[Net Admin] Tools

I am going to try to put all tools that I think are valuable for a Network Administrator.
I will try to list free utilities first. I had used a wide selection of utilities and it is going to take me some time to backtrack them :p
Auditing: Newt Freeware . It installs quick. It runs quick. In about 40 minutes it gives me a list of all computers in the domain (we have 97) It can save a report in csv and html besides its own databse format. It list basic information hardware information, user, clock reading and uptime.
Auditing Advanced: If you are a consultant, you might consider better using Newt Professional. They have a demo version that scans up to 10 machines. A lot more complete. I had a problem gathering information from NT4 workstations and they were very quick to fix it. LOTS OF INFORMATION, and it only cost 200$ which is a lot lower than competition. This is my keeper.
Patch Management:
Well, this is more difficult. Most utilities charge for it. And quite a bit. If you have to update a network that hasn't been updated in a while, i suggest using GFI's LANguard They have a 30 day demo for full product. After that advance features are disabled, which means basically it only scans basic information (similar to Newt) I am not a fan of their layout, but full product is too complete to use in other layout than treeview. This program lets you check for missing patch and services packs (among a large array os security). This is quite an expensive product, but 30 days is enought to patch most of the network to keep it up to date. After that, which a better network you can use..
Software Update Services From M$. It has a large deployment guide, but in short you can just install it in a Server family server, then configure the clients thru Active Directory or registry keys. Now you only have to read 4 pages of 100 ;)
You can even deploy the registry key (once you have a reg file with all the settings) using LANguard if you had it installed.
Later this year (around July) MS is suppoused to Launch version 2, which will be called Windows Update Services. This should be a lot more advance, having even reports (something I would really like from SUS) WUS is not available to download yet. NOTE: SUS takes quite a bit of RAM. I just realized this, so I haven't work in a looparound to restart the logging to RAM withouth having to restart (terminating the Service has no effect) Right now it has run for 3 hours and it is a similar stage than when started, using about 28 MB. When I realized it was using 560MB. It also requires enought hard drive to save all updates if you decide to host them locally (which is a good idea to save bandwith)I recomend a separate server for this if posible
Auditing And security MS also offers a security ScannerBaseline Security Analyzer V1.2 I am currently evaluating this. I had used far more advanced tools, but I think it does a good job considering it is free. There are a few more alternatives free too.
Auditing And securityNessus .It is only for Unix compatible systems, but it has a Windows client to run from a Windows machine.

With more time I will add more software. For now, I go to sleep :p

For patch management try MBSAFU

found @ sourgeforge. It's a set of six utilities that will use HFnetchk / MBSA to download the patches on a given set of PC's. Best of all... you don't have to wait for patch deployment.

Link for MbsaFU

Something neat I found the other dat in a technet webcast (BTW, this are very usefull, so take a couple)
GPMC or Group Policy Management console. It lets you manage the group policies, and add a couple of more tools if your servers are running 2003 native mode. I highly recomend it if you have to use policies
http://www.microsoft.com/windowsserv...gpmcintro.mspx
This tool can also be used in an eviroment without AD. There is an article about that in http://www.windowsnetworking.com/, but I didn't save the link, so you will have to look for it

This is not a tool, but a tip for Network Administrators:
Well, if you are a network administrator in a company, do you run with an account that has admin right? NO! There are lot of reasons why not to, just to name a few:
you will be at the same level that most users, having a better idea of what problems might arise with any change, and letting you resolve it before a support call from a user is made

1. you will be at the same level that most users, having a better idea of what problems might arise with any change, and letting you resolve it before a support call from a user is made.
2. You could be a security hole yourself. It would be easy for you to spread viruses, spyware, or just get hacked.
3. You won't make users jelous, and thus avoid some users asking you extra favors because you have admin rights
4. This should also be true for server, which you have to add, that not only you don't login with admin rights into a server, but you don't administer it locally either. There are lots of tools to do the administration remotely, so there is no need to log into the server. For example, Active directory users and a lot of MMC tools come in the admin pack (located in the i386 folder)(requires Windows XP SP1 in the client machine to be installed)

