Supported Platforms: Windows 2000, Windows 2003, Windows XP

This check reports if pcAnywhere is not configured to generate log entries.

The following table lists the error messages for the check.

Table: Error messages for Log generation enabled

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: PCA_LOG_DISABLED_PCA

Category: Policy Compliance

  • Windows 2000 (109067)

  • Windows 2003 (209067)

  • Windows XP (204067)

Title: pcAnywhere logging not enabled

Description:pcAnywhere logging is not enabled

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: PCA_NOT_INSTALLED

Category: Policy Compliance

  • Windows 2000 (109912)

  • Windows 2003 (209912)

  • Windows XP (204912)

Title: pcAnywhere not installed

Description:pcAnywhere is not installed on the agent machine.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Login timeout (Windows)

Module: Symantec Product Info

Supported Platforms: Windows 2000, Windows 2003, Windows XP

This check reports pcAnywhere hosts that are not configured to time out while waiting for login, or are configured to use a timeout value larger than the maximum specified in the value field.

The following table lists the error messages for the check.

Table: Error messages for Login timeout

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: PCA_NO_LOGIN_TIMEOUT

Category: Policy Compliance

  • Windows 2000 (109904)

  • Windows 2003 (209904)

  • Windows XP (204904)

Title: No login timeout configured

Description:The listed pcAnywhere host is not configured to timeout while waiting for a user to log in.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: PCA_LOGIN_TIMEOUT

Category: Policy Compliance

  • Windows 2000 (109905)

  • Windows 2003 (209905)

  • Windows XP (204905)

Title: Login timeout too long

Description:The time limit to complete login setting for the listed pcAnywhere host is larger than the value specified.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: PCA_NOT_INSTALLED

Category: Policy Compliance

  • Windows 2000 (109912)

  • Windows 2003 (209912)

  • Windows XP (204912)

Title: pcAnywhere not installed

Description:pcAnywhere is not installed on the agent machine.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Maximum Virus Definition File age (Windows)

Module: Symantec Product Info

Supported Platforms: Windows 2000, Windows XP

This check reports a problem if the date of the Virus Definition File for a Norton AntiVirus is older than the maximum age in days specified in this check.

The following table lists the error messages for the check.

Table: Error messages for Maximum Virus Definition File age

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_AV_VIRUSDEF_VIOLATION

Category: Policy Compliance

  • Windows 2000 (109064)

  • Windows XP (204064)

Title: Norton AntiVirus Virus Definition File overdue

Description:The date of the Virus Definition File for Norton AntiVirus is older than the maximum age in days specified by your policy.

Severity: yellow-3

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_AV_NOT_INSTALLED

Category: Policy Compliance

  • Windows 2000 (109051)

  • Windows XP (204051)

Title: Norton Antivirus not installed

Description:This system does not have Norton AntiVirus installed.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Maximum Virus Definition File age (Windows)

Module: Symantec Product Info

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports a problem if the date of the Virus Definition File for a Symantec AntiVirus Corporate Edition is older than the maximum age in days specified in this check.

The following table lists the error messages for the check.

Table: Error messages for Maximum Virus Definition File age

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_AVCE_VIRUSDEF_VIOLATION

Category: Policy Compliance

  • Windows 2000 (109065)

  • Windows 2003 (209065)

  • Windows 2008 (252065)

  • Windows Vista (232065)

  • Windows XP (204065)

Title: SAVCE Virus Definition File overdue

Description:The date of the Virus Definition File for Symantec AntiVirus Corporate Edition is older than the maximum age in days specified by your policy.

Severity: yellow-3

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_AVCE_NOT_INSTALLED

Category: Policy Compliance

  • Windows 2000 (109055)

  • Windows 2003 (209055)

  • Windows 2008 (252055)

  • Windows Vista (232055)

  • Windows XP (204055)

Title: Symantec AntiVirus Corporate Edition not installed

Description:This system does not have Symantec AntiVirus Corporate Edition installed.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Maximum login attempts (Windows)

Module: Symantec Product Info

Supported Platforms: Windows 2000, Windows 2003, Windows XP

This check reports pcAnywhere hosts that allow more than the number of login attempts secified in the value field.

The following table lists the error messages for the check.

Table: Error messages for Maximum login attempts

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: PCA_NO_LOGIN_ATTEMPTS

Category: Policy Compliance

  • Windows 2000 (109906)

  • Windows 2003 (209906)

  • Windows XP (204906)

Title: No login attempt maximum configured

Description:The listed pcAnywhere host is not configured to enforce a maximum number of login attempts.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: PCA_LOGIN_ATTEMPTS

Category: Policy Compliance

  • Windows 2000 (109907)

  • Windows 2003 (209907)

  • Windows XP (204907)

Title: Max login attempts too high

Description:The limit login attempts per call setting for the listed pcAnywhere host is larger than the value specified.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: PCA_NOT_INSTALLED

Category: Policy Compliance

  • Windows 2000 (109912)

  • Windows 2003 (209912)

  • Windows XP (204912)

Title: pcAnywhere not installed

Description:pcAnywhere is not installed on the agent machine.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Minimum version (Windows)

Module: Symantec Product Info

Supported Platforms: Windows 2000, Windows XP

This check reports a problem if the Norton AntiVirus version installed is less than the version specified in this check. This check also reports a problem if Norton AntiVirus is not installed on the host.

The following table lists the error messages for the check.

Table: Error messages for Minimum version

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_AV_VERSION_VIOLATION

Category: Policy Compliance

  • Windows 2000 (109050)

  • Windows XP (204050)

Title: Norton AntiVirus version outdated

Description:The version of Norton AntiVirus installed is older than what is allowed by your policy.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_AV_NOT_INSTALLED

Category: Policy Compliance

  • Windows 2000 (109051)

  • Windows XP (204051)

Title: Norton Antivirus not installed

Description:This system does not have Norton AntiVirus installed.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Minimum version (Windows)

Module: Symantec Product Info

Supported Platforms: Windows 2000, Windows 2003, Windows XP, Windows 2008, Windows Vista

This check reports a problem if the Symantec AntiVirus Corporate Edition version installed is less than the version specified in this check. This check also reports a problem if Symantec AntiVirus Corporate Edition is not installed on the host.

The following table lists the error messages for the check.

Table: Error messages for Minimum version

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_AVCE_VERSION_VIOLATION

Category: Policy Compliance

  • Windows 2000 (109054)

  • Windows 2003 (209054)

  • Windows XP (204054)

  • Windows 2008 (252054)

  • Windows Vista (232054)

Title: Symantec AntiVirus Corporate Edition version outdated

Description:The version of Symantec AntiVirus Corporate Edition installed is older than what is allowed by your policy.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_AVCE_NOT_INSTALLED

Category: Policy Compliance

  • Windows 2000 (109055)

  • Windows 2003 (209055)

  • Windows XP (204055)

  • Windows 2008 (252054)

  • Windows Vista (232054)

Title: Symantec AntiVirus Corporate Edition not installed

Description:This system does not have Symantec AntiVirus Corporate Edition installed.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Minimum version (Windows)

Module: Symantec Product Info

Supported Platforms: Windows 2000, Windows 2003, Windows XP

This check reports if the installed version of pcAnywhere is less than the minimum specified in the value field.

The following table lists the error messages for the check.

Table: Error messages for Minimum version

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: PCA_MIN_VERSION

Category: Policy Compliance

  • Windows 2000 (109911)

  • Windows 2003 (209911)

  • Windows XP (204911)

Title: pcAnywhere version too low

Description:The installed version of pcAnywhere is lower than the value specified.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: PCA_NOT_INSTALLED

Category: Policy Compliance

  • Windows 2000 (109912)

  • Windows 2003 (209912)

  • Windows XP (204912)

Title: pcAnywhere not installed

Description:pcAnywhere is not installed on the agent machine.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Normal termination (Windows)

Module: Symantec Product Info

Supported Platforms: Windows 2000, Windows 2003, Windows XP

This check reports pcAnywhere hosts that are not configured to handle normal terminations using one of the methods enabled in the name list.

The following table lists the error messages for the check.

Table: Error messages for Normal termination

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: PCA_NORMAL_TERM

Category: Policy Compliance

  • Windows 2000 (109091)

  • Windows 2003 (209091)

  • Windows XP (204091)

Title: Forbidden normal termination mechanism

Description:The listed pcAnywhere host is configured to handle normal terminations using a forbidden method.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: PCA_NOT_INSTALLED

Category: Policy Compliance

  • Windows 2000 (109912)

  • Windows 2003 (209912)

  • Windows XP (204912)

Title: pcAnywhere not installed

Description:pcAnywhere is not installed on the agent machine.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Norton AntiVirus (Windows)

Module: Symantec Product Info

Supported Platforms: Windows 2000, Windows XP

This header identifies checks that examine Norton AntiVirus settings.


Password required to execute (Windows)

Module: Symantec Product Info

Supported Platforms: Windows 2000, Windows 2003, Windows XP

This check reports pcAnywhere hosts that do not require a password to execute.

The following table lists the error messages for the check.

Table: Error messages for Password required to execute

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: PCA_EXEC_ALLOWED

Category: Policy Compliance

  • Windows 2000 (109085)

  • Windows 2003 (209085)

  • Windows XP (204085)

Title: pcAnywhere host executable without password

Description:The listed pcAnywhere host is not configured to require a password for executing.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: PCA_NOT_INSTALLED

Category: Policy Compliance

  • Windows 2000 (109912)

  • Windows 2003 (209912)

  • Windows XP (204912)

Title: pcAnywhere not installed

Description:pcAnywhere is not installed on the agent machine.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Password required to modify (Windows)

Module: Symantec Product Info

Supported Platforms: Windows 2000, Windows 2003, Windows XP

This check reports pcAnywhere hosts that do not require a password to modify properties.

The following table lists the error messages for the check.

Table: Error messages for Password required to modify

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: PCA_MODIFY_ALLOWED

Category: Policy Compliance

  • Windows 2000 (109084)

  • Windows 2003 (209084)

  • Windows XP (204084)

Title: pcAnywhere host modifiable without password

Description:The listed pcAnywhere host is not configured to require a password for modifying.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: PCA_NOT_INSTALLED

Category: Policy Compliance

  • Windows 2000 (109912)

  • Windows 2003 (209912)

  • Windows XP (204912)

Title: pcAnywhere not installed

Description:pcAnywhere is not installed on the agent machine.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Password required to view (Windows)

Module: Symantec Product Info

Supported Platforms: Windows 2000, Windows 2003, Windows XP

This check reports pcAnywhere hosts that do not require a password to view properties.

The following table lists the error messages for the check.

Table: Error messages for Password required to view

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: PCA_VIEW_ALLOWED

Category: Policy Compliance

  • Windows 2000 (109083)

  • Windows 2003 (209083)

  • Windows XP (204083)

Title: pcAnywhere host viewable without password

Description:The listed pcAnywhere host is not configured to require a password for viewing.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: PCA_NOT_INSTALLED

Category: Policy Compliance

  • Windows 2000 (109912)

  • Windows 2003 (209912)

  • Windows XP (204912)

Title: pcAnywhere not installed

Description:pcAnywhere is not installed on the agent machine.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Prompt to confirm connection (Windows)

Module: Symantec Product Info

Supported Platforms: Windows 2000, Windows 2003, Windows XP

This check reports pcAnywhere hosts that are not configured to prompt to confirm connections, or that have a prompt timeout value greater than the maximum specified in the value field.

The following table lists the error messages for the check.

Table: Error messages for Prompt to confirm connection

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: PCA_NO_PROMPT

Category: Policy Compliance

  • Windows 2000 (109094)

  • Windows 2003 (209094)

  • Windows XP (204094)

Title: Host does not prompt to confirm connection

Description:The listed pcAnywhere host is not configured to prompt to confirm connections.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: PCA_PROMPT_TIMEOUT

Category: Policy Compliance

  • Windows 2000 (109095)

  • Windows 2003 (209095)

  • Windows XP (204095)

Title: Timeout after prompt too long

Description:The listed pcAnywhere host is configured to use a timeout larger than the value specified.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: PCA_NOT_INSTALLED

Category: Policy Compliance

  • Windows 2000 (109912)

  • Windows 2003 (209912)

  • Windows XP (204912)

Title: pcAnywhere not installed

Description:pcAnywhere is not installed on the agent machine.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Record event log locally (Windows)

Module: Symantec Product Info

Supported Platforms: Windows 2000, Windows 2003, Windows XP

This check reports if pcAnywhere is not configured to record log entries locally.

The following table lists the error messages for the check.

Table: Error messages for Record event log locally

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: PCA_NO_LOCAL_LOG_EVT

Category: Policy Compliance

  • Windows 2000 (109074)

  • Windows 2003 (209074)

  • Windows XP (204074)

Title: No local pcAnywhere event log

Description:pcAnywhere event logging is not configured to store logs locally.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: PCA_NOT_INSTALLED

Category: Policy Compliance

  • Windows 2000 (109912)

  • Windows 2003 (209912)

  • Windows XP (204912)

Title: pcAnywhere not installed

Description:pcAnywhere is not installed on the agent machine.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Record event log on server (Windows)

Module: Symantec Product Info

Supported Platforms: Windows 2000, Windows 2003, Windows XP

This check reports if pcAnywhere is not configured to record NT event log entries on a central server, or if it is configured to log events on a server that is not included in the name list. Use the namelist to include valid servers by their UNC path.

The following table lists the error messages for the check.

Table: Error messages for Record event log on server

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: PCA_NO_SERVER_LOG_EVT

Category: Policy Compliance

  • Windows 2000 (109072)

  • Windows 2003 (209072)

  • Windows XP (204072)

Title: pcAnywhere not logging events on remote server

Description:pcAnywhere is not configured to store event log data on a remote server.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: PCA_FORBIDDEN_SERVER_EVT

Category: Policy Compliance

  • Windows 2000 (109073)

  • Windows 2003 (209073)

  • Windows XP (204073)

Title: pcAnywhere event log on unapproved server

Description:pcAnywhere is configured to store event log data on an unapproved server.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: PCA_NOT_INSTALLED

Category: Policy Compliance

  • Windows 2000 (109912)

  • Windows 2003 (209912)

  • Windows XP (204912)

Title: pcAnywhere not installed

Description:pcAnywhere is not installed on the agent machine.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Record log locally (Windows)

Module: Symantec Product Info

Supported Platforms: Windows 2000, Windows 2003, Windows XP

This check reports if pcAnywhere is not configured to record log entries locally.

The following table lists the error messages for the check.

Table: Error messages for Record log locally

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: PCA_NO_LOCAL_LOG_PCA

Category: Policy Compliance

  • Windows 2000 (109070)

  • Windows 2003 (209070)

  • Windows XP (204070)

Title: No local pcAnywhere log

Description:pcAnywhere logging is not configured to store logs locally.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: PCA_NOT_INSTALLED

Category: Policy Compliance

  • Windows 2000 (109912)

  • Windows 2003 (209912)

  • Windows XP (204912)

Title: pcAnywhere not installed

Description:pcAnywhere is not installed on the agent machine.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Record log on server (Windows)

Module: Symantec Product Info

Supported Platforms: Windows 2000, Windows 2003, Windows XP

This check reports if pcAnywhere is not configured to record log entries on a central server, or if it is configured to log events on a server that is not included in the name list. Use the namelist to include/exclude valid servers by their UNC path.

The following table lists the error messages for the check.

Table: Error messages for Record log on server

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: PCA_NO_SERVER_LOG_PCA

Category: Policy Compliance

  • Windows 2000 (109068)

  • Windows 2003 (209068)

  • Windows XP (204068)

Title: pcAnywhere not storing log on remote server

Description:pcAnywhere logging is not configured to store log files on a remote server.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: PCA_FORBIDDEN_SERVER_PCA

Category: Policy Compliance

  • Windows 2000 (109069)

  • Windows 2003 (209069)

  • Windows XP (204069)

Title: pcAnywhere log on unapproved server

Description:pcAnywhere is configured to store log files on an unapproved server.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: PCA_NOT_INSTALLED

Category: Policy Compliance

  • Windows 2000 (109912)

  • Windows 2003 (209912)

  • Windows XP (204912)

Title: pcAnywhere not installed

Description:pcAnywhere is not installed on the agent machine.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Remotes w/ different algorithm (Windows)

Module: Symantec Product Info

Supported Platforms: Windows 2000, Windows 2003, Windows XP

This check reports pcAnywhere hosts that are not configured to deny connections from remotes requesting a different encryption algorithm

The following table lists the error messages for the check.

Table: Error messages for Remotes w/ different algorithm

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: PCA_ENCRYPTION_DIFF_ALG

Category: Policy Compliance

  • Windows 2000 (109082)

  • Windows 2003 (209082)

  • Windows XP (204082)

Title: pcAnywhere host allowing different encryption algorithms

Description:The listed pcAnywhere host is not configured to refuse connections form remotes using a different encryption algorithm.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: PCA_NOT_INSTALLED

Category: Policy Compliance

  • Windows 2000 (109912)

  • Windows 2003 (209912)

  • Windows XP (204912)

Title: pcAnywhere not installed

Description:pcAnywhere is not installed on the agent machine.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Remotes with lower encryption (Windows)

Module: Symantec Product Info

Supported Platforms: Windows 2000, Windows 2003, Windows XP

This check reports pcAnywhere hosts that are not configured to deny connections from remotes requesting a lower encryption level.

The following table lists the error messages for the check.

Table: Error messages for Remotes with lower encryption

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: PCA_LOWER_ENCRYPTION

Category: Policy Compliance

  • Windows 2000 (109081)

  • Windows 2003 (209081)

  • Windows XP (204081)

Title: pcAnywhere host allowing insecure connections

Description:The listed pcAnywhere host is not configured to refuse connections from remotes requesting a lower encryption level.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: PCA_NOT_INSTALLED

Category: Policy Compliance

  • Windows 2000 (109912)

  • Windows 2003 (209912)

  • Windows XP (204912)

Title: pcAnywhere not installed

Description:pcAnywhere is not installed on the agent machine.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


SNMP traps enabled (Windows)

Module: Symantec Product Info

Supported Platforms: Windows 2000, Windows 2003, Windows XP

This check reports if pcAnywhere is not configured to enable SNMP traps, or if it is configured to use a trap destination that is not included in the name list. Use the name list to include/exclude destinations by IP address.

The following table lists the error messages for the check.

Table: Error messages for SNMP traps enabled

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: PCA_SNMP_DISABLED

Category: Policy Compliance

  • Windows 2000 (109076)

  • Windows 2003 (209076)

  • Windows XP (204076)

Title: pcAnywhere SNMP disabled

Description:pcAnywhere is not configured to use SNMP traps.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: PCA_FORBIDDEN_DESTINATION

Category: Policy Compliance

  • Windows 2000 (109077)

  • Windows 2003 (209077)

  • Windows XP (204077)

Title: Forbidden pcAnywhere SNMP trap destination found

Description:pcAnywhere SNMP traps are configured to include a forbidden destination.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: PCA_NOT_INSTALLED

Category: Policy Compliance

  • Windows 2000 (109912)

  • Windows 2003 (209912)

  • Windows XP (204912)

Title: pcAnywhere not installed

Description:pcAnywhere is not installed on the agent machine.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Scan frequency (Windows)

Module: Symantec Product Info

Supported Platforms: Windows 2000, Windows XP

This check reports a problem if a Norton AntiVirus scan has not been performed within the required number of days.

The following table lists the error messages for the check.

Table: Error messages for Scan frequency

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_AV_LASTSCAN_VIOLATION

Category: Policy Compliance

  • Windows 2000 (109053)

  • Windows XP (204053)

Title: Norton AntiVirus scan overdue

Description:Norton AntiVirus has not completed a virus scan within the number of days required by your policy.

Severity: yellow-3

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_AV_NOT_INSTALLED

Category: Policy Compliance

  • Windows 2000 (109051)

  • Windows XP (204051)

Title: Norton Antivirus not installed

Description:This system does not have Norton AntiVirus installed.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Scan frequency (Windows)

Module: Symantec Product Info

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports a problem if a Symantec AntiVirus Corporate Edition scan has not been performed within the required number of days.

The following table lists the error messages for the check.

Table: Error messages for Scan frequency

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_AVCE_LASTSCAN_VIOLATION

Category: Policy Compliance

  • Windows 2000 (109057)

  • Windows 2003 (209057)

  • Windows 2008 (252057)

  • Windows Vista (232057)

  • Windows XP (204057)

Title: Symantec AntiVirus Corporate Edition scan overdue

Description:Symantec AntiVirus Corporate Edition has not completed a virus scan within the number of days required by your policy.

Severity: yellow-3

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_AVCE_NOT_INSTALLED

Category: Policy Compliance

  • Windows 2000 (109055)

  • Windows 2003 (209055)

  • Windows 2008 (252055)

  • Windows Vista (232055)

  • Windows XP (204055)

Title: Symantec AntiVirus Corporate Edition not installed

Description:This system does not have Symantec AntiVirus Corporate Edition installed.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Secure abnormal termination (Windows)

Module: Symantec Product Info

Supported Platforms: Windows 2000, Windows 2003, Windows XP

This check reports pcAnywhere hosts that are not configured to secure abnormal terminations using one of the methods enabled in the name list.

The following table lists the error messages for the check.

Table: Error messages for Secure abnormal termination

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: PCA_UNSECURE_ABNORMAL_TERM

Category: Policy Compliance

  • Windows 2000 (109089)

  • Windows 2003 (209089)

  • Windows XP (204089)

Title: Forbidden abnormal termination security

Description:The listed pcAnywhere host is configured to use a forbidden moethod for securing an abnormal termination.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: PCA_NOT_INSTALLED

Category: Policy Compliance

  • Windows 2000 (109912)

  • Windows 2003 (209912)

  • Windows XP (204912)

Title: pcAnywhere not installed

Description:pcAnywhere is not installed on the agent machine.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Secure after connection (Windows)

Module: Symantec Product Info

Supported Platforms: Windows 2000, Windows 2003, Windows XP

This check reports pcAnywhere hosts that are not configured to secure the workstation after connection using one of the methods enabled in the name list.

The following table lists the error messages for the check.

Table: Error messages for Secure after connection

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: PCA_SECURE_CONNECTION

Category: Policy Compliance

  • Windows 2000 (109098)

  • Windows 2003 (209098)

  • Windows XP (204098)

Title: Host uses forbidden connection security

Description:The listed pcAnywhere host is configured to use a forbidden moethod to secure the workstation after connection.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: PCA_NOT_INSTALLED

Category: Policy Compliance

  • Windows 2000 (109912)

  • Windows 2003 (209912)

  • Windows XP (204912)

Title: pcAnywhere not installed

Description:pcAnywhere is not installed on the agent machine.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Secure normal termination (Windows)

Module: Symantec Product Info

Supported Platforms: Windows 2000, Windows 2003, Windows XP

This check reports pcAnywhere hosts that are not configured to secure normal terminations using one of the methods enabled in the name list.

The following table lists the error messages for the check.

Table: Error messages for Secure normal termination

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: PCA_UNSECURE_NORMAL_TERM

Category: Policy Compliance

  • Windows 2000 (109092)

  • Windows 2003 (209092)

  • Windows XP (204092)

Title: Forbidden normal termination security

Description:The listed pcAnywhere host is configured to use a forbidden method for securing a normal termination.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: PCA_NOT_INSTALLED

Category: Policy Compliance

  • Windows 2000 (109912)

  • Windows 2003 (209912)

  • Windows XP (204912)

Title: pcAnywhere not installed

Description:pcAnywhere is not installed on the agent machine.

Severity: yellow-2

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Symantec AntiVirus Corporate Edition (Windows)

Module: Symantec Product Info

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This header identifies checks that examine Symantec AntiVirus Corporate Edition settings.


Symantec pcAnywhere (Windows)

Module: Symantec Product Info

Supported Platforms: Windows 2000, Windows 2003, Windows XP

This header identifies checks that examine Symantec pcAnywhere settings.


System Auditing module

This section includes the following topics:

  • About the System Auditing module

  • Supported operating systems: System Auditing

  • Application event log size (Windows)

  • Application events do not overwrite Application log (Windows)

  • Archive Application events log when full (Windows)

  • Archive Security event log when full (Windows)

  • Archive System event log when full (Windows)

  • Days until Application events are overwritten (Windows)

  • Days until security events are overwritten (Windows)

  • Days until system events are overwritten (Windows)

  • Guest access to event logs (Windows)

  • Security event log size (Windows)

  • Security events do not overwrite security log (Windows)

  • Security events failure auditing (Windows)

  • Security events success auditing (Windows)

  • System event log size (Windows)

  • System events do not overwrite system log (Windows)

  • System halts when security log full (Windows)


About the System Auditing module

The System Auditing module reports the security events that are audited for failure or success and what happens when the log file is full.

System auditing helps you identify unauthorized users and provides valuable tracking information during or after a break-in.

Some checks report messages that you can use to update template or snapshot files to match current agent settings. Other checks report the messages that you can use to reverse agent settings or disable user accounts. Updatable and correctable messages are identified as TU, SU, or C type messages in the descriptions of checks that use them.


Supported operating systems: System Auditing

The System Auditing module is supported on the following operating systems:

  • Windows 2000

  • Windows 2003

  • Windows 2008

  • Windows Vista

  • Windows XP


Application event log size (Windows)

Module: System Auditing

Supported Platforms: Windows 2000, Windows 2003, Windows XP, Windows Vista, Windows 2008

This check reports a problem when the maximum size of the application event log is less than the specified log size in kilobytes.

The following table lists the error message for the check.

Table: Error message for Application event log size

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_APP_LOG_SIZE_SMALL

Category: Policy Compliance

  • Windows 2000 (106136)

  • Windows 2003 (206136)

  • Windows XP (201136)

Title: Application event log size is too small

Description:The maximum size of the application event log is smaller than the size that is specified in your Symantec ESM policy. Information in the application event log can be overwritten sooner than expected.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Log size: %s kilobytes; expected: %s kilobytes]


Application events do not overwrite Application log (Windows)

Module: System Auditing

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports a problem when the system can overwrite the Application event log.

The following table lists the error message for the check.

Table: Error message for Application events do not overwrite Application log

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_LOG_OVERWRITE_APPLN

Category: Policy Compliance

  • Windows 2000 (106144)

  • Windows 2003 (206144)

  • Windows 2008 (249144)

  • Windows Vista (229144)

  • Windows XP (201144)

Title: Application event log will be overwritten

Description:The application event log is set to permit overwriting. Information in the application event log can be lost.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Archive Application events log when full (Windows)

Module: System Auditing

Supported Platforms: Windows 2008, Windows Vista

This check reports a problem when application event log entries can be overwritten and if logs are not archived when it is full.

The following table lists the error message for the check.

Table: Error message for Archive Application events log when full

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_LOG_OVERWRITE_ARCHIVE_APPLN

Category: Policy Compliance

  • Windows 2008 (249146)

  • Windows Vista (229146)

Title: Application events do not archive logs when it is full

Description:The application event log is not set to permit archival. The logs will not be archived when it is full.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Archive Security event log when full (Windows)

Module: System Auditing

Supported Platforms: Windows 2008, Windows Vista

This check reports a problem when security event log entries can be overwritten and if logs are not archived when it is full.

The following table lists the error message for the check.

Table: Error message for Archive Security event log when full

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_LOG_OVERWRITE_ARCHIVE_SEC

Category: Policy Compliance

  • Windows 2008 (249147)

  • Windows Vista (229147)

Title: Security events do not archive logs when it is full

Description:The security event log is not set to permit archival. The logs will not be archived when it is full.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Archive System event log when full (Windows)

Module: System Auditing

Supported Platforms: Windows 2008, Windows Vista

This check reports a problem when system event log entries can be overwritten and if logs are not archived when it is full.

The following table lists the error message for the check.

Table: Error message for Archive System event log when full

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_LOG_OVERWRITE_ARCHIVE_SYS

Category: Policy Compliance

  • Windows 2008 (249148)

  • Windows Vista (229148)

Title: System events do not archive logs when it is full

Description:The system event log is not set to permit archival. The logs will not be archived when it is full.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Days until Application events are overwritten (Windows)

Module: System Auditing

Supported Platforms: Windows 2000, Windows 2003, Windows XP

This check reports a problem when Application event log entries can be overwritten before a specified number of days has passed.

The following table lists the error message for the check.

Table: Error message for Days until Application events are overwritten

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_LOG_TIME_TO_OVERWRT_SHORT_APPLN

Category: Policy Compliance

  • Windows 2000 (106142)

  • Windows 2003 (206142)

  • Windows XP (201142)

Title: Application event log will be overwritten too soon

Description:The Application event log can be overwritten sooner than specified in your Symantec ESM policy. Information in the Application event log can be lost.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Overwrite time: %s days; expected: %s days]


Days until security events are overwritten (Windows)

Module: System Auditing

Supported Platforms: Windows 2000, Windows 2003, Windows XP

This check reports a problem when security event log entries can be overwritten before a specified number of days has passed.

The following table lists the error message for the check.

Table: Error message for Days until security events are overwritten

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_LOG_TIME_TO_OVERWRITE_TOO_SHORT

Category: Policy Compliance

  • Windows 2000 (106133)

  • Windows 2003 (206133)

  • Windows XP (201133)

Title: Security event log will be overwritten too soon

Description:The security event log can be overwritten sooner than specified in your Symantec ESM policy. Information in the security event log can be lost.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Overwrite time: %s days; expected: %s days]


Days until system events are overwritten (Windows)

Module: System Auditing

Supported Platforms: Windows 2000, Windows 2003, Windows XP

This check reports a problem when system event log entries can be overwritten before a specified number of days has passed.

The following table lists the error message for the check.

Table: Error message for Days until system events are overwritten

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_LOG_TIME_TO_OVERWRT_SHORT_SYS

Category: Policy Compliance

  • Windows 2000 (106143)

  • Windows 2003 (206143)

  • Windows XP (201143)

Title: System event log will be overwritten too soon

Description:The system event log can be overwritten sooner than specified in your Symantec ESM policy. Information in the system event log can be lost.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Overwrite time: %s days; expected: %s days]


Guest access to event logs (Windows)

Module: System Auditing

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports a problem when the Guest account can access the security, application, or system event log files.

The following table lists the error message for the check.

Table: Error message for Guest access to event logs

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_EVENTLOG_RESTRICT_ACCESS

Category: Policy Compliance

  • Windows 2000 (106138)

  • Windows 2003 (206138)

  • Windows 2008 (249138)

  • Windows Vista (229138)

  • Windows XP (201138)

Title: Guest can access event logs

Description:The Guest account can access the security, application, or system event log files.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Security event log size (Windows)

Module: System Auditing

Supported Platforms: Windows 2000, Windows 2003, Windows XP, Windows Vista, Windows 2008

This check reports a problem when the maximum size of the security event log is less than the specified log size in kilobytes.

The following table lists the error message for the check.

Table: Error message for Security event log size

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_LOG_SIZE_SMALL

Category: Policy Compliance

  • Windows 2000 (106132)

  • Windows 2003 (206132)

  • Windows XP (201132)

Title: Security event log size is too small

Description:The maximum size of the security event log is smaller than the size that is specified in your Symantec ESM policy. Information in the security event log can be overwritten sooner than expected.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Log size: %s kilobytes; expected: %s kilobytes]


Security events do not overwrite security log (Windows)

Module: System Auditing

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports a problem when the system can overwrite the security event log.

The following table lists the error message for the check.

Table: Error message for Security events do not overwrite security log

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_LOG_OVERWRITE

Category: Policy Compliance

  • Windows 2000 (106134)

  • Windows 2003 (206134)

  • Windows 2008 (249134)

  • Windows Vista (229134)

  • Windows XP (201134)

Title: Security event log will be overwritten

Description:The security event log is set to permit overwriting. Information in the security event log can be lost.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Security events failure auditing (Windows)

Module: System Auditing

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check verifies that specified, failed security events are being audited. Use the Keys lists to specify which failed security events should be audited.

The following table lists the error messages for the check.

Table: Error messages for Security events failure auditing

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_SEC_EVENT_AUDIT_NOT_ENABLED

Category: Policy Compliance

  • Windows 2000 (106130)

  • Windows 2003 (206130)

  • Windows 2008 (249130)

  • Windows Vista (229130)

  • Windows XP (201130)

Title: Security event auditing is not enabled

Description:Security event auditing is not enabled. Audit trails will not be generated. Enable security event auditing to be able to track unauthorized users during or after a break-in.

Severity: red-4

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_SEC_EVENT_SETTING_TOO_WEAK

Category: Policy Compliance

  • Windows 2000 (106131)

  • Windows 2003 (206131)

  • Windows 2008 (249131)

  • Windows Vista (229131)

  • Windows XP (201131)

Title: Security event audit settings are too weak

Description:Security event audit settings are weaker than those specified in your Symantec ESM security policy. Some actions on this system will not be audited unless the related action settings are enabled. Change the event audit settings to match the policy.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Security events success auditing (Windows)

Module: System Auditing

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check verifies that specified, successful security events are being audited. Use the Keys lists to specify which successful security events should be audited.

The following table lists the error messages for the check.

Table: Error messages for Security events success auditing

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_SEC_EVENT_AUDIT_NOT_ENABLED

Category: Policy Compliance

  • Windows 2000 (106130)

  • Windows 2003 (206130)

  • Windows 2008 (249130)

  • Windows Vista (229130)

  • Windows XP (201130)

Title: Security event auditing is not enabled

Description:Security event auditing is not enabled. Audit trails will not be generated. Enable security event auditing to be able to track unauthorized users during or after a break-in.

Severity: red-4

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: ESM_SEC_EVENT_SETTING_TOO_WEAK

Category: Policy Compliance

  • Windows 2000 (106131)

  • Windows 2003 (206131)

  • Windows 2008 (249131)

  • Windows Vista (229131)

  • Windows XP (201131)

Title: Security event audit settings are too weak

Description:Security event audit settings are weaker than those specified in your Symantec ESM security policy. Some actions on this system will not be audited unless the related action settings are enabled. Change the event audit settings to match the policy.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


System event log size (Windows)

Module: System Auditing

Supported Platforms: Windows 2000, Windows 2003, Windows XP, Windows Vista, Windows 2008

This check reports a problem when the maximum size of the system event log is less than the specified log size in kilobytes.

The following table lists the error message for the check.

Table: Error message for System event log size

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_SYS_LOG_SIZE_SMALL

Category: Policy Compliance

  • Windows 2000 (106137)

  • Windows 2003 (206137)

  • Windows XP (201137)

Title: System event log size is too small

Description:The maximum size of the system event log is smaller than the size that is specified in your Symantec ESM policy. Information in the system event log can be overwritten sooner than expected.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Log size: %s kilobytes; expected: %s kilobytes]


System events do not overwrite system log (Windows)

Module: System Auditing

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports a problem when the system can overwrite the system event log.

The following table lists the error message for the check.

Table: Error message for System events do not overwrite system log

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_LOG_OVERWRITE_SYS

Category: Policy Compliance

  • Windows 2000 (106145)

  • Windows 2003 (206145)

  • Windows 2008 (249145)

  • Windows Vista (229145)

  • Windows XP (201145)

Title: System event log will be overwritten

Description:The system event log is set to permit overwriting. Information in the system event log can be lost.

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


System halts when security log full (Windows)

Module: System Auditing

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This check reports a problem when the system does not halt when the security event log is full.

The following table lists the error message for the check.

Table: Error message for System halts when security log full

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_LOG_FULL_SYSTEM_NO_HALT

Category: Policy Compliance

  • Windows 2000 (106135)

  • Windows 2003 (206135)

  • Windows 2008 (249135)

  • Windows Vista (229135)

  • Windows XP (201135)

Title: System does not halt when security event log full

Description:The system does not halt when the security log is full. The system can continue to be used without recording any new audits. To set the system to halt when the log is full, change the following value to 1 in the registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\CrashOnAuditFail

Severity: yellow-1

Correctable: true

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]


Section II. Symantec ESM checks for UNIX

Symantec ESM checks for UNIX

This section includes the following topics:

  • Account Integrity module
  • Agent Information module
  • Discovery module
  • File Access module
  • File Attributes module
  • File Find module
  • File Watch module
  • Integrated Command Engine module
  • Login Parameters module
  • Network Integrity module
  • OS Patches module
  • Object Integrity module
  • Password Strength module
  • Startup Files module
  • System Auditing module
  • System Mail module
  • System Queues module
  • User Files module


Account Integrity module

This section includes the following topics:

  • About the Account Integrity module

  • Accounts can be locked (UNIX)

  • Accounts should be disabled (UNIX)

  • Automatically update snapshots (UNIX)

  • Changed accounts (UNIX)

  • Changed groups (UNIX)

  • Deleted accounts (UNIX)

  • Deleted groups (UNIX)

  • Disabled accounts (UNIX)

  • Disallowed home directory (UNIX)

  • Disallowed home directory (cont'd) (UNIX)

  • Duplicate IDs (UNIX)

  • Excessive number of accounts (UNIX)

  • General information field required (UNIX)

  • Group IDs (UNIX)

  • Home directories (UNIX)

  • Home directory permissions (UNIX)

  • Illegal login shells (UNIX)

  • List of users (UNIX)

  • Local accounts/groups only (UNIX)

  • Local disks only (UNIX)

  • Login shell owners (UNIX)

  • Login shell permissions (UNIX)

  • Maximum reported messages (UNIX)

  • New accounts (UNIX)

  • New groups (UNIX)

  • Non-executable login shells (UNIX)

  • Nonexistent login shells (UNIX)

  • Options always checked for all accounts and groups: (UNIX)

  • Password in /etc/passwd (UNIX)

  • Remote-only accounts (UNIX)

  • Report RBAC attributes not in template (UNIX)

  • Reserved GID ranges (UNIX)

  • Reserved UID/GID (UNIX)

  • Reserved UID ranges (UNIX)

  • Role based access (UNIX)

  • Role based access (cont'd) (UNIX)

  • Setgid login shells (UNIX)

  • Setuid login shells (UNIX)

  • User shell compliance (UNIX)

  • Users to check (UNIX)

  • /etc/passwd syntax (UNIX)


Accounts can be locked (UNIX)

Module: Account Integrity

This check reports user accounts that can be locked due to consecutive unsuccessful login attempts because the maximum number of retry failures is not set to 0. Note that this check is not intended for normal user accounts but only for system accounts, such as root. The check is supported only on AIX 4.x+, Linux, Solaris 8+, HPUX 10.x+, and OSF1 operating systems. The name list lets you specify the accounts that are examined by the check (the Users to check option does not apply).

The following table lists the error messages for the check.

Table: Error messages for Accounts can be locked

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_ACCOUNT_LOCKED_OUT Category: ESM Administrative Information | UNIX (5172) | Title: Accounts can be locked out Description:The listed accounts will be locked if consecutive unsuccessful login attempts exceed a maximum number of retry failures that is greater than "0." To prevent the root account from being locked, set the maximum number of login retries to "0" for the root user. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NOTSUPPORT_LOCKED_ACCOUNTS Category: ESM Administrative Information | UNIX (5181) | Title: Accounts can be locked out not supported Description:The agent does not support the check for Accounts can be locked out. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Accounts should be disabled (UNIX)

Module: Account Integrity

This check examines login shells, passwords, and the .rhosts file to identify and report user accounts that should be, but are not, disabled. Use the check's name list to include users such as bin and adm in the check. If you also enable the check, Disabled accounts, that check will automatically exclude the user accounts that are included for this check.

The following table lists the error message for the check.

Table: Error message for Accounts should be disabled

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_NOT_DISABLED Category: ESM Administrative Information | UNIX (5166) | Title: Account not disabled Description:The named accounts should be, but are not, disabled. You should disable these accounts. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Automatically update snapshots (UNIX)

Module: Account Integrity

Enable this option to automatically update snapshots with current information.


Changed accounts (UNIX)

Module: Account Integrity

This check reports user accounts that were changed after the last user snapshot update. Reported changes include user id, group id, home directory, login shell, and GECOS field.

The following table lists the error message for the check.

Table: Error message for Changed accounts

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_CHGUSER Category: ESM Administrative Information | UNIX (5161) | Title: Changed user account Description:The listed accounts have changed on your system since the last time the Symantec ESM user snapshot was updated. If these accounts were not changed by the system administrator, they could represent a security breach. Check all account changes to be sure they are authorized. Then update your snapshot to include all authorized changes. | Severity: yellow-1 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]


Changed groups (UNIX)

Module: Account Integrity

This check reports groups that were changed after the last group snapshot update. Reported changes include group id and group membership.

The following table lists the error message for the check.

Table: Error message for Changed groups

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_CHGGROUP Category: ESM Administrative Information | UNIX (5164) | Title: Changed system group Description:The listed groups have been changed on your system since the last time the Symantec ESM group snapshot was updated. If these group changes were not made by the system administrator, they could represent a security breach. Check all group changes to be sure they are authorized. Then update your snapshot to include all authorized changes. | Severity: yellow-1 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]


Deleted accounts (UNIX)

Module: Account Integrity

This check reports accounts that were deleted after the last user snapshot update.

The following table lists the error message for the check.

Table: Error message for Deleted accounts

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_DELUSER Category: ESM Administrative Information | UNIX (5160) | Title: Deleted user account Description:The listed have been deleted from your system since the last time the Symantec ESM user snapshot was updated. If these accounts were not deleted by the system administrator, they could represent a security breach. Check all the account deletions to be sure they are authorized. Then update your snapshot to reflect all authorized deletions. | Severity: green-0 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]


Deleted groups (UNIX)

Module: Account Integrity

This check reports groups that were deleted after the last group snapshot update.

The following table lists the error message for the check.

Table: Error message for Deleted groups

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_DELGROUP Category: ESM Administrative Information | UNIX (5163) | Title: Deleted system group Description:The listed groups have been deleted from your system since the last time the Symantec ESM group snapshot was updated. If these groups were not deleted by the system administrator, they could represent a security breach. Check all the group deletions to be sure they are authorized. Then update your snapshot to reflect all authorized deletions. | Severity: green-0 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]


Disabled accounts (UNIX)

Module: Account Integrity

This check examines login shells, passwords, and the .rhosts file to identify and report user accounts that are disabled. An account may be accessed remotely via rlogin, even when the account's password hash is invalid. To prevent this, the account must not have a .rhosts file, or it must be empty. Use the check's name lists to exclude or include accounts for the check. If you also enable the Accounts should be disabled check, the Disabled accounts check will automatically exclude the user accounts included for that check.

The following table lists the error message for the check.

Table: Error message for Disabled accounts

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_DISABLED Category: ESM Administrative Information | UNIX (5140) | Title: Account disabled Description:The named accounts have been disabled. This message provides information but does not require any action on your part. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Disallowed home directory (UNIX)

Module: Account Integrity

This check reports users that are using disallowed directories as their home directories. Use the name list to specify the disallowed directories that are reported by the check.

The following table lists the error message for the check.

Table: Error message for Disallowed home directory

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_USINGHOMEDIR Category: ESM Administrative Information | UNIX (5168) | Title: Disallowed home directory Description:The listed accounts are using disallowed directories for their home directories. These accounts should be modified to use allowed home directories. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Disallowed home directory (cont'd) (UNIX)

Module: Account Integrity

This option lets you specify the users that are excluded or included for the Disallowed home directory check. The Users to check option does not apply to this check.


Duplicate IDs (UNIX)

Module: Account Integrity

This check reports user IDs (UIDs) that are shared by two or more accounts and group IDs (GIDs) that are shared by two or more groups.

The following table lists the error messages for the check.

