Video Screencast Help
Endpoint Management Community Blog
Showing posts tagged with Symantec Management Platform (Notification Server)
Showing posts in English
Ludovic Ferre | 09 Sep 2013 | 0 comments

After I posted my previous blog entry [1] I went to implement a solution (for which the documentation is done and awaiting moderation to be release here on Connect).

It worked pretty well, but still we have far too many basic inventory coming in. A look at captured NSE's indicated that there is another problem with inventories hijacking the Basic Inventory Capture Item:

Sample 1:

<?xml version='1.0' ?>
<message>
<from><resource guid='{ffffff-ffff-ffff-ffff-ffffffffffff}' typeGuid='{493435F7-3B17-4C4C-B07F-C23E7AB7781F}'/></from>
<to>1592B913-72F3-4c36-91D2-D4EDA21D2F96</to>
<time>20130905211027.187000-120</time>
<body><inventory><dataClass guid="ca029e6b-f124-4399-9b91-10c41b73165b"><data><resource partialUpdate="true"><row PolicyGuid="ffffff-ffff-ffff-ffff-ffffffffffff" TaskInstanceGuid=...
Ludovic Ferre | 05 Sep 2013 | 2 comments

Today is riddle day. So here it is in full:

When is a basic inventory not a basic inventory?

When it's a custom inventory!!!

So, now this explains why we are getting thousands of customer inventory every day at my customer. The custom inventories are generated by VBS and as documented here on Connect [1] (and I'm sure in much of the product documentation) we generate NSE's with a msgTo element pointing to the Basic Inventory Dataclass:

'----------------------NOTIFICATION SERVER ENTRY STARTS HERE------------------
dim nse
set nse = WScript.CreateObject ("Altiris.AeXNSEvent")
nse.To = "{1592B913-72F3-4C36-91D2-D4EDA21D2F96}" 'Never change this guid, it is needed by NS.
nse.Priority = 1
dim objDCInstance
set objDCInstance = nse.AddDataClass ("{8284a0ad-b37f-4c9b-b0ad-cb92f97d7401}") ' Change this to math the guid of the custom data class
dim objDataClass
set objDataClass...
mmurphy7 | 09 Aug 2013 | 0 comments

In the past 6 months Apple has released 2 Security Updates for their Windows versions of Quicktime and iTunes addressing 52 vulnerabilities. Both of the Apple Security Bulletins released had vulnerabilities that could be used to exploit the rights of the logged on user. Here’s a breakdown of the updates released:

Bulletins 2
Vulnerabilities 52
% of Vulnerabilities with privilege exploits 48%

Apple, unlike Microsoft and other software vendors Arellia has looked at, does not classify their Security Updates. Instead they lump many vulnerabilities into a single security update. Here’s a breakdown of the two security updates and the vulnerabilities with Privilege Exploits:

Security Update Vulnerabilities with Privilege Exploits Total Vulnerabilities
...
mmurphy7 | 09 Aug 2013 | 0 comments

In the past 6 months Adobe has released 16 Security Bulletins addressing 116 vulnerabilities. Of the 16 Adobe Security Bulletins released 81% had vulnerabilities that could be used to exploit the rights of the logged on user. However, if you don’t count the bulletins related to ColdFusion then 100% of the Security Bulletins had vulnerabilities that could be used to exploit user rights. Here’s a breakdown of the Adobe Security Bulletins:

Bulletins 16
Vulnerabilities 116
% of Bulletins with privilege exploits 81.25%
% of Vulnerabilities with privilege exploits 67.24%

Adobe classifies the bulletins as critical, important, moderate, and low. Similar to Microsoft, critical vulnerabilities can run attacker code and install software...

mmurphy7 | 09 Aug 2013 | 0 comments

In the past 6 months Mozilla has released 62 Security Bulletins addressing 88 vulnerabilities. Of the 62 Mozilla Security Bulletins released more than 1 out of every 2 bulletins had vulnerabilities that could be used to exploit the rights of the logged on user. All of the bulletins released affected Mozilla Firefox, which means that any user not keeping up to date with their Firefox browser is in imminent danger unless some privilege management software is in place. Here’s a breakdown of the Mozilla Security Bulletins:

Bulletins 62
Vulnerabilities 88
% of Bulletins with privilege exploits 55%
% of Vulnerabilities with privilege exploits 67%

Mozilla...

mmurphy7 | 09 Aug 2013 | 0 comments

In the past 6 months Microsoft has released 51 Security Bulletins addressing 121 vulnerabilities. Here’s a breakdown of the bulletins and vulnerabilities. Of the 51 Microsoft Security Bulletins released nearly 1 out of every 3 bulletins had vulnerabilities that could be used to exploit the rights of the logged on user.

Bulletins 51
Vulnerabilities 121
% of Bulletins with privilege exploits 35%
% of Vulnerabilities with privilege exploits 34%

Microsoft classifies the bulletins as critical, important, moderate, and low. Vulnerabilities of critical bulletins mean vulnerabilities can be exploited without the user knowing. Vulnerabilities of important bulletins will provide end users some warnings that the exploit is happening, but these...

mmurphy7 | 09 Aug 2013 | 0 comments

One of the most dangerous threats to IT security is abuse of privileged access. Preventing the exploitation of administrator privileges first requires knowledge of who has administrator access whether local or domain based. This is not only good practice, but also driven by many security standards.

One such security compliance standard is the Payment Card Industry Data Security Standard (PCI DSS) which outlines many security requirements to protect consumers’ credit card data. Requirement 8.5.1 states: Control addition, deletion, and modification of user IDs, credentials, and other identifier objects, which clearly identifies the need to monitor and maintain control of the administrators group.

The Center for Internet Security (CIS) releases security configuration guidelines for each Operating System. For Windows 7 section 1.8 defines User Rights and who should have access to certain system capabilities. The key to the user rights defined by CIS is which...

michael cole | 31 Jul 2013 | 0 comments

I came across a stored procedure that is quite popular for troubleshooting SQL especially blocking, it's not new but deserves a repost. I tried it against sp_who and sp_who2. It seems that this SP gives a more instant snapshot in better detail. Probably it's best feature is a clickable link to the transact that is running. I could still see block chains better with sp_who2, as you could see the trail of SPID's better. There is a SQL query for finding the lead blocker at http://sqlserverplanet.com/troubleshooting/blocking-processes-lead-blocker

For those that are interested in what the differences are between sp_who and sp_who2, the screen snip below shows the column differences, the hidden difference is that sp_who is documented and thus supported, otherwise they are very similar. SP_WhoIsActive complements them.

Disclaimer

...
ohzone - CherylPeterson | 30 Jul 2013 | 0 comments

We love our Connect community members and once again we're celebrating SysAdmin day. Check out this blog to find out how we are sharing the love with you!

Happy International Sysadmin Day!

Tell us something crazy that's happened in your world and we might make it worth your time!

stebro | 26 Jun 2013 | 0 comments

Properly securing privileged accounts is a basic security tenet and often a priority for servers. Unfortunately, the same level of concern is not present for desktops in many organizations. Yet desktops\laptops often contain as much sensitive information as servers and have done so for many years.

Most desktops\laptops have information that doesn’t make it to servers yet is extremely sensitive and valuable. Think about what is on the laptops of the CEO, the HR director, the software architect, or the CFO in any given organization. Much of this information on these systems can create serious risks if compromised as any data on an organizations file or database server. Endpoint security too often focuses solely on the threat of malware and hackers, but ignores the simple threat of insecure privileged user accounts.

For Windows systems, privileged accounts are any accounts that are in the Administrators group. Often there is at least one account that is used by an...