So..you need to run a lot of tools that require admin right?? Like DNS, DHCP console, Active Directory users and computers, GPMC, etc
Easy, create a shortcut to cmd in your desktop (for easy access), right click and chose properties. Now from the shortcut tab chose advanced, and select the option "Run with different credentials" Click OK twice and everytime you open that cmd will ask you for the credential. Just type an admin account and you got yourself a cmd with admin rights
NOTE: Do not use administrator as the account. Create a different account with administrator rights (best is to copy the admin account)
Actually, administrator and guest accounts should have already been renamed, the password changed, and lock away in a safe, but never to be used again.
So, what good is a cmd with admin right? well you can open all programs that you will need with admin rights from that cmd. What I did was I created a folder (I called it "admin" located in my desktop) and I put there shortcuts to all programs that I need/might need with admin rights, like Hyena, LC5, NEwt Security Scanner, Sybari client (for Spam manager) and one very important is Internet Explorer (more in IE later). I also have a admin console.msc (more on it later too).
the cmd runs directly from the location of the file, so it will always be system Drive\Windows folder\System32, so I created a batch file that automatically goes to the admin folder I created in my desktop. So now I just have to type new (and then hit tab for auto complete) and the program opens with admin rights.
Why Internet Explorer? Well, not to browse web pages. PLEASE NOT!! because then what is the point ;) It is just to run the Windows update if needed, but more importantly, there is no way to run explorer.exe with different credential, so we run internet explorer instead. Then I type in the addess bar C:\ and I have Windows explorer with admin rights. Now I can access control panel with admin rights :D
Note: Most control panel applets can be run with diferent credentials using the "run as" command. To display the run as command you have to press and hold shift and then right click on the file. Neat, right?
Now, for the admin console. I opened a MMC and then added all snap-ins that I need to manage the network in one console window. Like AD Users and Computers, DHCP, DNS, Disk management (one for each DC), Event Viewer for all important servers, Exchange Management Console, Services for the important servers, The Symantec management console, WiNS, Shared folders for the SANS and server that have share folders, DFS, Services, GPMC, and anything else you might need. After that, you probably have most of what ever you might need in one tool, one window.
I use this system at home too, and my brother also uses it at home.
He very pleased reported 4 full months without having to re-format his PC because he messed it up somehow :p (A lot better than format once a month)
Note, this requires some patience until you learn with programs need admin rights. Some things might not work as you intended. Though luck thought, since not running as admin is a best practice in a corporate network :p
Well, good luck

This is a complete set: So it is in the category of Auditing/security/hacking/administration
Auditor Security Collection is a boot disk that boots on Knoppix linux distro. It has lots of features. I know I put it in another thread but it goes better here
http://www.techzonez.com/forums/show...ity+Collection
The link to the program is http://www.remote-exploit.org/?page=auditor

Don't forget WinGrep for parsing all kinds of logs / text / any files for a specific string.

http://www.wingrep.com/download.html

I posted this awhile back, appropriate for this thread:

Not sure if this has been posted before but, I use this tool at many of the sites that I work in, this tool will allow you to launch a program with elevated permissions so that you can keep all of the users as just plain "users" instead of Adminstrators or Power Users. The tool is called CPAU, here is the link.
http://www.joeware.net/win/free/index.htm

One more tool that is more in line with this thread:

This is a tool that will allow you to control the power management settings of your client machines using Group Policy, it will also work on workgroup machine using reg entrys. This might be a bit esoteric, but it took me a long time to find something that works reliably. Unfortunately Microsoft did not include any Templates for this, probably because GPO cannot handle binary registry entry's. Here is the link for it,
http://www.terranovum.com/projects/...tar/ez_gpo.html

Just a coment. TKS to Curio abou Wingrep (He suggested it in another post, and I have been using it ever since).
And the CPAU also solved a little problem I had for some time, where for just one program I needed to assing local admin right to a user, so now I am a bit happier and I find both tools extremely usefull

Been looking for a good syslog on Windows and found Kiwi Syslog Daemon and related tools (log viewer and some test apps). Great if you have a router or switch that can broadcast to a syslog server and it's free too. Superb.

I did look at it too, but the pro version has a lot of features that I want. So I am also looking for a syslog that is complete and free (:rolleyes:) there is probably one in Linux package.
I think it is more of a necesity now a days to log everything even if you don't need it, so this is my main project. LOG, change log, AD log, Audit log, security log. etc

There are also free tools to broadcast the Windows Event Log events to the Syslog server, on this occasion I just needed to capture all the web sites visited via that particular router for erm... research purposes :rolleyes:

Of course Linux also has Syslog and probably the CentOS or RH Enterprise would be fully featured. But all it does is capture messages it's the sorting of them that is the clever bit.

Another Open Source IT Tool found on Sourceforge today. Zenoss Download here

Open Source Enterprise Monitoring: The Next Step in IT Management

Zenoss provides an integrated, easy-to-deploy and cost-effective alternative to the big suites from IBM, HP, CA and BMC for enterprise IT infrastructure monitoring.

For years, organizations (especially medium-sized companies) have struggled to manage their growing IT infrastructures because powerful management tools were very complicated and extremely expensive. Zenoss is changing the game.