Table: Error messages for Duplicate IDs

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_DUPUID Category: ESM Administrative Information | UNIX (5150) | Title: Duplicate UID Description:The user IDs (UIDs) listed below are used in more than one user account. Accounts that share a UID have full access to each other's files. This right should be granted with care to prevent a security breach. You should change the UID of each account to a unique number. You should also change the ownership of the files in each user's home directory to match the new UID. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_DUPGID Category: ESM Administrative Information | UNIX (5151) | Title: Duplicate GID Description:The group IDs (GIDs) listed below are used in more than one group. Groups that share a GID have access to each other's files. This right should be granted with care to prevent a security breach. You should change the GID of each group to a unique number. You should also change the ownership of any files owned by the group to match the new GID. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_DUPROOTUID Category: ESM Administrative Information | UNIX (5176) | Title: Duplicate root UID Description:The reserved user ID (UID) listed below is used in more than one user account. Accounts that share a UID have full access to each other's files. This right should be granted with care to prevent a security breach. You should change the UID of each account to a unique number. You should also change the ownership of the files in each user's home directory to match the new UID. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_DUPROOTGID Category: ESM Administrative Information | UNIX (5177) | Title: Duplicate root GID Description:The reserved group ID (GID) listed below is used in more than one group. Groups that share a GID have access to each other's files. This right should be granted with care to prevent a security breach. You should change the GID of each group to a unique number. You should also change the ownership of any files owned by the group to match the new GID. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Excessive number of accounts (UNIX)

Module: Account Integrity

This check reports a problem if more than the specified number of non-system accounts exists on the agent. This check is for use on systems such as web servers where an excessive number of non-system accounts can be a security risk. You should limit the number of non-system accounts on these systems to the minimum required for them to accomplish their purposes.

The following table lists the error message for the check.

Table: Error message for Excessive number of accounts

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_TOO_MANY_ACCOUNTS Category: ESM Administrative Information | UNIX (5165) | Title: Too Many Accounts Description:The number of non-system accounts on this agent does not comply with your security policy. The number of non-system accounts should be kept to a minimum on web servers and other systems where an excessive number of accounts can be a security risk. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [Number of non-system accounts: %s]


General information field required (UNIX)

Module: Account Integrity

When this option is enabled, the /etc/passwd syntax check reports users with incomplete or invalid entries in the GECOS field. Enable the /etc/passwd syntax check to activate this option.

The following table lists the error message for the check.

Table: Error message for General information field required

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_PASSSYNTAX Category: ESM Administrative Information | UNIX (5169) | Title: /etc/passwd Syntax Error Description:The listed accounts have syntax errors or unfilled entries in the /etc/passwd file. Correct the syntax errors and enter data for all required fields in the /etc/passwd file for these accounts. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Group IDs (UNIX)

Module: Account Integrity

This check reports user accounts that do not have a group ID (GID) listed in the group file.

The following table lists the error message for the check.

Table: Error message for Group IDs

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_NOGROUP Category: ESM Administrative Information | UNIX (5130) | Title: No such group Description:The group IDs specified for the accounts listed below do not exist in the /etc/group file. This is not consistent with the system configuration. You should either change the group ID for each account to one of the groups defined in /etc/group or add the group ID to /etc/group. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Home directories (UNIX)

Module: Account Integrity

This check reports user accounts that do not have home directories and home directories that do not have correct user or group ownerships. Use the check's name list to exclude users that are not already excluded by the Users to check option.

The following table lists the error messages for the check.

Table: Error messages for Home directories

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_NOHOME Category: ESM Administrative Information | UNIX (5142) | Title: Home directory does not exist Description:The listed accounts have home directories that do not exist. This is not consistent with the system configuration. This can also prevent account users from logging in. Either change each account in /etc/passwd to point to a valid directory that is owned by the account or create a home directory for the account with the proper user and group ownership. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_HOMEUID Category: ESM Administrative Information | UNIX (5143) | Title: UID of home directory is incorrect Description:The listed accounts have home directories that do not have the proper user ID (UID) ownership. This is not consistent with the system configuration. Unauthorized users can access these directories, and authorized users can be prevented from creating files in their home directories. Either change each account entry in /etc/passwd to point to a valid directory that is owned by the account or change the user ownership of the home directory to match the account's UID. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_HOMEGID Category: ESM Administrative Information | UNIX (5144) | Title: GID of home directory is incorrect Description:The listed accounts have home directories that do not have the proper group ID (GID) ownership. This is not consistent with the system configuration. Unauthorized users can access these directories, and authorized users can be prevented from creating files in their home directories. Either change each account entry in /etc/passwd to point to a valid directory that is owned by the account or change the user ownership of the home directory to match the account's GID. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_HOMENOTDIR Category: ESM Administrative Information | UNIX (5145) | Title: Not a directory Description:The listed accounts have non-directory files specified as their home directories in /etc/passwd. This is not consistent with the system configuration. Authorized users can be prevented from logging in. You should change each account entry in /etc/passwd to point to a valid directory that is owned by the account. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Home directory permissions (UNIX)

Module: Account Integrity

This check reports users with home directory permissions that are less restrictive than the value specified in your policy. Permissions are specified as a three-digit octal number. Use the name list to include or exclude users for the check (the Users to check option does not apply).

The following table lists the error message for the check.

Table: Error message for Home directory permissions

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_HOMEDIRPERMISSION Category: ESM Administrative Information | UNIX (5171) | Title: Home directory permissions Description:The listed accounts have home directory permissions that exceed the permissions specified in your security policy. You should modify the permissions of the home directories for the specified accounts so the permissions do not exceed the policy value. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Illegal login shells (UNIX)

Module: Account Integrity

This check reports user accounts with login shells that are not listed in the /etc/shells file. Use the check's name list to exclude users that are not already excluded by the Users to check option.

The following table lists the error messages for the check.

Table: Error messages for Illegal login shells

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_NOETCSHELL Category: ESM Administrative Information | UNIX (5131) | Title: /etc/shells does not exist Description:The file /etc/shells does not exist or is not a regular file. Symantec ESM uses this file to check shells on Solaris, HP-UX, and Linux operating systems. On Linux systems that lack this file, chsh(1) does not properly restrict the files that can be used as shells. You should create the /etc/shells file and list all valid shells in that file. Use full path names and list each shell on a new line. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NOLOGIN_CFG Category: ESM Administrative Information | UNIX (5132) | Title: /etc/security/login.cfg does not exist Description:The file /etc/security/login.cfg does not exist. This file is used on AIX operating systems to provide configuration information for login and user authentication. Without this file, users can use unsecured passwords. You should recreate or restore this file immediately. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NOSHELLS Category: ESM Administrative Information | UNIX (5133) | Title: The 'shells' stanza is missing in login.cfg Description:The shells stanza is missing from /etc/security/login.cfg. Symantec ESM uses this stanza to determine which shell can be used by each user account on AIX operating systems. Without this stanza, Symantec ESM cannot perform shell checking. You should add the shells stanza to /etc/security/login.cfg. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NOTASHELL Category: ESM Administrative Information | UNIX (5138) | Title: Shell is not in /etc/shells Description:The shells for the listed accounts are not valid in /etc/shells. Account users may acquire privileges by accessing these shells. Either add the shells to /etc/shells or modify the account entries in /etc/passwd to point to valid shells in /etc/shells. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NOTASHELL_AIX Category: ESM Administrative Information | UNIX (5139) | Title: Shell is not in /etc/security/login.cfg Description:The shells for the listed accounts are not valid in /etc/security/login.cfg. Account users may acquire privileges by accessing these shells. Either add the shells to /etc/security/login.cfg or modify the account entries in /etc/passwd to point to valid shells in /etc/security/login.cfg. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_ETC_SHELLS_EMPTY Category: ESM Administrative Information | UNIX (5175) | Title: /etc/shells file has no shell entries Description:There are no shells listed in the /etc/shells file. Symantec ESM uses this file to determine which shells can be used by each user account on Solaris, HP-UX, and Linux operating systems. When this file is empty, Symantec ESM cannot perform shell checking. You should list all valid shells in this file. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


List of users (UNIX)

Module: Account Integrity

This check lists the users checked by the Account Integrity module. The UID, GID, comment field, home directory, and shell are shown for each user.

The following table lists the error message for the check.

Table: Error message for List of users

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_SHOW Category: ESM Administrative Information | UNIX (5149) | Title: Show user Description:The following user accounts have been checked by Symantec ESM. This message provides information but does not require any action on your part. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Local accounts/groups only (UNIX)

Module: Account Integrity

This option restricts checks to user accounts and groups that are defined in the agent's /etc/passwd and /etc/group files. By selecting this option, you ensure that users are checked only once in sites that serve accounts with NIS.


Local disks only (UNIX)

Module: Account Integrity

This option restricts checks to users with home directories that are located on disks that are local to the system running the check. Selecting this option ensures that user files are checked only once in sites that serve user directories with NFS, even though the module can be run on more than one system.


Login shell owners (UNIX)

Module: Account Integrity

This check reports user accounts with login shells that are not owned by root or bin. Use the check's name list to exclude users that are not already excluded by the Users to check option.

The following table lists the error message for the check.

Table: Error message for Login shell owners

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_SHELL_OWNER Category: ESM Administrative Information | UNIX (5173) | Title: Shell owner Description:The files specified as shells for the named accounts are not owned by root or bin. This is not consistent with the system configuration. You should change the account entries to point to valid shells in /etc/passwd. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Login shell permissions (UNIX)

Module: Account Integrity

This check reports user accounts with login shells that have group or world write permissions. Use the check's name list to exclude users that are not already excluded by the Users to check option.

The following table lists the error message for the check.

Table: Error message for Login shell permissions

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_WRITABLE_SHELL Category: ESM Administrative Information | UNIX (5174) | Title: Writable shell Description:The files specified as shells for the named accounts are writable by group or others. This is not consistent with the system configuration. You should change the account entries to point to valid shells in /etc/passwd. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Maximum reported messages (UNIX)

Module: Account Integrity

Enable this option to limit the number of messages returned for each enabled check. Use the value field to specify the maximum number of times a given message should be displayed. Once the maximum number has been reached for a single message, the message will be displayed once more with the number of repeating instances of the message that are not reported.


New accounts (UNIX)

Module: Account Integrity

This check reports accounts that were added after the last user snapshot update.

The following table lists the error message for the check.

Table: Error message for New accounts

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_NEWUSER Category: ESM Administrative Information | UNIX (5159) | Title: New user account Description:The accounts listed below have been added to your system since the last time the Symantec ESM user snapshot was updated. If these accounts were not added by the system administrator, they may represent a security breach. Check all new accounts to be sure they are authorized. Then update your snapshot to include all authorized accounts. | Severity: yellow-1 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]


New groups (UNIX)

Module: Account Integrity

This check reports groups that were added after the last group snapshot update.

The following table lists the error message for the check.

Table: Error message for New groups

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_NEWGROUP Category: ESM Administrative Information | UNIX (5162) | Title: New system group Description:The listed groups have been added to your system since the last time the Symantec ESM group snapshot was updated. If these groups were not added by the system administrator, they could represent a security breach. Check all new groups to be sure they are authorized. Then update your snapshot to include all authorized group accounts. | Severity: yellow-1 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]


Non-executable login shells (UNIX)

Module: Account Integrity

This check reports user accounts with login shells that are not executable. Use the check's name list to exclude users that are not already excluded by the Users to check option.

The following table lists the error message for the check.

Table: Error message for Non-executable login shells

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_NONEXECSHELL Category: ESM Administrative Information | UNIX (5135) | Title: Non-executable shell Description:The files specified as shells for the listed accounts are not executable. This is not consistent with the system configuration. Also, this can prevent account users from logging in. You should change these accounts to point to valid shells in /etc/passwd. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Nonexistent login shells (UNIX)

Module: Account Integrity

This check reports user accounts with login shells that do not exist on the agent system. Use the check's name list to exclude users that are not already excluded by the Users to check option.

The following table lists the error message for the check.

Table: Error message for Nonexistent login shells

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_NONEXISTSHELL Category: ESM Administrative Information | UNIX (5134) | Title: Non-existent shell Description:The files specified as shells for the listed accounts do not exist. This is not consistent with the system configuration. Also, this can prevent account users from logging in. You should change these accounts to point to valid shells in /etc/passwd. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Options always checked for all accounts and groups: (UNIX)

Module: Account Integrity

The following checks are run for all accounts. These checks are not subject to exclusions and restrictions imposed by the Users to check or Local disks only options.


Password in /etc/passwd (UNIX)

Module: Account Integrity

This check reports users with passwords that are contained in the /etc/passwd file when the system is using, or has access to, shadow files or enhanced security files. Use the name list to exclude users from this check (the Users to check option does not apply).

The following table lists the error message for the check.

Table: Error message for Password in /etc/passwd

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_PASSEXISTED Category: ESM Administrative Information | UNIX (5167) | Title: Password in /etc/passwd Description:Encrypted passwords for the listed accounts exist in the /etc/passwd file even though enhanced security is enabled. You should modify the password entries for these accounts in the /etc/password file, using the proper format for your operating system, to ensure that password data is not stored in the /etc/password file. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Remote-only accounts (UNIX)

Module: Account Integrity

This check examines login shells and passwords to identify and report user accounts that do have disabling passwords but do not have disabling shells and non-empty .rhosts files in their home directories. Such accounts can be accessed by remote login commands such as rsh, rlogin, rfcp, and rcp. Use the check's name list to exclude or include accounts for the check.

The following table lists the error message for the check.

Table: Error message for Remote-only accounts

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_REMOTEONLY Category: ESM Administrative Information | UNIX (5141) | Title: Account is disabled but available remotely Description:Passwords for the named accounts have been disabled, but users can still access the accounts using remote login commands such as rcp, remsh, or rlogin. This requires that the host and user account names match entries in the hosts.equiv file and that a .rhosts file is located in the user's home directory and owned by the user. You should remove the .rhosts file from the user account's home directory and change the account's login shell to a disabling login shell such as /bin/false. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Report RBAC attributes not in template (UNIX)

Module: Account Integrity

Enable this option to report RBAC users, roles, profiles, auths, or execution attributes that are found on the agent but not listed in the template. Attributes can be included or excluded using the name list. Use the Add Attribute button in the template editor to add attributes that are reported by this option.


Reserved GID ranges (UNIX)

Module: Account Integrity

This option lets you specify reserved group ID ranges for different operating systems to be used with the Reserved UID/GID check. If no range is specified for a particular operating system, the default ranges will be used. Entries in this list should be in the format <OS>:<RANGE>, where <OS> is the name of the operating system to use and <RANGE> is one or more user-defined ranges. A colon is used to separate these two values. Possible values for <OS> include AIX, HP-UX, Linux and Solaris. Possible values for <RANGE> include a single value (e.g. AIX:5), a hyphen-separated range of values (e.g. AIX:0-10), or a list of ranges delimited by semicolons (e.g. AIX:0-5;10;15-20).


Reserved UID/GID (UNIX)

Module: Account Integrity

This check reports users and groups with a user ID or group ID within the range reserved for system accounts that could give them super-user privileges or privileged access to system files. Users and groups that are part of the standard operating system distribution are not reported. Use the name list to include or exclude users for the check (the Users to check option does not apply). Use the Reserved UID ranges and Reserved GID ranges options to customize reserved user ID or group ID ranges.

The following table lists the error messages for the check.

Table: Error messages for Reserved UID/GID

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_PRIVUID Category: ESM Administrative Information | UNIX (5152) | Title: Privileged user Description:The listed accounts have user IDs (UIDs) that either make them super-users (UID 0) or allow them to access system files. These accounts are not part of the normal operating system distribution and can represent a security risk. You should remove the access privileges from these accounts by changing the UIDs to larger, unique values. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_PRIVGID Category: ESM Administrative Information | UNIX (5153) | Title: Privileged group Description:The listed groups have group IDs (GIDs) that grant members of the group special access to system files. These groups are not part of the normal operating system distribution and can represent a security risk. You should remove the privileged access from members of these groups by changing the GIDs to larger, unique values. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_SHUTDOWN_PRIV Category: ESM Administrative Information | UNIX (5154) | Title: User has shutdown privileges Description:The listed users have been granted shutdown privileges. This privilege allows the users to disrupt normal system activities and should be granted with care. You should carefully review the list and remove any users who should not have shutdown privileges. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_SHUTDOWN_ANY_SYS Category: ESM Administrative Information | UNIX (5155) | Title: User has shutdown privileges from any system Description:The listed users have been granted shutdown privileges on any system in your cluster. This privilege allows the users to disrupt normal system activities and should be granted with care. You should carefully review the list and remove any users that should not have shutdown privileges. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_SHUTDOWN_ANY_USER Category: ESM Administrative Information | UNIX (5156) | Title: Any user has shutdown privileges from these systems Description:Your system has granted any user shutdown privileges. This privilege allows any user to disrupt normal system activities by initiating a system shutdown. You should assign shutdown privileges only to specific users. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_SHUTDOWN_ANY_SYS_USER Category: ESM Administrative Information | UNIX (5157) | Title: Any user has shutdown privileges from any system Description:All systems on your cluster have granted all users shutdown privileges. This privilege allows any user to disrupt normal system activities by initiating a shutdown. You should assign shutdown privileges only to specific users. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_GRPKERNPRIV Category: ESM Administrative Information | UNIX (5158) | Title: Group has kernel capabilities Description:The listed groups have been assigned one or more kernel capabilities. This is a potential security problem if the group has been assigned any kernel capabilities that are not required by users in the group. You should carefully review the list and remove unnecessary kernel capabilities. For more information, read the man pages for the getprivgrp, setprivgrp, and chown commands. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Reserved UID ranges (UNIX)

Module: Account Integrity

This option lets you specify reserved user ID ranges for different operating systems to be used with the Reserved UID/GID check. If no range is specified for a particular operating system, the default ranges will be used. Entries in this list should be in the format <OS>:<RANGE>, where <OS> is the name of the operating system to use and <RANGE> is one or more user-defined ranges. A colon is used to separate these two values. Possible values for <OS> include AIX, HP-UX, Linux and Solaris. Possible values for <RANGE> include a single value (e.g. AIX:5), a hyphen-separated range of values (e.g. AIX:0-10), or a list of ranges delimited by semicolons (e.g. AIX:0-5;10;15-20).


Role based access (UNIX)

Module: Account Integrity

This check reports role based access configurations that do not match those specified in the enabled templates. This check is available on Solaris 8 or later.

The following table lists the error messages for the check.

Table: Error messages for Role based access

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_RBAC_FORBIDDEN_ATTRIB Category: ESM Administrative Information | UNIX (5178) | Title: Forbidden RBAC attribute found Description:The listed RBAC attribute (user, role, or profile) contains a forbidden auth, execution attribute, profile, or role. The type and name of the forbidden attributes are listed in the information field. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_RBAC_MANDATORY_ATTRIB Category: ESM Administrative Information | UNIX (5179) | Title: Mandatory RBAC attribute not found Description:The listed RBAC attribute (user, role, or profile) does not contain a mandatory auth, execution attribute, profile, or role. The type and name of the mandatory attributes are listed in the information field. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_RBAC_ABSENT_ATTRIB Category: ESM Administrative Information | UNIX (5180) | Title: RBAC attribute not listed in template Description:The listed RBAC attribute (user, role, profile, auth, or execution attribute) was found on the agent, but is not listed in the template. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Role based access (cont'd) (UNIX)

Module: Account Integrity

Use this option to include or exclude RBAC users, roles, or profiles from the Role base access check.


Setgid login shells (UNIX)

Module: Account Integrity

This check reports user accounts with login shells that have setgid privileges. Use the check's name list to exclude users that are not already excluded by the Users to check option.

The following table lists the error message for the check.

Table: Error message for Setgid login shells

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_SETGIDSHELL Category: ESM Administrative Information | UNIX (5137) | Title: Setgid shell Description:The shells for the listed accounts are setgid. Account users have full access to the files owned by this GID while they are logged in. They can setgid to a privileged group such as bin or root to gain nearly unlimited access to the system. Use the chmod command to remove setgid from these shells. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Setuid login shells (UNIX)

Module: Account Integrity

This check reports user accounts with login shells that have setuid privileges. Use the check's name list to exclude users that are not already excluded by the Users to check option.

The following table lists the error message for the check.

Table: Error message for Setuid login shells

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_SETUIDSHELL Category: ESM Administrative Information | UNIX (5136) | Title: Setuid shell Description:The shells for the listed accounts are setuid. Account users have full access to the files owned by this UID while they are logged in. Users can also setuid to a privileged account such as bin or root and get unlimited access to the system. Use the chmod command to remove setuid from these shells. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


User shell compliance (UNIX)

Module: Account Integrity

This check reports users who are using login shells that are not shell compliant according to template file definitions. Use the file list to specify template files for this check (the Users to check option does not apply to this check).

The following table lists the error message for the check.

Table: Error message for User shell compliance

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_NO_SHELLCOMPLIANCE Category: ESM Administrative Information | UNIX (5170) | Title: Shell Compliance Description:The listed accounts are using login shells that do not comply with shell definitions in enabled Shells templates. You should modify the login shell entries for the specified accounts to ensure shell compliance. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Users to check (UNIX)

Module: Account Integrity

This option specifies users and groups that will be excluded or included in security checks that are not defined as "Options always checked for all accounts and groups."


/etc/passwd syntax (UNIX)

Module: Account Integrity

This check looks at the /etc/passwd file and reports users with entries that include syntax errors. Use the name list to exclude users from this check (the Users to check option does not apply).

The following table lists the error message for the check.

Table: Error message for /etc/passwd syntax

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_PASSSYNTAX Category: ESM Administrative Information | UNIX (5169) | Title: /etc/passwd Syntax Error Description:The listed accounts have syntax errors or unfilled entries in the /etc/passwd file. Correct the syntax errors and enter data for all required fields in the /etc/passwd file for these accounts. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Agent Information module

This section includes the following topics:

  • About the Agent Information module

  • Agent Version (UNIX)

  • Agent name (UNIX)

  • CPU Information (UNIX)

  • DNS Setting (UNIX)

  • ESM Application Modules (UNIX)

  • OS Information (UNIX)

  • Registered to Manager (UNIX)

  • SU Version (UNIX)


Agent Version (UNIX)

Module: Agent Information

This check reports the version of the ESM agent.

The following table lists the error messages for the check.

Table: Error messages for Agent Version

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: ESM_FILE_IS_MISSING Category: System Information | UNIX (9329) | Title: File cannot be found Description:There is an Error locating the referenced file. Either it does not exist or it is corrupted. Please see the information field for more details. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: ESM_AGENT_VERSION Category: System Information | UNIX (9334) | Title: Agent Version Description:Please check the information column for the version of installed ESM Agent of the system.It reports the content of the 'version.dat' file found in #esm/bin/#plat directory. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Agent name (UNIX)

Module: Agent Information

This check reports the hostname of ESM agent.

The following table lists the error message for the check.

Table: Error message for Agent name

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: ESM_INSTALLED_AGENT Category: System Information | UNIX (9330) | Title: ESM Agent's Name Description:This is agent name as provided during the ESM agent installation. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


CPU Information (UNIX)

Module: Agent Information

This check reports the Processor type, Number of processors and Processor frequency.

The following table lists the error messages for the check.

Table: Error messages for CPU Information

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: ESM_CPU_INFO Category: System Information | UNIX (9336) | Title: CPU Information Description:It reports number of prccessors, processor type and speed on the systems processors. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: ESM_CPU_PARAM Category: System Information | UNIX (9337) | Title: CPU Parameters Description:It reports the number of processors, name, speed and processor model. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


DNS Setting (UNIX)

Module: Agent Information

This check reports the Domain name and DNS servers of the ESM agent.

The following table lists the error messages for the check.

Table: Error messages for DNS Setting

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: ESM_PRIMARY_DNSSUFFIX Category: System Information | UNIX (9338) | Title: Primary DNS Suffix Description:Specifies the primary Domain Name System (DNS) suffix for the system. The primary DNS suffix is used in DNS name registration and DNS name resolution. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: ESM_DNS_SERVERS Category: System Information | UNIX (9339) | Title: DNS Servers Description:Specifies the list of Domain Name System (DNS) servers to which Windows Sockets sends queries when it resolves names for the interface. The interface-specific DNS name server for the system is determined by 'DhcpNameServer' entry, which the Dynamic Host Configuration Protocol (DHCP) configures, and by the 'NameServer' entry, which the user can configure. If the value of NameServer is valid, it takes precedence over the value of DhcpNameServer. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


ESM Application Modules (UNIX)

Module: Agent Information

This check reports all the ESM application modules applied on the agent.

The following table lists the error message for the check.

Table: Error message for ESM Application Modules

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: ESM_APPLICATION_MODULE Category: System Information | UNIX (9340) | Title: ESM Application Module Description:The respective ESM application modules has been installed on the ESM agent machine. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


OS Information (UNIX)

Module: Agent Information

This check reports the OS name, OS version and hardware model of the ESM agent.

The following table lists the error message for the check.

Table: Error message for OS Information

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: ESM_OS_INFORMATION Category: System Information | UNIX (9332) | Title: OS Information Description:Please check the information column for the operating system details such as the OS Name, the OS version and the Hardware model. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Registered to Manager (UNIX)

Module: Agent Information

This check reports all the ESM managers to which the agent is registered. All these managers are listed in the /esm/config/manager.dat file.

The following table lists the error messages for the check.

Table: Error messages for Registered to Manager

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: ESM_FILE_IS_MISSING Category: System Information | UNIX (9329) | Title: File cannot be found Description:There is an Error locating the referenced file. Either it does not exist or it is corrupted. Please see the information field for more details. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: ESM_REGISTERED_MANAGER Category: System Information | UNIX (9331) | Title: Registered to Manager Description:The system that has been reported is a manager to which the agent is registered. This Manager can remotely access the ESM agent and schedule various policy runs. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


SU Version (UNIX)

Module: Agent Information

This check reports the SU version of the ESM agent.

The following table lists the error messages for the check.

Table: Error messages for SU Version

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: ESM_FILE_IS_MISSING Category: System Information | UNIX (9329) | Title: File cannot be found Description:There is an Error locating the referenced file. Either it does not exist or it is corrupted. Please see the information field for more details. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: ESM_SU_VERSION Category: System Information | UNIX (9335) | Title: SU Version Description:Please check the information column for the SU version installed on the ESM Agent.It reports the SU version after analysing the manifest file 'manifest.xml' found in '#esm/config' directory. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Discovery module

This section includes the following topics:

  • About the Discovery module

  • Profile candidate devices (Windows and UNIX)

  • Profile timeout (Windows and UNIX)

  • Report if found (Windows and UNIX)

  • Scan non-responding addresses (Windows and UNIX)

  • Symantec ESM device status (Windows and UNIX)

  • Symantec Intruder Alert device status (Windows and UNIX)

  • Targets (Windows and UNIX)


File Access module

This section includes the following topics:

  • About the File Access module

  • Execute permission (UNIX)

  • Files to check (UNIX)

  • Read permission (UNIX)

  • Users to check (UNIX)

  • Write permission (UNIX)


About the File Access module

The File Access module examines read, write, and execute permissions on specified files and access control lists (ACLs) on AIX and HP-UX operating systems. This module is present in the Queries policy.


Execute permission (UNIX)

Module: File Access

This check reports users that can execute the specified file.

The following table lists the error messages for the check.

Table: Error messages for Execute permission

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_FILEXPOSE Category: System Information | UNIX (5730) | Title: User file access Description:The following users may access the named files as specified. This message provides information but does not require any security action on your part. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NOEXPOSE Category: System Information | UNIX (5731) | Title: No user file access Description:No users were found with the specified access to the named files. This message provides information but does not require any security action on your part. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Files to check (UNIX)

Module: File Access

This option lets you specify the list of files that the module will check. Each entry must contain a complete path name.


Read permission (UNIX)

Module: File Access

This check reports users that can read the specified file.

The following table lists the error messages for the check.

Table: Error messages for Read permission

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_FILEXPOSE Category: System Information | UNIX (5730) | Title: User file access Description:The following users may access the named files as specified. This message provides information but does not require any security action on your part. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NOEXPOSE Category: System Information | UNIX (5731) | Title: No user file access Description:No users were found with the specified access to the named files. This message provides information but does not require any security action on your part. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Users to check (UNIX)

Module: File Access

This option lets you create name lists of Users and Groups that will be included in the module checks. Only the users and groups specified in this option will be included in File Access reports.


Write permission (UNIX)

Module: File Access

This check reports users that can write the specified file.

The following table lists the error messages for the check.

Table: Error messages for Write permission

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_FILEXPOSE Category: System Information | UNIX (5730) | Title: User file access Description:The following users may access the named files as specified. This message provides information but does not require any security action on your part. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NOEXPOSE Category: System Information | UNIX (5731) | Title: No user file access Description:No users were found with the specified access to the named files. This message provides information but does not require any security action on your part. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


File Attributes module

This section includes the following topics:

  • About the File Attributes module

  • Allow any privileged group (UNIX)

  • Allow any privileged user (UNIX)

  • Audit Log Info (UNIX)

  • Automatically update snapshots (UNIX)

  • Changed files (change time) (UNIX)

  • Changed files (modification time) (UNIX)

  • Changed files (signature) (UNIX)

  • Changed files (size) (UNIX)

  • Detect Extended attributes (UNIX)

  • Exclude decreased permissions (UNIX)

  • Files not listed in template (UNIX)

  • Group ownership (UNIX)

  • Ignore symbolic links (UNIX)

  • Keywords list (UNIX)

  • Local disks only (UNIX)

  • Maximum reported messages (UNIX)

  • NFS exported files (UNIX)

  • Permissions (UNIX)

  • Template files (UNIX)

  • User ownership (UNIX)


About the File Attributes module

The File Attributes module reports changes in system file attributes including file ownership, permissions, size, and creation and modification times.


Running CRC and MD5 signature checks on UNIX directories

The templates in the UNIX File Attributes module and the UNIX File Watch module let you select options that generate signatures on specified files and directories. This function is enabled on the UNIX computers because directories are treated as files with a special format.

To generate a signature on a UNIX directory, the module opens the directory as if it were a regular file and reads the raw data it contains. There are some directories on UNIX computers that cannot be read in this way. For example, directories that are mounted from a remote file system using NFS cannot be read as files. On some versions of UNIX, the /tmp directory and its subdirectories are also not readable as files.

When the module tries to generate a file signature for a directory that cannot be read as a file, the result is the signature of an empty file. The signature of an empty file has a CRC value of zero or an MD5 value of d41d8cd98f00b204e9800998ecf8427e.

When the module generates a signature for a directory that can be read as a file, it is important to understand what the file contains. The contents are dependent on the type of file system.

The most common file systems store the names of the files contained in the directory along with the files' inode numbers, which specify their locations on the disk. Other information about the files that are contained in a directory such as size, permissions, and modification times are not stored in the directory file. In these file systems, the directory signature does not normally change unless a file is added, removed, or renamed in the directory.

Changing the contents of a file in a directory is usually not sufficient to change the signature of the directory.


Allow any privileged group (UNIX)

Module: File Attributes

This option modifies the behavior of the Group ownership check. When this option is enabled, Symantec ESM allows any privileged group to own a file if the template specifies a privileged group owner. Privileged groups are groups with low GID values. In most situations, ownership of system files by any privileged group is acceptable. For example, if the template specifies group ownership by root, then Symantec ESM allows ownership by any privileged group including system, staff, bin, sys, or adm. This option lets you accommodate variations in ownership between different versions or installations of the same operating system and still use the same templates.


Allow any privileged user (UNIX)

Module: File Attributes

This option modifies the behavior of the User ownership check. When this option is enabled, Symantec ESM allows any privileged user to own a file if the template specifies a privileged owner. Privileged users are users with low UID values. In most situations, ownership of system files by any privileged user is acceptable. For example, if the template specifies user ownership by root, then Symantec ESM allows ownership by any privileged user including root, bin, daemon, sys, or adm. This option lets you accommodate variations in ownership between different versions or installations of the same operating system and still use the same templates.


Audit Log Info (UNIX)

Module: File Attributes

Enable this option to get file access information from the BSM audit logs on Solaris agents or the binary audit trail logs on AIX and HP-UX agents. The edit field is used for checks that do not use snapshots, it specifies the number of days back to search in the audit log.


Automatically update snapshots (UNIX)

Module: File Attributes

Enable this option to automatically update snapshots with current information.


Changed files (change time) (UNIX)

Module: File Attributes

This check verifies the change times of files that have the Change Time option checked in their associated template records. File change times are compared to the values stored in the agent's snapshot file. Note: change time represents the last change made to the file's status, for example, owner or permissions.

The following table lists the error messages for the check.

Table: Error messages for Changed files (change time)

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_DIFFATTRIB_R Category: System Information | UNIX (5561) | Title: File attributes have changed Description:At least one attribute in each of the listed files does not match a related value in the Symantec ESM snapshot file. These changes may represent a security problem. If the changes were made by the system administrator, you should update the snapshot file. If the changes were not authorized, you should restore the files from a backup or from the original distribution media. You should also run CRC and/or MD5 checks on the files to ensure file integrity. It is possible for an intruder to modify a file without changing the modification time. | Severity: red-4 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]
String ID: STKU_DIFFATTRIB_Y Category: System Information | UNIX (5562) | Title: File attributes have changed Description:At least one attribute in each of the listed files does not match a related value in the Symantec ESM snapshot file. These changes may represent a security problem. If the changes were made by the system administrator, you should update the snapshot file. If the changes were not authorized, you should restore the files from a backup or from the original distribution media. You should also run CRC and/or MD5 checks on the files to ensure file integrity. It is possible for an intruder to modify a file without changing the modification time. | Severity: yellow-1 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]
String ID: STKU_DIFFATTRIB_G Category: System Information | UNIX (5563) | Title: File attributes have changed Description:At least one attribute in each of the listed files does not match a related value in the Symantec ESM snapshot file. These changes may represent a security problem. If the changes were made by the system administrator, you should update the snapshot file. If the changes were not authorized, you should restore the files from a backup or from the original distribution media. You should also run CRC and/or MD5 checks on the files to ensure file integrity. It is possible for an intruder to modify a file without changing the modification time. | Severity: green-0 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]


Changed files (modification time) (UNIX)

Module: File Attributes

This check verifies the modification times of files that have the Modification Time option checked in their associated template records. Modification times are compared to the values stored in the agent's snapshot file. Note: modification time represents the last change made to the file's data.

The following table lists the error messages for the check.

Table: Error messages for Changed files (modification time)

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_DIFFATTRIB_R Category: System Information | UNIX (5561) | Title: File attributes have changed Description:At least one attribute in each of the listed files does not match a related value in the Symantec ESM snapshot file. These changes may represent a security problem. If the changes were made by the system administrator, you should update the snapshot file. If the changes were not authorized, you should restore the files from a backup or from the original distribution media. You should also run CRC and/or MD5 checks on the files to ensure file integrity. It is possible for an intruder to modify a file without changing the modification time. | Severity: red-4 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]
String ID: STKU_DIFFATTRIB_Y Category: System Information | UNIX (5562) | Title: File attributes have changed Description:At least one attribute in each of the listed files does not match a related value in the Symantec ESM snapshot file. These changes may represent a security problem. If the changes were made by the system administrator, you should update the snapshot file. If the changes were not authorized, you should restore the files from a backup or from the original distribution media. You should also run CRC and/or MD5 checks on the files to ensure file integrity. It is possible for an intruder to modify a file without changing the modification time. | Severity: yellow-1 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]
String ID: STKU_DIFFATTRIB_G Category: System Information | UNIX (5563) | Title: File attributes have changed Description:At least one attribute in each of the listed files does not match a related value in the Symantec ESM snapshot file. These changes may represent a security problem. If the changes were made by the system administrator, you should update the snapshot file. If the changes were not authorized, you should restore the files from a backup or from the original distribution media. You should also run CRC and/or MD5 checks on the files to ensure file integrity. It is possible for an intruder to modify a file without changing the modification time. | Severity: green-0 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]


Changed files (signature) (UNIX)

Module: File Attributes

This check performs checksum checks on files that have the CRC and/or MD5 options checked in their associated template records. Disabling this check prevents Symantec ESM from reading each of the files in the templates. This reduces I/O on your disks and makes File Attributes run faster. However, because checksum checks are the most difficult security checks for a hacker to circumvent, you should enable this check.

The following table lists the error messages for the check.

Table: Error messages for Changed files (signature)

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_DIFFATTRIB_R Category: System Information | UNIX (5561) | Title: File attributes have changed Description:At least one attribute in each of the listed files does not match a related value in the Symantec ESM snapshot file. These changes may represent a security problem. If the changes were made by the system administrator, you should update the snapshot file. If the changes were not authorized, you should restore the files from a backup or from the original distribution media. You should also run CRC and/or MD5 checks on the files to ensure file integrity. It is possible for an intruder to modify a file without changing the modification time. | Severity: red-4 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]
String ID: STKU_DIFFATTRIB_Y Category: System Information | UNIX (5562) | Title: File attributes have changed Description:At least one attribute in each of the listed files does not match a related value in the Symantec ESM snapshot file. These changes may represent a security problem. If the changes were made by the system administrator, you should update the snapshot file. If the changes were not authorized, you should restore the files from a backup or from the original distribution media. You should also run CRC and/or MD5 checks on the files to ensure file integrity. It is possible for an intruder to modify a file without changing the modification time. | Severity: yellow-1 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]
String ID: STKU_DIFFATTRIB_G Category: System Information | UNIX (5563) | Title: File attributes have changed Description:At least one attribute in each of the listed files does not match a related value in the Symantec ESM snapshot file. These changes may represent a security problem. If the changes were made by the system administrator, you should update the snapshot file. If the changes were not authorized, you should restore the files from a backup or from the original distribution media. You should also run CRC and/or MD5 checks on the files to ensure file integrity. It is possible for an intruder to modify a file without changing the modification time. | Severity: green-0 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]


Changed files (size) (UNIX)

Module: File Attributes

This check verifies the sizes of files that have the Size option checked in their associated template records. File sizes are compared to the values stored in the agent's snapshot file.

The following table lists the error messages for the check.

Table: Error messages for Changed files (size)

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_DIFFATTRIB_R Category: System Information | UNIX (5561) | Title: File attributes have changed Description:At least one attribute in each of the listed files does not match a related value in the Symantec ESM snapshot file. These changes may represent a security problem. If the changes were made by the system administrator, you should update the snapshot file. If the changes were not authorized, you should restore the files from a backup or from the original distribution media. You should also run CRC and/or MD5 checks on the files to ensure file integrity. It is possible for an intruder to modify a file without changing the modification time. | Severity: red-4 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]
String ID: STKU_DIFFATTRIB_Y Category: System Information | UNIX (5562) | Title: File attributes have changed Description:At least one attribute in each of the listed files does not match a related value in the Symantec ESM snapshot file. These changes may represent a security problem. If the changes were made by the system administrator, you should update the snapshot file. If the changes were not authorized, you should restore the files from a backup or from the original distribution media. You should also run CRC and/or MD5 checks on the files to ensure file integrity. It is possible for an intruder to modify a file without changing the modification time. | Severity: yellow-1 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]
String ID: STKU_DIFFATTRIB_G Category: System Information | UNIX (5563) | Title: File attributes have changed Description:At least one attribute in each of the listed files does not match a related value in the Symantec ESM snapshot file. These changes may represent a security problem. If the changes were made by the system administrator, you should update the snapshot file. If the changes were not authorized, you should restore the files from a backup or from the original distribution media. You should also run CRC and/or MD5 checks on the files to ensure file integrity. It is possible for an intruder to modify a file without changing the modification time. | Severity: green-0 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]


Detect Extended attributes (UNIX)

Module: File Attributes

This check verifies whether the system contains any Files and Directories with Extended Attributes.This check is applicable for Solaris 10 only.

The following table lists the error messages for the check.

Table: Error messages for Detect Extended attributes

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_FILE_EXT_ATTR_SET_R Category: System Information | UNIX (5540) | Title: File/directory has extended attributes set Description:The listed file/directory has extended attributes set on it. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_FILE_EXT_ATTR_SET_Y Category: System Information | UNIX (5542) | Title: File/directory has extended attributes set Description:The listed file/directory has extended attributes set on it. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_FILE_EXT_ATTR_SET_G Category: System Information | UNIX (5543) | Title: File/directory has extended attributes set Description:The listed file/directory has extended attributes set on it. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Exclude decreased permissions (UNIX)

Module: File Attributes

This option modifies the behavior of the Permissions check. When this option is enabled, only permission changes that increase file accesses are reported. When this option is disabled, all changes to file permissions are reported.


Files not listed in template (UNIX)

Module: File Attributes

This check reports all files not found in the templates. This report can (and most likely will) be very long. Use the name list to exclude specified directories from the check.

The following table lists the error message for the check.

Table: Error message for Files not listed in template

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_FILE_NOT_IN_TEMPLATE Category: System Information | UNIX (5538) | Title: File/directory not in template Description:The listed file was not included in the template's monitored file list. This message is for informational purposes only. If you suspect that a reported file is evidence of tampering on the system, you should check the file's origin. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Group ownership (UNIX)

Module: File Attributes

This check verifies proper group ownership of files using the values specified in your templates.

The following table lists the error messages for the check.

Table: Error messages for Group ownership

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_DIFFOWN_R Category: System Information | UNIX (5564) | Title: Different file ownership Description:The file owner does not match the owner specified in the File template. If the changes are authorized, update the File template. If the changes are not authorized, correct the file owner and run CRC and/or MD5 checksum checks to ensure file integrity. | Severity: red-4 Correctable: true Snapshot Updatable: false Template Updatable: true Information Field Format: [%s]
String ID: STKU_DIFFOWN_Y Category: System Information | UNIX (5565) | Title: Different file ownership Description:The file owner does not match the owner specified in the File template. If the changes are authorized, update the File template. If the changes are not authorized, correct the file owner and run CRC and/or MD5 checksum checks to ensure file integrity. | Severity: yellow-1 Correctable: true Snapshot Updatable: false Template Updatable: true Information Field Format: [%s]
String ID: STKU_DIFFOWN_G Category: System Information | UNIX (5566) | Title: Different file ownership Description:The file owner does not match the owner specified in the File template. If the changes are authorized, update the File template. If the changes are not authorized, correct the file owner and run CRC and/or MD5 checksum checks to ensure file integrity. | Severity: green-0 Correctable: true Snapshot Updatable: false Template Updatable: true Information Field Format: [%s]
String ID: STKU_NOGROUP Category: System Information | UNIX (5535) | Title: Group in template does not exist Description:A group name that is specified in one of your File Attributes templates does not exist as a group on the system. Files in your template that specify this group as owner are improperly owned. You should either change the group name in the template or add the missing group name to your system. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_DIFFOWN_DIR_R Category: System Information | UNIX (5567) | Title: Different directory ownership Description:The directory owner does not match the owner specified in the File template. If the changes are authorized, update the File template. If the changes are not authorized, correct the directory owner. | Severity: red-4 Correctable: true Snapshot Updatable: false Template Updatable: true Information Field Format: [%s]
String ID: STKU_DIFFOWN_DIR_Y Category: System Information | UNIX (5568) | Title: Different directory ownership Description:The directory owner does not match the owner specified in the File template. If the changes are authorized, update the File template. If the changes are not authorized, correct the directory owner. | Severity: yellow-1 Correctable: true Snapshot Updatable: false Template Updatable: true Information Field Format: [%s]
String ID: STKU_DIFFOWN_DIR_G Category: System Information | UNIX (5569) | Title: Different directory ownership Description:The directory owner does not match the owner specified in the File template. If the changes are authorized, update the File template. If the changes are not authorized, correct the directory owner. | Severity: green-0 Correctable: true Snapshot Updatable: false Template Updatable: true Information Field Format: [%s]


Ignore symbolic links (UNIX)

Module: File Attributes

This option is only used by the Files not listed in template check. When this option in enabled, the module ignores symbolic links on the directory tree. Most symbolic links point to files or directories that are located on another file system and may be owned by a different UID or GID. This option is enabled by default so these files are not checked.


Keywords list (UNIX)

Module: File Attributes

This option lets you enable or disable File Keywords templates that File templates use to locate file paths.


Local disks only (UNIX)

Module: File Attributes

This option restricts all module checks to only those file systems that are located on local disks. File systems located on remote disks (served by NFS) will not be checked.


Maximum reported messages (UNIX)

Module: File Attributes

Enable this option to limit the number of messages returned for each enabled check. Use the value field to specify the maximum number of times a given message should be displayed. Once the maximum number has been reached for a single message, the message will be displayed once more with the number of repeating instances of the message that are not reported.


NFS exported files (UNIX)

Module: File Attributes

This check reports files from enabled templates that are being shared over NFS version 3 and earlier. NFS version 4 uses server-side authentication and is therefore considered to be more secure.

The following table lists the error messages for the check.

Table: Error messages for NFS exported files

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_NFS_EXPORTED_R Category: System Information | UNIX (5570) | Title: File or directory is being exported Description:The listed file is currently being exported over an insecure version of NFS. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NFS_EXPORTED_Y Category: System Information | UNIX (5571) | Title: File or directory is being exported Description:The listed file is currently being exported over an insecure version of NFS. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NFS_EXPORTED_G Category: System Information | UNIX (5572) | Title: File or directory is being exported Description:The listed file is currently being exported over an insecure version of NFS. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Permissions (UNIX)

Module: File Attributes

This check verifies proper file permissions using the values specified in your templates.

The following table lists the error messages for the check.

Table: Error messages for Permissions

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_DIFFPERM_R Category: System Information | UNIX (5573) | Title: Different file permissions Description:The file permissions do not match the permissions specified in the File template. If the changes are authorized, update the File template. If the changes are not authorized, correct the file permissions and run CRC and/or MD5 checksum checks to ensure file integrity. | Severity: red-4 Correctable: true Snapshot Updatable: false Template Updatable: true Information Field Format: [%s]
String ID: STKU_DIFFPERM_Y Category: System Information | UNIX (5574) | Title: Different file permissions Description:The file permissions do not match the permissions specified in the File template. If the changes are authorized, update the File template. If the changes are not authorized, correct the file permissions and run CRC and/or MD5 checksum checks to ensure file integrity. | Severity: yellow-1 Correctable: true Snapshot Updatable: false Template Updatable: true Information Field Format: [%s]
String ID: STKU_DIFFPERM_G Category: System Information | UNIX (5575) | Title: Different file permissions Description:The file permissions do not match the permissions specified in the File template. If the changes are authorized, update the File template. If the changes are not authorized, correct the file permissions and run CRC and/or MD5 checksum checks to ensure file integrity. | Severity: green-0 Correctable: true Snapshot Updatable: false Template Updatable: true Information Field Format: [%s]
String ID: STKU_DIFFPERM_DIR_R Category: System Information | UNIX (5576) | Title: Different directory permissions Description:The directory permissions do not match the permissions specified in the File template. If the changes are authorized, update the File template. If the changes are not authorized, correct the directory permissions. | Severity: red-4 Correctable: true Snapshot Updatable: false Template Updatable: true Information Field Format: [%s]
String ID: STKU_DIFFPERM_DIR_Y Category: System Information | UNIX (5577) | Title: Different directory permissions Description:The directory permissions do not match the permissions specified in the File template. If the changes are authorized, update the File template. If the changes are not authorized, correct the directory permissions. | Severity: yellow-1 Correctable: true Snapshot Updatable: false Template Updatable: true Information Field Format: [%s]
String ID: STKU_DIFFPERM_DIR_G Category: System Information | UNIX (5578) | Title: Different directory permissions Description:The directory permissions do not match the permissions specified in the File template. If the changes are authorized, update the File template. If the changes are not authorized, correct the directory permissions. | Severity: green-0 Correctable: true Snapshot Updatable: false Template Updatable: true Information Field Format: [%s]


Template files (UNIX)

Module: File Attributes

This option lets you enable or disable the template files that the module uses to check selected file attributes.

The following table lists the error messages for the check.

Table: Error messages for Template files

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_ITEMCOUNT Category: System Information | UNIX (5541) | Title: Number of matched templates and items Description:This informational message shows how many templates from the policy matched the agent by platform and how many items from those templates matched the OS and version sublists. This does not necessarily show how many files were checked, because some template items may represent files that do not exist or multiple files identified by wild cards. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [Templates: %s; items: %s]
String ID: STKU_NOTEMPLATES Category: System Information | UNIX (5533) | Title: No template files specified Description:The File Attributes module was run without any template files. No security checks were performed. Check your policy to ensure that at least one template file is enabled for this agent's operating system and rerun the module. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NOEXISTWC Category: System Information | UNIX (5539) | Title: Mandatory wild card entry Description:A wild card pattern specified as MANDATORY in one of your File Attributes templates is not a valid measure of checking for the existence of files that are MANDATORY. You must enter full file and path names in the template for items that are MANDATORY. Correct the entry and rerun the module. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NOEXIST_R Category: System Information | UNIX (5555) | Title: Mandatory file does not exist Description:A file name specified as MANDATORY in one of your File Attributes templates does not exist on the system. You should either change the requirement for this file in the template or add the missing file to your system. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NOEXIST_Y Category: System Information | UNIX (5556) | Title: Mandatory file does not exist Description:A file name specified as MANDATORY in one of your File Attributes templates does not exist on the system. You should either change the requirement for this file in the template or add the missing file to your system. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NOEXIST_G Category: System Information | UNIX (5557) | Title: Mandatory file does not exist Description:A file name specified as MANDATORY in one of your File Attributes templates does not exist on the system. You should either change the requirement for this file in the template or add the missing file to your system. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_FORBIDWC_R Category: System Information | UNIX (5579) | Title: Forbidden wild card file exists Description:A wild card pattern specified as FORBIDDEN in one of your File Attributes templates has matched a file that exists on the system. You should either change the requirement for this pattern in the template or remove the file from your system. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_FORBIDWC_Y Category: System Information | UNIX (5580) | Title: Forbidden wild card file exists Description:A wild card pattern specified as FORBIDDEN in one of your File Attributes templates has matched a file that exists on the system. You should either change the requirement for this pattern in the template or remove the file from your system. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_FORBIDWC_G Category: System Information | UNIX (5581) | Title: Forbidden wild card file exists Description:A wild card pattern specified as FORBIDDEN in one of your File Attributes templates has matched a file that exists on the system. You should either change the requirement for this pattern in the template or remove the file from your system. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_FORBID_R Category: System Information | UNIX (5558) | Title: Forbidden file exists Description:A file name specified as FORBIDDEN in one of your File Attributes templates exists on the system. You should either change the requirement for this file in the template or remove the file from your system. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_FORBID_Y Category: System Information | UNIX (5559) | Title: Forbidden file exists Description:A file name specified as FORBIDDEN in one of your File Attributes templates exists on the system. You should either change the requirement for this file in the template or remove the file from your system. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_FORBID_G Category: System Information | UNIX (5560) | Title: Forbidden file exists Description:A file name specified as FORBIDDEN in one of your File Attributes templates exists on the system. You should either change the requirement for this file in the template or remove the file from your system. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


User ownership (UNIX)

Module: File Attributes

This check verifies proper user ownership of files using the values specified in your templates.

The following table lists the error messages for the check.

Table: Error messages for User ownership

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_DIFFOWN_R Category: System Information | UNIX (5564) | Title: Different file ownership Description:The file owner does not match the owner specified in the File template. If the changes are authorized, update the File template. If the changes are not authorized, correct the file owner and run CRC and/or MD5 checksum checks to ensure file integrity. | Severity: red-4 Correctable: true Snapshot Updatable: false Template Updatable: true Information Field Format: [%s]
String ID: STKU_DIFFOWN_Y Category: System Information | UNIX (5565) | Title: Different file ownership Description:The file owner does not match the owner specified in the File template. If the changes are authorized, update the File template. If the changes are not authorized, correct the file owner and run CRC and/or MD5 checksum checks to ensure file integrity. | Severity: yellow-1 Correctable: true Snapshot Updatable: false Template Updatable: true Information Field Format: [%s]
String ID: STKU_DIFFOWN_G Category: System Information | UNIX (5566) | Title: Different file ownership Description:The file owner does not match the owner specified in the File template. If the changes are authorized, update the File template. If the changes are not authorized, correct the file owner and run CRC and/or MD5 checksum checks to ensure file integrity. | Severity: green-0 Correctable: true Snapshot Updatable: false Template Updatable: true Information Field Format: [%s]
String ID: STKU_NOUSER Category: System Information | UNIX (5534) | Title: User in template does not exist Description:A user name that is specified in one of your File Attributes templates does not exist as a user on the system. Files in your template that specify this user as owner are improperly owned. You should either change the user name in the template or add the missing user name to your system. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_DIFFOWN_DIR_R Category: System Information | UNIX (5567) | Title: Different directory ownership Description:The directory owner does not match the owner specified in the File template. If the changes are authorized, update the File template. If the changes are not authorized, correct the directory owner. | Severity: red-4 Correctable: true Snapshot Updatable: false Template Updatable: true Information Field Format: [%s]
String ID: STKU_DIFFOWN_DIR_Y Category: System Information | UNIX (5568) | Title: Different directory ownership Description:The directory owner does not match the owner specified in the File template. If the changes are authorized, update the File template. If the changes are not authorized, correct the directory owner. | Severity: yellow-1 Correctable: true Snapshot Updatable: false Template Updatable: true Information Field Format: [%s]
String ID: STKU_DIFFOWN_DIR_G Category: System Information | UNIX (5569) | Title: Different directory ownership Description:The directory owner does not match the owner specified in the File template. If the changes are authorized, update the File template. If the changes are not authorized, correct the directory owner. | Severity: green-0 Correctable: true Snapshot Updatable: false Template Updatable: true Information Field Format: [%s]


File Find module

This section includes the following topics:

  • About the File Find module

  • Automatically update snapshots (UNIX)

  • Device files not in /dev (UNIX)

  • Directories/files/types excluded (UNIX)

  • File content search (UNIX)

  • Global zone only (UNIX)

  • Group owners disallowed (UNIX)

  • Group writable files (UNIX)

  • Ignore symbolic links (UNIX)

  • Local disks only (UNIX)

  • Maximum reported messages (UNIX)

  • New setgid files (UNIX)

  • New setuid files (UNIX)

  • Owners disallowed (UNIX)

  • SUID/GUID shell escape files (UNIX)

  • Setgid executable files (UNIX)

  • Setgid files (UNIX)

  • Setuid executable files (UNIX)

  • Setuid files (UNIX)

  • Starting directories (UNIX)

  • Sticky files (UNIX)

  • Symbolic links with bad targets (UNIX)

  • Uneven file permissions (UNIX)

  • Unowned directories/files (UNIX)

  • Unprintable characters in file names (UNIX)

  • World writable directories without sticky bit (UNIX)

  • World writable files (UNIX)


Automatically update snapshots (UNIX)

Module: File Find

Enable this option to automatically update snapshots with current information.


Device files not in /dev (UNIX)

Module: File Find

This check reports special device files that are not located in the /dev directory (or in the /devices directory on Solaris). Special device files outside this directory can be used to gain unauthorized access to data on the device. Enter full path names and wildcard characters in the file list to specify files and directories to be excluded from the check. For example, you would enter /proc/* to exclude all files in the /proc directory. Enter the file-type proceeded by a pipe character to exclude files of that type. For example, you would enter CHAR to exclude character device files. Available file-types are CHAR and BLOCK.

The following table lists the error message for the check.

Table: Error message for Device files not in /dev

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_DEVICES Category: System Information | UNIX (5637) | Title: Device special file outside /dev Description:The listed files are device special files. These files are normally located only in the /dev directory (the /devices directory on Solaris). Special device files outside this directory can be used to gain unauthorized access to data on the device. You should correct this problem by moving these files to the /dev directory. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Directories/files/types excluded (UNIX)

Module: File Find

Use this option to exclude specified directories and files from the File Find directory traversal. You can specify files and directories with full path names or without path names. For example, if you enter /etc/passwd, only the /etc/passwd file is excluded. If you enter passwd, all files and directories named passwd are excluded. If you enter etc/passwd, nothing is excluded because this is an illegal format. Enter the file-type proceeded by a pipe character to exclude files of that type. For example, you would enter CHAR to exclude character device files. Available file-types are CHAR, BLOCK, FIFO, and SOCK.

The following table lists the error message for the check.

Table: Error message for Directories/files/types excluded

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_EXCLUDE_ROOT Category: System Information | UNIX (5641) | Title: Exclude root Description:You have chosen to run File Find with a directory list set to "Exclude" and have placed root "/" in the list of directories to ignore. The choice to exclude root will be ignored, because this is an invalid choice when running this module. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


File content search (UNIX)

Module: File Find

This check reports files with contents that match text or text patterns that are defined in File Content Search templates. Use the name list to enable or disable the File Content Search templates. This check does not use the Starting directories or Exclude directories/files options, but it does use the Check local disks only option.

The following table lists the error messages for the check.

Table: Error messages for File content search

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_FCS_GREEN Category: System Information | UNIX (5646) | Title: Green level content search matched Description:Text items that were defined in the File Content Search template were matched. Please see the Info field for detailed information. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_FCS_YELLOW Category: System Information | UNIX (5647) | Title: Yellow level content search matched Description:Text items that were defined in the File Content Search template were matched. Please see the Info field for detailed information. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_FCS_RED Category: System Information | UNIX (5648) | Title: Red level content search matched Description:Text items that were defined in the File Content Search template were matched. Please see the Info field for detailed information. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_INVALID_FCS_ENTRY Category: System Information | UNIX (5651) | Title: No block specified for 2nd pattern Description:No block was specified for the 2nd pattern match in the File List sublist of the File Content Search template. When a 2nd pattern is specified, the B, E, or G Delimiter options must be used to define the text block that is searched. | Severity: yellow-3 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Global zone only (UNIX)

Module: File Find

This option checks file systems that are on global zone only. File systems that are located on local zones are not checked when this option is selected. If this option is not selected, file systems on local zones and global zone are checked. This check is supported on Solaris 10 systems.


Group owners disallowed (UNIX)

Module: File Find

This check reports files that are owned by unauthorized groups. Use the name list to specify groups that are authorized to own files and directories and are, therefore, excluded from the check.

The following table lists the error message for the check.

Table: Error message for Group owners disallowed

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_DISALLOWED_GROUP_OWNER Category: System Information | UNIX (5650) | Title: Disallowed group owner Description:The named file or directory is not owned by an authorized group. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [Group owner: %s]


Group writable files (UNIX)

Module: File Find

This check finds files that are writable by anyone with group access. If system files are involved, security problems can result because system files do not need to be modified or deleted during normal operation. Enter full path names in the file list to specify files to be excluded from the check. Enter the file-type proceeded by a pipe character to exclude files of that type. For example, you would enter CHAR to exclude character device files. Available file-types are CHAR, BLOCK, FIFO, and SOCK.

The following table lists the error message for the check.

Table: Error message for Group writable files

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_GWFILES Category: System Information | UNIX (5639) | Title: Group writable Description:This file is writable by anyone with group access to the files. Security problems can result because system files do not need to be modified or deleted during normal operation. Symantec recommends that you examine the file and make sure it should be writable by anyone with group access to the files. Use care when taking corrective action in response to this message. For example, the directory /usr/tmp must be group writable for correct operation of your system. | Severity: green-0 Correctable: true Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Ignore symbolic links (UNIX)

Module: File Find

When this option in enabled, the module ignores symbolic links on the directory tree.


Local disks only (UNIX)

Module: File Find

This option checks only file systems that are located on local disks. File systems that are located on remote disks (served by NFS) are not checked when this option is selected.


Maximum reported messages (UNIX)

Module: File Find

Enable this option to limit the number of messages returned for each enabled check. Use the value field to specify the maximum number of times a given message should be displayed. Once the maximum number has been reached for a single message, the message will be displayed once more with the number of repeating instances of the message that are not reported.


New setgid files (UNIX)

Module: File Find

This check reports files that have had setgid attribute changes. The first time File Find runs, it creates a snapshot file that lists all setgid files. On subsequent runs, File Find reports any executable files that are newly assigned the setgid attribute and setgid files that are no longer found in the system. Messages reported by this check can be used to update the snapshot file from the Report dialog box.

The following table lists the error messages for the check.

Table: Error messages for New setgid files

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_SETIDNEW Category: System Information | UNIX (5632) | Title: New setuid/setgid file Description:The listed files have been assigned setuid or setgid attributes since the last time the ESM snapshot was updated. With these attributes, anyone running these files is temporarily assigned the UID or GID of the file. While many system files depend on these attributes for proper operation, security problems can result if they are assigned to programs that allow reading and writing of files or escapes to shell. If the new attributes were assigned by the system administrator, you should update the snapshot. If changes were not authorized, you should use the chmod command to restore the previous file attributes. | Severity: red-4 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]
String ID: STKU_SETIDNOT Category: System Information | UNIX (5633) | Title: File is no longer setuid/setgid Description:Setuid or setgid attributes have been removed for the listed files since the last time the ESM snapshot was updated. Anyone running files with setuid or setgid attributes is temporarily assigned the UID or GID of the file. Many system files depend on these attributes for proper operation. If these attributes were changed by the system administrator, you should update the snapshot. If changes were not authorized, you should use the chmod command to restore the previous file attributes. | Severity: green-0 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]
String ID: STKU_SETIDDEL Category: System Information | UNIX (5634) | Title: Setuid/setgid file not found Description:The listed files previously had the setuid or setgid attribute but now cannot be found on your system. Anyone running a file with the setuid or setgid attribute is temporarily assigned the UID or GID of the file. Many system files depend on these attributes for proper operation. If the files were deleted by the system administrator, you should update the ESM snapshot. If the deletions were not authorized, you should restore the files to your system. | Severity: green-0 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]


New setuid files (UNIX)

Module: File Find

This check reports files that have had setuid attribute changes. The first time File Find runs, it creates a snapshot file that lists all setuid files. On subsequent runs, File Find reports any executable files that are newly assigned the setuid attribute and setuid files that are no longer found in the system. Messages reported by this check can be used to update the snapshot file from the Report dialog box.

The following table lists the error messages for the check.

Table: Error messages for New setuid files

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_SETIDNEW Category: System Information | UNIX (5632) | Title: New setuid/setgid file Description:The listed files have been assigned setuid or setgid attributes since the last time the ESM snapshot was updated. With these attributes, anyone running these files is temporarily assigned the UID or GID of the file. While many system files depend on these attributes for proper operation, security problems can result if they are assigned to programs that allow reading and writing of files or escapes to shell. If the new attributes were assigned by the system administrator, you should update the snapshot. If changes were not authorized, you should use the chmod command to restore the previous file attributes. | Severity: red-4 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]
String ID: STKU_SETIDNOT Category: System Information | UNIX (5633) | Title: File is no longer setuid/setgid Description:Setuid or setgid attributes have been removed for the listed files since the last time the ESM snapshot was updated. Anyone running files with setuid or setgid attributes is temporarily assigned the UID or GID of the file. Many system files depend on these attributes for proper operation. If these attributes were changed by the system administrator, you should update the snapshot. If changes were not authorized, you should use the chmod command to restore the previous file attributes. | Severity: green-0 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]
String ID: STKU_SETIDDEL Category: System Information | UNIX (5634) | Title: Setuid/setgid file not found Description:The listed files previously had the setuid or setgid attribute but now cannot be found on your system. Anyone running a file with the setuid or setgid attribute is temporarily assigned the UID or GID of the file. Many system files depend on these attributes for proper operation. If the files were deleted by the system administrator, you should update the ESM snapshot. If the deletions were not authorized, you should restore the files to your system. | Severity: green-0 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]


Owners disallowed (UNIX)

Module: File Find

This check reports files that are owned by unauthorized users. Use the name list to specify users that are authorized to own files and directories and are, therefore, excluded from the check.

The following table lists the error message for the check.

Table: Error message for Owners disallowed

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_DISALLOWED_OWNER Category: System Information | UNIX (5649) | Title: Disallowed owner Description:The named file or directory is not owned by an authorized user. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [Owner: %s]


SUID/GUID shell escape files (UNIX)

Module: File Find

This option modifies the behavior of the Setuid files, Setgid files, Setuid executable files and Setgid executable files checks. When this option and one or all of these security checks are enabled, the checks examine the files that are listed in the agent's /etc/shells file, as well as the shell escape files specified in the file list, for setuid and/or setgid attributes. Enter the full path names in the file list to specify the shell escape files that need to be included in the check. This check is dependent on the Starting directories check.

The following table lists the error messages for the check.

Table: Error messages for SUID/GUID shell escape files

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_SGID_SHELL_FILE Category: System Information | UNIX (5644) | Title: SGID bin/shell file Description:The listed files have been assigned setgid attributes. They are also specified in the file list as files that provide escape to shell access. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_SUID_SHELL_FILE Category: System Information | UNIX (5645) | Title: SUID bin/shell file Description:The listed files have been assigned setuid attributes. They are also specified in the file list as files that provide escape to shell access. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Setgid executable files (UNIX)

Module: File Find

This check finds files that have been assigned the setgid attribute and are executable. Anyone running a setgid file is temporarily assigned the group ID of the file. While many system files depend on this attribute for proper operation, security problems can result if setgid is assigned to programs that allow reading and writing of files or escapes to shell. The executable status of files is determined using the UNIX file command. Enter full path names and wildcard characters in the file list to specify files and directories to be excluded from the check. For example, you would enter /etc/* to exclude all files in the /etc directory. ESM recognizes two types of executable files: binaries and scripts. To exclude one or the other, add BINARY or SCRIPT to the exclude name list. Files excluded by executable type will be reported by the Setgid Files check, if it is enabled.

The following table lists the error message for the check.

Table: Error message for Setgid executable files

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_SETGID_EXEC Category: System Information | UNIX (5654) | Title: File is setgid and executable Description:The listed files have been assigned the setgid attribute and are executable. Setgid means that anyone running these files is temporarily assigned the group ID of the file. While many system files depend on this attribute for proper operation, security problems can result if setgid is assigned to programs that allow reading and writing of files or escapes to shell. You should examine the listed files for such attributes and use the chmod command to change the file setgid properties where appropriate. The executable status of these files was determined using the UNIX file command. The output of this command is shown in the information field. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Setgid files (UNIX)

Module: File Find

This check finds files that have been assigned the setgid attribute. Anyone running a setgid file is temporarily assigned the group ID of the file. While many system files depend on this attribute for proper operation, security problems can result if setgid is assigned to programs that allow reading and writing of files or escapes to shell. Enter full path names and wildcard characters in the file list to specify files and directories to be excluded from the check. For example, you would enter /etc/* to exclude all files in the /etc directory.

The following table lists the error message for the check.

Table: Error message for Setgid files

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_SETGID Category: System Information | UNIX (5631) | Title: File is setgid Description:The listed files have been assigned the setgid attribute. Setgid means that anyone running these files is temporarily assigned the group ID of the file. While many system files depend on this attribute for proper operation, security problems can result if setgid is assigned to programs that allow reading and writing of files or escapes to shell. You should examine the listed files for such attributes and use the chmod command to change the file setgid properties where appropriate. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Setuid executable files (UNIX)

Module: File Find

This check reports files that have been assigned the setuid attribute and are executable. Anyone running a setuid file is temporarily assigned the user ID of the file. While many system files depend on this attribute for proper operation, security problems can result if setuid is assigned to programs that allow reading and writing of files or escapes to shell. The executable status of files is determined using the UNIX file command. Enter full path names and wildcard characters in the file list to specify files and directories to be excluded from the check. For example, you would enter /etc/* to exclude all files in the /etc directory. ESM recognizes two types of executable files: binaries and scripts. To exclude one or the other, add BINARY or SCRIPT to the exclude name list. Files excluded by executable type will be reported by the Setuid Files check, if it is enabled.

The following table lists the error message for the check.

Table: Error message for Setuid executable files

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_SETUID_EXEC Category: System Information | UNIX (5653) | Title: File is setuid and executable Description:The listed files have been assigned the setuid attribute and are executable. Setuid means that anyone running these files is temporarily assigned the user ID of the file. While many system files depend on this attribute for proper operation, security problems can result if setuid is assigned to programs that allow reading and writing of files or escapes to shell. You should examine the listed files for such attributes and use the chmod command to change file setuid properties where appropriate. The executable status of these files was determined using the UNIX file command. The output of this command is shown in the information field. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Setuid files (UNIX)

Module: File Find

This check reports files that have been assigned the setuid attribute. Anyone running a setuid file is temporarily assigned the user ID of the file. While many system files depend on this attribute for proper operation, security problems can result if setuid is assigned to programs that allow reading and writing of files or escapes to shell. Enter full path names and wildcard characters in the file list to specify files and directories to be excluded from the check. For example, you would enter /etc/* to exclude all files in the /etc directory.

The following table lists the error message for the check.

Table: Error message for Setuid files

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_SETUID Category: System Information | UNIX (5630) | Title: File is setuid Description:The listed files have been assigned the setuid attribute. Setuid means that anyone running these files is temporarily assigned the user ID of the file. While many system files depend on this attribute for proper operation, security problems can result if setuid is assigned to programs that allow reading and writing of files or escapes to shell. You should examine the listed for such attributes and use the chmod command to change file setuid properties where appropriate. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Starting directories (UNIX)

Module: File Find

Use this option to specify the starting directories for the File Find directory traversal. Enter one or more full path names in the file list to specify the starting points for directory tree searches. Enter a plus sign (+) character followed by a number at the end of a path name to specify how many levels File Find should travel down the directory tree. For example, enter /etc/home+1 to specify a search that travels one level below /etc/home. File Find checks to see if the /etc/home+1 directory exists before it identifies +1 as a depth parameter.


Sticky files (UNIX)

Module: File Find

This check reports files that have the save text after execution (sticky) bit set. When the bit is set on an executable file, the system will retain the program code in the file buffer cache after the program has finished. When the bit is set on a directory, only the owner of a file or the owner of the directory can delete files from the directory. System performance can degrade if the bit is set on too many programs. Enter full path names in the file list to specify files to be excluded from the check. Enter the file-type proceeded by a pipe character to exclude files of that type. For example, you would enter CHAR to exclude character device files. Available file-types are CHAR, BLOCK, FIFO, and SOCK.

The following table lists the error message for the check.

Table: Error message for Sticky files

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_STICKY Category: System Information | UNIX (5635) | Title: Sticky bit set Description:The listed files have the save text after execution (sticky) bit set. When the bit is set on an executable file, the system will retain the program code in the file buffer cache after the program is finished. When the bit is set on a directory, only the owner of a file or the owner of the directory can delete files from the directory. Setting this bit on too many programs can degrade system performance. On some systems, the sticky bit can have security ramifications if NOT set on system directories. You should examine the listed files to be sure that the sticky bit settings are authorized. Use the chmod command to change the settings if appropriate. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Symbolic links with bad targets (UNIX)

Module: File Find

This check reports symbolic links which point to invalid targets.

The following table lists the error message for the check.

Table: Error message for Symbolic links with bad targets

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_SYMLINK_BADTARGET Category: System Information | UNIX (5655) | Title: Symbolic link with bad target Description:The listed symbolic link points to an invalid or nonexistent target. | Severity: yellow-2 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Uneven file permissions (UNIX)

Module: File Find

This check finds files with uneven permissions. Uneven permissions mean that other access is greater than group access or user access. It can also mean that group access is greater that user access. A file with uneven permissions is inconsistent and does not make sense from a security perspective. Enter full path names in the file list to specify files to be excluded from the check. Enter the file-type proceeded by a pipe character to exclude files of that type. For example, you would enter CHAR to exclude character device files. Available file-types are CHAR, BLOCK, FIFO, and SOCK.

The following table lists the error message for the check.

Table: Error message for Uneven file permissions

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_UNEVEN Category: System Information | UNIX (5640) | Title: Uneven permissions Description:The listed files have uneven permissions. Uneven permissions indicate that other access is greater than group access or user access. Group access could also be greater than user access. A file with uneven permissions is inconsistent and does not make sense from a security perspective. You should determine the proper permissions for the listed files and use the chmod command to make corrections. | Severity: green-0 Correctable: true Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Unowned directories/files (UNIX)

Module: File Find

This check finds directories or files with ownerships (UID or GID) that cannot be associated with user names on the system being checked. Enter full path names and wildcard characters in the file list to specify files and directories to be excluded from the check. For example, you would enter /home/* to exclude all files in the /home directory. Enter the file-type proceeded by a pipe character to exclude files of that type. For example, you would enter CHAR to exclude character device files. Available file-types are CHAR, BLOCK, FIFO, and SOCK.

The following table lists the error messages for the check.

Table: Error messages for Unowned directories/files

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_UNOWNED_UID Category: System Information | UNIX (5642) | Title: Unowned UID Description:The listed files have unowned UIDs. An unowned UID is a user ID that cannot be associated with a name. A file with an unowned UID is not accounted for and does not make sense from a security perspective. You should determine the proper owners for the listed files and use the chown command to make corrections. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_UNOWNED_GID Category: System Information | UNIX (5643) | Title: Unowned GID Description:The listed files have unowned GIDs. An unowned GID is a group ID that cannot be associated with a name. A file with an unowned GID is not accounted for and does not make sense from a security perspective. You should determine the proper groups for the listed files and use the chgrp command to make corrections. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Unprintable characters in file names (UNIX)

Module: File Find

This check reports file or directory names that contain unprintable characters. An unexplained file or directory containing unprintable characters in the name could be a security issue and should be verified.

The following table lists the error message for the check.

Table: Error message for Unprintable characters in file names

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_UNPRINTABLE Category: System Information | UNIX (5652) | Title: Unprintable character(s) in file name Description:A file or directory containing unprintable characters in the name was found. This could be a security issue if this is an unexplained file or directory. Verify that this is a necessary file or directory. | Severity: yellow-3 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


World writable directories without sticky bit (UNIX)

Module: File Find

This check reports world-writable directories that do not have the sticky bit set. Any user can delete any file in these directories. This includes files created by other users. Enter full path names in the file list to specify directories to be excluded from the check.

The following table lists the error message for the check.

Table: Error message for World writable directories without sticky bit

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_NOTSTICKY Category: System Information | UNIX (5636) | Title: World writable directory w/o sticky bit set Description:The listed directories are world writable and do not have the save text after execution (sticky) bit set. World writable directories that do not have the sticky bit set allow any user to delete any of the files in these directories. This includes files created by other users. You should examine the listed directories to determine whether they should be world writable. Use the chmod o+t command to set the sticky bit for these directories. See "chmod" in the man pages for more information. | Severity: red-4 Correctable: true Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


World writable files (UNIX)

Module: File Find

This check finds files that are writable by everyone. Security problems can result because there are no controls over who can modify or delete these files. Enter full path names in the file list to specify files to be excluded from the check. Enter the file-type proceeded by a pipe character to exclude files of that type. For example, you would enter CHAR to exclude character device files. Available file-types are CHAR, BLOCK, FIFO, and SOCK.

The following table lists the error message for the check.

Table: Error message for World writable files

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_WWFILES Category: System Information | UNIX (5638) | Title: World writable Description:The listed files are writable by everyone. Security problems can result because there are no controls over who can modify or delete these files. You should examine the listed files to make sure that they should be writable by everyone. Use care when taking corrective action in response to this message. For example, the directory /usr/tmp must be world writable for correct operation of your system. | Severity: yellow-3 Correctable: true Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


File Watch module

This section includes the following topics:

  • About the File Watch module

  • Audit Log Info (UNIX)

  • Automatically update snapshots (UNIX)

  • Changed files (ownership) (UNIX)

  • Changed files (permissions) (UNIX)

  • Changed files (signature) (UNIX)

  • Files/directories to watch (UNIX)

  • Filter changed device ownership/permissions (UNIX)

  • Ignore Directories (UNIX)

  • Invalid signature (UNIX)

  • Keywords list (UNIX)

  • Local disks only (UNIX)

  • Malicious files (UNIX)

  • New files (UNIX)

  • Removed files (UNIX)


About the File Watch module

The File Watch module reports changes to files since the last snapshot update and violations of template settings. In addition, the module does the following:

  • Creates and maintains an agent snapshot file named fwatch.dat to detect file changes

  • Looks for the files with file names or signature patterns that match specified names and patterns

  • Searches for malicious files and compares the file signatures with snapshot or template files, depending on the enabled checks


Audit Log Info (UNIX)

Module: File Watch

Enable this option to get file access information from the BSM audit logs on Solaris agents or the binary audit trail logs on AIX and HP-UX agents.


Automatically update snapshots (UNIX)

Module: File Watch

Enable this option to automatically update snapshots with current information.


Changed files (ownership) (UNIX)

Module: File Watch

This check reports ownership changes that affect files and directories within the directory trees that are watched.

The following table lists the error messages for the check.

Table: Error messages for Changed files (ownership)

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: ESMM_DIFF_OWN Category: Policy Compliance | UNIX (45733) | Title: File ownership modified Description:The file's ownership changed after the last snapshot update. If the change is authorized, update the snapshot. If it is not authorized, restore ownership to the previous owner. | Severity: yellow-1 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]
String ID: ESMM_DIFF_OWN_GREEN Category: Policy Compliance | UNIX (45745) | Title: File ownership modified (Green Level) Description:The file's ownership changed after the last snapshot update. If the change is authorized, update the snapshot. If it is not authorized, restore ownership to the previous owner. | Severity: green-0 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]
String ID: ESMM_DIFF_OWN_YELLOW Category: Policy Compliance | UNIX (45746) | Title: File ownership modified (Yellow Level) Description:The file's ownership changed after the last snapshot update. If the change is authorized, update the snapshot. If it is not authorized, restore ownership to the previous owner. | Severity: yellow-2 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]
String ID: ESMM_DIFF_OWN_RED Category: Policy Compliance | UNIX (45747) | Title: File ownership modified (Red Level) Description:The file's ownership changed after the last snapshot update. If the change is authorized, update the snapshot. If it is not authorized, restore ownership to the previous owner. | Severity: red-4 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]


Changed files (permissions) (UNIX)

Module: File Watch

This check reports permissions changes that affect files and directories within the directory trees that are watched.

The following table lists the error messages for the check.

Table: Error messages for Changed files (permissions)

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: ESMM_DIFF_PERM Category: Policy Compliance | UNIX (45734) | Title: Directory or file permissions changed Description:The permissions for the directory or file were changed after the last snapshot update. If the changes are authorized, update the snapshot. If they are not authorized, restore the previous permissions. | Severity: yellow-1 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]
String ID: ESMM_DIFF_PERM_GREEN Category: Policy Compliance | UNIX (45748) | Title: Directory or file permissions changed (Green level) Description:The permissions for the directory or file were changed after the last snapshot update. If the changes are authorized, update the snapshot. If they are not authorized, restore the previous permissions. | Severity: green-0 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]
String ID: ESMM_DIFF_PERM_YELLOW Category: Policy Compliance | UNIX (45749) | Title: Directory or file permissions changed (Yellow level) Description:The permissions for the directory or file were changed after the last snapshot update. If the changes are authorized, update the snapshot. If they are not authorized, restore the previous permissions. | Severity: yellow-2 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]
String ID: ESMM_DIFF_PERM_RED Category: Policy Compliance | UNIX (45750) | Title: Directory or file permissions changed (Red level) Description:The permissions for the directory or file were changed after the last snapshot update. If the changes are authorized, update the snapshot. If they are not authorized, restore the previous permissions. | Severity: red-4 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]
String ID: ESMM_EXP_PERM Category: Policy Compliance | UNIX (45735) | Title: Directory or file permissions expanded Description:The permissions for the directory or file were expanded after the last snapshot update. If the changes are authorized, update the snapshot. If they are not authorized, restore the previous permissions. | Severity: yellow-1 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]
String ID: ESMM_EXP_PERM_GREEN Category: Policy Compliance | UNIX (45760) | Title: Directory or file permissions expanded (Green level) Description:The permissions for the directory or file were expanded after the last snapshot update. If the changes are authorized, update the snapshot. If they are not authorized, restore the previous permissions. | Severity: green-0 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]
String ID: ESMM_EXP_PERM_YELLOW Category: Policy Compliance | UNIX (45761) | Title: Directory or file permissions expanded (Yellow level) Description:The permissions for the directory or file were expanded after the last snapshot update. If the changes are authorized, update the snapshot. If they are not authorized, restore the previous permissions. | Severity: yellow-2 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]
String ID: ESMM_EXP_PERM_RED Category: Policy Compliance | UNIX (45762) | Title: Directory or file permissions expanded (Red level) Description:The permissions for the directory or file were expanded after the last snapshot update. If the changes are authorized, update the snapshot. If they are not authorized, restore the previous permissions. | Severity: red-4 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]


Changed files (signature) (UNIX)

Module: File Watch

This check performs signature checks and compares current signatures against snapshot values to detect changed files in the directory trees being watched.

The following table lists the error messages for the check.

Table: Error messages for Changed files (signature)

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: ESMM_MODIFIED Category: Policy Compliance | UNIX (45736) | Title: File modified Description:The file changed after the last snapshot update. If the changes are authorized, update the snapshot. If they are not authorized, restore to the file from a backup. | Severity: yellow-1 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]
String ID: ESMM_MODIFIED_GREEN Category: Policy Compliance | UNIX (45757) | Title: File modified (Green level) Description:The file changed after the last snapshot update. If the changes are authorized, update the snapshot. If they are not authorized, restore to the file from a backup. | Severity: green-0 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]
String ID: ESMM_MODIFIED_YELLOW Category: Policy Compliance | UNIX (45758) | Title: File modified (Yellow level) Description:The file changed after the last snapshot update. If the changes are authorized, update the snapshot. If they are not authorized, restore to the file from a backup. | Severity: yellow-2 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]
String ID: ESMM_MODIFIED_RED Category: Policy Compliance | UNIX (45759) | Title: File modified (Red level) Description:The file changed after the last snapshot update. If the changes are authorized, update the snapshot. If they are not authorized, restore to the file from a backup. | Severity: red-4 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]


Files/directories to watch (UNIX)

Module: File Watch

This option lets you enable and disable templates that specify files and directories to be watched for changes. These .fw templates are cross-platform with platform designations specified within the template files themselves.

The following table lists the error messages for the check.

Table: Error messages for Files/directories to watch

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: ESMM_SNAPSHOT_TAKEN Category: Policy Compliance | UNIX (45730) | Title: Snapshot taken Description:A snapshot of the directory has been created. This message should only be reported the first time that the module is run with this directory in the name list. If this message is unexpected, the previous snapshot may have been deleted to conceal unauthorized changes. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: ESMM_FILE_NOT_CHECKED Category: Policy Compliance | UNIX (45743) | Title: File not checked Description:The file or directory was not examined for the reason that is reported in the Information field. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: ESMM_NO_TEMPLATE Category: Policy Compliance | UNIX (45744) | Title: No template specified Description:No template was enabled, so the listed check or option could not be executed. Enable a template with the appropriate file extension and rerun the module. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Filter changed device ownership/permissions (UNIX)

Module: File Watch

Enable this option to prevent ESM from reporting file ownership or permissions changes for console login files on Linux systems. Files watched in the File Watch template may change ownership when users log on through the X console or one of the local tty devices. Specify the location of the console.perms file or the logindevperm file in the OS/Rev sublist of the File Watch template for directories containing device files. Enable the Changed files (ownership) check in addition to the Filter device ownership/permissions check.


Ignore Directories (UNIX)

Module: File Watch

This option enables file watch security checks to ignore directories to file systems.


Invalid signature (UNIX)

Module: File Watch

This check reports files with CRC, MD5, or combined file signatures that do not match signatures and signature types that are defined in the File Signatures template. Use the name list to enable or disable the selected File Signatures templates. These templates are identified by .fs file extensions.

The following table lists the error messages for the check.

Table: Error messages for Invalid signature

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: ESMM_SIG_NOTMATCH Category: Policy Compliance | UNIX (45740) | Title: File signature does not match template Description:The file signature does not match the signature that is specified in the File Signatures template. If the change is authorized, update the template file. If the change is not authorized, restore the file from a backup. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: true Information Field Format: [%s]
String ID: ESMM_FILE_NOTEXIST Category: Policy Compliance | UNIX (45742) | Title: Mandatory file does not exist Description:The file is defined as mandatory in the File Signatures template, but it does not exist. Add the missing file to the system or change the requirement for the file in the template. | Severity: yellow-3 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: ESMM_NO_TEMPLATE Category: Policy Compliance | UNIX (45744) | Title: No template specified Description:No template was enabled, so the listed check or option could not be executed. Enable a template with the appropriate file extension and rerun the module. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Keywords list (UNIX)

Module: File Watch

This option lets you enable or disable File Watch Keywords templates that File Watch templates use to locate file paths associated with keyword values.


Local disks only (UNIX)

Module: File Watch

This option restricts security checks to file systems that are located on local disks. File systems that are located on remote disks (served by NFS) will not be checked.

The following table lists the error message for the check.

Table: Error message for Local disks only

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: ESMM_FILE_NOT_CHECKED Category: Policy Compliance | UNIX (45743) | Title: File not checked Description:The file or directory was not examined for the reason that is reported in the Information field. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Malicious files (UNIX)

Module: File Watch

This check reports files with signatures that match attack signatures that are defined in Malicious File Watch templates. Use the name list to enable or disable Malicious File Watch templates that are identified by .mfw file extensions.

The following table lists the error messages for the check.

Table: Error messages for Malicious files

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: ESMM_MALICIOUS_FILE Category: Policy Compliance | UNIX (45737) | Title: Possible malicious file found Description:The file signature matches the malicious file signature pattern that is reported in the Information field. Investigate the file to determine if it is malicious. Compare it with a known good copy if possible. If the file is found to be malicious, remove it from the system and follow the procedures specified by your company's security policy. | Severity: yellow-2 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [Name: %s; probability: %s%%; description: %s]
String ID: ESMM_MFW_TEMPLATE_ERR Category: Policy Compliance | UNIX (45739) | Title: MFW template error Description:The Malicious File Watch template file contains the error that is reported in the Information field. Correct the error manually, then rerun the check. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: ESMM_NO_TEMPLATE Category: Policy Compliance | UNIX (45744) | Title: No template specified Description:No template was enabled, so the listed check or option could not be executed. Enable a template with the appropriate file extension and rerun the module. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


New files (UNIX)

Module: File Watch

This check reports files and directories that were added to the watched directory trees after the last snapshot update.

The following table lists the error messages for the check.

Table: Error messages for New files

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: ESMM_NEW Category: Policy Compliance | UNIX (45731) | Title: New directory or file Description:The file or directory was added after the last snapshot update. If the addition is authorized, update the snapshot. If it is not authorized, delete the file or directory. | Severity: yellow-1 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]
String ID: ESMM_NEW_GREEN Category: Policy Compliance | UNIX (45751) | Title: New directory or file (Green level) Description:The file or directory was added after the last snapshot update. If the addition is authorized, update the snapshot. If it is not authorized, delete the file or directory. | Severity: green-0 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]
String ID: ESMM_NEW_YELLOW Category: Policy Compliance | UNIX (45752) | Title: New directory or file (Yellow level) Description:The file or directory was added after the last snapshot update. If the addition is authorized, update the snapshot. If it is not authorized, delete the file or directory. | Severity: yellow-2 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]
String ID: ESMM_NEW_RED Category: Policy Compliance | UNIX (45753) | Title: New directory or file (Red level) Description:The file or directory was added after the last snapshot update. If the addition is authorized, update the snapshot. If it is not authorized, delete the file or directory. | Severity: red-4 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]


Removed files (UNIX)

Module: File Watch

This check reports files and directories that were removed from the watched directory trees after the last snapshot update.

The following table lists the error messages for the check.