Through open source development and distribution, we are able to keep costs down and directly involve end users throughout the world. The result is that we have changed the economics of delivering great software and we ensure that the product stays aligned with the real needs of IT operators. In effect, we are bringing the "Zen of Open Source" to enterprise network and systems management.

Zenoss is designed to operate on any modern Unix system with a sufficient GNU build environment. For now it is known to work on at least the following platforms:
Linux
RedHat Enterprise
Fedora Core
Ubuntu
Suse
FreeBSD
Mac OS X

*Zenoss is also able to be installed and run in a Windows environment. This is accomplished using the VMplayer from vmware.com, and the Zenoss Virtual Appliance. For more information about installing Zenoss using the VMplayer, see the Zenoss Quick Start Guide.

It looks very interesting. It feels like Nagios but seems to be easier.
I used Hobbit. It is based on Big Brother. Definetively easier to use than Nagios. I tried 3 before deciding for it. Points that won it for me were.
Deployment was easier than Nagios. Requires a bit of time to learn it, but it can be set in a day (I can set it now in less than an hour).
easy to add services (it is done thru a config file, which I would open with programer's notepad and copy paste settings to add similar services.
It is not required a client. Thought with it can be faster gathering, and allows more check. The client is also used to check on logs in a secure manner (not needing to access the logs remotely).
1 Page all status, which option to see more in detail.
Clients pull configuration from server, not needing to modify client by client when changes are made.
This said, I would test Zenoss if I have a project were I need to monitor a network, but for what I read Zenoss and Hobbit could be complemented.
Hobbit doesn't use SNMP, thought it could be implemented into it.
Big advantage of zenoss is having a virtual appliances which makes it fater to have it running (for testing pourposes or to show to upper management)
This is how I got the hobbit running as well, but I installed it in the VM appliance. I was able to copy the configuration thought, so passing from a virtual appliance to a server took about 30 minutes (installation + configuration of IP and preparing the server)
Rik, could you provide your experience with Zenoss? Does it need a dedicated server?

I haven't run it yet. Looks like we will probably test it on a Win 2k3 server setup using the vmware image, and maybe on an Ubuntu box also.

From what I read it doesn't require it's own server tho.

Free add-on that enables you to lock down a computer whereby it works when turned on in a disk cache, this is then removed when you reboot restoring the computer to the setup by admin state.

You have to be a bit careful setting it up but only to the extent that you set everything how you want it then commit changes to disk then reboot and then enable the disk protection. Make sure you create the user profiles and commit changes before reboot otherwise it will need to set up the profiles every time you boot as the disk protection will remove the user's profile folders.

It is useful for an internet Kiosk type machine, spare PC used for loan outs or any system where you don't want the user making changes to their own system but saving files to a central server or external drive. You might also use it on an internet surfing machine so that you can surf on the dark side without getting your PC infected to hell with spyware and trojans.

You know you sometimes get an error message with a disk described as some volume \\?\Volume{876827-2029-00978LOADSOFBLOODYNUMBERS} and you dont 't have a clue what it's talking about. Go to the command prompt and type 'mountvol' [enter] - and it tells you.

Fed up of seeing thousands of logon attempts for administrator/sql/abby/test against your MS FTP server - join the club :)

Try this if you must use MS FTP - http://www.insight-onsite.us/IO/Prog...0Security.aspx seems to work OK to me.

I have also written some stuff to add swathes of IPs to the ban lists of various IIS bits (websites, SMTP service, FTP). If anyone is inerested I might put them up - I am talking about adding 50000 plus ips at a time :) banning whole countries in a single bound. But if you wanna go this far it might be easier to just add those thousands you do want to be able to get on rather than the millions you want to ban.

Excellent advice as always.

I used RoboCopy GUI for years, but I am now switching to RichCopy.
http://technet.microsoft.com/en-us/m...spotlight.aspx
RichCopy does copy a lot faster. I have used it to recover files from failed hard drives (laptop hard drive, connected to a desktop) and copied 16 GB in about 20 minutes, giving me the list of corrupted files at the end (14 mp3). Needless to say the person was super happy, and I did it really fast :)
Robocopy and RichCopy are GUI based, but can be used from command line as well. I have a server that has 6 scheduled tasks to copy 8 databases each (access dbs), and this tool does it in seconds.
On another note, I wanted to point out that Hobbit has changed it name to Xymon and there has been some new changes. I can setup our network monitoring in a couple of hours (I can do it in 15 minutes now, but a couple of hours if I had to setup a brand new network) and it works awesome in an old linux server (or PC). I am running our production network monitoring and helpdesk from an ATOM pc that I build for about 250$
http://sourceforge.net/projects/hobbitmon/

Second the RichCopy App, very handy!