Table: Error messages for Removed files

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: ESMM_REMOVED Category: Policy Compliance | UNIX (45732) | Title: Directory or file removed Description:The file or directory was removed after the last snapshot update. If the removal is authorized, update the snapshot. If it is not authorized, restore the file or directory from a backup. | Severity: yellow-1 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]
String ID: ESMM_REMOVED_GREEN Category: Policy Compliance | UNIX (45754) | Title: Directory or file removed (Green level) Description:The file or directory was removed after the last snapshot update. If the removal is authorized, update the snapshot. If it is not authorized, restore the file or directory from a backup. | Severity: green-0 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]
String ID: ESMM_REMOVED_YELLOW Category: Policy Compliance | UNIX (45755) | Title: Directory or file removed (Yellow level) Description:The file or directory was removed after the last snapshot update. If the removal is authorized, update the snapshot. If it is not authorized, restore the file or directory from a backup. | Severity: yellow-2 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]
String ID: ESMM_REMOVED_RED Category: Policy Compliance | UNIX (45756) | Title: Directory or file removed (Red level) Description:The file or directory was removed after the last snapshot update. If the removal is authorized, update the snapshot. If it is not authorized, restore the file or directory from a backup. | Severity: red-4 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]


Integrated Command Engine module

This section includes the following topics:

  • About the Integrated Command Engine module

  • Check Return Code (Windows and UNIX)

  • Command Engine templates (Windows and UNIX)

  • Copy Scripts (Windows and UNIX)

  • Display messages in order (Windows and UNIX)

  • Failed messages (Windows and UNIX)

  • Information messages (Windows and UNIX)

  • Not applicable messages (Windows and UNIX)

  • Not available messages (Windows and UNIX)

  • Overwrite Scripts (Windows and UNIX)

  • Passed messages (Windows and UNIX)

  • Redirect Stderr to Stdout (Windows and UNIX)

  • Report All Stderr messages (Windows and UNIX)

  • Script missing messages (Windows and UNIX)

  • Unmapped messages (Windows and UNIX)

  • User 1/0 messages (Windows and UNIX)

  • User 1/1 messages (Windows and UNIX)

  • User 1/2 messages (Windows and UNIX)

  • User 1/3 messages (Windows and UNIX)

  • User 1/4 messages (Windows and UNIX)

  • User 2/0 messages (Windows and UNIX)

  • User 2/1 messages (Windows and UNIX)

  • User 2/2 messages (Windows and UNIX)

  • User 2/3 messages (Windows and UNIX)

  • User 2/4 messages (Windows and UNIX)

  • User 3/0 messages (Windows and UNIX)

  • User 3/1 messages (Windows and UNIX)

  • User 3/2 messages (Windows and UNIX)

  • User 3/3 messages (Windows and UNIX)

  • User 3/4 messages (Windows and UNIX)


Login Parameters module

This section includes the following topics:

  • About the Login Parameters module

  • Devices with failed logins (UNIX)

  • Devices with no user restrictions (UNIX)

  • Excessive failed logins for users (UNIX)

  • Excessive failed logins on agent (UNIX)

  • Excessive failed su attempts for users (UNIX)

  • Excessive successful su attempts for users (UNIX)

  • Inactive accounts (UNIX)

  • Inactive accounts with unchanged passwords (UNIX)

  • Local accounts/groups only (UNIX)

  • Local disks only (UNIX)

  • Locked accounts (UNIX)

  • Login failures (UNIX)

  • Login retries (UNIX)

  • Maximum reported messages (UNIX)

  • Password changes failed (UNIX)

  • Password expired (UNIX)

  • Remote root logins (UNIX)

  • Report all inactive account instances (UNIX)

  • Successful login attempts not logged (UNIX)

  • Successful su attempts not logged (UNIX)

  • Trusted mode only: (UNIX)

  • Unsuccessful login attempts not logged (UNIX)

  • Unsuccessful su attempts not logged (UNIX)

  • Users to check (UNIX)

  • Warning banners (UNIX)

  • Warning banners (/etc/issue) (UNIX)


About the Login Parameters module

The Login Parameters module report the system logon vulnerabilities such as old and unused accounts, failed logons, and expired passwords.


Devices with failed logins (UNIX)

Module: Login Parameters

This check reports devices with failed logins and provides information about the failed logins if possible.

The following table lists the error messages for the check.

Table: Error messages for Devices with failed logins

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_FAILDEVICE Category: Policy Compliance | UNIX (5244) | Title: Devices with failed logins Description:The administrator can set different policies for logins at different terminals, depending on the site's physical and administrative needs. This check detects failed login attempts on devices. You should investigate all failed logins, especially any attempts on /dev/console or on a modem device. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_AIXPORTERROR Category: Policy Compliance | UNIX (5248) | Title: AIX /etc/security/portlog Description:This AIX system does not have an /etc/security/portlog file, or ESM cannot open or read the file. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_AIXPORT Category: Policy Compliance | UNIX (5249) | Title: Devices with failed logins Description:The listed ports have failed logins on them. This information is obtained from reading the /etc/security/portlog file. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Devices with no user restrictions (UNIX)

Module: Login Parameters

This check reports devices that do not have any user restrictions. On trusted security systems, administrators are able to limit who can come in on individual (or specific) devices.

The following table lists the error message for the check.

Table: Error message for Devices with no user restrictions

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_NORESTRICTIONS Category: Policy Compliance | UNIX (5247) | Title: Devices with no restrictions Description:The listed devices have no user restrictions on them. Anyone can use these devices. On trusted computer systems, administrators can limit the use of devices to specific users. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Excessive failed logins for users (UNIX)

Module: Login Parameters

This check reports users that have exceeded the allowed number of failed logins. Use the name list to exclude or include users to be checked. Specify the number of failed logins followed by a slash and the time period in hours.

The following table lists the error messages for the check.

Table: Error messages for Excessive failed logins for users

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_INVALID_DATA Category: Policy Compliance | UNIX (5265) | Title: Invalid failed login parameters Description:Parameters for the Excessive failed logins on agent and Excessive failed logins for users checks must be expressed using numbers and separated by a forward slash (/). The first number indicates the number of allowed login failures. The second number indicates the time period (in hours). For example, 5/24 indicates that five login failures are allowed within a 24 hour period. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_USER_LIMIT Category: Policy Compliance | UNIX (5263) | Title: User failed login limit exceeded Description:The user has exceeded the number of allowed failed logins. Login failures might indicate an attempted break in. This is especially true if there have been a large number of failures on only a few accounts. Contact the system administrator if these attempts are coming from a site outside your organization. Also, verify that the reported users have secure passwords and network configurations. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [User: %s; Failed: %s; Limit: %s; Hours: %s]
String ID: STKU_NOLOGINLOG Category: Policy Compliance | UNIX (5230) | Title: Failed login attempts not logged Description:The loginlog file does not exist. Failed login attempts are not being logged by the login program. You should create this file immediately. Read the man page for the loginlog file for more information if necessary. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Excessive failed logins on agent (UNIX)

Module: Login Parameters

This check reports agents that have exceeded the allowed number of failed logins. Specify the number of failed logins followed by a slash and the time period in hours.

The following table lists the error messages for the check.

Table: Error messages for Excessive failed logins on agent

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_INVALID_DATA Category: Policy Compliance | UNIX (5265) | Title: Invalid failed login parameters Description:Parameters for the Excessive failed logins on agent and Excessive failed logins for users checks must be expressed using numbers and separated by a forward slash (/). The first number indicates the number of allowed login failures. The second number indicates the time period (in hours). For example, 5/24 indicates that five login failures are allowed within a 24 hour period. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_AGENT_LIMIT Category: Policy Compliance | UNIX (5264) | Title: Agent failed login limit exceeded Description:The agent has exceeded the number of allowed failed logins. Login failures might indicate an attempted break in. This is especially true if there have been a large number of failures on only a few accounts. Contact the system administrator if these attempts are coming from a site outside your organization. Also, verify that users on this agent have secure passwords and network configurations. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [Failed: %s; Limit: %s; Hours: %s]
String ID: STKU_NOLOGINLOG Category: Policy Compliance | UNIX (5230) | Title: Failed login attempts not logged Description:The loginlog file does not exist. Failed login attempts are not being logged by the login program. You should create this file immediately. Read the man page for the loginlog file for more information if necessary. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Excessive failed su attempts for users (UNIX)

Module: Login Parameters

This check reports users that have exceeded the allowed number of failed su attempts. Use the name list to exclude or include substitute users to be checked. Specify the number of failed attempts followed by a slash and the time period in hours.

The following table lists the error messages for the check.

Table: Error messages for Excessive failed su attempts for users

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_FAILED_SU_EXCEED_LIMITS Category: Policy Compliance | UNIX (5268) | Title: Failed SU attempts exceed limits Description:The user has exceeded the number of allowed failed su attempts. SU failures might indicate an attempted break in. This is especially true if there have been a large number of failures on only a few accounts. Contact the system administrator if these attempts are coming from a site outside your organization. Also, verify that the reported users have secure passwords and network configurations. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [SU attempts: %s; Failed: %s; Limit: %s; Hours: %s]
String ID: STKU_INVALID_DATA Category: Policy Compliance | UNIX (5265) | Title: Invalid failed login parameters Description:Parameters for the Excessive failed logins on agent and Excessive failed logins for users checks must be expressed using numbers and separated by a forward slash (/). The first number indicates the number of allowed login failures. The second number indicates the time period (in hours). For example, 5/24 indicates that five login failures are allowed within a 24 hour period. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Excessive successful su attempts for users (UNIX)

Module: Login Parameters

This check reports users that have exceeded the allowed number of successful su attempts. Use the name list to exclude or include substitute users to be checked. Specify the number of successful attempts followed by a slash and the time period in hours.

The following table lists the error messages for the check.

Table: Error messages for Excessive successful su attempts for users

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_SUCCESS_SU_EXCEED_LIMITS Category: Policy Compliance | UNIX (5269) | Title: Successful SU attempts exceed limits Description:The user has exceeded the number of allowed successful su attempts. SU to substitute users might indicate an attempted break in. This is especially true if the substitute users are privilege users. Contact the system administrator if these attempts are coming from a site outside your organization. Also, verify that the reported users have secure passwords and network configurations. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [SU attempts: %s; Succeed: %s; Limit: %s; Hours: %s]
String ID: STKU_INVALID_DATA Category: Policy Compliance | UNIX (5265) | Title: Invalid failed login parameters Description:Parameters for the Excessive failed logins on agent and Excessive failed logins for users checks must be expressed using numbers and separated by a forward slash (/). The first number indicates the number of allowed login failures. The second number indicates the time period (in hours). For example, 5/24 indicates that five login failures are allowed within a 24 hour period. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Inactive accounts (UNIX)

Module: Login Parameters

This check reports accounts that have never been logged into, as well as accounts that have not been logged into for the number of days specified. Use the check's name list to include or exclude users.

The following table lists the error messages for the check.

Table: Error messages for Inactive accounts

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_LASTLOG Category: Policy Compliance | UNIX (5232) | Title: Inactive account Description:The listed users have not logged into their accounts for the specified number of days. Inactive accounts can become easy targets for intruders trying to break into your system. You should remove or disable inactive accounts. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_CANNOT_LOGIN Category: Policy Compliance | UNIX (5233) | Title: Cannot login Description:The listed users do not have any access to their accounts. AIX allows system administrators to apply restrictions to accounts. All of the AIX restrictions have been applied to these accounts. You should review the restrictions for the listed users to ensure that they are current and accurate. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_LOGIN_RESTRICTIONS Category: Policy Compliance | UNIX (5234) | Title: Login restrictions Description:The listed users have restricted logins. This message provides information but may not require any action on your part. These users do not have complete access to their accounts. This can be beneficial in systems that do not allow rlogin or telnet sessions. It can also be beneficial in systems that do not allow access to certain accounts through the su command. You should review the restrictions for the listed users to ensure that they are current and accurate. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [Login types disallowed: %s]
String ID: STKU_NO_LOGIN_RESTRICT Category: Policy Compliance | UNIX (5235) | Title: No login restrictions Description:The listed account does not have any login restrictions. AIX allows a system administrator to apply certain restrictions to accounts. There are three types of AIX login restrictions: su, local, and remote. You should apply these restrictions as your security needs demand. Read the man pages for more information about these restrictions. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Inactive accounts with unchanged passwords (UNIX)

Module: Login Parameters

This check reports accounts that are both inactive and have not had a password change within the specified number of days. Specify the number of inactive days followed by a slash and the number of days since a password change. Use the name list to include or exclude specified user accounts from the check.

The following table lists the error message for the check.

Table: Error message for Inactive accounts with unchanged passwords

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_INACTIVE_EXPIRED Category: Policy Compliance | UNIX (5267) | Title: Inactive account with unchanged password Description:The listed user account is inactive and has not had a password change within the specified number of days. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Local accounts/groups only (UNIX)

Module: Login Parameters

This option restricts checks to user accounts that are defined in the agent's /etc/passwd file. By selecting this option, you ensure that users are checked only once in sites that serve user accounts with NIS.


Local disks only (UNIX)

Module: Login Parameters

This option restricts checks to users with home directories that are located on disks that are local to the system running the check. Selecting this option ensures that user files are checked only once in sites that serve user directories with NFS, even though the module can be run on more than one system.


Locked accounts (UNIX)

Module: Login Parameters

This check reports user accounts that are locked. If possible, it reports the reason that the account is locked. Use the Users/Groups name lists to exclude users that are not excluded by the Users to check option.

The following table lists the error messages for the check.

Table: Error messages for Locked accounts

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_LOCKED Category: Policy Compliance | UNIX (5243) | Title: Locked accounts Description:This account is locked. Accounts are locked for the following reasons: 1. The password has expired. 2. The maximum number of unsuccessful login attempts has been exceeded. 3. The administrator lock is set. 4. The account expiration is reached. 5. The time since the last login is exceeded. If possible, the module will determine why the account is locked. You should investigate any locked account, especially if the maximum number of unsuccessful login attempts was reached. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_LOCKNOTSUP Category: Policy Compliance | UNIX (5250) | Title: Account locking not supported in non-trusted mode Description:The account locking feature is not an OS-supported feature on non-trusted systems. This message provides information but does not require any security action on your part. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Login failures (UNIX)

Module: Login Parameters

This check reports failed login attempts to user accounts. The check is not supported on all operating systems. This may require the system either to be running in an enhanced security mode or to have special logging features enabled. Use the check's name list to exclude users that are not excluded by the Users to check option.

The following table lists the error messages for the check.

Table: Error messages for Login failures

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_NOLOGINLOG Category: Policy Compliance | UNIX (5230) | Title: Failed login attempts not logged Description:The loginlog file does not exist. Failed login attempts are not being logged by the login program. You should create this file immediately. Read the man page for the loginlog file for more information if necessary. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_LOGFAIL Category: Policy Compliance | UNIX (5231) | Title: Failed login attempt Description:The listed accounts have had login attempt failures. Login attempt failures could indicate an attempt to break into your system. This is especially true if there have been a large number of attempts on only a few accounts. You should contact the system administrator if these attempts are coming from a site outside your organization. You should also verify that the listed accounts have secure passwords and network configurations. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Login retries (UNIX)

Module: Login Parameters

This check reports user accounts with settings that are greater than the Login retries value specified in your policy. This check is supported on AIX, Linux, Solaris 8.0+ and when running in trusted mode, HPUX and OSF1. Use the name list to exclude accounts that should not be reported by this check.

The following table lists the error messages for the check.

Table: Error messages for Login retries

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_LOGIN_RETRIES_EXCEEDS_LIMIT Category: Policy Compliance | UNIX (5260) | Title: Login retries setting exceeds policy value Description:The login retries setting for the named account exceeds the value specified in your policy. Set this value low to protect this account from a brute force password attack. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NOTSUPPORT_LOGIN_RETRIES Category: Policy Compliance | UNIX (5271) | Title: Login retries setting exceeds policy value Description:The login retries setting for the named account exceeds the value specified in your policy. Set this value low to protect this account from a brute force password attack. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Maximum reported messages (UNIX)

Module: Login Parameters

Enable this option to limit the number of messages returned for each enabled check. Use the value field to specify the maximum number of times a given message should be displayed. Once the maximum number has been reached for a single message, the message will be displayed once more with the number of repeating instances of the message that are not reported.


Password changes failed (UNIX)

Module: Login Parameters

This check reports user accounts that have failed password changes. If possible, it provides information about the failed password change. Use the Users/Groups name lists to exclude users that are not excluded by the Users to check option.

The following table lists the error messages for the check.

Table: Error messages for Password changes failed

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_UNSUCCESSFUL Category: Policy Compliance | UNIX (5245) | Title: Unsuccessful password changes Description:The listed users have had unsuccessful password changes. A lot of unsuccessful password changes could point to an intruder. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_AIXUNSUCCESSFUL Category: Policy Compliance | UNIX (5246) | Title: Unsuccessful password changes not logged Description:AIX does not log unsuccessful password changes. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_UNSUCNOTSUP Category: Policy Compliance | UNIX (5251) | Title: Failed Password Changes not supported in non-trusted mode Description:The Failed Password Changes check is not an OS-supported feature on non-trusted systems. This message provides information but does not require any security action on your part. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Password expired (UNIX)

Module: Login Parameters

This check reports user accounts with expired passwords on systems that support password expiration. The check also reports expired user accounts and other conditions that could make your system vulnerable to potential intruders with unauthorized password knowledge. Use the Users/Groups name lists to exclude users that are not excluded by the Users to check option.

The following table lists the error messages for the check.

Table: Error messages for Password expired

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_EXPIRED_AIX_ACC Category: Policy Compliance | UNIX (5237) | Title: Account expired Description:The listed accounts have expired. Inactive accounts can be easy targets for intruders trying to break into your system. You should review these accounts and remove or archive any accounts that are not actively being used on your system. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_EXPIRED Category: Policy Compliance | UNIX (5238) | Title: Password expired Description:The passwords for the listed accounts have expired. Account users will be required to supply new passwords when they next log in to the system. Accounts with expired passwords may no longer be active. You should review these accounts and remove or archive any accounts that are not actively being used on your system. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_PASS_LSTCHG Category: Policy Compliance | UNIX (5239) | Title: Password last change Description:The listed users are shown with the last time they changed their passwords. Users should be required to change passwords at regular intervals. The probability of an intruder guessing a user's password increases with the length of time the user is allowed to keep the same password. You should set a limit on the length of time a user is allowed to keep the same password. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_PASS_NOCHECK Category: Policy Compliance | UNIX (5240) | Title: Any password good Description:The listed accounts do not require users to enter passwords that meet minimum system requirements for password strength. The users can enter passwords that intruders find easy to guess. You should modify these accounts to require user passwords that meet minimum system requirements. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_PASS_WARN Category: Policy Compliance | UNIX (5241) | Title: Password warnings Description:This account has been warned that the password is about to expire. This message provides information but does not require any security action on your part. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Remote root logins (UNIX)

Module: Login Parameters

This check reports a problem when the root account can be accessed remotely through rlogin/telnet/ssh/scp. The root account should be accessed only through the system console.

The following table lists the error messages for the check.

Table: Error messages for Remote root logins

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_ROOTRLOGIN Category: Policy Compliance | UNIX (5257) | Title: Root can be accessed remotely Description:The root account can be accessed remotely through rlogin or telnet. The root account should be accessed only through the system console. | Severity: yellow-3 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [Root accessible ttys: %s]
String ID: STKU_SECURETTY_MISSING Category: Policy Compliance | UNIX (5258) | Title: No tty security file Description:The tty security file is missing. This file lets you control the security of devices such as terminals, pseudo-terminals, and windows. Without this file, the root account can be accessed remotely through rlogin or telnet. You should create this file with security settings appropriate for your site. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_DEFAULT_LOGIN_MISSING Category: Policy Compliance | UNIX (5259) | Title: No default login configuration file exists Description:The system is missing the login configuration file. This file lets you control the default login behavior of terminals, pseudo-terminals, and windows. You should create this file with default values appropriate to your site. See the man page for login for additional information. You should also consider restricting root logins to the console device or to a terminal that is located in a physically secured area and directly connected to your system. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_ROOTRSSH Category: Policy Compliance | UNIX (5272) | Title: Root can be accessed remotely by SSH or SCP Description:The root account can be accessed remotely through SSH or SCP. The root account should be accessed only through the system console. | Severity: yellow-3 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Report all inactive account instances (UNIX)

Module: Login Parameters

This option causes all inactive user accounts on all agents to be reported instead of reporting each account name on only one agent per job run. If you are not using NIS and want accounts with the same name on different systems to be treated separately, enable this option.

The following table lists the error message for the check.

Table: Error message for Report all inactive account instances

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_INACTIVE_ACCT Category: Policy Compliance | UNIX (5222) | Title: Inactive account Description:The listed users have not logged into their accounts for the specified number of days. Inactive accounts can become easy targets for intruders trying to break into your system. You should remove or disable inactive accounts. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Successful login attempts not logged (UNIX)

Module: Login Parameters

This check reports agent systems where successful login attempts are not being logged.

The following table lists the error message for the check.

Table: Error message for Successful login attempts not logged

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_SUCLOGNOLOG Category: Policy Compliance | UNIX (5252) | Title: Successful login attempts not logged Description:Successful login attempts are not being logged by this system. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Successful su attempts not logged (UNIX)

Module: Login Parameters

This check reports agent systems where successful su attempts are not being logged.

The following table lists the error message for the check.

Table: Error message for Successful su attempts not logged

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_SUCCESS_SU_NOT_LOG Category: Policy Compliance | UNIX (5255) | Title: Successful su attempts not logged Description:Successful su attempts are not being logged by this system. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Trusted mode only: (UNIX)

Module: Login Parameters

The security checks listed under this header are for UNIX systems that can be run in a trusted security mode. This is also called enhanced security mode on some systems. Currently-supported platforms include AIX, HP-UX, and Digital UNIX/Tru64.


Unsuccessful login attempts not logged (UNIX)

Module: Login Parameters

This check reports agent systems where unsuccessful login attempts are not being logged. NOTE: This check does not apply to Digital/OSF1/Tru64 systems that are not in TCB mode.

The following table lists the error messages for the check.

Table: Error messages for Unsuccessful login attempts not logged

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_UNSUCLOGNOLOG Category: Policy Compliance | UNIX (5253) | Title: Unsuccessful login attempts not logged Description:Unsuccessful login attempts are not being logged by this system. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NOT_REGULAR Category: Policy Compliance | UNIX (5254) | Title: Unsuccessful logins not logged to regular file Description:Unsuccessful login attempts are not being logged to a regular file. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Unsuccessful su attempts not logged (UNIX)

Module: Login Parameters

This check reports agent systems where unsuccessful su attempts are not being logged.

The following table lists the error message for the check.

Table: Error message for Unsuccessful su attempts not logged

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_UNSUCCESS_SU_NOT_LOG Category: Policy Compliance | UNIX (5256) | Title: Unsuccessful su attempts not logged Description:Unsuccessful su attempts are not being logged by this system. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Users to check (UNIX)

Module: Login Parameters

This option lets you specify name lists of users and user groups that will be excluded or included in all security checks executed by the module.

The following table lists the error messages for the check.

Table: Error messages for Users to check

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_FAILED_SU_EXCEED_LIMITS Category: Policy Compliance | UNIX (5268) | Title: Failed SU attempts exceed limits Description:The user has exceeded the number of allowed failed su attempts. SU failures might indicate an attempted break in. This is especially true if there have been a large number of failures on only a few accounts. Contact the system administrator if these attempts are coming from a site outside your organization. Also, verify that the reported users have secure passwords and network configurations. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [SU attempts: %s; Failed: %s; Limit: %s; Hours: %s]
String ID: STKU_SUCCESS_SU_EXCEED_LIMITS Category: Policy Compliance | UNIX (5269) | Title: Successful SU attempts exceed limits Description:The user has exceeded the number of allowed successful su attempts. SU to substitute users might indicate an attempted break in. This is especially true if the substitute users are privilege users. Contact the system administrator if these attempts are coming from a site outside your organization. Also, verify that the reported users have secure passwords and network configurations. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [SU attempts: %s; Succeed: %s; Limit: %s; Hours: %s]


Warning banners (UNIX)

Module: Login Parameters

This check looks for appropriate warning banners in the /etc/motd, /etc/issue (/etc/security/login.cfg on AIX), /etc/default/telnetd, and /etc/default/ftpd (/etc/fptd/ftpaccess on Solaris 9 and 10) files. The check reports files that are missing and banners that do not match at least one of the regular expressions that are specified in the check's name list. On Solaris only, the check also executes the eeprom command to check the banner that displays at boot time.

The following table lists the error messages for the check.

Table: Error messages for Warning banners

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_BANNER_NOT_MATCHED Category: Policy Compliance | UNIX (5261) | Title: File does not contain required banner phrase Description:The contents of the named file do not match any of the regular expressions that are listed in the check's name list. If the named file is "eeprom," the oem-banner eeprom setting did not exactly match any of the text strings that are specified in the name list. The eeprom check does not recognize regular expressions syntax. Use warning banners to provide legal notice to users that your systems are monitored to detect unauthorized uses. | Severity: yellow-3 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NO_BANNER_FILE Category: Policy Compliance | UNIX (5262) | Title: Named banner file does not exist Description:The named banner file does not exist, so some warning banners cannot be displayed on your system. If the named file is "eeprom," the oem-banner? eeprom setting is "false". Use warning banners to provide legal notice to users that your systems are monitored to detect unauthorized uses. | Severity: yellow-3 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_BANNER_PARAMETER_NOT_SET Category: Policy Compliance | UNIX (5270) | Title: Banner parameter in EEPROM is not set Description:The oem-banner parameter in the binary "eeprom" does not contain any banner. The eeprom check does not recognize regular expressions syntax. Use warning banners to provide legal notice to users that your systems are monitored to detect unauthorized uses. | Severity: yellow-3 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Warning banners (/etc/issue) (UNIX)

Module: Login Parameters

This check looks for appropriate warning banners in /etc/issue file on Solaris systems. The check does not report if the file is not available on the system. The check reports banners that do not match at least one of the regular expressions that are specified in the name list of check titled "Warning banners". This check should be executed along with the check titled "Warning Banners". The check will not report for any banner if executed as a stand-alone check.

The following table lists the error messages for the check.

Table: Error messages for Warning banners (/etc/issue)

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_BANNER_NOT_MATCHED Category: Policy Compliance | UNIX (5261) | Title: File does not contain required banner phrase Description:The contents of the named file do not match any of the regular expressions that are listed in the check's name list. If the named file is "eeprom," the oem-banner eeprom setting did not exactly match any of the text strings that are specified in the name list. The eeprom check does not recognize regular expressions syntax. Use warning banners to provide legal notice to users that your systems are monitored to detect unauthorized uses. | Severity: yellow-3 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NO_BANNER_FILE Category: Policy Compliance | UNIX (5262) | Title: Named banner file does not exist Description:The named banner file does not exist, so some warning banners cannot be displayed on your system. If the named file is "eeprom," the oem-banner? eeprom setting is "false". Use warning banners to provide legal notice to users that your systems are monitored to detect unauthorized uses. | Severity: yellow-3 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Network Integrity module

This section includes the following topics:

  • About the Network Integrity module

  • Access control (xhost) (UNIX)

  • Anonymous FTP enabled (UNIX)

  • Anonymous FTP owner (UNIX)

  • Anonymous FTP permissions (UNIX)

  • Anonymous FTP shell (UNIX)

  • Automatically update snapshots (UNIX)

  • Daemon logging (UNIX)

  • Deleted listening TCP ports (UNIX)

  • Deleted listening UDP ports (UNIX)

  • Exported non-secure exclude list (UNIX)

  • FTP allowed system accounts (UNIX)

  • FTP allowed users (UNIX)

  • FTP debug logging disabled (UNIX)

  • FTP denied users (UNIX)

  • FTP disabled (UNIX)

  • FTP enabled (UNIX)

  • FTP session logging disabled (UNIX)

  • Forbidden listening TCP ports (UNIX)

  • Forbidden listening UDP ports (UNIX)

  • Hosts.lpd allows all hosts and users (UNIX)

  • Hosts.lpd invalid comment characters (UNIX)

  • Hosts.lpd invalid dash character (UNIX)

  • Listening TCP ports (UNIX)

  • Listening UDP ports (UNIX)

  • Modified listening TCP ports (UNIX)

  • Modified listening UDP ports (UNIX)

  • NFS exported directory (UNIX)

  • NFS exported directory access (UNIX)

  • NFS exported directory anonymous UIDs (UNIX)

  • NFS exported directory anonymous access (UNIX)

  • NFS exported directory no access lists (UNIX)

  • NFS exported directory non-secure (UNIX)

  • NFS exported directory root access (UNIX)

  • NFS exported directory root access by any host (UNIX)

  • NFS exported directory writable by any host (UNIX)

  • NFS exported directory write permissions (UNIX)

  • NFS mounted directory (UNIX)

  • NIS/NIS+ enabled (UNIX)

  • NIS netgroups (UNIX)

  • Netgroup information (UNIX)

  • New listening TCP ports (UNIX)

  • New listening UDP ports (UNIX)

  • Print servers (UNIX)

  • Print service without printers (UNIX)

  • Promiscuous mode (UNIX)

  • SNMP config file path (UNIX)

  • SNMP default community strings (UNIX)

  • SNMP v3 encryption (UNIX)

  • SNMP version (UNIX)

  • SNMP write access (UNIX)

  • TFTP (UNIX)

  • Trusted hosts/users (UNIX)


About the Network Integrity module

The UNIX Network Integrity module reports vulnerabilities in NFS software and NIS or NIS+ services, and identifies user accounts that can access the host and user accounts in a UNIX domain through file transfer protocol (FTP) and trivial file transfer protocol (TFTP) utilities.

Note:

Backup any system administration file that you intend to modify before changing it. Modifying the administration files incorrectly can cause serious, network-wide problems.


Access control (xhost) (UNIX)

Module: Network Integrity

This check reports whether the command 'xhost +' has been run on the main display.

The following table lists the error messages for the check.

Table: Error messages for Access control (xhost)

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_NOXHOSTCHK Category: Change Notification | UNIX (6437) | Title: error with xhost command Description:An error occured while trying to discover whether the xhost + command has been executed on the main display on this machine. | Severity: yellow-3 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_ACCESS_DISABLED Category: Change Notification | UNIX (6438) | Title: Access control disabled Description:The command 'xhost +' has been run on the main display of this machine. This means that access control to the main display is turned off. Run the command 'xhost -' on the main display to turn access control back on. | Severity: yellow-3 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_ACCESS_UNKNOWN Category: Change Notification | UNIX (6439) | Title: Access control unknown Description:The 'xhost' command is not returning any status, which usually means that access control is disabled. It is possible that the 'xhost' command has been compromised, so the main display should be checked. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Anonymous FTP enabled (UNIX)

Module: Network Integrity

This check reports systems where anonymous FTP access is permitted.

The following table lists the error message for the check.

Table: Error message for Anonymous FTP enabled

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_ANONFTP Category: Change Notification | UNIX (6334) | Title: Anonymous FTP permitted Description:Anonymous FTP is permitted on your system. Anyone can transfer files to and from the FTP account on your system without special authorization. This is not generally a security risk because access is limited to files in the FTP account home directory. This message provides information but does not require any security action on your part. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Anonymous FTP owner (UNIX)

Module: Network Integrity

This check reports anonymous FTP directories that are not owned by root. Root should own these directories to prevent unauthorized users from accessing or modifying files.

The following table lists the error message for the check.

Table: Error message for Anonymous FTP owner

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_ROOTOWN Category: Change Notification | UNIX (6331) | Title: Root should own FTP directory Description:The following FTP directories are not owned by root. Proper ownership is required for correct FTP operation. Use the chown command to change user ownership to root. | Severity: red-4 Correctable: true Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Anonymous FTP permissions (UNIX)

Module: Network Integrity

This check reports anonymous FTP directories that are writable by user accounts other than the owner of the FTP home directory.

The following table lists the error message for the check.

Table: Error message for Anonymous FTP permissions

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_NOTWRITE Category: Change Notification | UNIX (6333) | Title: Should not have write permissions Description:The named FTP directories should not have write permissions. Write permissions are a security risk for your system. Use the chmod command to remove write permissions from each directory. | Severity: red-4 Correctable: true Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Anonymous FTP shell (UNIX)

Module: Network Integrity

This check reports which shell is being used for an anonymous FTP user. For security purposes, this should not be a valid shell.

The following table lists the error message for the check.

Table: Error message for Anonymous FTP shell

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_ANONSHELL Category: Change Notification | UNIX (6440) | Title: Anonymous FTP shell Description:An anonymous ftp account is present in your password file. For security reasons, the shell specified for this account should not be a valid one (e.g. /bin/false). This prevents users from logging in as the ftp user. If no shell is specified in the password file, the default shell will be used. You should verify that the shell specified is not a valid one. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [Shell: %s]


Automatically update snapshots (UNIX)

Module: Network Integrity

Enable this option to automatically update snapshots with current information.


Daemon logging (UNIX)

Module: Network Integrity

This check reports the running daemons whose corresponding logging file is not found on the agent machine. Use the template to specify the daemon name and the logging file for the check to work.


Deleted listening TCP ports (UNIX)

Module: Network Integrity

This check reports TCP ports that have been closed for listening since the last snapshot update.

The following table lists the error message for the check.

Table: Error message for Deleted listening TCP ports

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_DELETED_LISTENING_TCP_PORT Category: Change Notification | UNIX (6432) | Title: Deleted listening TCP port Description:The TCP port has stopped listening since the last snapshot update. If the port is not needed by an authorized service, update the snapshot in the console grid. If it is needed, reopen the port. | Severity: yellow-3 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]


Deleted listening UDP ports (UNIX)

Module: Network Integrity

This check reports UDP ports that have been closed for listening since the last snapshot update.

The following table lists the error message for the check.

Table: Error message for Deleted listening UDP ports

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_DELETED_LISTENING_UDP_PORT Category: Change Notification | UNIX (6435) | Title: Deleted listening UDP port Description:The UDP port has stopped listening since the last snapshot update. If the port is not needed by an authorized service, update the snapshot in the console grid. If it is needed, reopen the port. | Severity: yellow-3 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]


Exported non-secure exclude list (UNIX)

Module: Network Integrity

This check acts as an exclude list for the NFS exported directory non-secure check. Any directories listed in the exclude list below will not be reported.


FTP allowed system accounts (UNIX)

Module: Network Integrity

This check reports system accounts such as root and bin that are not denied access to FTP through the ftpusers file. System accounts should be denied FTP access. FTP passwords are transmitted in clear text and could be intercepted, which would give an attacker privileged access to your system.

The following table lists the error messages for the check.

Table: Error messages for FTP allowed system accounts

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_NOFTPUSERS Category: Change Notification | UNIX (6335) | Title: No ftpusers file on your system Description:The ftpusers file does not exist on your system. This is a security problem because the ftpusers file is used to prevent specific accounts from using FTP. In normal operations, some accounts should be denied access to FTP. This includes the root account, any guest accounts, uucp accounts, accounts with restricted shells, and any other account that should not be copying files across the network. You should create the ftpusers file and add these accounts to it. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_SYSACCMISS Category: Change Notification | UNIX (6338) | Title: System account can FTP Description:The named system account is not denied access to FTP through the ftpusers file. System accounts should be denied FTP access. FTP passwords are transmitted in clear text and could be intercepted, which would give an attacker privileged access to your system. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


FTP allowed users (UNIX)

Module: Network Integrity

This check reports users that are allowed FTP access to the system. Use the name list to exclude or include users for the check.

The following table lists the error messages for the check.

Table: Error messages for FTP allowed users

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_NOFTPUSERS Category: Change Notification | UNIX (6335) | Title: No ftpusers file on your system Description:The ftpusers file does not exist on your system. This is a security problem because the ftpusers file is used to prevent specific accounts from using FTP. In normal operations, some accounts should be denied access to FTP. This includes the root account, any guest accounts, uucp accounts, accounts with restricted shells, and any other account that should not be copying files across the network. You should create the ftpusers file and add these accounts to it. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_USERCANFTP Category: Change Notification | UNIX (6336) | Title: User permitted to use FTP Description:The named user has access to FTP. This user can use FTP to transfer files to and from other systems. You should add any user accounts that should be denied FTP access to the ftpusers file. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


FTP debug logging disabled (UNIX)

Module: Network Integrity

This check reports systems where FTP debug logging is not enabled. The check examines the FTP command line parameters in the inetd.conf or xinetd.conf file and checks for correct configuration entries in the syslog.conf file.

The following table lists the error message for the check.

Table: Error message for FTP debug logging disabled

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_FTP_NOLOG_DEBUG Category: Change Notification | UNIX (6420) | Title: FTP not configured to log debug messages Description:The file transfer protocol (FTP) daemon is not configured to log debug information. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


FTP denied users (UNIX)

Module: Network Integrity

This check reports users that are denied FTP access to the system. Use the name list to exclude or include users for the check.

The following table lists the error messages for the check.

Table: Error messages for FTP denied users

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_NOFTPUSERS Category: Change Notification | UNIX (6335) | Title: No ftpusers file on your system Description:The ftpusers file does not exist on your system. This is a security problem because the ftpusers file is used to prevent specific accounts from using FTP. In normal operations, some accounts should be denied access to FTP. This includes the root account, any guest accounts, uucp accounts, accounts with restricted shells, and any other account that should not be copying files across the network. You should create the ftpusers file and add these accounts to it. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_FTPDENIED Category: Change Notification | UNIX (6337) | Title: User denied access to FTP Description:The named user is denied access to FTP. Denied users should include the root account, any guest accounts, uucp accounts, accounts with restricted shells, and any other account that should not be copying files across the network. You should add any user accounts that should be denied FTP access to the ftpusers file. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


FTP disabled (UNIX)

Module: Network Integrity

This check reports any agent where FTP is disabled. FTP should be disabled or carefully configured to minimize security risks.

The following table lists the error message for the check.

Table: Error message for FTP disabled

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_NOFTP Category: Change Notification | UNIX (6330) | Title: FTP is not configured on your system Description:FTP is not configured on your system. The FTP daemon must be listed in /etc/inetd.conf or xinetd.conf for FTP to function. This message provides information but does not require any security action on your part. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


FTP enabled (UNIX)

Module: Network Integrity

This check reports any agent where FTP is enabled. FTP should be disabled or carefully configured to minimize security risks.

The following table lists the error message for the check.

Table: Error message for FTP enabled

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_FTP_ENABLED Category: Change Notification | UNIX (6421) | Title: FTP is configured on your system Description:The inetd.conf or xinetd.conf file indicates that FTP is configured on your system. FTP should be disabled or carefully configured to minimize security risks. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


FTP session logging disabled (UNIX)

Module: Network Integrity

This check reports systems where FTP session logging is not enabled. The check examines the FTP command line parameters in the inetd.conf or xinetd.conf file and checks for correct configuration entries in the syslog.conf file. Depending on the operating system, session logging may record session times, user account names, transferred file names, and session login failures.

The following table lists the error message for the check.

Table: Error message for FTP session logging disabled

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_FTP_NOLOG_SESSION Category: Change Notification | UNIX (6419) | Title: FTP session logging not configured Description:FTP session logging is not correctly configured on the agent system. To enable session logging, the FTP daemon must be started with the -l parameter in the inetd.conf or xinetd.conf file. Facilities and priorities must also be accurately identified in the syslog.conf file. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Forbidden listening TCP ports (UNIX)

Module: Network Integrity

This check reports TCP ports that are listening and are considered forbidden. Use the check's name list to specify port numbers that should be considered forbidden. This check is not supported on AIX versions prior to 4.3.

The following table lists the error message for the check.

Table: Error message for Forbidden listening TCP ports

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_FORBIDDEN_TCP Category: Change Notification | UNIX (6453) | Title: Forbidden listening TCP port Description:The named listening TCP port is forbidden and should be disabled. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Forbidden listening UDP ports (UNIX)

Module: Network Integrity

This check reports UDP ports that are listening and are considered forbidden. Use the check's name list to specify port numbers that should be considered forbidden. This check is not supported on AIX versions prior to 4.3.

The following table lists the error message for the check.

Table: Error message for Forbidden listening UDP ports

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_FORBIDDEN_UDP Category: Change Notification | UNIX (6454) | Title: Forbidden listening UDP port Description:The named listening UDP port is forbidden and should be disabled. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Hosts.lpd allows all hosts and users (UNIX)

Module: Network Integrity

This check reports systems with a hosts.lpd file that contains a line with only the plus sign (+) character. This line allows all users on all hosts to use the system's printers.

The following table lists the error message for the check.

Table: Error message for Hosts.lpd allows all hosts and users

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_LPD_ALLIN Category: Change Notification | UNIX (6416) | Title: All users on all hosts trusted for printing Description:The hosts.lpd file specifies that all users on all hosts are trusted for printing. This may be a security problem if you do not want all remote users to be able to print on your system's printers. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Hosts.lpd invalid comment characters (UNIX)

Module: Network Integrity

This check reports systems with a hosts.lpd file that contains lines with exclamation point (!) or pound sign (#) characters. These characters are used to identify comments in other files, but they are invalid in the hosts.lpd file where they can cause unexpected results with some versions of lpd.

The following table lists the error message for the check.

Table: Error message for Hosts.lpd invalid comment characters

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_LPD_COMMENT Category: Change Notification | UNIX (6417) | Title: Invalid comment character in hosts.lpd Description:The hosts.lpd file contains comment characters (! and #) that are invalid because there is no provision for comments in this file. This can cause unexpected behavior on some versions of lpd. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [Line num: %s; line: %s]


Hosts.lpd invalid dash character (UNIX)

Module: Network Integrity

This check reports systems where the first character in the hosts.lpd file is a dash (-) character, which exploits a known bug in some versions of lpd. See CERT CA-91:12.

The following table lists the error message for the check.

Table: Error message for Hosts.lpd invalid dash character

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_LPD_DASH Category: Change Notification | UNIX (6418) | Title: Invalid dash character in hosts.lpd Description:The first character in the hosts.lpd file is a dash (-) character, which allows a known exploit in some versions of lpd (see CERT CA-91:12). | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Listening TCP ports (UNIX)

Module: Network Integrity

This check reports listening TCP ports. The check also reports the process that opened the port if the /usr/sbin/lsof program exists on the agent. Use the check's name list to specify port numbers that should not be reported. This check is not supported on AIX versions prior to 4.3.

The following table lists the error message for the check.

Table: Error message for Listening TCP ports

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_OPEN_PORT Category: Change Notification | UNIX (6427) | Title: The named port is listening Description:The named port is listening. If the port should be open, add the port number to the name list of excluded ports for the Listening TCP ports or the Listening UDP ports check. If the port should not be open, stop the process that is using the port to protect your systems from unauthorized access. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [Owning process: %s]


Listening UDP ports (UNIX)

Module: Network Integrity

This check reports listening UDP ports. The check also reports the process that opened the port if the /usr/sbin/lsof program exists on the agent. Use the check's name list to specify port numbers that should not be reported. This check is not supported on AIX versions prior to 4.3.

The following table lists the error message for the check.

Table: Error message for Listening UDP ports

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_OPEN_PORT Category: Change Notification | UNIX (6427) | Title: The named port is listening Description:The named port is listening. If the port should be open, add the port number to the name list of excluded ports for the Listening TCP ports or the Listening UDP ports check. If the port should not be open, stop the process that is using the port to protect your systems from unauthorized access. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [Owning process: %s]


Modified listening TCP ports (UNIX)

Module: Network Integrity

This check reports listening TCP ports that have been modified since the last snapshot update.

The following table lists the error message for the check.

Table: Error message for Modified listening TCP ports

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_MODIFIED_LISTENING_TCP_PORT Category: Change Notification | UNIX (6433) | Title: Modified listening TCP port Description:The process that uses the TCP port has changed since the last snapshot update. If the change is authorized, update the snapshot in the console grid. If it is not authorized, stop the process. | Severity: yellow-3 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]


Modified listening UDP ports (UNIX)

Module: Network Integrity

This check reports listening UDP ports that have been modified since the last snapshot update.

The following table lists the error message for the check.

Table: Error message for Modified listening UDP ports

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_MODIFIED_LISTENING_UDP_PORT Category: Change Notification | UNIX (6436) | Title: Modified listening UDP port Description:The process that uses the UDP port has changed since the last snapshot update. If the change is authorized, update the snapshot in the console grid. If it is not authorized, stop the process. | Severity: yellow-3 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]


NFS exported directory (UNIX)

Module: Network Integrity

This check reports NFS exported directories with their export options. Use the file list to exclude directories from the check. Specify full path names in the file list.

The following table lists the error message for the check.

Table: Error message for NFS exported directory

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_FSEXPORT Category: Change Notification | UNIX (6361) | Title: File system exported Description:The following directories can be NFS mounted by remote systems. This is a security problem if there are no restrictions on which hosts can NFS mount the exported directories. You should export directories only if you explicitly specify each node that can NFS mount the directories. There is another security concern if the directories are exported with write access. Different sets of users can have access to the hosts that share an NFS directory. You should block write access to the exported directories. Finally, root access to exported file systems can be a security concern because privileged users on remote systems will have unrestricted access to the exported files. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


NFS exported directory access (UNIX)

Module: Network Integrity

This check reports the names of hosts that have remote access to exported file systems. Use the file list to exclude directories from the check. Specify full path names in the file list.

The following table lists the error message for the check.

Table: Error message for NFS exported directory access

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_EXPACCCHK Category: Change Notification | UNIX (6363) | Title: Access check for exported file systems Description:The following exported file systems allow NFS mount access to the remote systems or netgroups listed below. This is a security problem if any of the named systems is either a known security risk or an unknown system. You should carefully review the list of remote systems and remove any systems that are potential security risks. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


NFS exported directory anonymous UIDs (UNIX)

Module: Network Integrity

This check reports the user IDs through which anonymous users are granted access to named NFS exported directories by means of the anon=<UID> export option. Use the file list to exclude directories from the check. Specify full path names in the file list.

The following table lists the error message for the check.

Table: Error message for NFS exported directory anonymous UIDs

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_EXPANON Category: Change Notification | UNIX (6370) | Title: Anonymous mapping check for exported file systems Description:The following exported file systems map anonymous or unknown users to the user listed below. This might grant unknown users privileged access to the exported file system. A security problem exists if the anonymous users are mapped to a privileged user ID. You should carefully review the user name and user ID. Change the mappings that provide privileged access to these file systems. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


NFS exported directory anonymous access (UNIX)

Module: Network Integrity

This check reports NFS exported directories that can be accessed by anonymous users. Use the file list to exclude directories from the check. Specify full path names in the file list.

The following table lists the error message for the check.

Table: Error message for NFS exported directory anonymous access

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_EXP_ANON_ACCESS Category: Change Notification | UNIX (6422) | Title: Anonymous access is enabled Description:The named NFS exported directory allows anonymous access. If the anon option is not present or if it is set to a value other than -1, anonymous access is allowed. You should set the value of the anon option to -1 to disable anonymous access. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


NFS exported directory no access lists (UNIX)

Module: Network Integrity

This check reports NFS exported directories that do not have access lists. Without access lists, exported directories allow world access. You should use access lists with NFS exported directories to limit access to intended users. Use the file list to exclude directories from the check. Specify full path names in the file list.

The following table lists the error message for the check.

Table: Error message for NFS exported directory no access lists

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_EXPTOANY Category: Change Notification | UNIX (6362) | Title: File system exported to any host Description:The following exported file systems allow NFS mount access to any remote system. This is a security problem if unsecured systems exist on your network. You should export file systems with explicit access lists and limit access to only necessary systems. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


NFS exported directory non-secure (UNIX)

Module: Network Integrity

This check reports NFS exported directories that do not use a secure mode. In secure mode, NFS uses a stronger authentication procedure to ensure that only authorized users can access the directory. Not all operating systems support an NFS secure mode. Use the name list to specify the secure options that will be checked in the NFS configuration file.

The following table lists the error message for the check.

Table: Error message for NFS exported directory non-secure

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_NFS_EXPORT_NON_SECURE Category: Change Notification | UNIX (6403) | Title: NFS exported directory not secure Description:The specified directory is being exported in a non-secure mode. Normal UNIX authentication (UID/GID) will be used to control access to this directory. Using a more secure authentication method will increase protection of a shared directory. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


NFS exported directory root access (UNIX)

Module: Network Integrity

This check reports the names of hosts that have root access to NFS exported directories. Use the file list to exclude directories from the check. Specify full path names in the file list.

The following table lists the error message for the check.

Table: Error message for NFS exported directory root access

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_EXPROOTCHK Category: Change Notification | UNIX (6369) | Title: Root access check for exported file systems Description:The following exported file systems grant root access permission to the listed remote systems. This grants privileged users on the remote systems privileged access to the exported file system. This is a security problem if any system on the remote systems list is a known security risk. This is also a security problem if any system on the list is an unknown system. You should carefully review the list of remote systems. Remove any system that should not be granted root access to these file systems. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


NFS exported directory root access by any host (UNIX)

Module: Network Integrity

This check reports NFS exported directories that allow root access from any host on UNIX operating systems. Use the file list to exclude directories from the check. Specify full path names in the file list.

The following table lists the error message for the check.

Table: Error message for NFS exported directory root access by any host

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_EXPROOTANY Category: Change Notification | UNIX (6368) | Title: Root access available to any host Description:The following exported file systems grant root access permission to any system. This is a security problem for file systems that contain important data. You should not provide root access to exported file systems unless you explicitly specify each host. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


NFS exported directory writable by any host (UNIX)

Module: Network Integrity

This check reports NFS exported directories that are writable by any host. Use the file list to exclude directories from the check. Specify full path names in the file list.

The following table lists the error message for the check.

Table: Error message for NFS exported directory writable by any host

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_EXPANYWR Category: Change Notification | UNIX (6364) | Title: Exported file system can be written by any host Description:The following exported file systems grant write permissions to all systems on the export access list. This is a security problem for file systems that contain important data. You should not grant write permissions to exported file systems unless absolutely necessary. Also, you should explicitly specify each host that can NFS mount these file systems. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


NFS exported directory write permissions (UNIX)

Module: Network Integrity

This check reports the names of hosts that have write permissions to exported directories. Use the file list to exclude directories from the check. Specify full path names in the file list.

The following table lists the error message for the check.

Table: Error message for NFS exported directory write permissions

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_EXPWRCHK Category: Change Notification | UNIX (6367) | Title: Write check for exported file systems Description:The following exported file systems grant write permissions to the listed remote systems or netgroups. This is a security problem if any system on the remote systems list is a known security risk. This is also a security problem if any system on the list is an unknown system. You should carefully review the list of remote systems. Remove any system that should not be granted write permissions to these file systems. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


NFS mounted directory (UNIX)

Module: Network Integrity

This check provides information about NFS mounted directories. Use the file list to exclude directories from the check. Specify full path names in the file list.

The following table lists the error messages for the check.

Table: Error messages for NFS mounted directory

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_NFSMOUNTED Category: Change Notification | UNIX (6371) | Title: NFS mount point Description:The following remote directories are mounted on your system. This can be a security problem if setuid is allowed on these files. Setuid can allow a non-privileged user on your system to obtain privileges by running a setuid. Make sure that the privileged users on other systems that have access to the NFS served files can be trusted on your system. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NFSRWSOFT Category: Change Notification | UNIX (6372) | Title: NFS writable soft mount Description:The following NFS mount point is soft-mounted and writable. This is not recommended by the system vendor. You should immediately change the mount to either read-only or a hard mount. See the man pages for information about the mount command. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NFSSUID Category: Change Notification | UNIX (6373) | Title: NFS setuid mount Description:The following NFS mount points allow suid operation. The nosuid option has not been specified. This is a security problem because users on other systems can create setuid programs and shell scripts and run them from unprivileged accounts on this system. You should review these NFS mount points against your security policy to determine if the nosuid option should be used. See the man pages for information about the mount command. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


NIS/NIS+ enabled (UNIX)

Module: Network Integrity

This check examines the network information name service (NIS or NIS+) that is used by the agent system. The check determines whether NIS is enabled and, if it is enabled, which version is being used. The check also reports the agent's default domain name and the domain name server.

The following table lists the error messages for the check.

Table: Error messages for NIS/NIS+ enabled

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_NIS_DISABLED Category: Change Notification | UNIX (6407) | Title: NIS not enabled Description:NIS is not enabled on the agent. You should check the agent configuration to determine whether NIS should be enabled. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NIS_ENABLED Category: Change Notification | UNIX (6408) | Title: NIS enabled Description:NIS is enabled on the agent. You should check the agent configuration to determine whether NIS should be enabled. If it should be enabled, verify that the domain name and domain server are set correctly. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [Domain: %s; server: %s]
String ID: STKU_NIS_PLUS_ENABLED Category: Change Notification | UNIX (6409) | Title: NIS+ enabled Description:NIS+ is enabled on the agent. You should check the agent configuration to determine whether NIS+ should be enabled. If it should be, verify that the domain name and master server are set correctly. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NIS_NISPLUS_WARN Category: Change Notification | UNIX (6455) | Title: NIS/NIS+ warning Description:Error retrieving NIS/NIS+ data. The error number and its description are given. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


NIS netgroups (UNIX)

Module: Network Integrity

This check lists the netgroups stored in the NIS network information name service that is used by the agent system. Netgroup listings identify which hosts and users are allowed remote access to systems in listed domains.

The following table lists the error message for the check.

Table: Error message for NIS netgroups

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_NIS_NISPLUS_NETGROUP Category: Change Notification | UNIX (6415) | Title: NIS netgroup Description:The listed netgroups are stored in NIS. You should review the netgroup listings in NIS. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Netgroup information (UNIX)

Module: Network Integrity

This check compares the netgroup listings that are stored in the NIS name service with template records that define the netgroups that are authorized by your security policy. Netgroup listings identify which hosts and users are allowed remote access to systems in listed domains.

The following table lists the error messages for the check.

Table: Error messages for Netgroup information

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_NO_MATCHED_NETGROUP Category: Change Notification | UNIX (6410) | Title: Netgroup not matched Description:The netgroup is listed in NIS but not defined in the template file. You should review the netgroup listings in NIS and update the template to include all authorized netgroups. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_UNUSED_NETGROUP Category: Change Notification | UNIX (6411) | Title: Netgroup not used Description:The netgroup is defined in the template file but is not listed in NIS. You should review the netgroup listings in NIS and update the template if appropriate. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NO_MATCHED_TRIPLE Category: Change Notification | UNIX (6412) | Title: Triple not matched Description:The netgroup triple (i.e., host_name, user_name, domain_name) is listed in NIS but is not defined in the template file. You should review the netgroup listings in NIS and update the template if appropriate. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [Host: %s; user: %s; domain: %s]
String ID: STKU_WILDCARD_FIELD Category: Change Notification | UNIX (6413) | Title: Wildcard field found Description:The netgroup triple (i.e., host_name, user_name, domain_name listing) includes a wildcard or empty field in NIS but is not defined in the template. You should review the netgroup listings in NIS and update the template if appropriate. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [Host: %s; user: %s; domain: %s]
String ID: STKU_UNUSED_TRIPLE Category: Change Notification | UNIX (6414) | Title: Triple not used Description:The netgroup triple (i.e., host_name, user_name, domain_name listing) is defined in the template but is not listed in NIS. You should review the netgroup listings in NIS and update the template if appropriate. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [Host: %s; user: %s; domain: %s]


New listening TCP ports (UNIX)

Module: Network Integrity

This check reports TCP ports that have been opened for listening since the last snapshot update.

The following table lists the error message for the check.

Table: Error message for New listening TCP ports

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_NEW_LISTENING_TCP_PORT Category: Change Notification | UNIX (6431) | Title: New listening TCP port Description:The TCP port was opened for listening since the last snapshot update. If the service is authorized, update the snapshot in the console grid. If the service is not authorized, close the port. | Severity: red-4 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]


New listening UDP ports (UNIX)

Module: Network Integrity

This check reports UDP ports that have been opened for listening since the last snapshot update.

The following table lists the error message for the check.

Table: Error message for New listening UDP ports

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_NEW_LISTENING_UDP_PORT Category: Change Notification | UNIX (6434) | Title: New listening UDP port Description:The UDP port was opened for listening since the last snapshot update. If the service is authorized, update the snapshot in the console grid. If the service is not authorized, close the port. | Severity: red-4 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]


Print servers (UNIX)

Module: Network Integrity

This check reports systems that are running as print servers. The check verifies that a print spooler daemon is running, that it has at least one printer defined, and that at least one remote host can send jobs to its queues.

The following table lists the error messages for the check.

Table: Error messages for Print servers

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_LPD_SERVER Category: Change Notification | UNIX (6423) | Title: System acting as an lpd print server Description:This system is acting as a print server: lpd is running, /etc/printcap (/etc/qconfig for AIX) contains at least one printer, and there is at least one host listed in /etc/hosts.lpd or /etc/hosts.equiv. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_LPSCHED_SERVER Category: Change Notification | UNIX (6424) | Title: System acting as an lpsched print server Description:This system is acting as a print server: lpsched is running, at least one printer is defined, and there is at least one remote host that can print. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_CUPSD_SERVER Category: Change Notification | UNIX (6451) | Title: System acting as an cupsd print server Description:This system is acting as a print server: cupsd is running, either /etc/printcap or /etc/cups/printers.conf contains at least one printer, and there is at least one host listed in /etc/hosts.equiv. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Print service without printers (UNIX)

Module: Network Integrity

This check reports systems that are running a print spooler daemon but have not defined any printers. There is no reason to run this daemon if it isn't needed.

The following table lists the error messages for the check.

Table: Error messages for Print service without printers

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_LPD_NO_PRINTER Category: Change Notification | UNIX (6425) | Title: Daemon lpd is running without any defined printers Description:This system is running lpd but has no defined printers in /etc/printcap (/etc/qconfig for AIX). There is no reason to run this daemon if it is not being used. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_LPSCHED_NO_PRINTER Category: Change Notification | UNIX (6426) | Title: Daemon lpsched is running without any defined printers Description:This system is running lpsched but has no defined printers. There is no reason to run this daemon if it is not being used. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_CUPSD_NO_PRINTER Category: Change Notification | UNIX (6452) | Title: Daemon cupsd is running without any defined printers Description:This system is running cupsd but has no defined printers in /etc/printcap or /etc/cups/printers.conf. There is no reason to run this daemon if it is not being used. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Promiscuous mode (UNIX)

Module: Network Integrity

This check reports interfaces with promiscuous mode enabled. This check is only supported on Solaris sparc 2.8 64-bit and above and also on AIX 64-bit.

The following table lists the error messages for the check.

Table: Error messages for Promiscuous mode

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_PROMISC_OS_NOT_SUPPORTED Category: Change Notification | UNIX (6448) | Title: The OS is not supported for promiscuous mode detection Description:Promiscuous mode cannot be detected because the OS is not supported. AIX, HP-UX, Linux, Solaris 5.8 64-bit and higher are the only platforms supported. | Severity: yellow-3 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_PROMISC_ERROR Category: Change Notification | UNIX (6449) | Title: Promiscuous mode Error Description:An error occurred while attempting to detect promiscuous mode. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_PROMISC_DETECTED Category: Change Notification | UNIX (6450) | Title: Promiscuous mode detected Description:Promiscuous mode was detected on a network interface. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


SNMP config file path (UNIX)

Module: Network Integrity

This option lets you specify the path for the configuration file used by the SNMP agent. Each entry must contain a complete path name.


SNMP default community strings (UNIX)

Module: Network Integrity

This check reports if default community strings are being used.

The following table lists the error messages for the check.

Table: Error messages for SNMP default community strings

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_DEFAULT_COMMUNITY Category: Change Notification | UNIX (6441) | Title: Default community string found Description:A default community string was found. It is recommended that default values not be used as community strings as this creates a security risk. | Severity: yellow-3 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NO_SNMPD_CONF Category: Change Notification | UNIX (6445) | Title: No configuration file found for SNMP Description:The configuration file for snmp (snmpd.conf) was not found. Enter the path for this file in the option 'SNMP config file path'. | Severity: yellow-3 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_SNMPD_NOT_RUNNING Category: Change Notification | UNIX (6446) | Title: SNMP is not running Description:SNMP is not currently running. No SNMP checks will be performed. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


SNMP v3 encryption (UNIX)

Module: Network Integrity

This check reports if encryption is not being used with SNMP v3.

The following table lists the error messages for the check.

Table: Error messages for SNMP v3 encryption

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_V3_ENCRYPTION Category: Change Notification | UNIX (6443) | Title: Encryption is not being used Description:Encryption is not being used. Encryption of messages prevents eavesdropping by third parties. | Severity: yellow-3 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NO_SNMPD_CONF Category: Change Notification | UNIX (6445) | Title: No configuration file found for SNMP Description:The configuration file for snmp (snmpd.conf) was not found. Enter the path for this file in the option 'SNMP config file path'. | Severity: yellow-3 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_SNMPD_NOT_RUNNING Category: Change Notification | UNIX (6446) | Title: SNMP is not running Description:SNMP is not currently running. No SNMP checks will be performed. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


SNMP version (UNIX)

Module: Network Integrity

This check reports if the SNMP agent version is not v3.

The following table lists the error messages for the check.

Table: Error messages for SNMP version

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_AGENT_NOT_V3 Category: Change Notification | UNIX (6444) | Title: SNMP agent version is lower than v3 Description:The SNMP version being used by the agent is not version 3. SNMPv3 adds administration and security to SNMP. | Severity: yellow-3 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NO_SNMPD_CONF Category: Change Notification | UNIX (6445) | Title: No configuration file found for SNMP Description:The configuration file for snmp (snmpd.conf) was not found. Enter the path for this file in the option 'SNMP config file path'. | Severity: yellow-3 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_SNMPD_NOT_RUNNING Category: Change Notification | UNIX (6446) | Title: SNMP is not running Description:SNMP is not currently running. No SNMP checks will be performed. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


SNMP write access (UNIX)

Module: Network Integrity

This check reports if write access is allowed.

The following table lists the error messages for the check.

Table: Error messages for SNMP write access

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_WRITE_ACCESS Category: Change Notification | UNIX (6442) | Title: Write access is enabled Description:Write access is enabled. This is a potential security risk and it is recommended that write access be disabled. | Severity: yellow-3 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NO_SNMPD_CONF Category: Change Notification | UNIX (6445) | Title: No configuration file found for SNMP Description:The configuration file for snmp (snmpd.conf) was not found. Enter the path for this file in the option 'SNMP config file path'. | Severity: yellow-3 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_SNMPD_NOT_RUNNING Category: Change Notification | UNIX (6446) | Title: SNMP is not running Description:SNMP is not currently running. No SNMP checks will be performed. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


TFTP (UNIX)

Module: Network Integrity

This check examines the security of the trivial file transfer protocol (TFTP) utilities. Because TFTP users can transfer files to and from other file systems, you should carefully monitor TFTP access.

The following table lists the error messages for the check.

Table: Error messages for TFTP

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_SUNOS_UNSECURE_TFTP Category: Change Notification | UNIX (6339) | Title: TFTP daemon is not running in secure mode Description:The TFTP daemon is not running in secure mode. There are known security problems with TFTP that can be overcome by running the TFTP daemon in secure mode. To run the TFTP daemon in secure mode, add the -s option to the TFTP entry in the /etc/inetd.conf file. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_ULTRIX_UNSECURE_TFTP Category: Change Notification | UNIX (6340) | Title: TFTP daemon is not running in secure mode Description:The TFTP daemon is not running in secure mode. There are known security problems with TFTP that can be overcome by running the TFTP daemon in secure mode. To run the TFTP daemon in secure mode, add the -r option to the TFTP entry in the /etc/inetd.conf file. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_AIX_UNSECURE_TFTP Category: Change Notification | UNIX (6341) | Title: TFTP daemon is not configured securely Description:The TFTP daemon is not configured securely. To run TFTP in secure mode, the /etc/tftpaccess.ctl file must exist, be owned by root, have permissions of 644, and contain valid "allow:" and "deny:" entries. This is an immediate security problem because it allows anyone with access to your network to obtain any file with other read access. This includes the /etc/passwd file. You should either create /etc/tftpaccess.ctl with allow and deny entries or disable TFTP. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_TFTP_ACC_MISS Category: Change Notification | UNIX (6342) | Title: No TFTP user account Description:Your /etc/inetd.conf file is configured to run tftpd, but you do not have a TFTP account in /etc/passwd. You should add the TFTP user account to your passwd file. Specify a path argument with the tftpd command in your inetd.conf file to run TFTP. This will restrict client access to files that can be read or written by this user. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_TFTP_BAD_SHELL Category: Change Notification | UNIX (6343) | Title: Shell used by TFTP user account is bad Description:The shell used by the TFTP user account is either missing or is not the shell /bin/false. This is a security problem if a user can login through the TFTP account. You should set the shell for the TFTP account to /bin/false. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_TFTP_BAD_DIR Category: Change Notification | UNIX (6344) | Title: Home directory for TFTP account not set Description:The TFTP daemon will not run because the home directory for the TFTP account is missing from the passwd file. You should change the TFTP account's home directory to a directory owned by TFTP. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_TFTP_NOHOME Category: Change Notification | UNIX (6345) | Title: TFTP account does not have a home directory Description:The TFTP daemon will not run because the TFTP account does not have a home directory. You should create a home directory that is owned by the TFTP account. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_TFTP_BAD_UID Category: Change Notification | UNIX (6346) | Title: TFTP account does not own its home directory Description:The TFTP daemon will not run because the UID of the TFTP account does not match the UID of the home directory for the TFTP account. This is a security problem if the TFTP home directory has been changed. You should carefully check the directory and ownerships and make appropriate changes. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_AIX_TFTPACCESS Category: Change Notification | UNIX (6389) | Title: TFTP daemon allows/denies access on directory Description:Following is a list of directories that are allowed and denied access by TFTP. Check the listed directories and their subdirectories to be sure they contain only files that you want to make available to anyone on your network. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_AIX_TFTPDENY Category: Change Notification | UNIX (6390) | Title: TFTP daemon does not allow access on any directories Description:The TFTP daemon will not "allow:" any TFTP user to access any of the directories on your system. The /etc/tftpaccess.ctl file does not contain an "allow:" statement. You should either add at least one "allow:" statement to the /etc/tftpaccess.ctl file to run TFTP in a reliable secure mode or disable the TFTP daemon on your system. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NOTFTP Category: Change Notification | UNIX (6392) | Title: TFTP is not configured on your system Description:TFTP is not configured on your system. The TFTP daemon must be listed in /etc/inetd.conf or enabled in /etc/xinetd.d/tftp for TFTP to function. This message provides information but does not require any security action on your part. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_AIX_NO_TFTPACCESS Category: Change Notification | UNIX (6393) | Title: TFTP is not secure; tpaccess.ctl is missing Description:Tftpd is not running in secure mode. The /etc/tftpaccess.ctl file must exist and contain "deny:" and "allow:" entries if you want to run tftpd in secure mode. You should create this file. It must be owned by root and have permission bits set to 644. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_AIX_BAD_TFTPACCESS Category: Change Notification | UNIX (6394) | Title: TFTP is not secure; tftpaccess.ctl is ineffective Description:Tftpd is not running in secure mode. The /etc/tftpaccess.ctl file must be owned by root and have permission bits set to 644. To run TFTP in secure mode, you must change the owner and/or permissions of this file. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_AIX_WRONG_USER Category: Change Notification | UNIX (6395) | Title: The tftpd server does not have the nobody user ID Description:The tftpd server should have a user ID with the least privileges possible. The nobody ID allows the least permissions and is the default user ID. You should edit the tftp line in /etc/inet.conf to change the user ID to nobody. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_AIX_REMOTE_CREATE Category: Change Notification | UNIX (6396) | Title: The tftpd server allows remote users to create files Description:The tftpd server has been started with the -n option, which allows remote users to create files on the system. You should edit the tftp line in /etc/inetd.conf and remove the -n option. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_AIX_DEFAULT_DIR Category: Change Notification | UNIX (6397) | Title: A default TFTP destination directory has been specified Description:The path listed has been specified as the default destination directory. This directory will be used as the home directory for incoming files only. It will be used only if a full pathname is not specified. This message provides information but does not require any security action on your part. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_AIX_TX_LOGGING Category: Change Notification | UNIX (6398) | Title: TFTP transfer logging is not enabled Description:The tftpd server was not started with the '-v' flag. This flag will cause messages to be logged when any file is successfully transfered by the tftpd daemon. Log entries keep track of who is transfering files to and from the system with the tftpd daemon. This could be useful in tracking a suspected security breach. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_AIX_ADDR_LOGGING Category: Change Notification | UNIX (6399) | Title: The tftpd server is logging IP addresses with errors Description:The tftpd server was started with the -i flag. The IP address of the calling machine will be logged with error messages. This message provides information but does not require any security action on your part. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_AIX_ADDR2HOST Category: Change Notification | UNIX (6400) | Title: The tftpd server is converting IP addresses to host names Description:The tftpd server was started with the '-r' flag. The TFTP daemon will attempt to convert the IP address of the calling machine to the appropriate host name before messages are logged. This flag must be used with the '-i' or '-v' flag. This message provides information but does not require any security action on your part. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_AIX_SOCKLVL_DEBUG Category: Change Notification | UNIX (6401) | Title: Tftpd socket-level debugging is enabled Description:The tftpd server was started with the '-v' flag. This flag turns on socket level debugging. This message provides information but does not require any security action on your part. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_HASTFTP Category: Change Notification | UNIX (6402) | Title: TFTP is configured on your system Description:TFTP is configured on your system. The TFTP daemon must be listed in /etc/inetd.conf or enabled in /etc/xinetd.d/tftp for TFTP to function. The TFTP daemon should be disabled because it is considered to be insecure. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_SGID_TFTPD Category: Change Notification | UNIX (6404) | Title: TFTP daemon running as SGID Description:The TFTP daemon is running as SGID, which poses a security risk. The TFTP daemon should be disabled because it is considered to be insecure. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_SUID_TFTPD Category: Change Notification | UNIX (6405) | Title: TFTP daemon running as SUID Description:The TFTP daemon is running as SUID, which poses a security risk. The TFTP daemon should be disabled because it is considered to be insecure. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Trusted hosts/users (UNIX)

Module: Network Integrity

This check reports hosts and users that are trusted to access the agent system without supplying passwords through remote shell and remote login commands. You can use the name list to exclude all instances of either individual hosts or individual users from the check. You can also use the name list to exclude specific combinations of hosts and users from the check. The proper syntax for a host user entry in the exclude list is the host name followed by a space, then the user name.

The following table lists the error messages for the check.

Table: Error messages for Trusted hosts/users

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_ALLIN Category: Change Notification | UNIX (6347) | Title: All users on all hosts are trusted Description:The hosts.equiv file specifies that all users on all hosts are trusted. This is a security problem because any remote user with an account name that matches an account on your system (except root) can access your system. Access can be achieved using remote shell and remote login commands without even specifying a password. You should not allow trusted users to access your system. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_ALLUSER Category: Change Notification | UNIX (6348) | Title: User is trusted from any host Description:The hosts.equiv file specifies that the users listed below are trusted from any host. This is a security problem because any of these users that have an account name that matches an account on your system (except root) can access your system. Access can be achieved using remote shell and remote login commands without even specifying a password. You should not allow trusted users to access your system. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_CLUSTERIN Category: Change Notification | UNIX (6349) | Title: All hosts in your cluster are trusted Description:The hosts.equiv file specifies that all hosts in your HP-UX cluster are trusted. Any user in the cluster can access your system using remote shell and remote login commands without specifying a password. You should not allow trusted hosts to access your system. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_HOSTIN Category: Change Notification | UNIX (6350) | Title: All users on host are trusted Description:The hosts.equiv file specifies that all users on the hosts listed below are trusted. Any user on these hosts (except root) can access your system. Access can be achieved using remote shell and remote login commands without even specifying a password. You should not allow trusted users to access your system. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_HOSTOUT Category: Change Notification | UNIX (6351) | Title: Host is not trusted Description:The hosts.equiv file specifies that users on the listed hosts are not trusted. These users must specify a password before they can access your system using remote login. They cannot use remote shell. This message provides information but does not require any security action on your part. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_GROUPIN Category: Change Notification | UNIX (6352) | Title: Network group on host is trusted Description:The hosts.equiv file specifies that all users in the listed network groups on listed hosts are trusted. Any user in these network groups (except root) can access your system. Access can be achieved using remote shell and remote login commands without even specifying a password. You should not allow trusted users to access your system. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_GROUPOUT Category: Change Notification | UNIX (6353) | Title: Network group on host is not trusted Description:The hosts.equiv file specifies that all users in the listed network groups on listed hosts are not trusted. These users must specify a password before they can access your system using remote login. They cannot use remote shell. This message provides information but does not require any security action on your part. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_USERIN Category: Change Notification | UNIX (6354) | Title: User on host is trusted Description:The hosts.equiv file specifies that the listed users on the listed hosts are trusted. Any of these users (except root) can access your system. Access can be achieved using remote shell and remote login commands without even specifying a password. You should not allow trusted users to access your system. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_USEROUT Category: Change Notification | UNIX (6355) | Title: User on host is not trusted Description:The hosts.equiv file specifies that the listed users on the listed hosts are not trusted. These users must specify a password before they can access your system using remote login. They cannot use remote shell. This message provides information but does not require any security action on your part. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


OS Patches module

This section includes the following topics:

  • About the OS Patches module

  • Disable patch module (UNIX)

  • Installed patches (UNIX)

  • Patch not installed and process not running (UNIX)

  • Patch results summary (UNIX)

  • Patch templates (UNIX)

  • Superseded (UNIX)


About the OS Patches module

The OS Patches module reports patches that have been released for UNIX operating systems but are not found on the agent. The released patches are defined in template files. New patch templates are available bi-monthly through LiveUpdate.


Disable patch module (UNIX)

Module: OS Patches

When this option is enabled, no patches are checked.


Installed patches (UNIX)

Module: OS Patches

Enable this option to view all the installed patches that are checked by ESM.

The following table lists the error message for the check.

Table: Error message for Installed patches

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: ESM_INSTALLED_PATCH Category: Patch Assessment | UNIX (45245) | Title: Patch installed Description:This patch is installed and checked by ESM. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Patch not installed and process not running (UNIX)

Module: OS Patches

Enable this check to report patches that are not installed and not checked because the service or daemon that they would patch is not running. Missing patches are not reported if the running process condition is configured in the template and the process corresponding to the patch is not running. This check enables you to see missing patches that would otherwise not be reported as a result of this condition.

The following table lists the error message for the check.

Table: Error message for Patch not installed and process not running

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: ESM_MITIGATED_PATCH Category: Patch Assessment | UNIX (45244) | Title: Patch not installed and process not running Description:This patch is not installed, and the corresponding process is not running. Since the missing patch applies to a program that is not currently running, this may not pose an immediate risk. Refer to your security policy to determine if this patch should be installed. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Patch results summary (UNIX)

Module: OS Patches

Enable this option to list the total number of available patches, checked patches, missing patches, and forbidden patches. Total available patches are the patches that apply to this operating system and architecture. Total checked patches are patches that apply and have not been skipped. Patches can be skipped due to an unsatisfied sublist condition or when they apply to an application that is not installed. Total missing patches are patches that were supposed to be installed on the system, but are not present. Total forbidden patches are patches that were present, but are not allowed.

The following table lists the error message for the check.

Table: Error message for Patch results summary

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: ESM_PATCH_SUMMARY Category: Patch Assessment | UNIX (45243) | Title: Patch results summary Description:This summary lists total number of available patches, checked patches, missing patches, and forbidden patches. Total available patches are the patches that apply to this operating system and architecture. Total checked patches are patches that apply and have not been skipped. Patches can be skipped due to an unsatisfied sublist condition or when they apply to an application that is not installed. Total missing patches are patches that were supposed to be installed on the system, but are not present. Total forbidden patches are patches that were present, but are not allowed. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Patch templates (UNIX)

Module: OS Patches

This option lets you enable or disable template files that are used by the OS Patches module to check agent systems. The module uses only the enabled template files that match the agent's operating system. For example, on an agent running HP-UX, only enabled HP-UX templates are used.

The following table lists the error messages for the check.

Table: Error messages for Patch templates

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: ESM_NO_TEMPLATE_SPECIFIED Category: Patch Assessment | UNIX (45236) | Title: No applicable template files specified Description:The OS Patches module was run without applicable template files. No security checks were performed. Make sure that at least one template file is enabled for the agent's operating system and version. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: ESM_OPTIONAL_PATCH_NO_SUPERSEDE Category: Patch Assessment | UNIX (45241) | Title: Optional patch supersedes nothing Description:The patch cannot be Optional unless it supercedes at least one other patch. | Severity: yellow-2 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_PATCHNOTINS0 Category: Patch Assessment | UNIX (45233) | Title: Patch not installed Description:This patch is not installed. The message is informational only. Install the patch or implement a workaround. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [Vendor ID: %s; Date Issued: %s; Description: %s]
String ID: STKU_PATCHNOTINS1 Category: Patch Assessment | UNIX (45232) | Title: Patch not installed Description:This patch is not installed. It fixes a functionality problem, not a security problem. Install the patch or implement a workaround. | Severity: yellow-2 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [Vendor ID: %s; Date Issued: %s; Description: %s]
String ID: STKU_PATCHNOTINS2 Category: Patch Assessment | UNIX (45231) | Title: Patch not installed Description:This patch is not installed. It fixes a problem that lets unauthorized users deny service to legitimate users. Install the patch or implement a workaround. | Severity: yellow-2 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [Vendor ID: %s; Date Issued: %s; Description: %s]
String ID: STKU_PATCHNOTINS3 Category: Patch Assessment | UNIX (45230) | Title: Patch not installed Description:This patch is not installed. It fixes a problem that gives unauthorized root access to your system or certain files. Install the patch or implement a workaround. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [Vendor ID: %s; Date Issued: %s; Description: %s]
String ID: STKU_PATCHINSTALLED_AND_CHECKED Category: Patch Assessment | UNIX (45229) | Title: Patch Installed Description:This patch is installed. It fixes a problem that gives unauthorized root access to your system or certain files. Install the patch or implement a workaround. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s;Vendor ID: %s; Date Issued: %s; Description: %s]
String ID: ESM_FORBIDDEN_PATCH_0 Category: Patch Assessment | UNIX (45240) | Title: Forbidden patch found Description:This patch is installed. According to the template, it is forbidden. Remove it and install the previous version of the patch if one is available. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [Vendor ID: %s; Date Issued: %s; Description: %s]
String ID: ESM_FORBIDDEN_PATCH_1 Category: Patch Assessment | UNIX (45239) | Title: Forbidden patch found Description:This patch is installed. According to the template, it is forbidden. Remove it and install the previous version of the patch if one is available. | Severity: yellow-2 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [Vendor ID: %s; Date Issued: %s; Description: %s]
String ID: ESM_FORBIDDEN_PATCH_2 Category: Patch Assessment | UNIX (45238) | Title: Forbidden patch found Description:This patch is installed. According to the template, it is forbidden. Remove it and install the previous version of the patch if one is available. | Severity: yellow-2 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [Vendor ID: %s; Date Issued: %s; Description: %s]
String ID: ESM_FORBIDDEN_PATCH_3 Category: Patch Assessment | UNIX (45237) | Title: Forbidden patch found Description:This patch is installed. According to the template, it is forbidden. Remove it and install the previous version of the patch if one is available. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [Vendor ID: %s; Date Issued: %s; Description: %s]
String ID: STKU_PATCHNOTAVAIL2 Category: Patch Assessment | UNIX (45235) | Title: Patch not available Description:A CERT advisory has been issued for a problem that can deny service to legitimate users. When the advisory was issued, your OS vendor was working on a patch for the problem. Implement suggested workarounds and contact your OS vendor to obtain the patch that addresses the problem as soon as it is available. | Severity: yellow-2 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [Date Issued: %s; Description: %s]
String ID: STKU_PATCHNOTAVAIL3 Category: Patch Assessment | UNIX (45234) | Title: Patch not available Description:A CERT advisory has been issued for a problem that can compromise root access to your computer or files. When the advisory was issued, your OS vendor was working on a patch for the problem. Implement suggested workarounds and contact your OS vendor to obtain the patch that addresses the problem as soon as it is available. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [Date Issued: %s; Description: %s]


Superseded (UNIX)

Module: OS Patches

Enable this option to report a patch and its superseding patches if the patch and all of its superseding patches are missing.

The following table lists the error message for the check.

Table: Error message for Superseded

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: ESM_SUPERSEDED_PATCH_NOT_INSTALLED Category: Patch Assessment | UNIX (45242) | Title: Superseded patch not installed Description:The listed patch is not installed. However, this patch has been replaced by the patch or patches listed in the Information field. You can install this patch or install one of the superseding patches. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [Superseding patches:%s; Vendor ID:%s;Date Issued:%s;Description:%s %s]


Object Integrity module

This section includes the following topics:

  • About the Object Integrity module

  • Automatically update snapshots (UNIX)

  • Changed devices (UNIX)

  • Deleted devices (UNIX)

  • Device directories (UNIX)

  • Disk and memory access (UNIX)

  • Exclude devices (UNIX)

  • List Solaris zones (UNIX)

  • List Solaris zones without ESM (UNIX)

  • New devices (UNIX)

  • Solaris user stack protection (UNIX)


About the Object Integrity module

The Object Integrity module reports changes in ownership, permissions, and device IDs.

When this module checks the UNIX file permissions, the module examines only user/ group/other and read/write/execute permissions. It does not consider extended permissions such as access control lists (ACLs), which are available on some UNIX operating systems and some third-party extensions.

The module also creates and maintains the sifdev.dat device snapshot files. Run the module one time to create the baseline snapshot file on each agent, then periodically rerun the module to detect changes.

The UNIX Object Integrity module has three security checks that let you update records in the sifdev.dat snapshot file to match current values on the agent. Snapshot-updatable messages display the letters SU in the Updatable/ Correctable column of the console grid.


Automatically update snapshots (UNIX)

Module: Object Integrity

Enable this option to automatically update snapshots with current information.


Changed devices (UNIX)

Module: Object Integrity

This check reports any devices that have been changed since the last time the ESM device snapshot was updated.

The following table lists the error message for the check.

Table: Error message for Changed devices

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_CHGDEVICE Category: Policy Compliance | UNIX (6232) | Title: Changed system device Description:The devices listed below have been changed on your system since the last time the ESM device snapshot was updated. If these device changes were not made by the system administrator, they may represent a security breach. You should check all device changes to be sure they are authorized. Then update your snapshot with authorized changes. | Severity: yellow-1 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]


Deleted devices (UNIX)

Module: Object Integrity

This check reports any devices that have been deleted since the last time the ESM device snapshot was updated.

The following table lists the error message for the check.

Table: Error message for Deleted devices

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_DELDEVICE Category: Policy Compliance | UNIX (6231) | Title: Deleted system device Description:The devices listed below have been deleted from your system since the last time the ESM device snapshot was updated. If these devices were not deleted by the system administrator, they may represent a security breach. You should check all device deletions to be sure they are authorized. Then update your snapshot with authorized changes. | Severity: yellow-1 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]


Device directories (UNIX)

Module: Object Integrity

This option lets you specify the directories that contain the special device files. Missing directories will be ignored. The directory list defaults to /dev and /devices (/devices is used only on Solaris).


Disk and memory access (UNIX)

Module: Object Integrity

This check verifies that disk and memory special device files are owned by a privileged UID or a privileged GID and do not provide any other access.

The following table lists the error messages for the check.

Table: Error messages for Disk and memory access

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_ACCUSR Category: Policy Compliance | UNIX (6233) | Title: Improperly owned special device file Description:The disk or memory special device files listed below are owned by a UID that is non-privileged. This can allow unauthorized access to the disk or system memory. You should change the UID to 0. | Severity: red-4 Correctable: true Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_ACCGRP Category: Policy Compliance | UNIX (6234) | Title: Special device file with non-privileged group access Description:The disk or memory special device files listed below allow group access and are owned by a GID that is non-privileged. This can allow unauthorized access to the disk or system memory. You should change the GID to 3. | Severity: red-4 Correctable: true Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_ACCOTH Category: Policy Compliance | UNIX (6235) | Title: Special device file with other access Description:The disk or memory special device files listed below allow other access. This can allow unauthorized access to the disk or system memory. You should remove other access. | Severity: red-4 Correctable: true Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Exclude devices (UNIX)

Module: Object Integrity

This option lets you specify special device files that will be excluded from the check. Exclusions should be made only for device files that are protected and do not pose a security risk.


List Solaris zones (UNIX)

Module: Object Integrity

This check reports all Solaris zones. Use the name-list to include or exclude zones. Enter the zone status preceded by a pipe character to include or exclude zones with that status. For example, enter running to include or exclude zones with the running status. This check is available on Solaris 10 and runs from only the global zone.

The following table lists the error message for the check.

Table: Error message for List Solaris zones

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_ZONE Category: Policy Compliance | UNIX (6236) | Title: Solaris zone Description:The listed zone exists on the agent. Information about the zone is displayed in the information field. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


List Solaris zones without ESM (UNIX)

Module: Object Integrity

This check reports all Solaris zones that do not have ESM installed. Use the name-list to include or exclude zones. Enter the zone status preceded by a pipe character to include or exclude zones with that status. For example, enter running to include or exclude zones with the running status. This check is available on Solaris 10 and runs from only the global zone.

The following table lists the error message for the check.

Table: Error message for List Solaris zones without ESM

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_ZONE_WITHOUT_ESM Category: Policy Compliance | UNIX (6237) | Title: Solaris zone without ESM Description:The listed zone does not have ESM installed. Information about the zone is displayed in the information field. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


New devices (UNIX)

Module: Object Integrity

This check reports any devices that have been added since the last time the ESM device snapshot was updated.

The following table lists the error message for the check.

Table: Error message for New devices

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_NEWDEVICE Category: Policy Compliance | UNIX (6230) | Title: New system device Description:The devices listed below have been added to your system since the last time the ESM device snapshot was updated. If these devices were not added by the system administrator, they may represent a security breach. You should check all new devices to be sure they are authorized. Then update your snapshot with authorized changes. | Severity: yellow-1 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]


Solaris user stack protection (UNIX)

Module: Object Integrity

This check reports Solaris agents that do not have user stack protection enabled. User stack protection is enabled by specifying set noexec_user_stack=1 in /etc/system. This check requires Soalris 6 or higher.

The following table lists the error message for the check.

Table: Error message for Solaris user stack protection

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_SOLARIS_STACK Category: Policy Compliance | UNIX (6238) | Title: User stack protection not enabled Description:User stack protection is not enabled. To enable it, add set noexec_user_stack=1 to the /etc/system file. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Password Strength module

This section includes the following topics:

  • About the Password Strength module

  • Accounts can be used without a password (UNIX)

  • Accounts without passwords (UNIX)

  • Add prefix (UNIX)

  • Add suffix (UNIX)

  • Double occurrences (UNIX)

  • Exclude shell (UNIX)

  • Guessed password (UNIX)

  • Local accounts/groups only (UNIX)

  • Local disks only (UNIX)

  • Login requires password (UNIX)

  • Lowercase (UNIX)

  • Maximum password age (UNIX)

  • Maximum repeated characters (UNIX)

  • Maximum reported messages (UNIX)

  • Minimum alphabetic characters (UNIX)

  • Minimum different characters (UNIX)

  • Minimum digits (UNIX)

  • Minimum lower case characters (UNIX)

  • Minimum non-alphabetic characters (UNIX)

  • Minimum password age (UNIX)

  • Minimum password history (UNIX)

  • Minimum special characters (UNIX)

  • Minimum upper case characters (UNIX)

  • NAMECHECK allows username=password (UNIX)

  • Password Requirements (UNIX)

  • Password = any username (UNIX)

  • Password = username (UNIX)

  • Password = wordlist word (UNIX)

  • Password age (UNIX)

  • Password age lockout (UNIX)

  • Password age warning (UNIX)

  • Password length restrictions (UNIX)

  • Password within GECOS field (UNIX)

  • Plural forms (UNIX)

  • Repeating Characters (UNIX)

  • Reverse order (UNIX)

  • System generated passwords (UNIX)

  • Trusted mode only (UNIX)

  • Uppercase (UNIX)

  • Users can choose their passwords (UNIX)

  • Users to check (UNIX)

  • Users without system password strength (UNIX)

  • Verify DICTIONDBDIR entry (UNIX)

  • Verify DICTIONLIST entry (UNIX)

  • Whitespace characters (UNIX)


About the Password Strength module

The Password Strength module reports the users that can log in without a password, and passwords that do not conform to specified format, length, expiration, and history requirements. It also applies dictionary tests to detect passwords that are easily guessed.

The module checks local NIS and/or /etc/passwd files on standard UNIX computers and /tcb files and shadow password files on enhanced or trusted UNIX computers.

Red Hat Linux operating systems must be configured for both of the following:

  • The pam_cracklib.so module and standard UNIX password encryption

  • The pam_pwdb.so module and the shadow password file


Using and editing word files

Checks in the Password Strength module compare passwords to words in word files (.wrd files). The Password = wordlist word check, for example, compares passwords to dictionary word files. Passwords that match word file words and variations of those words can be easily guessed by intruders and are a security threat.

In the word files, capital letters following underscores in file names indicate the languages. For example, D = German, FR= French, I = Italian, NL = Dutch, P = Portuguese, SP= Spanish.

The following is a list of the word files:

Category | File | Number of words
First name | firstnam.wrd Fname_D.wrd Fname_FR.wrd Fname_I.wrd Fname_NL.wrd Fname_P.wrd Fname_SP.wrd | 651 1602 784 952 724 449 349
Last name | lastnam.wrd Fname_D.wrd Fname_FR.wrd Fname_I.wrd Fname_NL.wrd Fname_P.wrd Fname_SP.wrd | 2958 3101 3196 2848 3005 723 3027
Dictionaries | synopsis.wrd english.wrd lenglish.wrd Slist_D.wrd List_D.wrd Llist_D.wrd Slist_FR.wrd List_FR.wrd Llist_FR.wrd Slist_I.wrd List_I.wrd Llist_I.wrd Slist_NL.wrd List_NL.wrd Llist_NL.wrd Slist_P.wrd List_P.wrd Llist_P.wrd Slist_SP.wrd List_SP.wrd Llist_SP.wrd yiddish.wrd | 253 3489 34886 169 2597 19319 166 2517 17893 227 2490 14814 399 3038 14232 217 2169 16950 162 2424 19580 639
Computers | computer.wrd Compu_D.wrd Compu_FR.wrd Compu_I.wrd Compu_NL.wrd Compu_P.wrd Compu_SP.wrd defaults.wrd nerdnet-defaults.wrd ntccrack.wrd Oracle.wrd wormlist.wrd | 143 545 346 255 184 226 216 465 142 16870 37 432
Specialty | cartoon.wrd college.wrd disney.wrd hpotter.wrd python.wrd sports.wrd tolkien.wrd trek.wrd | 133 819 433 715 3443 247 471 876

To enable a word file

  1. In the Disabled Word Files list, select a word file.

  2. Click the left arrow.

To disable a word file

  1. In the Enabled Word files list, select a word file.

  2. Click the right arrow.

To edit a word file

  1. Do one of the following:

    • Open an existing word file in a text editor.

      UNIX word files are located in esm/words.

    • Create a new ASCII plain-text word file in a text editor. Name the new file with a .wrd extension.

  2. Type only one word per line.

  3. Save the file in the words directory.


Accounts can be used without a password (UNIX)

Module: Password Strength

This check reports user accounts that can be set to have NULL passwords on HP-UX and Digital UNIX/Tru64 systems. To avoid security problems, your operating system should be allowed to enforce non-NULL passwords on all accounts.

The following table lists the error messages for the check.

Table: Error messages for Accounts can be used without a password

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_ALLOWNULL Category: ESM Error | UNIX (5342) | Title: Account can be used without password Description:The listed user accounts are allowed to have NULL passwords. To avoid security problems, these accounts should be modified so that NULL passwords are not permitted when the user changes passwords. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NOTSUPPORT_ALLOWNULL Category: ESM Error | UNIX (5392) | Title: Account can be used without password not supported Description:The agent does not support the check for Account can be used without password. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Accounts without passwords (UNIX)

Module: Password Strength

This check reports user accounts that can be accessed without entering a password. The user list lets you exclude user accounts that should be excepted from the check.

The following table lists the error message for the check.

Table: Error message for Accounts without passwords

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_PASSNOPASS Category: ESM Error | UNIX (5331) | Title: No password Description:The accounts listed below do not have passwords. This is a security problem because anyone with the user name can access these accounts. You should immediately assign passwords to these accounts. Then instruct each user to login, using the assigned password, and change the password again. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Add prefix (UNIX)

Module: Password Strength

This option examines each password for matches when specified prefixes are added to the words in enabled wordlists. If "Password = username" is selected, Symantec ESM checks each password for a match when the prefix is added to the user name; e.g., golf -> progolf.

The following table lists the error messages for the check.

Table: Error messages for Add prefix

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_GUESSPASS Category: ESM Error | UNIX (5330) | Title: Guessed user password Description:Symantec ESM guessed the passwords of the accounts listed below. This is a security problem because an intruder can also guess these passwords while trying to break into your system. You should immediately assign more secure passwords to these accounts. Then instruct each user to login, using the more secure password, and change the password again. A secure password should have six to eight characters, should not be found in any dictionary, and should have at least one non-alphabetic character. A secure password should also not match an account or host name. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_UNKNOWN_PAM_MODULE Category: ESM Error | UNIX (5368) | Title: Unknown PAM authentication module Description:ESM does not recognize any of the modules currently configured for authentication. Default Solaris hash types will be used for password cracking. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: []


Add suffix (UNIX)

Module: Password Strength

This option examines each password for matches when specified suffixes are added to the words in enabled wordlists. If "Password = username" check is selected, Symantec ESM checks each password for a match when the suffix is added to the user name; e.g., golf -> golfball.

The following table lists the error messages for the check.

Table: Error messages for Add suffix

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_GUESSPASS Category: ESM Error | UNIX (5330) | Title: Guessed user password Description:Symantec ESM guessed the passwords of the accounts listed below. This is a security problem because an intruder can also guess these passwords while trying to break into your system. You should immediately assign more secure passwords to these accounts. Then instruct each user to login, using the more secure password, and change the password again. A secure password should have six to eight characters, should not be found in any dictionary, and should have at least one non-alphabetic character. A secure password should also not match an account or host name. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_UNKNOWN_PAM_MODULE Category: ESM Error | UNIX (5368) | Title: Unknown PAM authentication module Description:ESM does not recognize any of the modules currently configured for authentication. Default Solaris hash types will be used for password cracking. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: []


Double occurrences (UNIX)

Module: Password Strength

When this option is enabled, passwords are checked for matches with doubled spellings of words in enabled wordlists. If "Password = username" is selected, Symantec ESM examines each password for a match when the related user name is doubled; e.g., golf -> golfgolf.

The following table lists the error messages for the check.

Table: Error messages for Double occurrences

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_GUESSPASS Category: ESM Error | UNIX (5330) | Title: Guessed user password Description:Symantec ESM guessed the passwords of the accounts listed below. This is a security problem because an intruder can also guess these passwords while trying to break into your system. You should immediately assign more secure passwords to these accounts. Then instruct each user to login, using the more secure password, and change the password again. A secure password should have six to eight characters, should not be found in any dictionary, and should have at least one non-alphabetic character. A secure password should also not match an account or host name. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_UNKNOWN_PAM_MODULE Category: ESM Error | UNIX (5368) | Title: Unknown PAM authentication module Description:ESM does not recognize any of the modules currently configured for authentication. Default Solaris hash types will be used for password cracking. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: []


Exclude shell (UNIX)

Module: Password Strength

This option lets you specify shells. The shells in the name list will be treated as illegal shells. If one of illegal shells is assigned to the shell of user accounts, the ESM will skip the user accounts from all the checks in this module.


Guessed password (UNIX)

Module: Password Strength

When this option is enabled, module security checks that match and guess passwords report guessed passwords using the format, <first character>*<last character>. When this option is disabled, the same security checks report the names of the accounts for which passwords are guessed.


Local accounts/groups only (UNIX)

Module: Password Strength

This option restricts checks to user accounts that are defined in the agent's /etc/passwd file. By selecting this option, you ensure that users are checked only once in sites that serve user accounts with NIS.


Local disks only (UNIX)

Module: Password Strength

This option restricts checks to users with home directories that are located on disks that are local to the system running the check. Selecting this option ensures that user files are checked only once in sites that serve user directories with NFS, even though the module can be run on more than one system.


Login requires password (UNIX)

Module: Password Strength

This check reports agents that allow users to log in without entering a password. This is a serious breach of security. This check is available on AIX and Solaris systems only.

The following table lists the error messages for the check.

Table: Error messages for Login requires password

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_NO_PASSREQ Category: ESM Error | UNIX (5345) | Title: Login does not require password Description:The agent does not require user passwords upon login. This is a serious security breach. The listed accounts should require passwords upon login. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NOTSUPPORT_PASSREQ Category: ESM Error | UNIX (5355) | Title: Login Requires Password not supported Description:The agent does not support the Login Requires Password check. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_PASSREQ_NOTFOUND Category: ESM Error | UNIX (5385) | Title: Default password authentication parameter values not provided Description:Default password authentication parameter values are not provided. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Lowercase (UNIX)

Module: Password Strength

When this option is enabled, passwords are checked for matches with the lowercase forms of words in enabled wordlists. If "Password = username" is selected, Symantec ESM checks each password for a match when the related user name is changed to all lowercase characters. Note that Symantec ESM changes only the alpha characters to lowercase; e.g., GOLF1 -> golf1.

The following table lists the error messages for the check.

Table: Error messages for Lowercase

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_GUESSPASS Category: ESM Error | UNIX (5330) | Title: Guessed user password Description:Symantec ESM guessed the passwords of the accounts listed below. This is a security problem because an intruder can also guess these passwords while trying to break into your system. You should immediately assign more secure passwords to these accounts. Then instruct each user to login, using the more secure password, and change the password again. A secure password should have six to eight characters, should not be found in any dictionary, and should have at least one non-alphabetic character. A secure password should also not match an account or host name. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_UNKNOWN_PAM_MODULE Category: ESM Error | UNIX (5368) | Title: Unknown PAM authentication module Description:ESM does not recognize any of the modules currently configured for authentication. Default Solaris hash types will be used for password cracking. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: []


Maximum password age (UNIX)

Module: Password Strength

This check reports agents that have a system default maximum password age greater than the specified value and agents that do not have a maximum password age setting. The check also reports users that have a maximum password age greater than the specified value.

The following table lists the error messages for the check.

Table: Error messages for Maximum password age

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_NO_MAXAGE Category: ESM Error | UNIX (5348) | Title: Invalid maximum password age Description:The accounts listed have not been assigned a proper value for the maximum age of the user password. Your policy should assign a proper value to increase the overall security of the system. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NOTSUPPORT_MAXAGE Category: ESM Error | UNIX (5358) | Title: Maximum Password Age not supported Description:The agent does not support the check for Maximum Password Age. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Maximum repeated characters (UNIX)

Module: Password Strength

This check reports agents and users that have set the maximum number of times a character can be repeated in passwords to be greater than a specified maximum number. It also reports agents that have not set a maximum number. This check is available on AIX systems and Solaris 10 only.

The following table lists the error messages for the check.

Table: Error messages for Maximum repeated characters

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_NO_MAXREPEATS Category: ESM Error | UNIX (5347) | Title: Invalid maximum number of repeated characters Description:The listed accounts have not been assigned a proper value for the maximum number of single characters that can be repeated in the user password. Your policy should assign a proper value to increase the overall security of the system. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NOTSUPPORT_MAXREPEATS Category: ESM Error | UNIX (5357) | Title: Maximum Number of Repeated Characters not supported Description:The agent does not support the check for Maximum Number of Repeated Characters. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Maximum reported messages (UNIX)

Module: Password Strength

Enable this option to limit the number of messages returned for each enabled check. Use the value field to specify the maximum number of times a given message should be displayed. Once the maximum number has been reached for a single message, the message will be displayed once more with the number of repeating instances of the message that are not reported.


Minimum alphabetic characters (UNIX)

Module: Password Strength

This check reports agents and users that have set the minimum number of alphabetic characters required in passwords to be smaller than a specified minimum number. It also reports agents that have not set a minimum number. This check is available on AIX systems and Solaris 10 only.

The following table lists the error messages for the check.

Table: Error messages for Minimum alphabetic characters

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_NO_MINALPHA Category: ESM Error | UNIX (5350) | Title: Invalid minimum number of alphabetic characters Description:The accounts listed have not been assigned a proper value for the minimum number of alphabetic characters in the user password. Your policy should assign a proper value to increase the overall security of the system. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NOTSUPPORT_MINALPHA Category: ESM Error | UNIX (5360) | Title: Minimum Number of Alphabetic Characters not supported Description:The agent does not support the check for Minimum Number of Alphabetic Characters. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Minimum different characters (UNIX)

Module: Password Strength

This check reports agents and users that have set the minimum number of different characters required in new passwords to be smaller than a specified minimum number. It also reports agents that have not set a minimum number. This check is available on AIX systems and Solaris 10 only.

The following table lists the error messages for the check.

Table: Error messages for Minimum different characters

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_NO_MINDIFF Category: ESM Error | UNIX (5351) | Title: Invalid minimum number of different characters Description:The accounts listed have not been assigned a proper value for the minimum number of password characters that must differ from previous user passwords. Your policy should assign a proper value to increase the overall security of the system. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NOTSUPPORT_MINDIFF Category: ESM Error | UNIX (5361) | Title: Minimum Number of Different Characters not supported Description:The agent does not support the check for Minimum Number of Different Characters. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Minimum digits (UNIX)

Module: Password Strength

This check reports agents that have set the minimum digits in passwords to be less than a specified minimum number. It also reports agents that have not set a minimum number. This check is available on Solaris 10 and HP-UX 11+ only.

The following table lists the error messages for the check.

Table: Error messages for Minimum digits

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_NO_MINDIGIT Category: ESM Error | UNIX (5376) | Title: Invalid minimum number of digits Description:The agent listed has not been assigned a proper value for the minimum number of password characters that must be digits. Your policy should assign a proper value to increase the overall security of the system. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NOTSUPPORT_MINDIGIT Category: ESM Error | UNIX (5377) | Title: Minimum Number of Digits not supported Description:The agent does not support the check for Minimum Number of Digits. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Minimum lower case characters (UNIX)

Module: Password Strength

This check reports agents that have set the minimum number of lower case characters in passwords to be less than a specified minimum number. It also reports agents that have not set a minimum number. This check is available on Solaris 10 and HP-UX 11+ only.

The following table lists the error messages for the check.

Table: Error messages for Minimum lower case characters

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_NO_MINLOWER Category: ESM Error | UNIX (5374) | Title: Invalid minimum number of lower case characters Description:The agent listed has not been assigned a proper value for the minimum number of password characters that must be in lower case. Your policy should assign a proper value to increase the overall security of the system. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NOTSUPPORT_MINLOWER Category: ESM Error | UNIX (5375) | Title: Minimum Number of Lower Case Characters not supported Description:The agent does not support the check for Minimum Number of Lower Case Characters. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Minimum non-alphabetic characters (UNIX)

Module: Password Strength

This check reports agents and users that have set the minimum number of non-alphabetic characters required in passwords to be smaller than a specified minimum number. It also reports agents that have not set a minimum number. This check is available on AIX systems and Solaris 10 only.

The following table lists the error messages for the check.

Table: Error messages for Minimum non-alphabetic characters

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_NO_MINOTHER Category: ESM Error | UNIX (5352) | Title: Invalid minimum number of non-alphabetic characters Description:The accounts listed have not been assigned a proper value for the minimum number of non-alphabetic characters in the user password. Your policy should assign a proper value to increase the overall security of the system. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NOTSUPPORT_MINOTHER Category: ESM Error | UNIX (5362) | Title: Minimum Number of Non-Alphabetic Characters not supported Description:The agent does not support the check for Minimum Number of Non-Alphabetic Characters. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Minimum password age (UNIX)

Module: Password Strength

This check reports agents that have a system default minimum password age smaller than the specified value and agents that do not have a minimum password age setting. The check also reports users that have a minimum password age smaller than the specified value.

The following table lists the error messages for the check.

Table: Error messages for Minimum password age

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_NO_MINAGE Category: ESM Error | UNIX (5349) | Title: Invalid minimum password age Description:The accounts listed have not been assigned a proper value for the minimum age of the user password. Your policy should assign a proper value to increase the overall security of the system. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NOTSUPPORT_MINAGE Category: ESM Error | UNIX (5359) | Title: Minimum Password Age not supported Description:The agent does not support the check for Minimum Password Age. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Minimum password history (UNIX)

Module: Password Strength

This check reports agents and users with password history settings that are less than a specified minimum number of passwords. It also reports agents that do not have password history settings. This check is available on AIX ,trusted mode HP-UX 11+ and Solaris 10 systems only.

The following table lists the error messages for the check.

Table: Error messages for Minimum password history

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_NO_HISTSIZE Category: ESM Error | UNIX (5353) | Title: Invalid minimum password history Description:The accounts listed have not been assigned a proper value for the minimum number of user passwords that will be retained as history to prevent reuse of previously-used passwords. Your policy should assign a proper value to increase the overall security of the system. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NOTSUPPORT_HISTSIZE Category: ESM Error | UNIX (5363) | Title: Minimum Password History not supported Description:The agent does not support the Minimum Password History check. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Minimum special characters (UNIX)

Module: Password Strength

This check reports agents that have set the minimum number of special characters (non-alpha and non-digit) passwords to be less than a specified minimum number. It also reports agents that have not set a minimum number. This check is available on Solaris 10 and HP-UX 11+ only.

The following table lists the error messages for the check.

Table: Error messages for Minimum special characters

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_NO_MINSPECIAL Category: ESM Error | UNIX (5378) | Title: Invalid minimum number of special characters Description:The agent listed has not been assigned a proper value for the minimum number of password characters that must be special characters (non-alpha and non-digit). Your policy should assign a proper value to increase the overall security of the system. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NOTSUPPORT_MINSPECIAL Category: ESM Error | UNIX (5379) | Title: Minimum Number of Special Characters not supported Description:The agent does not support the check for Minimum Number of Special Charaters. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Minimum upper case characters (UNIX)

Module: Password Strength

This check reports agents that have set the minimum number of upper case characters in passwords to be less than a specified minimum number. It also reports agents that have not set a minimum number. This check is available on Solaris 10 and HP-UX 11+ only.

The following table lists the error messages for the check.

Table: Error messages for Minimum upper case characters

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_NO_MINUPPER Category: ESM Error | UNIX (5372) | Title: Invalid minimum number of upper case characters Description:The agent listed has not been assigned a proper value for the minimum number of password characters that must be in upper case. Your policy should assign a proper value to increase the overall security of the system. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NOTSUPPORT_MINUPPER Category: ESM Error | UNIX (5373) | Title: Minimum Number of Upper Case Characters not supported Description:The agent does not support the check for Minimum Number of Upper Case Characters. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


NAMECHECK allows username=password (UNIX)

Module: Password Strength

Check verifies if NAMECHECK setting allows users login name and password to be same. This check is available on Solaris 10 only.

The following table lists the error messages for the check.

Table: Error messages for NAMECHECK allows username=password

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_NAMECHECK Category: ESM Error | UNIX (5389) | Title: NAMECHECK allows username=password Description:The agent listed does not have NAMECHECK setting to disallow username = password. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NOTSUPPORT_NAMECHECK Category: ESM Error | UNIX (5390) | Title: NAMECHECK entry not supported Description:The agent does not support the check for NAMECHECK. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Password Requirements (UNIX)

Module: Password Strength

This check reports password options that do not match those found in the enabled templates. This check only processes attribute = value kind of format. e.g /etc/default/passwd file on Sun OS.

The following table lists the error messages for the check.

Table: Error messages for Password Requirements

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_PASSWORD_REQUIREMENT_GREEN Category: ESM Error | UNIX (5369) | Title: Password option does not match template Description:The listed password option does not match the allowed values in the tempale. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_PASSWORD_REQUIREMENT_YELLOW Category: ESM Error | UNIX (5370) | Title: Password option does not match template Description:The listed password option does not match the allowed values in the tempale. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_PASSWORD_REQUIREMENT_RED Category: ESM Error | UNIX (5371) | Title: Password option does not match template Description:The listed password option does not match the allowed values in the tempale. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Password = any username (UNIX)

Module: Password Strength

This check examines each password and reports when the password and any username match.

The following table lists the error messages for the check.

Table: Error messages for Password = any username

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_GUESSPASS Category: ESM Error | UNIX (5330) | Title: Guessed user password Description:Symantec ESM guessed the passwords of the accounts listed below. This is a security problem because an intruder can also guess these passwords while trying to break into your system. You should immediately assign more secure passwords to these accounts. Then instruct each user to login, using the more secure password, and change the password again. A secure password should have six to eight characters, should not be found in any dictionary, and should have at least one non-alphabetic character. A secure password should also not match an account or host name. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_UNKNOWN_PAM_MODULE Category: ESM Error | UNIX (5368) | Title: Unknown PAM authentication module Description:ESM does not recognize any of the modules currently configured for authentication. Default Solaris hash types will be used for password cracking. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: []


Password = username (UNIX)

Module: Password Strength

This check examines each password and reports when the username and password match. The check is not as thorough as "Password = any username" and is provided for systems with a large number of user accounts. If the "Password = any username" takes too long or is too CPU intensive, you can use "Password = username" on a daily basis and the "Password = any username" on weekends.

The following table lists the error messages for the check.

Table: Error messages for Password = username

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_GUESSPASS Category: ESM Error | UNIX (5330) | Title: Guessed user password Description:Symantec ESM guessed the passwords of the accounts listed below. This is a security problem because an intruder can also guess these passwords while trying to break into your system. You should immediately assign more secure passwords to these accounts. Then instruct each user to login, using the more secure password, and change the password again. A secure password should have six to eight characters, should not be found in any dictionary, and should have at least one non-alphabetic character. A secure password should also not match an account or host name. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_UNKNOWN_PAM_MODULE Category: ESM Error | UNIX (5368) | Title: Unknown PAM authentication module Description:ESM does not recognize any of the modules currently configured for authentication. Default Solaris hash types will be used for password cracking. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: []


Password = wordlist word (UNIX)

Module: Password Strength

This check examines each password and reports matches with words in the word list (e.g., golf -> golf). The word files list lets you enable and disable the word files that are used for this check. For shorter run times, in the Percent of words per policy run text box, type a number less than 100. This defines the percentage of words that are examined during each run. Each run starts at the place in the word list where the previous run ended.

The following table lists the error messages for the check.

Table: Error messages for Password = wordlist word

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_GUESSPASS Category: ESM Error | UNIX (5330) | Title: Guessed user password Description:Symantec ESM guessed the passwords of the accounts listed below. This is a security problem because an intruder can also guess these passwords while trying to break into your system. You should immediately assign more secure passwords to these accounts. Then instruct each user to login, using the more secure password, and change the password again. A secure password should have six to eight characters, should not be found in any dictionary, and should have at least one non-alphabetic character. A secure password should also not match an account or host name. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NOWORDS Category: ESM Error | UNIX (5336) | Title: No word files specified Description:The Password = wordlist word option was enabled but no word files were specified. Change your policy so that at least one word file is enabled. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_UNKNOWN_PAM_MODULE Category: ESM Error | UNIX (5368) | Title: Unknown PAM authentication module Description:ESM does not recognize any of the modules currently configured for authentication. Default Solaris hash types will be used for password cracking. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: []


Password age (UNIX)

Module: Password Strength

This check reports user accounts with passwords that have not been changed within the specified number of days.

The following table lists the error messages for the check.

Table: Error messages for Password age

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_NO_MINCHANGE Category: ESM Error | UNIX (5346) | Title: Invalid password age Description:The passwords for the accounts listed have not been changed within the number of days specified by your policy. Users should be required to frequently change passwords to increase the overall security of the system. | Severity: yellow-3 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NOTSUPPORT_MINCHANGE Category: ESM Error | UNIX (5356) | Title: Password Age Checking not supported Description:The agent does not support Password Age Checking. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Password age lockout (UNIX)

Module: Password Strength

This check reports agents that have a system password lockout age greater than the specified value and systems that do not have a password lockout age setting. The check also reports users that have a password lockout age greater than the specified value. This check is supported only on HP-UX operating systems in secure mode.

The following table lists the error messages for the check.

Table: Error messages for Password age lockout

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_AGE_LOCKOUT Category: ESM Error | UNIX (5365) | Title: Password Age Lockout Description:The accounts listed have not been set to lockout the workstation the user password has not been changed during a specified period. Your policy should assign an lockout to increase the overall security of the system. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NOTSUPPORT_AGE_LOCKOUT Category: ESM Error | UNIX (5364) | Title: Password Age Lockout not supported Description:The agent does not support the check for Password Age Lockout. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Password age warning (UNIX)

Module: Password Strength

This check reports agents that have a system password warning age greater than the specified value and systems that do not have a password warning age setting. The check also reports users that have a password warning age greater than the specified value. This check is supported on Following 1)HP-UX operating systems in secure mode and shadow mode.2)Solaris 10

The following table lists the error messages for the check.

Table: Error messages for Password age warning

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_AGE_WARNING Category: ESM Error | UNIX (5367) | Title: Password Age Warning Description:The accounts listed have not been set to warn if the user password is about to expire. Your policy should warn the user the the account password is about to expire to increase the overall security of the system. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NOTSUPPORT_AGE_WARNING Category: ESM Error | UNIX (5366) | Title: Password Age Warning not supported Description:The agent does not support the check for Password Age Warning. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Password length restrictions (UNIX)

Module: Password Strength

This check examines the system configuration for the minimum password length that the passwd program will accept. The check reports a problem if the minimum length is less than the length specified in your policy. This check runs only on UNIX operating systems that support minimum password length restrictions. This currently includes AIX, Solaris, Digital UNIX/Tru64, Red Hat Linux, SuSE Linux and HP-UX 11+ systems. When password length specified in configuration file and in policy is more than maximum length supported by algorithm used to encrypt the password then both the length specified in policy and in configuration file are made equal to password length supported by algorithm.

The following table lists the error message for the check.

Table: Error message for Password length restrictions

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_MINPASSLEN Category: ESM Error | UNIX (5334) | Title: Minimum password length too short Description:Your system has a minimum password length restriction that is less than the value specified by your policy. The default value is six characters. Short passwords expose your system to intruders because they are easy to guess. You should set the minimum password length to at least six characters. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Password within GECOS field (UNIX)

Module: Password Strength

This check examines each password and reports matches with words in the general information field (i.e., the GECOS field) in the /etc/passwd file.

The following table lists the error messages for the check.

Table: Error messages for Password within GECOS field

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_NO_PASSGECOS Category: ESM Error | UNIX (5354) | Title: No data in GECOS field Description:The accounts listed do not have any GECOS entries. The GECOS field is used to store general information about the account. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_GUESSPASS Category: ESM Error | UNIX (5330) | Title: Guessed user password Description:Symantec ESM guessed the passwords of the accounts listed below. This is a security problem because an intruder can also guess these passwords while trying to break into your system. You should immediately assign more secure passwords to these accounts. Then instruct each user to login, using the more secure password, and change the password again. A secure password should have six to eight characters, should not be found in any dictionary, and should have at least one non-alphabetic character. A secure password should also not match an account or host name. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_UNKNOWN_PAM_MODULE Category: ESM Error | UNIX (5368) | Title: Unknown PAM authentication module Description:ESM does not recognize any of the modules currently configured for authentication. Default Solaris hash types will be used for password cracking. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: []


Plural forms (UNIX)

Module: Password Strength

When this option is enabled, passwords are checked for matches with the plural forms of words in enabled wordlists. If "Password = username" is selected, Symantec ESM checks each password for a match when the related user name is changed to its plural form; e.g., golf -> golfs.

The following table lists the error messages for the check.

Table: Error messages for Plural forms

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_GUESSPASS Category: ESM Error | UNIX (5330) | Title: Guessed user password Description:Symantec ESM guessed the passwords of the accounts listed below. This is a security problem because an intruder can also guess these passwords while trying to break into your system. You should immediately assign more secure passwords to these accounts. Then instruct each user to login, using the more secure password, and change the password again. A secure password should have six to eight characters, should not be found in any dictionary, and should have at least one non-alphabetic character. A secure password should also not match an account or host name. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_UNKNOWN_PAM_MODULE Category: ESM Error | UNIX (5368) | Title: Unknown PAM authentication module Description:ESM does not recognize any of the modules currently configured for authentication. Default Solaris hash types will be used for password cracking. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: []


Repeating Characters (UNIX)

Module: Password Strength

This option reports users whose password consists of a single repeating character, and no other characters (e.g. aaaa, qqqqqq, etc., up to 8 repetitions).

The following table lists the error message for the check.

Table: Error message for Repeating Characters

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_GUESSPASS Category: ESM Error | UNIX (5330) | Title: Guessed user password Description:Symantec ESM guessed the passwords of the accounts listed below. This is a security problem because an intruder can also guess these passwords while trying to break into your system. You should immediately assign more secure passwords to these accounts. Then instruct each user to login, using the more secure password, and change the password again. A secure password should have six to eight characters, should not be found in any dictionary, and should have at least one non-alphabetic character. A secure password should also not match an account or host name. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Reverse order (UNIX)

Module: Password Strength

When this option is enabled, passwords are checked for matches with the reverse spelling of words in enabled wordlists. If "Password = username" is selected, Symantec ESM examines each password for a match when the related user name is spelled backward; e.g., golf -> flog.

The following table lists the error messages for the check.

Table: Error messages for Reverse order

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_GUESSPASS Category: ESM Error | UNIX (5330) | Title: Guessed user password Description:Symantec ESM guessed the passwords of the accounts listed below. This is a security problem because an intruder can also guess these passwords while trying to break into your system. You should immediately assign more secure passwords to these accounts. Then instruct each user to login, using the more secure password, and change the password again. A secure password should have six to eight characters, should not be found in any dictionary, and should have at least one non-alphabetic character. A secure password should also not match an account or host name. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_UNKNOWN_PAM_MODULE Category: ESM Error | UNIX (5368) | Title: Unknown PAM authentication module Description:ESM does not recognize any of the modules currently configured for authentication. Default Solaris hash types will be used for password cracking. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: []


System generated passwords (UNIX)

Module: Password Strength

This check reports user accounts that have system generated passwords (or accounts that have to use the system generated password option on the next password change). This is a valid option for generating safe passwords, but sometimes system generated passwords are written down because they are difficult to remember. This check is supported on HP-UX and Digital UNIX/Tru64 systems.

The following table lists the error message for the check.

Table: Error message for System generated passwords

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_SYSTEMGENERATED Category: ESM Error | UNIX (5343) | Title: Account with system-generated password Description:Passwords for the accounts listed are system-generated. This is a valid option for generating safe passwords, but sometimes system-generated passwords are written down because they are difficult to remember. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Trusted mode only (UNIX)

Module: Password Strength

This header identifies security checks for UNIX systems that have the ability to run in a trusted security mode. This is called enhanced security mode on some systems.


Uppercase (UNIX)

Module: Password Strength

When this option is enabled, passwords are checked for matches with the uppercase forms of words in enabled wordlists. If "Password = username" is selected, Symantec ESM checks each password for a match when the related user name is changed to all uppercase characters. Note that Symantec ESM changes only the alpha characters to uppercase; e.g., golf1 -> GOLF1.

The following table lists the error messages for the check.

Table: Error messages for Uppercase

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_GUESSPASS Category: ESM Error | UNIX (5330) | Title: Guessed user password Description:Symantec ESM guessed the passwords of the accounts listed below. This is a security problem because an intruder can also guess these passwords while trying to break into your system. You should immediately assign more secure passwords to these accounts. Then instruct each user to login, using the more secure password, and change the password again. A secure password should have six to eight characters, should not be found in any dictionary, and should have at least one non-alphabetic character. A secure password should also not match an account or host name. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_UNKNOWN_PAM_MODULE Category: ESM Error | UNIX (5368) | Title: Unknown PAM authentication module Description:ESM does not recognize any of the modules currently configured for authentication. Default Solaris hash types will be used for password cracking. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: []


Users can choose their passwords (UNIX)

Module: Password Strength

This check reports user accounts that are able to choose their own passwords on HP-UX and Digital UNIX/Tru64 systems. If users can pick their own passwords, the passwords should be checked by both Symantec ESM's Password Strength module and system password strength programs.

The following table lists the error message for the check.

Table: Error message for Users can choose their passwords

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_PICKOWN Category: ESM Error | UNIX (5341) | Title: User can pick password Description:Users can specify passwords for their accounts. Assess the vulnerabilities of these passwords using the Password Strength module. The other alternative is to use system-generated passwords, but these passwords are often difficult to remember. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Users to check (UNIX)

Module: Password Strength

This option lets you specify the users and user groups that will be excluded or included by the module's security checks.


Users without system password strength (UNIX)

Module: Password Strength

This check reports user accounts that are not checked by the system-provided password strength program on AIX, trusted mode HP-UX, and Digital UNIX/Tru64 systems. All user passwords should be checked by both Symantec ESM's Password Strength module and system password strength programs.

The following table lists the error messages for the check.

Table: Error messages for Users without system password strength

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_NOSTRENGTH Category: ESM Error | UNIX (5340) | Title: User without system password strength Description:The passwords for the accounts listed have not been checked by the system's password strength program. All passwords should be checked both by the system's password strength program and by Symantec ESM's Password Strength module. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NOTSUPPORT_STRENGTH Category: ESM Error | UNIX (5384) | Title: User without system password strength not supported Description:The agent does not support the check for User without system password strength. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Verify DICTIONDBDIR entry (UNIX)

Module: Password Strength

This check verifies if DICTIONDBDIR refers to User Defined Path Below (If User Defined Path is not mentioned , path mentioned in /etc/default/passwd is considered). This check is available on Solaris 10 only.

The following table lists the error messages for the check.

Table: Error messages for Verify DICTIONDBDIR entry

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_NO_DICTIONDBDIR Category: ESM Error | UNIX (5393) | Title: Verify DICTIONDBDIR entry Description:The agent listed does not allow users to have DICTIONDBDIR for the password. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NOTSUPPORT_DICTIONDBDIR Category: ESM Error | UNIX (5387) | Title: DICTIONDBDIR not supported Description:The agent does not support the check for DICTIONDBDIR. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Verify DICTIONLIST entry (UNIX)

Module: Password Strength

This check verifies if DICTIONLIST has been set to /usr/share/lib/dict/words. This check is available on Solaris 10 only.

The following table lists the error messages for the check.

Table: Error messages for Verify DICTIONLIST entry

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_NO_DICTIONLIST Category: ESM Error | UNIX (5391) | Title: Verify DICTIONLIST entry Description:The agent listed does not allow users to have DICTIONLIST for the password. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NOTSUPPORT_DICTIONLIST Category: ESM Error | UNIX (5386) | Title: DICTIONLIST not supported Description:The agent does not support the check for DICTIONLIST. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Whitespace characters (UNIX)

Module: Password Strength

This check reports agents that do not allow whitespace characters in password. This check is available on Solaris 10 only.

The following table lists the error messages for the check.

Table: Error messages for Whitespace characters

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_NO_WHITESPACE Category: ESM Error | UNIX (5380) | Title: Whitespace characters disabled Description:The agent listed does not allow users to have whitespace characters in the password. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NOTSUPPORT_WHITESPACE Category: ESM Error | UNIX (5381) | Title: Whitespace Characters not supported Description:The agent does not support the check for Whitespace Charaters. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Startup Files module

This section includes the following topics:

  • About the Startup Files module

  • Approved wrappers (UNIX)

  • Automatically update snapshots (UNIX)

  • Changed services (UNIX)

  • Check critical processes (UNIX)

  • Connection logging is not enabled (UNIX)

  • Current directory in startup PATH (UNIX)

  • Deleted services (UNIX)

  • Duplicate services (UNIX)

  • Enhanced security enabled (UNIX)

  • File system setuid protection (UNIX)

  • Grub password (UNIX)

  • Installed services (UNIX)

  • Login/tty file contents (UNIX)

  • Maximum reported messages (UNIX)

  • New services (UNIX)

  • Non-wrapped services (UNIX)

  • Service wrappers (UNIX)

  • Services (UNIX)

  • Services not in template (UNIX)

  • Services which are enabled (UNIX)

  • Solaris EEPROM auto-boot? (UNIX)

  • Solaris EEPROM security-mode (UNIX)

  • Syslog (UNIX)

  • System startup file contents (UNIX)

  • Unconfined services (UNIX)

  • Verify Network parameter Values (UNIX)


About the Startup Files module

The Startup Files module examines rc scripts and system startup files, looking for discrepancies with system-owned services that are defined in the Services templates. It also reports new, changed, and deleted services.


Approved wrappers (UNIX)

Module: Startup Files

This option lets you specify approved wrappers that are used by the Installed services check. Processes that are listed as forbidden in the Services template files but are wrapped with an approved wrapper will not be reported as a forbidden process.


Automatically update snapshots (UNIX)

Module: Startup Files

Enable this option to automatically update snapshots with current information.


Changed services (UNIX)

Module: Startup Files

This option reports any services with configurations that have been changed since the last time the ESM service snapshot was updated. Changes in service owner, full path, and parameters are reported. Services that are listed as Ignored in the Services template are not reported when found.

The following table lists the error messages for the check.

Table: Error messages for Changed services

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_CHANGED_PROCESS_PARAMS Category: Policy Compliance | UNIX (5860) | Title: Changed process parameters Description:ESM found a process parameter that has changed on the system. This could indicate a security problem. You should review the reported processes for security problems. You should also review all other security reports from ESM for possible related problems. | Severity: yellow-1 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [Parameters: %s; expected: %s]
String ID: STKU_CHANGED_PROCESS_FULLPATH Category: Policy Compliance | UNIX (5861) | Title: Changed process full path Description:ESM found a process full path name that has changed on the system. This could indicate a security problem. You should review the reported processes for security problems. You should also review all other security reports from ESM for possible related problems. | Severity: yellow-1 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [Full path: %s; expected: %s]
String ID: STKU_CHANGED_PROCESS_OWNER Category: Policy Compliance | UNIX (5863) | Title: Changed process owner Description:ESM found a process owner that has changed since the last time the snapshot file was updated. This could indicate a security problem. You should review the reported processes for security problems. You should also review all other security reports from ESM for possible related problems. | Severity: yellow-1 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [Owner: %s; expected: %s]
String ID: STKU_NOTEMPLATES Category: Policy Compliance | UNIX (5848) | Title: No template files specified Description:No templates were found. Templates allow a much greater control over what is monitored on your system. By not having templates, you have no way of determining what should or should not be running on your system. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_FORBIDDEN_PARAMETER_FOUND Category: Policy Compliance | UNIX (5852) | Title: Forbidden parameter Description:ESM found a forbidden parameter running with a system-owned process on the agent. The parameter was defined as forbidden in the Services template. You should terminate the process because it may be causing security problems or damaging your system. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [Forbidden parameter: %s; found parameter: %s; process: %s; found template: %s; comment: %s]
String ID: STKU_MANDATORY_PARAMETER_NOT_FOUND Category: Policy Compliance | UNIX (5853) | Title: Mandatory parameter not found Description:ESM found that a Mandatory parameter was not running with a system- owned process on the agent. Since the parameter was defined as Mandatory in your Services template, this could indicate a security problem. You should review all listed processes for problems. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [Mandatory parameter: %s; process: %s; template: %s; comment: %s]
String ID: STKU_FORBIDDEN_PROCESS_FOUND Category: Policy Compliance | UNIX (5850) | Title: Forbidden process found Description:A system-owned process that is defined as Forbidden in the Services template is running on the agent. You should terminate the process because it may be causing security problems or damaging your system. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [Template: %s; comment: %s]
String ID: STKU_MANDATORY_PROCESS_NOT_FOUND Category: Policy Compliance | UNIX (5851) | Title: Mandatory process not found Description:ESM found that a system-owned process set to Mandatory in the Services template is not running on the agent. This could indicate a security problem. You should review all listed processes for problems. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [Template: %s; comment: %s]
String ID: STKU_CREATED_SNAPSHOT_FILE Category: Policy Compliance | UNIX (5862) | Title: Process snapshot file created Description:The process snapshot file has been created. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: []


Check critical processes (UNIX)

Module: Startup Files

This check is applicable only on non-global zones created on Sun Solaris 10+ with esm agent installed on non-global zones and if either one of "Duplicate processes" or "Installed services" or "Services not in template" or all the three mentioned checks are enabled. Processes with PPID's 0 or 1 are considered as critical processes i.e. processes whose parent process is either zsched (which is the equivalent of sched of global zone) or init. Both these processes on local zone have values greater than 0 and 1. By enabling this check, the pid value of zsched is set to 0 and of init is set to 1 and thus helps in identifying critical processes running on non-global zones.


Connection logging is not enabled (UNIX)

Module: Startup Files

This check verifies whether connection logging has been enabled for inetd based services on Solaris 10.This Check reports for Default Setting of tcp_trace and the setting for individual services which are Enabled or online.If inetd is running, the "tracing" feature can be used to log information about the source of any network connections seen by the daemon.This check is available on Solaris 10 only.

The following table lists the error messages for the check.

Table: Error messages for Connection logging is not enabled

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_TRACED_SERVICE Category: Policy Compliance | UNIX (5879) | Title: Connection logging is not enabled for this service Description:ESM found an inetd service that is not traced by one of the Traced Services check. If inetd is running, the "tracing" feature can be used to log information about the source of any network connections seen by the daemon. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_DEF_TRACED_SERVICE Category: Policy Compliance | UNIX (5889) | Title: Default inetd Settings Connection logging is not enabled Description:ESM found that in default settings for inetd services tcp_trace is not set to TRUE.If inetd is running, the "tracing" feature can be used to log information about the source of any network connections seen by the daemon. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Current directory in startup PATH (UNIX)

Module: Startup Files

This check examines the contents of the rc scripts and warns of any that set the PATH variable to include the current directory (with "." or "::" commands). This check examines the same scripts as the System startup file contents check does. Use that check's file list to exclude system startup files for this check. Specify full path names in the file list.

The following table lists the error message for the check.

Table: Error message for Current directory in startup PATH

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_CURR_DIR_IN_PATH Category: Policy Compliance | UNIX (5867) | Title: Current directory command in PATH variable Description:The named startup file sets the PATH variable to include the current directory (with a . or :: command). This can lead to problems when the system is compromised and someone is able to put replacements for commonly-used programs (trojan horses) in directories where services are run. You should remove all current directory commands from PATH variables. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [Line: %s; line num: %s]


Deleted services (UNIX)

Module: Startup Files

This option reports any services that have been deleted since the last time the ESM service snapshot was updated. Services that are listed as Ignored in the Services template are not reported when found.

The following table lists the error messages for the check.

Table: Error messages for Deleted services

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_DELETED_PROCESS Category: Policy Compliance | UNIX (5864) | Title: Deleted process Description:ESM found a process which is no longer running on the system. Termination of a process could indicate a security problem if someone has the ability to kill a process. You should review all other security reports from ESM for possible problems. | Severity: yellow-1 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [Full path: %s; owner: %s; tty/protocol: %s; parameters: %s]
String ID: STKU_INFO_TEXT_MESSAGE Category: Policy Compliance | UNIX (5847) | Title: Changed process information Description:Please note the following: ESM found a process that has changed since the last time the snapshot file was updated. The reason that a process may change on the system can be a security problem. You should review the changed processes for security problems. You should also review all other security reports from ESM for possible related problems. | Severity: yellow-1 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [%s]
String ID: STKU_NOTEMPLATES Category: Policy Compliance | UNIX (5848) | Title: No template files specified Description:No templates were found. Templates allow a much greater control over what is monitored on your system. By not having templates, you have no way of determining what should or should not be running on your system. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_FORBIDDEN_PARAMETER_FOUND Category: Policy Compliance | UNIX (5852) | Title: Forbidden parameter Description:ESM found a forbidden parameter running with a system-owned process on the agent. The parameter was defined as forbidden in the Services template. You should terminate the process because it may be causing security problems or damaging your system. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [Forbidden parameter: %s; found parameter: %s; process: %s; found template: %s; comment: %s]
String ID: STKU_MANDATORY_PARAMETER_NOT_FOUND Category: Policy Compliance | UNIX (5853) | Title: Mandatory parameter not found Description:ESM found that a Mandatory parameter was not running with a system- owned process on the agent. Since the parameter was defined as Mandatory in your Services template, this could indicate a security problem. You should review all listed processes for problems. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [Mandatory parameter: %s; process: %s; template: %s; comment: %s]
String ID: STKU_FORBIDDEN_PROCESS_FOUND Category: Policy Compliance | UNIX (5850) | Title: Forbidden process found Description:A system-owned process that is defined as Forbidden in the Services template is running on the agent. You should terminate the process because it may be causing security problems or damaging your system. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [Template: %s; comment: %s]
String ID: STKU_MANDATORY_PROCESS_NOT_FOUND Category: Policy Compliance | UNIX (5851) | Title: Mandatory process not found Description:ESM found that a system-owned process set to Mandatory in the Services template is not running on the agent. This could indicate a security problem. You should review all listed processes for problems. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [Template: %s; comment: %s]
String ID: STKU_CREATED_SNAPSHOT_FILE Category: Policy Compliance | UNIX (5862) | Title: Process snapshot file created Description:The process snapshot file has been created. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: []


Duplicate services (UNIX)

Module: Startup Files

This option reports all system-owned services/processes/commands that are duplicated or found to be running multiple times in the process table. System-owned processes are identified in the process table by PPIDs of 0 or 1 on all systems except AIX. On AIX, system-owned processes are identified by PPIDs that are equal to the process ID of the System Resource Controller. Services/processes/commands that are listed as Ignored in the Services template are not reported when found.

The following table lists the error messages for the check.

Table: Error messages for Duplicate services

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_DUPLICATE_PROCESSES Category: Policy Compliance | UNIX (5855) | Title: Duplicate process Description:ESM found a duplicate system-owned process in the process table. All duplicate entries are not necessarily problems. For example, it is possible to have duplicate entries for /etc/nfsd, which is the NFS daemon. However, you should examine the duplicate entries and determine which processes are valid duplicates. Invalid process entries could be a sign of a security breach. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NO_DUPLICATE_PROCESSES Category: Policy Compliance | UNIX (5856) | Title: No duplicate processes found Description:ESM found no duplicate system-owned processes in the process table. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: []
String ID: STKU_NOTEMPLATES Category: Policy Compliance | UNIX (5848) | Title: No template files specified Description:No templates were found. Templates allow a much greater control over what is monitored on your system. By not having templates, you have no way of determining what should or should not be running on your system. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_FORBIDDEN_PARAMETER_FOUND Category: Policy Compliance | UNIX (5852) | Title: Forbidden parameter Description:ESM found a forbidden parameter running with a system-owned process on the agent. The parameter was defined as forbidden in the Services template. You should terminate the process because it may be causing security problems or damaging your system. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [Forbidden parameter: %s; found parameter: %s; process: %s; found template: %s; comment: %s]
String ID: STKU_MANDATORY_PARAMETER_NOT_FOUND Category: Policy Compliance | UNIX (5853) | Title: Mandatory parameter not found Description:ESM found that a Mandatory parameter was not running with a system- owned process on the agent. Since the parameter was defined as Mandatory in your Services template, this could indicate a security problem. You should review all listed processes for problems. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [Mandatory parameter: %s; process: %s; template: %s; comment: %s]
String ID: STKU_FORBIDDEN_PROCESS_FOUND Category: Policy Compliance | UNIX (5850) | Title: Forbidden process found Description:A system-owned process that is defined as Forbidden in the Services template is running on the agent. You should terminate the process because it may be causing security problems or damaging your system. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [Template: %s; comment: %s]
String ID: STKU_MANDATORY_PROCESS_NOT_FOUND Category: Policy Compliance | UNIX (5851) | Title: Mandatory process not found Description:ESM found that a system-owned process set to Mandatory in the Services template is not running on the agent. This could indicate a security problem. You should review all listed processes for problems. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [Template: %s; comment: %s]


Enhanced security enabled (UNIX)

Module: Startup Files

This check looks for any enhanced security extensions that are enabled on the operating system.

The following table lists the error messages for the check.

Table: Error messages for Enhanced security enabled

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_NO_ENHANCED Category: Policy Compliance | UNIX (5839) | Title: No enhanced security features Description:The operating system does not provide any additional security features that can be optionally enabled. This message provides information but does not require any action on your part. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: []
String ID: STKU_SEC_DISABLE_OSF1 Category: Policy Compliance | UNIX (5840) | Title: Enhanced OSF1 security features are disabled Description:OSF1 provides enhanced security features that can be optionally enabled. These features are currently disabled. You should run the /usr/sbin/secsetup command to enable these features. See the system documentation for additional information. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: []
String ID: STKU_SEC_DISABLE_HP Category: Policy Compliance | UNIX (5841) | Title: Enhanced HPUX security features are disabled Description:HPUX provides enhanced security features that can be optionally enabled. These features are currently disabled. You should enable these features with the system administration manager (sam) tool. See the system documentation for additional information. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: []
String ID: STKU_SEC_DISABLE_AIX Category: Policy Compliance | UNIX (5842) | Title: Enhanced AIX security features are disabled Description:AIX provides enhanced security features that can be optionally enabled. These features are currently disabled. You should enable these features by reinstalling the operating system and choosing to install the trusted security options. Unfortunately, these options cannot be installed as add-on software at this time. See the system documentation for additional information. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: []
String ID: STKU_SEC_DISABLE_SGI Category: Policy Compliance | UNIX (5843) | Title: Enhanced IRIX security features are disabled Description:The IRIX operating system supports the use of a shadow password file, but this system is not using a shadow file. Shadow files allow encrypted passwords to be hidden from all non-root users. You should enable the use of a shadow password file. See the pwconv(1M) and shadow(4) man pages and the system documentation for additional information. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: []
String ID: STKU_SEC_UNKNOWN_OSF1 Category: Policy Compliance | UNIX (5844) | Title: Cannot determine state of OSF1 security enhancements Description:ESM cannot determine if the system is running BASE or ENHANCED mode security. You should run the /usr/sbin/secsetup command to set the desired security state. See the system documentation for additional information. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: []
String ID: STKU_SEC_UNKNOWN_HP Category: Policy Compliance | UNIX (5845) | Title: Cannot determine state of security enhancements Description:ESM cannot determine if the system is running BASE or TRUSTED mode security. You should use the system admininstration manager (sam) tool to set the security mode. See the system documentation for additional information. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: []
String ID: STKU_SEC_UNKNOWN_AIX Category: Policy Compliance | UNIX (5846) | Title: Cannot determine state of AIX security enhancements Description:ESM cannot determine if the system is running BASE or TRUSTED mode. Trusted mode is supported only in OS version 4.2 or higher. Consult the system documentation for further details on determining if you have the trusted mode installed (this is not an add-on software package at this time). | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: []


File system setuid protection (UNIX)

Module: Startup Files

This check reports a problem if setuid files on Solaris operating systems are allowed on a writable local file system. Other file systems should be mounted with the nosuid option whenever possible. Because the root partition should not be mounted with the nosuid option, it is included in exclude list by default. Only Local file systems are examined. It is critical that the administrator have a good understanding of mounted file systems before making changes because mistakes could render the system useless.

The following table lists the error message for the check.

Table: Error message for File system setuid protection

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_MOUNT_ALLOWS_RW_OR_SUID Category: Policy Compliance | UNIX (5869) | Title: Mount point allows write access to setuid files Description:The named mount point allows write access to setuid or setgid files. All setuid or setgid files should reside on the /usr partition, and that partition should be mounted with the ro (read-only) option. All other partitions should be mounted with the nosuid option if possible. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Grub password (UNIX)

Module: Startup Files

This check verifies whether Boot loader password is enabled on the system.This Check is available on Solaris 10 only on X86 platform.

The following table lists the error message for the check.

Table: Error message for Grub password

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_BOOTPASSWORD Category: Policy Compliance | UNIX (5884) | Title: Grub password Description:Configuration changes can be done by pressing a function key (F1, F10 etc.) at boot time before the operating system boots. The BIOS password is required before changes can be made to the CMOS setup; this prevents a casual attacker from changing the list of devices from which the system boots.This Check is available on Solaris 10 only. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Installed services (UNIX)

Module: Startup Files

This check reports installed services on your system. The check parses the /etc/inetd.conf or xinetd.conf file for all services found in that file. On Solaris 10, the check uses the inetadm command to list the services. The check looks at Services template records to identify forbidden processes. Services that are defined as Ignored in the Services template are not reported when found. Services that are defined as Optional are reported when the mandatory parameter is not found or the forbidden parameter is found.

The following table lists the error messages for the check.

Table: Error messages for Installed services

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_INSTALLED_SERVICES Category: Policy Compliance | UNIX (5858) | Title: Installed services Description:This is a list of currently installed services that are defined in the file /etc/inetd.conf or xinetd.conf. These services have been defined with specific sets of data to execute on your system. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NOTEMPLATES Category: Policy Compliance | UNIX (5848) | Title: No template files specified Description:No templates were found. Templates allow a much greater control over what is monitored on your system. By not having templates, you have no way of determining what should or should not be running on your system. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_FORBIDDEN_PARAMETER_FOUND Category: Policy Compliance | UNIX (5852) | Title: Forbidden parameter Description:ESM found a forbidden parameter running with a system-owned process on the agent. The parameter was defined as forbidden in the Services template. You should terminate the process because it may be causing security problems or damaging your system. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [Forbidden parameter: %s; found parameter: %s; process: %s; found template: %s; comment: %s]
String ID: STKU_MANDATORY_PARAMETER_NOT_FOUND Category: Policy Compliance | UNIX (5853) | Title: Mandatory parameter not found Description:ESM found that a Mandatory parameter was not running with a system- owned process on the agent. Since the parameter was defined as Mandatory in your Services template, this could indicate a security problem. You should review all listed processes for problems. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [Mandatory parameter: %s; process: %s; template: %s; comment: %s]
String ID: STKU_FORBIDDEN_PROCESS_FOUND Category: Policy Compliance | UNIX (5850) | Title: Forbidden process found Description:A system-owned process that is defined as Forbidden in the Services template is running on the agent. You should terminate the process because it may be causing security problems or damaging your system. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [Template: %s; comment: %s]
String ID: STKU_MANDATORY_PROCESS_NOT_FOUND Category: Policy Compliance | UNIX (5851) | Title: Mandatory process not found Description:ESM found that a system-owned process set to Mandatory in the Services template is not running on the agent. This could indicate a security problem. You should review all listed processes for problems. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [Template: %s; comment: %s]


Login/tty file contents (UNIX)

Module: Startup Files

This check examines the contents of the securetty and /etc/default/login files. The check reports pseudo-terminals that allow root logins, unrestricted root logins, and systems that allow root logins from other than the system console. Use the file list to exclude pseudo-terminals or devices, which do allow root logins, from the check. Specify full path names for device files.

The following table lists the error messages for the check.

Table: Error messages for Login/tty file contents

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_PTYSECURE Category: Policy Compliance | UNIX (5830) | Title: Pseudo-terminal listed as secure Description:The pseudo-terminals listed below are flagged as secure in the tty control file. Secure terminals allow root logins from the network. This is a security risk because your system's privileged accounts are exposed to access from hosts that are attached to your network but outside your organization. You should remove the secure flag from the pseudo-terminal entries in the tty control file. You should also reset init on your system to restrict root logins to secure terminals. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NOSECURETTY Category: Policy Compliance | UNIX (5831) | Title: No tty security file Description:The systems listed below are missing one or more device security files. These files let you control the security of devices such as terminals, pseudo-terminals, and windows. You should create these files with security settings appropriate for your site. You should allow root logins only on terminals that are connected directly to your system and located in a physically secure area. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NODEFAULTLOGIN Category: Policy Compliance | UNIX (5836) | Title: No default login configuration file exists Description:The systems listed below are missing their login configuration files. These files let you control the default login behavior of terminals, pseudo-terminals, and windows. You should create these files with default values appropriate to your site. Consult the man pages for additional information. You should also consider restricting root logins to the console device or to a terminal that is located in a physically secured area and directly connected to your system. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NOLOGINCONSOLE Category: Policy Compliance | UNIX (5837) | Title: Root login not restricted Description:The systems listed below do not restrict root login. This is a security risk because it exposes your system privileged accounts to unauthorized users. You should restrict root logins by inserting the line CONSOLE=/dev/console into the /etc/default/login file. Consult the man pages for additional information. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_LOGINDEV Category: Policy Compliance | UNIX (5838) | Title: Root login restricted to the following devices Description:The systems listed below restrict root login to a device different from /dev/console as recommended by Silicon Graphics, Inc. You should allow root logins only on terminals that are connected directly to your system and located in a physically secure area. You should review the list to ensure that the correct devices are listed. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Maximum reported messages (UNIX)

Module: Startup Files

Enable this option to limit the number of messages returned for each enabled check. Use the value field to specify the maximum number of times a given message should be displayed. Once the maximum number has been reached for a single message, the message will be displayed once more with the number of repeating instances of the message that are not reported.


New services (UNIX)

Module: Startup Files

This option reports any services that have been added since the last time the ESM service snapshot was updated. Services that are listed as Ignored in the Services template are not reported when found.

The following table lists the error messages for the check.

Table: Error messages for New services

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_NEW_PROCESS Category: Policy Compliance | UNIX (5865) | Title: New process Description:ESM found a new process that is now running on the system. The presence of a new, running process could indicate a security problem, if someone has the ability to kill a process. You should review all other security reports from ESM for possible problems. | Severity: yellow-1 Correctable: false Snapshot Updatable: true Template Updatable: false Information Field Format: [Full path: %s; owner: %s; tty/protocol: %s; parameters: %s]
String ID: STKU_NOTEMPLATES Category: Policy Compliance | UNIX (5848) | Title: No template files specified Description:No templates were found. Templates allow a much greater control over what is monitored on your system. By not having templates, you have no way of determining what should or should not be running on your system. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_FORBIDDEN_PARAMETER_FOUND Category: Policy Compliance | UNIX (5852) | Title: Forbidden parameter Description:ESM found a forbidden parameter running with a system-owned process on the agent. The parameter was defined as forbidden in the Services template. You should terminate the process because it may be causing security problems or damaging your system. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [Forbidden parameter: %s; found parameter: %s; process: %s; found template: %s; comment: %s]
String ID: STKU_MANDATORY_PARAMETER_NOT_FOUND Category: Policy Compliance | UNIX (5853) | Title: Mandatory parameter not found Description:ESM found that a Mandatory parameter was not running with a system- owned process on the agent. Since the parameter was defined as Mandatory in your Services template, this could indicate a security problem. You should review all listed processes for problems. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [Mandatory parameter: %s; process: %s; template: %s; comment: %s]
String ID: STKU_FORBIDDEN_PROCESS_FOUND Category: Policy Compliance | UNIX (5850) | Title: Forbidden process found Description:A system-owned process that is defined as Forbidden in the Services template is running on the agent. You should terminate the process because it may be causing security problems or damaging your system. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [Template: %s; comment: %s]
String ID: STKU_MANDATORY_PROCESS_NOT_FOUND Category: Policy Compliance | UNIX (5851) | Title: Mandatory process not found Description:ESM found that a system-owned process set to Mandatory in the Services template is not running on the agent. This could indicate a security problem. You should review all listed processes for problems. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [Template: %s; comment: %s]
String ID: STKU_CREATED_SNAPSHOT_FILE Category: Policy Compliance | UNIX (5862) | Title: Process snapshot file created Description:The process snapshot file has been created. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: []


Non-wrapped services (UNIX)

Module: Startup Files

This check reports services that are not wrapped with an approved wrapper. Use the check's name list to specify approved wrappers that will not be reported by the check. Service wrappers provide access control and logging of inetd services. This check is ignored on any system that is not running inetd, including systems running xinetd, because xinetd provides access control and logging without the need for additional wrappers.On Solaris 10 this Check reports for Default Setting of tcp_wrappers and the setting for individual services which are Enabled or online.

The following table lists the error messages for the check.

Table: Error messages for Non-wrapped services

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_NON_WRAPPED_SERVICE Category: Policy Compliance | UNIX (5868) | Title: Non-wrapped service Description:ESM found an inetd service that is not wrapped by one of the wrappers listed for the Non-wrapped Services check. Service wrappers are used to restrict access to the wrapped service. Services that are not wrapped can be a security risk. You should use wrappers to control who has access to network services and to log the use of services. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_DEF_NON_WRAPPED_SERVICE Category: Policy Compliance | UNIX (5888) | Title: Default Settings for inetd Non-wrapped service Description:ESM found that in default settings for inetd services tcp_wrappers is not set to TRUE. Service wrappers are used to restrict access to the wrapped service. Services that are not wrapped can be a security risk. You should use wrappers to control who has access to network services and to log the use of services. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Service wrappers (UNIX)

Module: Startup Files

This option lets you specify any service wrappers that are to be reported by the Installed services check. Service wrappers are services that are prepended to other services on the system (such as itawrap, which preprocesses a service on the system for security reasons).

The following table lists the error message for the check.

Table: Error message for Service wrappers

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_SERVICE_WRAPPER Category: Policy Compliance | UNIX (5866) | Title: Service wrapper Description:ESM found a service wrapper, which was specified in the "Service Wrappers" name list, wrapping the listed service. Service wrappers are services that are prepended to other services on the system. Unauthorized service wrappers can be a security risk. You should remove any unauthorized service wrappers from your /etc/inetd.conf or xinetd.conf file. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Services (UNIX)

Module: Startup Files

This option lets you enable or disable the Services template files that are used by module checks to identify system-owned processes that should be Ignored, Mandatory, Optional, or Forbidden on your system. Services templates also have two parameter lists: a list of Mandatory Parameters (parameters that must be used with a process), and a list of Forbidden Parameters (parameters that must not be used with a process). When parameters are duplicated in both the Forbidden and Mandatory lists, both are reported. (For example, if the process /etc/init has a forbidden parameter of -q and a mandatory parameter of -q, when the -q parameter is found, it is reported as being forbidden.) Entries in template services and parameter lists are treated as case sensitive.

The following table lists the error messages for the check.

Table: Error messages for Services

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_DUPLICATE_TEMPLATE_ENTRY Category: Policy Compliance | UNIX (5854) | Title: Duplicate template entry Description:ESM found a duplicate entry in the template file. When it finds duplicate entries, ESM cannot determine which entry should be used, so the first entry is used and all and any subsequent same or duplicate entries are ignored. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_SERVICELOGIC_GREEN Category: Policy Compliance | UNIX (5875) | Title: Service template logic Description:Service template entry logic evaluated to true. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_SERVICELOGIC_YELLOW Category: Policy Compliance | UNIX (5876) | Title: Service template logic Description:Service template entry logic evaluated to true. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_SERVICELOGIC_RED Category: Policy Compliance | UNIX (5877) | Title: Service template logic Description:Service template entry logic evaluated to true. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Services not in template (UNIX)

Module: Startup Files

This option reports system-owned processes that are running on your system but are not listed in the Services template. System-owned processes are identified in the process table by PPIDs of 0 or 1 on all systems except AIX. On AIX, system-owned processes are identified by PPIDs that are equal to the process ID of the System Resource Controller.

The following table lists the error messages for the check.

Table: Error messages for Services not in template

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_PROCESS_NOT_IN_TEMPLATE Category: Policy Compliance | UNIX (5857) | Title: Processes not listed in template Description:ESM found the following system-owned processes that were not listed in the Services template. These may be fine, but they should be reviewed for validity. Any process that is suspected of security or other problems should not be running on the system. Your system administrator should look closely at these processes to make sure they are valid. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NOTEMPLATES Category: Policy Compliance | UNIX (5848) | Title: No template files specified Description:No templates were found. Templates allow a much greater control over what is monitored on your system. By not having templates, you have no way of determining what should or should not be running on your system. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_FORBIDDEN_PARAMETER_FOUND Category: Policy Compliance | UNIX (5852) | Title: Forbidden parameter Description:ESM found a forbidden parameter running with a system-owned process on the agent. The parameter was defined as forbidden in the Services template. You should terminate the process because it may be causing security problems or damaging your system. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [Forbidden parameter: %s; found parameter: %s; process: %s; found template: %s; comment: %s]
String ID: STKU_MANDATORY_PARAMETER_NOT_FOUND Category: Policy Compliance | UNIX (5853) | Title: Mandatory parameter not found Description:ESM found that a Mandatory parameter was not running with a system- owned process on the agent. Since the parameter was defined as Mandatory in your Services template, this could indicate a security problem. You should review all listed processes for problems. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [Mandatory parameter: %s; process: %s; template: %s; comment: %s]
String ID: STKU_FORBIDDEN_PROCESS_FOUND Category: Policy Compliance | UNIX (5850) | Title: Forbidden process found Description:A system-owned process that is defined as Forbidden in the Services template is running on the agent. You should terminate the process because it may be causing security problems or damaging your system. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [Template: %s; comment: %s]
String ID: STKU_MANDATORY_PROCESS_NOT_FOUND Category: Policy Compliance | UNIX (5851) | Title: Mandatory process not found Description:ESM found that a system-owned process set to Mandatory in the Services template is not running on the agent. This could indicate a security problem. You should review all listed processes for problems. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [Template: %s; comment: %s]


Services which are enabled (UNIX)

Module: Startup Files

This check lists unnecessary Services from template if enabled and are recommened to be Disabled.This check is available on Solaris 10 only.

The following table lists the error messages for the check.

Table: Error messages for Services which are enabled

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_ENABLED_SERVICE_Y Category: Policy Compliance | UNIX (5882) | Title: This service has been enabled Description:ESM has Found a service which is enabled.If this service is not required, it is recommended to be disabled to guard against potential exploit by users and services that are operating locally on the system. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_ENABLED_SERVICE_R Category: Policy Compliance | UNIX (5886) | Title: This service has been enabled Description:ESM has Found a service which is enabled.If this service is not required, it is recommended to be disabled to guard against potential exploit by users and services that are operating locally on the system. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_ENABLED_SERVICE_G Category: Policy Compliance | UNIX (5887) | Title: This service has been enabled Description:ESM has Found a service which is enabled.If this service is not required, it is recommended to be disabled to guard against potential exploit by users and services that are operating locally on the system. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Solaris EEPROM auto-boot? (UNIX)

Module: Startup Files

This check reports a problem when the auto-boot? parameter value is false. This parameter value should be true so that the system automatically boots after power-on or reset.

The following table lists the error message for the check.

Table: Error message for Solaris EEPROM auto-boot?

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_EEPROM_AUTO_BOOT Category: Policy Compliance | UNIX (5871) | Title: EEPROM auto-boot? parameter is false Description:The EEPROM auto-boot? parameter should be set to true so the system will boot automatically after power-on or reset. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Solaris EEPROM security-mode (UNIX)

Module: Startup Files

This check reports a problem if the system does not prompt for a PROM security password. The value of the EEPROM security-mode parameter should be set to command or full.

The following table lists the error message for the check.

Table: Error message for Solaris EEPROM security-mode

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_EEPROM_SECURITY_MODE_NONE Category: Policy Compliance | UNIX (5870) | Title: EEPROM security-mode parameter is none Description:The value of the EEPROM security-mode parameter is none. When this value is none, the system does not prompt for the PROM security password. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Syslog (UNIX)

Module: Startup Files

This check reports syslog configurations that do not match the enabled templates.

The following table lists the error messages for the check.

Table: Error messages for Syslog

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_SYSLOG_GREEN Category: Policy Compliance | UNIX (5872) | Title: Syslog configuration does not match template Description:The listed syslog configuration entry does not match the template. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_SYSLOG_YELLOW Category: Policy Compliance | UNIX (5873) | Title: Syslog configuration does not match template Description:The listed syslog configuration entry does not match the template. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_SYSLOG_RED Category: Policy Compliance | UNIX (5874) | Title: Syslog configuration does not match template Description:The listed syslog configuration entry does not match the template. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


System startup file contents (UNIX)

Module: Startup Files

This check examines the contents of the rc scripts and verifies that the files referenced by the scripts are not world writable and/or writable by a non-privileged group. Files referenced in the rc scripts and listed in the exclude list will not be reported. Specify full path names in the file list.

The following table lists the error messages for the check.

Table: Error messages for System startup file contents

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_SYSSWW Category: Policy Compliance | UNIX (5834) | Title: World writable file/directory referenced in startup file Description:The files listed below are referenced in a startup file and are world writable. This usually presents a security risk because there is no control over who can modify these files. Files referenced in startup files are executed (or read) by the root account on system startup. Anyone can replace these files and have them executed (or read) by root the next time the system restarts. You should investigate the usage of each file and consider changing its permissions so world write is not allowed (chmod o-w filename) or removing the reference to the file from the script. In the rare cases in which using such a file is necessary and safe, you can suppress this message. | Severity: red-4 Correctable: true Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_SYSSGW Category: Policy Compliance | UNIX (5835) | Title: File/directory writable by non-privileged group referenced in startup file Description:The files listed below are referenced in a startup file. These files are group writable AND owned by a non-privileged group. This is a security problem because anyone with group access can modify the files. Files referenced in startup files are executed (or read) by the root account on system startup. Anyone with group access can replace these files and have them executed (or read) by root the next time the system boots. You should change the permissions on each file so group write is not allowed (chmod g-w filename). | Severity: yellow-1 Correctable: true Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Unconfined services (UNIX)

Module: Startup Files

This check reports processes with tcp or udp ports that do not have AppArmor protection enabled on Suse Enterprise Server 10 and above. Use the name list to exclude services.

The following table lists the error message for the check.

Table: Error message for Unconfined services

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_UNCONFINED_SERVICE Category: Policy Compliance | UNIX (5878) | Title: Unconfined service Description:The listed process has open tcp or udp ports and does not have AppArmor protection enabled. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Verify Network parameter Values (UNIX)

Module: Startup Files

This check verifies if network and routing parameters have been set according to recommended values. This check is available on Solaris 10 only.

The following table lists the error message for the check.

Table: Error message for Verify Network parameter Values

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_NW_RT_PARAMETERS Category: Policy Compliance | UNIX (5883) | Title: This Network parameter value is not recommended Description:ESM has found a Network/Routing parameter which is not set according to recommended value. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


System Auditing module

This section includes the following topics:

  • About the System Auditing module

  • Accounting enabled (UNIX)

  • Auditing enabled (UNIX)

  • Authentication database internal consistency (UNIX)

  • Event auditing (UNIX)

  • File read auditing (UNIX)

  • File write auditing (UNIX)

  • System call mapping (UNIX)


About the System Auditing module

The System Auditing module reports the unaudited agents, non-compliant events auditing and system call mappings, and AIX files that are not audited for read and write actions and inconsistencies with authentication databases on trusted computers.


Accounting enabled (UNIX)

Module: System Auditing

This check reports agents that are not running system accounting.

The following table lists the error message for the check.

Table: Error message for Accounting enabled

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_NOACCT Category: Policy Compliance | UNIX (6130) | Title: Accounting is not enabled Description:Accounting is not enabled on your system. Accounting should be enabled because it can provide valuable information when you suspect your system's security has been compromised. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Auditing enabled (UNIX)

Module: System Auditing

This check verifies that auditing is enabled on the system. This check is currently supported only on AIX, HP-UX, and Solaris operating systems.

The following table lists the error message for the check.

Table: Error message for Auditing enabled

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_AUDIT_OFF Category: Policy Compliance | UNIX (6147) | Title: Auditing not enabled Description:System auditing is not currently enabled. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Authentication database internal consistency (UNIX)

Module: System Auditing

This check looks for inconsistencies within the authentication database on operating systems running in trusted or enhanced security mode. The trusted database is usually located in /tcb, so the files in that directory should be consistent with the /etc/passwd files. You should research each inconsistency reported.

The following table lists the error messages for the check.

Table: Error messages for Authentication database internal consistency

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_INCONSISTENT Category: Policy Compliance | UNIX (6133) | Title: Inconsistent Description:ESM cannot find the command /tcb/bin/authck. Please check to determine whether you have trusted security installed on this system. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_RETRIEVE Category: Policy Compliance | UNIX (6134) | Title: Cannot retrieve Description:The name given is in the Protected Password Database but cannot be retrieved by the getprpwent system call. This may be caused by running NIS on a trusted machine. You should not run NIS and trusted mode at the same time. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NOTIN Category: Policy Compliance | UNIX (6135) | Title: Not in /etc/passwd Description:The name given is not in /etc/passwd but is in the Protected Password Database. There should be entries both in /etc/passwd and in the /tcb directory for each user. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_MULTIPLY Category: Policy Compliance | UNIX (6136) | Title: Multiple listings Description:The named user is listed multiple times in the password file. The file should contain only one entry for each user name. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_UID Category: Policy Compliance | UNIX (6137) | Title: UID inconsistency Description:Each user should have a unique UID. Users with two or more UIDs can cause confusion in giving file permissions. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NOTLISTED Category: Policy Compliance | UNIX (6138) | Title: Not listed Description:The named user was not listed in /etc/passswd or in the Protected Password Database. Users should have listings in both of these places. This may be because NIS is running. You should not run NIS on a trusted system. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_UNKNOWN Category: Policy Compliance | UNIX (6139) | Title: Warning Description:An inconsistency has been detected in the Protected Password Database. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_AIXUSER Category: Policy Compliance | UNIX (6140) | Title: AIX user warning Description:An inconsistency has been detected in the Protected Password Database. On AIX, the command "pwdck -n ALL" is used to generate this report. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_AIXFILE Category: Policy Compliance | UNIX (6141) | Title: AIX file warning Description:An inconsistency has been detected between the system files and /etc/security/sysck.cfg. On AIX, the command "tcbck -n ALL" is used to generate this report. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_HPCONSISTENT Category: Policy Compliance | UNIX (6142) | Title: HP warning Description:An inconsistency has been detected between the system files and the trusted database on HP. On HP, ESM uses the command "authck -a" to generate this report and stops after 300 items. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Event auditing (UNIX)

Module: System Auditing

This check looks at the events specified in the Events template and reports events that are not being audited. This check is currently supported only on AIX, HP-UX, and Solaris operating systems. Use the file list to enable or disable the Events templates.

The following table lists the error messages for the check.

Table: Error messages for Event auditing

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_TRUSTEDEVENT Category: Policy Compliance | UNIX (6131) | Title: Events not audited Description:The named events are not being audited by your operating system. You should enable system auditing of these events so you can identify unauthorized users during or after an attempted security breach. | Severity: yellow-3 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [User: %s; Type: %s]
String ID: STKU_HP_TRUSTEDEVENTMAP Category: Policy Compliance | UNIX (6146) | Title: HP event map error Description:The system call is not being audited in the same manner as the specified event. | Severity: yellow-3 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [System Call: %s; Type: %s]
String ID: STKU_AUDIT_OFF Category: Policy Compliance | UNIX (6147) | Title: Auditing not enabled Description:System auditing is not currently enabled. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


File read auditing (UNIX)

Module: System Auditing

This check verifies that specified files are audited for Read actions. Specify full path names in the file list for files that should be audited. This check is currently supported only on AIX operating systems.

The following table lists the error messages for the check.

Table: Error messages for File read auditing

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_FILE_READ Category: Policy Compliance | UNIX (6148) | Title: Read actions not audited Description:The named file is not being audited for Read actions. | Severity: yellow-3 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: []
String ID: STKU_AUDIT_OFF Category: Policy Compliance | UNIX (6147) | Title: Auditing not enabled Description:System auditing is not currently enabled. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


File write auditing (UNIX)

Module: System Auditing

This check verifies that specified files are audited for Write actions. Specify full path names in the file list for files that should be audited. This check is currently supported only on AIX operating systems.

The following table lists the error messages for the check.

Table: Error messages for File write auditing

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_FILE_WRITE Category: Policy Compliance | UNIX (6149) | Title: Write actions not audited Description:The named file is not being audited for Write actions. | Severity: yellow-3 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: []
String ID: STKU_AUDIT_OFF Category: Policy Compliance | UNIX (6147) | Title: Auditing not enabled Description:System auditing is not currently enabled. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


System call mapping (UNIX)

Module: System Auditing

This check verifies that system calls are mapped to events as specified in the Event Maps template. This check is currently supported only on AIX, HP-UX, and Solaris operating systems. Use the file list to enable or disable the Event Maps templates.

The following table lists the error message for the check.

Table: Error message for System call mapping

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_EVENTMAP Category: Policy Compliance | UNIX (6145) | Title: Event map error Description:The system call specified is not mapped to the named event. | Severity: yellow-3 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [System Call: %s]


System Mail module

This section includes the following topics:

  • About the System Mail module

  • Command aliases (UNIX)

  • Decode aliases (UNIX)

  • FX/path directives (UNIX)

  • Log level setting (UNIX)

  • Mail boxes (UNIX)

  • Postmaster (UNIX)

  • Sendmail Restricted Shell (UNIX)

  • Sendmail configuration file (UNIX)

  • Sendmail log (UNIX)

  • Wizard passwords (UNIX)


About the System Mail module

The System Mail module reports security holes in mail configuration files, mail file attributes, and the Morris worm.


Command aliases (UNIX)

Module: System Mail

This check looks for mail aliases piped to a command. This is a potential security problem because it allows outside access to the command. In particular, any command that allows reading and writing of files or escapes to shell can provide unauthorized access to your system. Use the file list to exclude aliases from this check. Specify the full executable path name without quotes or flags to exclude all aliases piped to that executable.

The following table lists the error messages for the check.

Table: Error messages for Command aliases

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_ALIASCMD Category: System Information | UNIX (6030) | Title: Alias piped to command Description:The listed mail aliases are piped to a command. This means that the command can be accessed from outside. Commands that allow reading and writing of files or escapes to shell can provide unauthorized access to your system. You should examine the listed mail aliases and remove from the aliases file any commands that provide unintended access. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_BADALIASCMD Category: System Information | UNIX (6031) | Title: Alias piped to shell program Description:The listed mail aliases are piped to a command that is a known security risk. Commands that allow reading and writing of files or escapes to shell can provide unauthorized access to your system. You should remove these commands from the aliases file. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Decode aliases (UNIX)

Module: System Mail

This check looks for decode entries in your mail configuration file. These entries allow unencoded files to be sent to your system.

The following table lists the error message for the check.

Table: Error message for Decode aliases

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_POSDECODE Category: System Information | UNIX (6032) | Title: Decode entry in sendmail.cf Description:The listed decode entries are in the mail configuration file. This is a security problem. These entries allow unencoded files to be sent to your system. You should remove these entries from the mail configuration file. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


FX/path directives (UNIX)

Module: System Mail

This check examines the files listed for the FX/path directives in the sendmail.cf configuration file. Files that are not owned by root or allow group or world access will be reported.

The following table lists the error messages for the check.

Table: Error messages for FX/path directives

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_CFNOEXIST Category: System Information | UNIX (6041) | Title: Sendmail configuration file missing Description:The sendmail configuration file was not found on the system. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_FXPATH Category: System Information | UNIX (6055) | Title: Invalid owner/permissions for FX/Path directive Description:The owner or the permissions of the file specified in a FX/Path directive in the sendmail.cf configuration file is invalid. The owner of the file should be root and the file should not allow group or world access. | Severity: yellow-2 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Log level setting (UNIX)

Module: System Mail

This check reports a problem when the log level setting in the sendmail.cf file is less than the value set in your security policy. The default policy setting is 9.

The following table lists the error messages for the check.

Table: Error messages for Log level setting

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_LOGLEVEL Category: System Information | UNIX (6047) | Title: Log level less than policy setting Description:The log level setting is less than the value set in your security policy. The default policy setting is 9, which includes message logs that are caused by undeliverable mail. | Severity: yellow-2 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_CFNOEXIST Category: System Information | UNIX (6041) | Title: Sendmail configuration file missing Description:The sendmail configuration file was not found on the system. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Mail boxes (UNIX)

Module: System Mail

This check looks at the mail boxes in the system mail directory to ensure that a user account exists for each mail box in the system and each mail box is owned by the appropriate user. Use the Users and Groups name lists to exclude or include users for this check.

The following table lists the error messages for the check.

Table: Error messages for Mail boxes

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_MAILNOTMATCHED Category: System Information | UNIX (6034) | Title: Mail box is not matched by a user account Description:The listed mail boxes do not have corresponding user accounts on the system. Mail boxes that do not have corresponding user accounts are inconsistencies in your system. You should remove these mail boxes. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_MAILOWNERDIFF Category: System Information | UNIX (6035) | Title: Mail box is owned by another user Description:The listed mail boxes are owned by other users. This is a security problem because unauthorized users can read or write to these mail boxes and authorized users do not have access to their own mail. You should change the ownership of these mail boxes to the correct users. | Severity: yellow-1 Correctable: true Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_MAILBOXMODE Category: System Information | UNIX (6036) | Title: Mail box grants read/write permissions Description:The listed mail boxes grant read or write permissions to either group or others. This is a security problem because users other than the owners can read or write to these mail boxes. You should change the permissions on these mail boxes so only the owners have read and write permissions. | Severity: yellow-1 Correctable: true Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Postmaster (UNIX)

Module: System Mail

This check examines the mail aliases file to verify that the postmaster alias is set to a valid user to send critical sendmail messages. The UNIX default alias is root.

The following table lists the error messages for the check.

Table: Error messages for Postmaster

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_CFNOEXIST Category: System Information | UNIX (6041) | Title: Sendmail configuration file missing Description:The sendmail configuration file was not found on the system. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_ALIASNOEXIST Category: System Information | UNIX (6042) | Title: Mail alias file missing or not a regular file Description:The sendmail alias file is missing or is not a regular file. Because the alias file could not be read, the Postmaster check assumes that there are no aliases defined. The alias file defines aliases for replacing one mail recipient address with another. The name of the alias file is specified by the AliasFile option (option A) in the sendmail.cf file and is listed in the name field. Either remove the AliasFile option from sendmail.cf or create a valid alias file. | Severity: yellow-2 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_POSTMASTERNOTFOUND Category: System Information | UNIX (6043) | Title: Postmaster does not resolve to a valid user account Description:RFC 822 requires every site that is running sendmail to accept for delivery mail that is addressed to "postmaster". On this system, there is no user named postmaster and there is no alias for postmaster that resolves to a valid user account. Mail sent to postmaster on this system may be returned to the sender as undeliverable. In your mail aliases file, define at least one alias for postmaster that is a valid user. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [Postmaster alias: %s]


Sendmail Restricted Shell (UNIX)

Module: System Mail

This check analyzes the configuration of smrsh (Sendmail Restricted Shell). Smrsh limits the set of programs from the ~/.forward file that Sendmail can run. The smrsh must be declared in the /etc/sendmail.cf file. The smrsh allowed programs must reside in smrsh special directory /usr/adm/sm.bin. Use the name list to list allowed programs for this check.

The following table lists the error messages for the check.

Table: Error messages for Sendmail Restricted Shell

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_SMRSH_NOT_USED Category: System Information | UNIX (6048) | Title: Smrsh not used in sendmail configuration Description:Your V8 sendmail program is not using the smrsh (Sendmail restricted Shell) program. Sendmail will run any program that it finds in a user's ~/.forward file. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_SMRSH_FILE_FORBIDDEN Category: System Information | UNIX (6049) | Title: Forbidden file in smrsh executables directory Description:This executable is not allowed by your V8 Sendmail smrsh (Sendmail restricted Shell) program. Check your /usr/adm/sm.bin directory. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_SMRSH_CONFIG_NOT_FOUND Category: System Information | UNIX (6050) | Title: Configuration file sendmail.cf was not found Description:The configuration file sendmail.cf was not found. Check that sendmail is installed on your computer, or that it is configured correctly. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_SMRSH_DIR_NOT_FOUND Category: System Information | UNIX (6051) | Title: Sendmail restricted directory was not found Description:The sendmail restricted directory was not found. Check that sendmail is installed on your computer, or that it is configured correctly. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Sendmail configuration file (UNIX)

Module: System Mail

This check examines the sendmail.cf configuration file for the noexpn, novrfy, and goaway settings. These settings are required to disable the expn and vrfy commands.

The following table lists the error messages for the check.

Table: Error messages for Sendmail configuration file

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_NOEXPNNOEXIST Category: System Information | UNIX (6045) | Title: expn command is enabled Description:The noexpn command is not set in the sendmail configuration file. This command must be set to disable the expn command, which displays user alias information. | Severity: yellow-2 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NOVRFYNOEXIST Category: System Information | UNIX (6046) | Title: vrfy command is enabled Description:The novrfy command is not set in the sendmail configuration file. This command must be set to disable the vrfy command, which displays user information. | Severity: yellow-2 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_CFNOEXIST Category: System Information | UNIX (6041) | Title: Sendmail configuration file missing Description:The sendmail configuration file was not found on the system. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Sendmail log (UNIX)

Module: System Mail

This check reports a problem when critical sendmail messages are not being logged. The check examines the sendmail log file defined in the syslog.conf file and verifies that the file is owned by root and that file permissons are valid.

The following table lists the error messages for the check.

Table: Error messages for Sendmail log

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_LOGNOTROOT Category: System Information | UNIX (6037) | Title: Sendmail log file not owned by root Description:The sendmail log file is not owned by root. This log file should be owned by root to prevent unauthorized access. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_LOG_NOT_CONFIG Category: System Information | UNIX (6038) | Title: Sendmail logging not configured Description:Sendmail logging is not correctly configured on the agent system. To enable logging, the sendmail daemon must be started. Facilities and priorities must also be accurately identified in the syslog.conf file. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_LOGPERMISSION Category: System Information | UNIX (6039) | Title: Invalid sendmail log file permissions Description:The sendmail log file permissions are invalid. Permissions should not include write and execute privileges for groups and others. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_LOGNOTREGFILE Category: System Information | UNIX (6040) | Title: Sendmail log file not regular file Description:The sendmail log file is not a regular file (i.e., the file is a symbolic link or a directory). | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Wizard passwords (UNIX)

Module: System Mail

This check looks for wizard passwords in your mail configuration file. These passwords can allow unauthorized access to your system.

The following table lists the error message for the check.

Table: Error message for Wizard passwords

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_POSWIZ Category: System Information | UNIX (6033) | Title: Wizard password in sendmail.cf Description:The listed wizard password entry is in the mail configuration file. This entry can provide unauthorized access to your system. You should remove this entry from the mail configuration file and re-freeze the configuration. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


System Queues module

This section includes the following topics:

  • About the System Queues module

  • AT subsystem access (UNIX)

  • CRONTAB file contents (UNIX)

  • CRON subsystem access (UNIX)

  • Only Root access to AT subsystem (UNIX)

  • Only Root access to CRON subsystem (UNIX)

  • Users to check (UNIX)


About the System Queues module

The System Queues module reports AT and CRON subsystem access, and the executables and configuration files that are present in the crontab file.

The System Queues module reports the messages that let you correct crontab file owners and permissions on the agent.

Correctable messages display the letter C in the Updatable/Correctable column of the console grid.


AT subsystem access (UNIX)

Module: System Queues

This check reports users that are allowed to use the at and batch utilities. Use the Users/Groups name lists to include or exclude users that are not included or excluded by the Users to check option.

The following table lists the error messages for the check.

Table: Error messages for AT subsystem access

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_ATGLOBAL Category: Policy Compliance | UNIX (5930) | Title: Global at and batch usage allowed Description:Your system is set so anyone can use the at and batch commands. See the man pages for information about the at command. This message provides information but does not require any security action on your part. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_ATSUONLY Category: Policy Compliance | UNIX (5931) | Title: Only root can use at and batch Description:Your system is set so only the root account can use the at and batch commands. See the man pages for information about the at command. This message provides information but does not require any security action on your part. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_ATALLOW Category: Policy Compliance | UNIX (5932) | Title: Allowed to use at and batch Description:This user is allowed to use the at and batch commands. See the man pages for information about the at command. This message provides information but does not require any security action on your part. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_ATDENY Category: Policy Compliance | UNIX (5933) | Title: Denied use of at and batch Description:This user is denied use of the at and batch commands. See the man pages for information about the at command. This message provides information but does not require any security action on your part. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_CRONNSUSER Category: Policy Compliance | UNIX (5943) | Title: Non-existent user configured for cron or at Description:This user is listed in one or more of the cron and batch configuration files but do not exist on the system. This can represent a security breach if the named accounts are later recreated and either granted cron or at access without authority or denied cron or at access when they should have authority. You should correct this problem by removing the listed users from the indicated files. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


CRONTAB file contents (UNIX)

Module: System Queues

This check looks at the contents of the crontabs on the system. Each command in the crontab is examined for configuration files and executable programs. Each of the executables and configuration files are checked for group or world permissions. Use the file list to exclude executables and configuration files from the check. Specify full path names in the file list.

The following table lists the error messages for the check.

Table: Error messages for CRONTAB file contents

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_CRONMODE Category: Policy Compliance | UNIX (5938) | Title: Crontab grants read/write permissions Description:These crontabs grant read or write permissions to group or others. This is a security problem because other users can read or write these crontabs. You should change the crontab permissions so that only owners may read and write these crontabs. | Severity: red-4 Correctable: true Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_CRONNOTMATCHED Category: Policy Compliance | UNIX (5939) | Title: Crontab not matched by a user account Description:These crontabs do not correspond to user accounts on your system. While not generally a security risk, a crontab file that does not correspond to any user account is an inconsistency in your system. You should remove crontabs that do not have corresponding user accounts. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_CRONOWNERDIFF Category: Policy Compliance | UNIX (5940) | Title: Crontab is owned by another user Description:These crontabs are owned by other users. This is a security problem because the intended users do not have access to their own crontabs and other users can read and write these crontabs. Review the crontabs list and change ownership to the correct users. | Severity: yellow-1 Correctable: true Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_CRONWW Category: Policy Compliance | UNIX (5941) | Title: World writable file referenced in crontab file Description:These files are referenced in a crontab file and are world writable. This is a security concern because there is no control over who can modify these files. Files referenced in crontab files are executed or read on a periodic basis. Anyone can replace these files and have them executed or read in another user's account the next time cron runs. You should correct this problem by changing the permissions on each file (chmod o-w filename) so that world write is not allowed. | Severity: red-4 Correctable: true Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_CRONGW Category: Policy Compliance | UNIX (5942) | Title: Group writable file referenced in crontab file Description:These files are referenced in a crontab file and are group writable. This can be a security concern because anyone with group access can modify these files. Files referenced in crontab files are executed or read on a periodic basis. Anyone with group access can replace these files and have them executed or read in another user's account the next time cron runs. You should correct this problem by changing the permissions on each file (chmod g-w filename) so that group write is not allowed. | Severity: yellow-1 Correctable: true Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_CRONNSUSER Category: Policy Compliance | UNIX (5943) | Title: Non-existent user configured for cron or at Description:This user is listed in one or more of the cron and batch configuration files but do not exist on the system. This can represent a security breach if the named accounts are later recreated and either granted cron or at access without authority or denied cron or at access when they should have authority. You should correct this problem by removing the listed users from the indicated files. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_CRONOWNNOTROOT Category: Policy Compliance | UNIX (5944) | Title: Crontab not owned by root Description:This user crontab file is not owned by root. This is a security problem because the owner and possibly others may be able to edit these files directly without using the crontab utility program. You should carefully review the list and change user ownership to root. | Severity: red-4 Correctable: true Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


CRON subsystem access (UNIX)

Module: System Queues

This check reports users that are allowed to use the cron facility. Use the Users/Groups name lists to include or exclude users that are not included or excluded by the Users to check option.

The following table lists the error messages for the check.

Table: Error messages for CRON subsystem access

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_CRONGLOBAL Category: Policy Compliance | UNIX (5934) | Title: Global cron usage allowed Description:Your system is set so anyone can use the crontab command. See the man pages for information about the crontab command. This message provides information but does not require any security action on your part. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_CRONSUONLY Category: Policy Compliance | UNIX (5935) | Title: Only root can use crontab Description:Your system is set so only the root account can use the crontab command. See the man pages for information about the crontab command. This message provides information but does not require any security action on your part. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_CRONALLOW Category: Policy Compliance | UNIX (5936) | Title: Allowed to use crontab Description:This user is allowed to use the crontab command. See the man pages for information about the crontab command. This message provides information but does not require any security action on your part. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_CRONDENY Category: Policy Compliance | UNIX (5937) | Title: Denied use of crontab Description:This user is denied use of the crontab command. See the man pages for information about the crontab command. This message provides information but does not require any security action on your part. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_CRONNSUSER Category: Policy Compliance | UNIX (5943) | Title: Non-existent user configured for cron or at Description:This user is listed in one or more of the cron and batch configuration files but do not exist on the system. This can represent a security breach if the named accounts are later recreated and either granted cron or at access without authority or denied cron or at access when they should have authority. You should correct this problem by removing the listed users from the indicated files. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Only Root access to AT subsystem (UNIX)

Module: System Queues

This check verifies whether no users are allowed to run "at" commands.

The following table lists the error messages for the check.

Table: Error messages for Only Root access to AT subsystem

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_ATSUONLY Category: Policy Compliance | UNIX (5931) | Title: Only root can use at and batch Description:Your system is set so only the root account can use the at and batch commands. See the man pages for information about the at command. This message provides information but does not require any security action on your part. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_ATALLOWWARN Category: Policy Compliance | UNIX (5948) | Title: Non root user allowed to use at and batch Description:This user is allowed to use the at. Only Authorised users should be allowed administrative access to at and batch commands. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_ATDENYEXISTS Category: Policy Compliance | UNIX (5946) | Title: at.deny file exists Description:The at.deny file contains a list of users that cannot access the at command.CIS recommended that file be removed. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_CRONNSUSER Category: Policy Compliance | UNIX (5943) | Title: Non-existent user configured for cron or at Description:This user is listed in one or more of the cron and batch configuration files but do not exist on the system. This can represent a security breach if the named accounts are later recreated and either granted cron or at access without authority or denied cron or at access when they should have authority. You should correct this problem by removing the listed users from the indicated files. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Only Root access to CRON subsystem (UNIX)

Module: System Queues

This check verifies whether root is the only user allowed to run the "crontab" command.

The following table lists the error messages for the check.

Table: Error messages for Only Root access to CRON subsystem

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_CRONSUONLY Category: Policy Compliance | UNIX (5935) | Title: Only root can use crontab Description:Your system is set so only the root account can use the crontab command. See the man pages for information about the crontab command. This message provides information but does not require any security action on your part. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_CRONALLOWWARN Category: Policy Compliance | UNIX (5949) | Title: Non root user allowed to use crontab Description:This user is allowed to use the crontab command. Only Authorised users should be allowed administrative access to crontab. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_CRONDENYEXISTS Category: Policy Compliance | UNIX (5947) | Title: cron.deny file exists Description:The cron.deny file contains a list of users that cannot access the crontab command.CIS recommended that file be removed. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_CRONNSUSER Category: Policy Compliance | UNIX (5943) | Title: Non-existent user configured for cron or at Description:This user is listed in one or more of the cron and batch configuration files but do not exist on the system. This can represent a security breach if the named accounts are later recreated and either granted cron or at access without authority or denied cron or at access when they should have authority. You should correct this problem by removing the listed users from the indicated files. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Users to check (UNIX)

Module: System Queues

This option lets you define name lists of users and user groups that will be excluded or included in all enabled security checks.


User Files module

This section includes the following topics:

  • About the User Files module

  • Current directory not allowed in PATH (UNIX)

  • Current directory only at end of PATH (UNIX)

  • Device files (UNIX)

  • File ownership (UNIX)

  • Forbidden files (UNIX)

  • Group writable directories in PATH (UNIX)

  • Group writable files (UNIX)

  • Hidden directories (UNIX)

  • Hide wwritable in ww dir (UNIX)

  • Ignore symbolic links (UNIX)

  • Local accounts/groups only (UNIX)

  • Local disks only (UNIX)

  • Maximum reported messages (UNIX)

  • Mount points (UNIX)

  • PATH (modifying startup script) (UNIX)

  • PATH (using su) (UNIX)

  • Required files (UNIX)

  • SETUID or SETGID (UNIX)

  • Startup file contents (UNIX)

  • Startup file protection (UNIX)

  • Suspicious file names (UNIX)

  • Umask (UNIX)

  • Umask (modifying startup script) (UNIX)

  • Umask (parsing startup scripts) (UNIX)

  • Umask (using su) (UNIX)

  • User defined shells (UNIX)

  • User directories follow system directories in PATH (UNIX)

  • Users to check (UNIX)

  • Users to check for Forbidden files (UNIX)

  • Users to check for Required files (UNIX)

  • Users to skip for Startup file protection (UNIX)

  • World writable directories in PATH (UNIX)

  • World writable files (UNIX)


About the User Files module

The User Files module examines the user file ownership and permissions, the PATH and umask settings in startup files, the files with the same names as system commands, the hidden directories, the special device files, and the remote mount points. This module is present in the Queries module.

The User Files module has six security checks that report correctable messages. These messages let you correct user file settings on the agent from the console grid. Correctable messages display the letter C in the Updatable/Correctable column of the console grid.


Current directory not allowed in PATH (UNIX)

Module: User Files

This check reports users with current directory entries (. or :: or : at the starting or ending of the path) located anywhere in their PATH variables. Use the check's name list to exclude or include users and user groups that are not already included or excluded by the Users to check option. Enable one, but not both, of the PATH (using su) or PATH (modifying startup script) options before executing this security check. Also, when both this and the Current directory only at end of PATH checks are run on the same user account, Symantec ESM reports any current directory entry in the user's PATH variable as an error.

The following table lists the error messages for the check.

Table: Error messages for Current directory not allowed in PATH

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_BOTH_CURDIR Category: System Error | UNIX (5456) | Title: User included for both current directory PATH checks Description:The named user was included by name lists for both of the security checks titled "Current Dir Allowed Only at End of PATH" and "Current Dir Not Allowed in PATH." This policy run applied the tougher standard of the Current directory not allowed in PATH check, but you should modify the name lists for future policy runs so that only one of these checks includes the listed user. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_CURDIR2 Category: System Error | UNIX (5457) | Title: Current directory found in path Description:The user has defined a path that includes the current directory. This is a security problem if the current directory for the user is set to a directory where other users have write access. The user can be "spoofed" when a common system command such as 'ls' is placed in that directory and executed instead of the system 'ls'. You should remove the current directory from the PATH environment variable in the .login, .cshrc, or .profile script file for this user. Note that a null field in the path is equivalent to '.'. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Current directory only at end of PATH (UNIX)

Module: User Files

This check reports users with current directory (. or ::) entries located anywhere except at the end of their PATH variables. Use the check's name list to exclude or include users and user groups that are not already included or excluded by the Users to check option. Enable one, but not both, of the PATH (using su) or PATH (modifying startup script) options before executing this security check. Also, when both this and the Current directory not allowed in PATH checks are run on the same user account, Symantec ESM reports any current directory entry in the user's PATH variable as an error.

The following table lists the error messages for the check.

Table: Error messages for Current directory only at end of PATH

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_CURDIR Category: System Error | UNIX (5437) | Title: Current directory not last in path Description:The named user has defined a path that includes the current directory in a location other than at the end of the path. This is a security problem if the current directory for the user is set to a directory where other users have write access. The user can be "spoofed" when a common system command such as 'ls' is placed in that directory and executed instead of the system 'ls'. You should move the current directory to the end of the path where the PATH environment variable is set in the .login, .cshrc, or .profile script file for this user. Note that a null field in the path is equivalent to '.'. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_BOTH_CURDIR Category: System Error | UNIX (5456) | Title: User included for both current directory PATH checks Description:The named user was included by name lists for both of the security checks titled "Current Dir Allowed Only at End of PATH" and "Current Dir Not Allowed in PATH." This policy run applied the tougher standard of the Current directory not allowed in PATH check, but you should modify the name lists for future policy runs so that only one of these checks includes the listed user. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Device files (UNIX)

Module: User Files

This check looks for block-special and character-special (device) files in the user's home directory tree. Specify full path names in the file list to exclude files from this check.

The following table lists the error message for the check.

Table: Error message for Device files

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_USRDEVICE Category: System Error | UNIX (5453) | Title: Device special file in user area Description:The user has device special files in their home directory trees. These files are normally located in /dev and are owned by system UIDs and GIDs. Unauthorized access to devices through special files can compromise the data on these devices. You should remove these files from the user areas. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


File ownership (UNIX)

Module: User Files

This check reports user files and directories that have different UIDs or GIDs than the IDs listed in the agent's password file. Specify full path names in the file list to exclude files from this check.

The following table lists the error message for the check.

Table: Error message for File ownership

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_USRONOTOWNER Category: System Error | UNIX (5436) | Title: User does not own file Description:The file is in a user's directory tree but is not owned by the user. Either the user ID or group ID of the file does not match the user ID or group ID of the user, as defined in /etc/passwd. This is a security problem if the incorrect ownership allows unauthorized access to the file. Authorized users can also be prevented from accessing the file. You should change the user or group ownership of the file. If the file is correctly owned but in the wrong directory, move the file out of the user's directory tree. | Severity: yellow-1 Correctable: true Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Forbidden files (UNIX)

Module: User Files

This check reports forbidden files that are found in a user's home directory. Use the name list to specify the relative path names for files that are forbidden.

The following table lists the error message for the check.

Table: Error message for Forbidden files

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_FORBIDDEN_FILE_FOUND Category: System Error | UNIX (5461) | Title: Forbidden file found Description:The named forbidden file was found in the home directory of the user specified in the information field. Remove this file. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Group writable directories in PATH (UNIX)

Module: User Files

The check reports group-writable directories that are listed in user PATH variables. Use the check's name list to exclude or include users and user groups that are not already included or excluded by the Users to check option. Enable one, but not both, of the PATH (using su) or PATH (modifying startup script) options before executing this security check.

The following table lists the error message for the check.

Table: Error message for Group writable directories in PATH

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_PATHGROUPWRITE Category: System Error | UNIX (5459) | Title: Group writable directory in user path Description:The named, group-writable directory is listed in the named user's PATH variable. This allows other members of the user group to create files that could "spoof" this user by placing a new file with the name of a common command like "ls" in the named directory. This can be a serious security problem. You should remove group write permissions from the named directory (chmod g-w filename) or remove the directory from the user's path. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Group writable files (UNIX)

Module: User Files

This check identifies user files and directories that are group writable. Specify full path names in the file list to exclude files from this check.

The following table lists the error message for the check.

Table: Error message for Group writable files

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_USRGROUPWRITE Category: System Error | UNIX (5431) | Title: Group writable Description:The file is writable by anyone with group access to the files. This can be a security problem if members of the group are not authorized to access the files. You should change the permissions for these files so group write is not allowed (chmod g-w filename). | Severity: green-0 Correctable: true Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Hidden directories (UNIX)

Module: User Files

This check looks for hidden directories in the user's home directory tree. A hidden directory is one that begins with a dot (.) character and does not appear in a typical directory listing. Although it is not very effective, users can try to hide information in hidden directories that they are not authorized to have. Use the file list to specify hidden directory names that should not be flagged by this check.

The following table lists the error message for the check.

Table: Error message for Hidden directories

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_HIDEDIR Category: System Error | UNIX (5454) | Title: Hidden directory Description:The user has "hidden" directories in their home directory trees. A hidden directory is one that begins with a dot (.) character and does not appear on a normal directory listing. Although it is not very effective, users can try to hide information in hidden directories that they are not authorized to have. Examine the contents of these directories and take action when necessary. Hidden directories which are normal and expected can be specified in the file list and excluded from this check. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Hide wwritable in ww dir (UNIX)

Module: User Files

This check identifies user files and directories that are world writable,but it will not check file/directories inside the world writable directories.This option applies only if "World writable files" check is selected.


Ignore symbolic links (UNIX)

Module: User Files

This option causes the User Files module to ignore symbolic links within a user's directory tree (both symbolic links to files and symbolic links to directories). Most symbolic links point to files or directories that are located on another file system and are often owned by a different UID or GID. By default, this option is selected so these files are not checked.


Local accounts/groups only (UNIX)

Module: User Files

This option restricts checks to user accounts that are defined in the agent's /etc/passwd file. By selecting this option, you ensure that users are checked only once in sites that serve user accounts with NIS.


Local disks only (UNIX)

Module: User Files

This option restricts checks to users with home directories that are located on disks that are local to the system running the check. Selecting this option ensures that user files are checked only once in sites that serve user directories with NFS, even though the module can be run on more than one system.


Maximum reported messages (UNIX)

Module: User Files

Enable this option to limit the number of messages returned for each enabled check. Use the value field to specify the maximum number of times a given message should be displayed. Once the maximum number has been reached for a single message, the message will be displayed once more with the number of repeating instances of the message that are not reported.


Mount points (UNIX)

Module: User Files

This check reports mount points within the user's home directory tree. It is not standard practice to mount devices in user areas. This can represent unauthorized access to data on the device in question. Enter directory names or special device file names in the file list to specify any mount points that should be excluded from this check.

The following table lists the error message for the check.

Table: Error message for Mount points

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_USERMOUNT Category: System Error | UNIX (5455) | Title: User mount point Description:The user has devices mounted on a directory in their home directory trees. It is not standard practice to mount devices in user areas. Please verify that this mount is authorized and that the data on the device is not being compromised. You should remove all devices from user areas and remount them on directories in the system area. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


PATH (modifying startup script) (UNIX)

Module: User Files

This option determines how PATH checks are performed. When this option is selected, Symantec ESM adds a command to the end of each user's .profile or .login script to check PATH settings. The option is effective only after the user logs in subsequent to the change. Do not select this option if you select the option titled PATH (using su). The two options are mutually exclusive.


PATH (using su) (UNIX)

Module: User Files

This option determines how PATH checks are performed. When this option is selected, Symantec ESM uses the su command to access each user account and run startup scripts to check PATH settings. Do not select this option if you select the option titled PATH (modifying startup script). The two options are mutually exclusive.


Required files (UNIX)

Module: User Files

This check reports required files that are not found in a user's home directory. Use the name list to specify the relative path names for the files that must appear in each user's home directory. System accounts and accounts with no home directory specified in the /etc/passwd file will not be checked.

The following table lists the error message for the check.

Table: Error message for Required files

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_REQUIRED_FILE_NOT_FOUND Category: System Error | UNIX (5460) | Title: Required file not found Description:The named required file was not found in the home directory of the user specified in the information field. Place this required file in the user's home directory. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


SETUID or SETGID (UNIX)

Module: User Files

This check identifies user files that have the set user ID (setuid) or the set group ID (setgid) bit set. Specify full path names in the file list to exclude files from this check.

The following table lists the error messages for the check.

Table: Error messages for SETUID or SETGID

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_SUIDOWNER Category: System Error | UNIX (5432) | Title: setuid to owner Description:The file is setuid for the owner of the directory tree where they reside. Setuid means that anyone who executes one of these files will, during execution, have an effective user ID that matches the file owner. This is a security problem because it allows unauthorized access to other files or programs owned by this user. Normally, there is no need for setuid files in user accounts. You should remove the setuid property from the file (chmod 750 filename). | Severity: red-4 Correctable: true Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_SGIDOWNER Category: System Error | UNIX (5433) | Title: setgid to owner Description:The file is setgid for anyone in the group with the owner of the directory tree where they reside. Setgid means that anyone who executes the file will, during execution, have an effective group ID that matches the group ownership of the file. This is a security problem because it allows unauthorized access to other files or programs owned by the group. Normally, there is no need for setgid files in user accounts. You should remove the setgid property from the file (chmod 750 filename). | Severity: red-4 Correctable: true Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_SUIDOTHER Category: System Error | UNIX (5434) | Title: Other setuid file Description:The file is setuid to a user other than the owner of the directory tree where they reside. Setuid means that anyone who executes the file will, during execution, have an effective user ID that matches the file owner. This is a security problem because it allows unauthorized access to other files or programs owned by this user. If the file is owned by root, anyone executing the file will temporarily have superuser privileges. Normally, there is no need for setuid files in user accounts. You should remove the setuid property from the file (chmod 750 filename). | Severity: red-4 Correctable: true Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_SGIDOTHER Category: System Error | UNIX (5435) | Title: Other setgid file Description:The file is setgid to a group other than the group that owns the directory tree in which they reside. Setgid means that anyone who executes the file will, during execution, have an effective group ID that matches the group ownership of the file. This is a security problem because it allows unauthorized access to other files or programs owned by the group. If the file is owned by root, anyone executing the file will temporarily have superuser privileges. Normally, there is no need for setgid files in user accounts. You should remove the setgid property from the file (chmod 750 filename). | Severity: red-4 Correctable: true Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Startup file contents (UNIX)

Module: User Files

This check reports accounts that have a .rhosts file or .netrc file. For .rhosts files, the check produces a list of users and systems that are not required to enter a password. For .netrc files, the check produces a list of entries containing passwords. The check's name lists let you exclude users and user groups that are not already excluded by the Users to check option.

The following table lists the error messages for the check.

Table: Error messages for Startup file contents

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_NETRC Category: System Error | UNIX (5443) | Title: Account has a .netrc file Description:The named accounts have .netrc files. These files provide a way for unauthorized users to access your system without entering a password. You should remove these files from the accounts. Further protection can be provided by placing a zero length, root owned .netrc file with permissions set to 0400 in each account's home directory. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NETRC_PASS Category: System Error | UNIX (5444) | Title: Netrc file contains password Description:The account has a .netrc file containing one or more passwords. A privileged user or a user with access to this account can read this file and obtain passwords for accounts on other systems. This can enable unauthorized access to those systems. You should ask the named users to remove all password entries from their .netrc files. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NETRC_PASS_READ Category: System Error | UNIX (5445) | Title: Passwords in readable .netrc file Description:The account has a group/world readable .netrc file that contains passwords. Users can read this file and obtain passwords for these accounts. You should set the permissions for the .netrc file to allow only the owner to read and write the file. You should also ask the users to remove all password entries from their .netrc files. | Severity: red-4 Correctable: true Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_RHOSTS Category: System Error | UNIX (5446) | Title: Account has a .rhost file Description:The named accounts have .rhost files. These files provide a way for unauthorized users to access your system without entering a password. You should remove these files from the accounts. Further protection can be provided by placing a zero length, root owned .rhosts file with permissions set to 0400 in each account's home directory. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_RLOGIN Category: System Error | UNIX (5447) | Title: Remote user may rlogin/rsh without password Description:The named accounts have entries in the .rhost files. These entries allow unauthorized users on remote hosts to access your system without specifying a password. You should carefully review the named accounts and remove any unnecessary entries in the .rhosts files. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_RLOGIN_ANY_HOST Category: System Error | UNIX (5448) | Title: Account allows rlogins from any host Description:The named accounts have entries in the .rhosts files that allow rlogins from any host using the remote user name. These entries allow unauthorized users on remote hosts to access your system without specifying a password. You should remove the .rhosts files from these accounts. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_RLOGIN_ANY_USER Category: System Error | UNIX (5449) | Title: Account allows rlogins by any user Description:The named accounts have entries in their .rhosts files that allow any users on listed remote systems to access your system. You should remove the .rhosts files from these accounts. | Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Startup file protection (UNIX)

Module: User Files

This check reports user startup files that do not have proper ownerships or permissions. Use the file permissions list to specify the names and expected permissions of the startup files for each user. You can exclude specified users and user groups from the check with the option, Users to skip for Startup file protection.

The following table lists the error messages for the check.

Table: Error messages for Startup file protection

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_USRSNOTOWNER Category: System Error | UNIX (5440) | Title: User does not own user startup file Description:The named user startup file is in the user directory tree but is not owned by the user. Either the user ID or group ID of the file does not match the user ID or group ID of the user, as defined in /etc/passwd. This is a security problem if the incorrect ownership allows unauthorized access to the files. Authorized users can also be prevented from accessing the files. You should change the user or group ownership of the file. | Severity: yellow-1 Correctable: true Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_BADPERM Category: System Error | UNIX (5441) | Title: Inadequate file permissions Description:The named file has permissions that either allow too much group or other access or include execute permission when it is not needed. Unauthorized access to files can provide intruders with information that is helpful in breaking into these accounts. Use the chmod command to set file permissions to the suggested value. | Severity: yellow-1 Correctable: true Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Suspicious file names (UNIX)

Module: User Files

This check reports executable files with suspicious names in the user's home directory tree. A suspicious name is one that is the same as a user name or the name of a system command listed in the man pages. An executable with a suspicious name can be executed unknowingly by another user. This can occur when a common user or system command is input and the path is not set up properly. Specify full path names in the file list to exclude files from this check.

The following table lists the error message for the check.

Table: Error message for Suspicious file names

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_SUSPFILE Category: System Error | UNIX (5452) | Title: Suspicious file name found Description:This user has executable files in their home directory trees that have "suspicious" names. A suspicious name is one that matches a user name or the name of a system command listed in the man pages. An executable with a suspicious name can unknowingly be executed by another user. This can occur when a common user or system command name is entered and the path is not set up properly. You should ask the named users to rename their executables. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Umask (UNIX)

Module: User Files

This check reports users whose umask value is less than the minimum umask value that you specify in the check (an octal number between 000 and 777). Umask determines the default permissions of newly-created files. Enable one of the Umask (using su), Umask (modifying startup script), or Umask (parsing startup scripts) options before running this check. In the name list, specify users and user groups that will be excluded from the check.


Umask (modifying startup script) (UNIX)

Module: User Files

This option determines how Umask check is performed. When this option is selected, Symantec ESM adds a command to the end of each user's .profile or .login script to check umask settings. The next time that the user logs in, the Umask check will be able to report the user's umask value. Do not select this option if you select either the Umask (using su) option or the Umask (parsing startup scripts) option. They are mutually exclusive.

The following table lists the error messages for the check.

Table: Error messages for Umask (modifying startup script)

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_UMASK Category: System Error | UNIX (5439) | Title: Unsafe umask Description:The named user has umask settings that allow too much access to group and others. The umask specifies an octal number that is subtracted from the permissions when a file is created. Lower number settings grant more access. See umask(1) in the man pages for more information. Symantec ESM's default minimum umask value provides normal security. This value is 027. It creates executables with permissions of 750 and other files with permissions of 640. You should change the umask command in the .login, .cshrc, or .profile script file for named users. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NOENVCHK Category: System Error | UNIX (5442) | Title: Did not check user's environment Description:The User Files module did not check the named user's environment. It is important to run environment checks for every user. The reason the checks were not completed is listed next to the user's name. The environment checks execute the user's startup files to check the user's path and umask. You should correct the named problems so the User Files module can complete properly. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Umask (parsing startup scripts) (UNIX)

Module: User Files

This option determines how the Umask check is performed. When this option is selected, Symantec ESM attempts to manually search each user's startup scripts for umask commands. Use the name list to specify scripts that should be parsed. Scripts listed using a relative path will be read from the user's home directory. Do not select this option if you select either the Umask (using su) option or the Umask (modifying startup script) option. They are mutually exclusive.

The following table lists the error messages for the check.

Table: Error messages for Umask (parsing startup scripts)

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_UMASK Category: System Error | UNIX (5439) | Title: Unsafe umask Description:The named user has umask settings that allow too much access to group and others. The umask specifies an octal number that is subtracted from the permissions when a file is created. Lower number settings grant more access. See umask(1) in the man pages for more information. Symantec ESM's default minimum umask value provides normal security. This value is 027. It creates executables with permissions of 750 and other files with permissions of 640. You should change the umask command in the .login, .cshrc, or .profile script file for named users. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NOENVCHK Category: System Error | UNIX (5442) | Title: Did not check user's environment Description:The User Files module did not check the named user's environment. It is important to run environment checks for every user. The reason the checks were not completed is listed next to the user's name. The environment checks execute the user's startup files to check the user's path and umask. You should correct the named problems so the User Files module can complete properly. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Umask (using su) (UNIX)

Module: User Files

This option determines how the Umask check is performed. When this option is selected, Symantec ESM uses the su command to access each user account and run startup scripts to check umask settings. Do not select this option if you select either the Umask (modifying startup script) option or the Umask (parsing startup scripts) option. They are mutually exclusive.

The following table lists the error messages for the check.

Table: Error messages for Umask (using su)

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_UMASK Category: System Error | UNIX (5439) | Title: Unsafe umask Description:The named user has umask settings that allow too much access to group and others. The umask specifies an octal number that is subtracted from the permissions when a file is created. Lower number settings grant more access. See umask(1) in the man pages for more information. Symantec ESM's default minimum umask value provides normal security. This value is 027. It creates executables with permissions of 750 and other files with permissions of 640. You should change the umask command in the .login, .cshrc, or .profile script file for named users. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_NOENVCHK Category: System Error | UNIX (5442) | Title: Did not check user's environment Description:The User Files module did not check the named user's environment. It is important to run environment checks for every user. The reason the checks were not completed is listed next to the user's name. The environment checks execute the user's startup files to check the user's path and umask. You should correct the named problems so the User Files module can complete properly. | Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


User defined shells (UNIX)

Module: User Files

This option lets you specify internal defined special shells which are not well-known login shells. The special shells in the name list will be treated as no login shells. If one of no login shells is assigned to the shell of user accounts, the ESM will skip the user accounts from checks Current directory only at end of PATH, Current directory not allowed in PATH, User directories follow system directories in PATH, World writable directories in PATH, Group writable directories in PATH, Umask, Startup file contents, and Startup file protection.


User directories follow system directories in PATH (UNIX)

Module: User Files

The check reports users with user directory entries that are located before the system directory entries in their PATH variables. Use the check's name list to exclude or include users and user groups that are not already included or excluded by the Users to check option. Enable one, but not both, of the PATH (using su) or PATH (modifying startup script) options before executing this security check.

The following table lists the error message for the check.

Table: Error message for User directories follow system directories in PATH

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_USERDIR Category: System Error | UNIX (5438) | Title: User directory too early in path Description:The named user has defined a path that puts a user directory before a system directory. This is a security problem if the user's current directory is set to a directory where other users have write access. The user can be "spoofed" when a common system command such as 'ls' is placed in that directory and executed instead of the system 'ls'. You should move the user directory to the end of the path where the PATH environment variable is set in the .login, .cshrc, or .profile script file for this user. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Users to check (UNIX)

Module: User Files

This option lets you specify the users and user groups that will be included or excluded in all User Files security checks.


Users to check for Forbidden files (UNIX)

Module: User Files

This option lets you specify users or user groups that will be included or excluded from the Forbidden files check.


Users to check for Required files (UNIX)

Module: User Files

This option lets you specify users or user groups that will be included or excluded from the Required files check.


Users to skip for Startup file protection (UNIX)

Module: User Files

This option lets you specify users and users groups that will be excluded from the Startup file protection check.


World writable directories in PATH (UNIX)

Module: User Files

The check reports world-writable directories that are listed in user PATH variables. Use the check's name list to exclude or include users and user groups that are not already included or excluded by the Users to check option. Enable one, but not both, of the PATH (using su) or PATH (modifying startup script) options before executing this security check.

The following table lists the error message for the check.

Table: Error message for World writable directories in PATH

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_PATHWORLDWRITE Category: System Error | UNIX (5458) | Title: World writable directory in user path Description:The named, world-writable directory is listed in the named user's PATH variable. This allows all users to create files that could "spoof" this user by placing a new file with the name of a common command like "ls" in the named directory. This can be a serious security problem. You should remove world write permissions from the named directory (chmod o-w filename) or remove the directory from the user's path. | Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


World writable files (UNIX)

Module: User Files

This check identifies user files and directories that are world writable. Specify full path names in the file list to exclude files that should be world writable from this check.

The following table lists the error message for the check.

Table: Error message for World writable files

Message String ID and Category | Platform and Message Numeric ID | Message Title and Description | Additional Information
String ID: STKU_USRWORLDWRITE Category: System Error | UNIX (5430) | Title: World writable Description:The file is writable by everyone. There are no controls over who can modify or delete them. This can be a serious security problem. You should change the permissions for these files so world write is not allowed (chmod o-w filename). | Severity: green-0 Correctable: true Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]


Working with Symantec ESM policies

This section includes the following topics:

  • About the Symantec ESM policies

  • Implementing best practice policies

  • Creating and editing your own policies

  • Copying and moving the policies

  • Running the policies

  • Demonstrating security checks

  • Sample policies


About the Symantec ESM policies

A policy is a set of modules with the enabled security checks that report security vulnerabilities.

Symantec ESM is installed with seven sample policies.

The baseline policies and the best practice policies can be installed through LiveUpdate or downloaded and installed from the Internet or a CD.


Implementing best practice policies

Symantec ESM best practice policies are configured to protect specific applications and operating systems from security vulnerabilities.

Operating system (OS) hardening policies incorporate the Symantec security research that is based on ISO 17799 and other industry standards and best practices. OS policies can be used in place of the default policies.

OS policies are configured by Symantec with values, name lists, templates, and word files that apply to the targeted platforms. They use Security Update modules and templates to check OS patches, password settings, and other vulnerabilities on the operating system. These policies may also introduce new templates and word lists to examine conditions that are required by supported standards or regulations.

The maintenance-paying Symantec ESM customers can download the OS Policies without charge through LiveUpdate or from the following Symantec Security Response Web site:


Creating and editing your own policies

Creating and editing the Symantec ESM policies requires Create New Policies and Modify Policy access rights. You can add a new policy or copy an existing policy. After creating a policy, edit it to add or delete the modules that the policy runs when it executes.

Note:

The manager does not keep multiple copies of policies with the same names. If users on different consoles add different policies with the same names, the latest version of the new policy overwrites all previous versions.

To add a new policy

  1. In the enterprise tree, do one of the following:

    • Right-click a manager, then click New > Policy.

    • Right-click Policies, then click New Policy.

  2. Type a new policy name of not more than 31 characters.

  3. Press Enter.

To duplicate a policy

  1. In the enterprise tree, right-click a policy, then click Duplicate.

  2. Type a new policy name of not more than 31 characters.

  3. Press Enter or click OK.

To edit a policy

  1. In the enterprise tree, double-click the policy that you want to edit.

  2. Edit the name lists as follows:

    • In the Available Modules list, click a module that you want to add to the policy, then click the left arrow.

    • In the Current Modules list, click a module that you want to remove from the policy, then click the right arrow.

  3. Click OK.

To rename a policy

  1. In the enterprise tree, right-click a policy, then click Rename.

  2. Type a new policy name of no more than 31 characters.

  3. Press Enter.

To delete a policy

  • In the enterprise tree, right-click a policy, then click Delete.

    The manager must have the Modify Policy access right.

    You cannot delete a policy when more than one Symantec ESM console is connected to the manager.

    To delete the report files that are associated with the policy, delete the /reports/ <policy> subfolder in the manager's ESM folder.


Copying and moving the policies

Copying policies ensures that policies are identical on multiple managers. Moving policies removes a policy from one manager and adds it to another, overwriting any policy-related information on the destination manager.

You need the Create New Policies access right to copy and move policies.

To copy a policy to another manager

  • In the enterprise tree, drag and drop a policy on a destination manager. You can also right-click a policy, drag and drop it on a destination manager, then click Copy.

To move a policy

  1. In the enterprise tree, drag the source manager policy and drop it on the destination manager.

  2. Click Move.


Running the policies

You can do the following to run a policy:

  • Drag and drop your policy on the agent or domain

  • Drag and drop your agent or domain on the policy


Demonstrating security checks

Before you apply a new security check to your systems, create a demo policy and add the check to it. Then verify the check on a representative computer. By using a demo policy, you can obtain results without disturbing the settings of policies that are created and named by the Symantec Security Response team.

Delete the demo policy after you complete your demonstrations.


Sample policies

Seven sample policies are shipped with Symantec ESM. After installing Symantec ESM, make copies of the sample policies, then rename and edit the copies to implement your company's security policy.

The following sample policies are shipped with Symantec ESM and let you begin with the most basic security issues and resolve any weaknesses before proceeding to the next level of complexity:

Phase 1

The Phase 1 policy includes the following modules:

  • Account Integrity

  • Disk Quota

  • Encrypted File System

  • File Watch

  • Login Parameters

  • Network Integrity

  • OS Patches

  • Password strength

  • Startup Files

  • System Auditing

Phase 2

The Phase 2 policy includes the following modules in addition to the modules in Phase 1:

  • File Attributes

  • Object Integrity

  • Registry

  • User Files

Phase 3

Phase 3 policies let you apply different standards to various networks or computers, such as Relaxed for development or testing, Cautious for production, and Strict for sensitive areas such as finance or strategic planning.

Phase 3 has the following types:

  • Phase 3:a Relaxed

    Includes all modules in Phase 2 with more security checks enabled

  • Phase 3:b Cautious

    Includes all modules in Phase 3:a with more security checks enabled and the Backup Integrity module

  • Phase 3:c Strict

    Includes all modules in Phase 3:b with more security checks enabled

Queries

The Queries policy reports account information and file permissions. It includes the following modules:

  • Account Information

  • Discovery

  • File Watch

  • User Files

Dynamic Assessment

The Dynamic Assessment policy integrates your customized scripts and programs with Symantec ESM. It uses the Integrated Command Engine (ICE) module.


Working with Symantec ESM modules

This section includes the following topics:

  • About the Symantec ESM modules

  • Enabling and disabling security checks

  • Specifying options


About the Symantec ESM modules

A module is a set of security checks and options that looks for security vulnerabilities and reports messages in the console grid.

For more information on the Symantec ESM modules, see chapters Symantec ESM modules for Windows and Symantec ESM modules for UNIX.


Enabling and disabling security checks

Only enabled security checks provide information when you run a module.

To enable and disable security checks

  1. In the enterprise tree, expand the Policies branch.

  2. Expand a module branch.

  3. Do one of the following:

    • Double-click an operating system icon.

    • Right-click an operating system icon, then click Properties.

  4. Select a check that you want to enable or disable.

  5. Check Check Enabled to enable the check or uncheck Check Enabled to disable the check.


Specifying options

You can control the behavior of the security checks with options. Some options contain text fields where you can specify parameters such as the minimum number of non-alphabetic characters that is required in a password.

Other options are used to specify the entities that you want to examine as name lists. For example, in the Users to Check option of the Password Strength module, you specify which users and security groups you want all module security checks to examine or skip. This option is permanently enabled as indicated by the circle in the box.

To display the name lists, click an option or security check on the left side of the window. In the name lists that appear on the right side of the window, you can specify the items that are included or excluded when you run all or some of the security checks in the module.


Working with Symantec ESM messages

This section includes the following topics:

  • About the Symantec ESM messages

  • Types of Symantec ESM messages

  • Common Symantec ESM messages

  • Correcting agents in messages

  • Updating template and snapshot files in messages

  • Editing the messages


About the Symantec ESM messages

Messages are reported by the checks that are present in the Symantec ESM modules. These messages are displayed in the grid on the ESM console.

A message contains the following attributes:

Name

Message names link the Symantec ESM code to the text of the message title and must not be changed.

Message names appear only in .m files and in uppercase.

Title

The message title is displayed in the console grid.

You can edit the message titles in .m files.

Text

The message text is displayed in a separate window of the summary report when you place the cursor on the Message field in the console grid.

You can edit message text in .m files.

Class

The class of a message indicates its severity.

A message can fall in one of the following classes:

  • Class 0

    Displays green messages that require no action

  • Classes 1 to 3

    Displays yellow messages that serve as a warning and need attention

  • Class 4

    Displays red messages that need immediate attention

Some messages display a code in the Updatable/Correctable field of the console grid that identifies the message as template-updatable (TU) or snapshot-updatable (SU). You can click the code to update the template or snapshot file to match the current agent settings.

Some messages also display a code in the Updatable/Correctable field that identifies the message as correctable (C). You can click the code to reverse agent settings or disable a vulnerable account.

Most messages are reported in the console grid, though some common messages are reported in a separate window.


Types of Symantec ESM messages

Symantec ESM reports the following types of messages:

Common | Common messages are available to all modules and report the Symantec ESM operational information such as Correction succeeded, Disk write error, etc.
Correctable | Correctable messages reverse the current agent settings.
Updatable | Updatable messages change the template or snapshot settings to the current agent settings.
Informative | Informative messages report the administrative information such as lists of user accounts or security vulnerabilities that require manual adjustments.


Common Symantec ESM messages

Several messages that report system conditions are stored in the Program Files\ Symantec\ESM\register\<architecture>\common.m file. Some of these common messages are displayed in the console grid, others in separate windows.

The following messages can be generated by more than one module:

Message Name | Message Title | Class
CANCELED | Module execution canceled by user | 4
CHECK_NOT_ PERFORMED | Warning - check could not be performed | 1
CORRECT_FAIL | Correction failed | 0
CORRECT_SUCCEED | Correction succeeded | 0
DISK_WRITE_FAIL | Disk write error | 0
EOF | End of file | 0
FEATURE_NOTSUP | Module feature not supported | 0
HEADER | No problems found | 0
NOMEM | Failed to allocate memory | 4
NOTE | Note | 0
SNAPSHOT_CREATED | Snapshot created | 4
SYSERR | Unexpected system error | 4
TEMPLATE_ITEM | Template item | 0
TEMPLATE_SUBLIST | Template sublist item | 0
TOOMANYERR | Too many report records, please correct problems and rerun | 4
UPDATE_FAIL | Update failed | 0
UPDATE_SUCCEED | Update succeeded | 0


Correcting agents in messages

Correctable messages display a C in the Updatable/Correctable field of the console grid.

You can use the Correct feature to correct agent rights or settings. For example, in the Account Integrity module, the Generate security audits check reports accounts with rights to generate entries in the security log. If you correct a reported user account, the right is revoked.

You can restore the right by repeating the same process that you used to revoke it. You can also use the Correct feature to disable a vulnerable account. In the Password Strength module, for example, you can immediately disable a reported account that has no password.

To correct the agent reported in the console grid

  1. In the console grid, right-click an item that contains C in the Updatable/ Correctable field, then click Correct.

  2. Type the name and password of a user that has the right to change the setting.

  3. Click OK.

To reverse a correction, use the same procedure except in step 1, right-click an item that contains Corrected in the Updatable/Correctable field, then click Uncorrect.


Updating template and snapshot files in messages

Some modules use the template files that specify authorized settings. When you run a module with enabled checks that examine these settings, discrepancies are reported with a TU code in the console grid.

Similarly, some modules use the snapshot files that contain the settings that were found the last time the module was run. The snapshot file is created when you run the module for the first time. Changes are detected in subsequent policy or module runs. Settings that do not match the snapshot file are reported with a SU code in the console grid.

To update a template or snapshot file in the console grid

  1. In the console grid, right-click an item that contains TU or SU in the Updatable/Correctable field.

  2. Click Update Template or Update Snapshot.


Editing the messages

Messages are contained in the module initialization files called .m (dot-m) files. The .m file of each module does the following:

  • Specifies security checks and options for the module

  • Associates the module with specified name lists

  • Contains a descriptive name for the module

  • Supplies default values for the module's security checks

  • Supplies message text that is reported in the console grid

During agent registration, the current version of each .m file is stored in the manager database at \ESM\ register\<operating system>\<module name>.m. You can specify the location of .m files on each agent.

The .m files contain ASCII text. Some lines begin with directives - words that are preceded by a period (.) - that classify file information. Directives are usually followed by the data and sometimes by the descriptive text. Messages begin with .begin directives, which always occur after information about security checks, options, and templates. Do not delete or reorder any messages.

To edit messages

  1. Select an agent with an operating system that reports messages that you want to edit.

  2. Open the common.m file or <module>.m file in a text editor.

  3. Edit the following directives as needed:

    .title

    Brief description of a security problem, enclosed in quotation marks, not exceeding 79 characters

    For example, .title "Maximum password age too high"

    The description is displayed in the console grid when the module runs.

    .class

    Severity of the problem from 0 to 4. For example, .class 2.

    You can use one of the following values of severity:

    • 0

      Green message that requires no action

    • 1 - 3

      Yellow message that deserves an action

    • 4

      Red message that requires immediate attention

    .text

    Explanation of the problem

    Lines of the text cannot exceed 128 characters and the total explanation cannot exceed 1,023 characters. Begin the text on the line after the .text directive.

    Include the following information:

    • Nature of the problem

    • Why it is a security risk

    • How to remedy the problem

    The .endtext directive should occur on a line by itself after the text (required even if you omit an explanation).

    For example, use the directive as follows:

    .text

    The maximum password age is too high. Infrequent password changes allow a long-term access to your system to anyone using a stolen password. Set the maximum password age to 60 days.

    .endtext

    Note:

    Do not begin a line of text with a period. This character is used as a control delimiter and improper usage causes the module to fail.

  4. Change the .customized directive value of each modified message to 1. Doing so prevents the edited message from being overwritten when the module is updated to a later version.

  5. Increment the module version number in the .module directive by 1. In the following example, 1300 was the last version number:

    .module "Account Information" acctinfo 1301 WIN2000

  6. Save the edited .m file.

  7. Re-register the module with appropriate managers.

  8. Verify that the edited messages appear in the message.dat file on computers at the following default location:

    \ESM\system\<system name>\db\ message.dat