Daily IT Matters [DIM]

Well this one is really simple. On your windows 2003 server go to DNS right click the server go to your forwarders and add the opendns dns servers. Also go to your root hints tab and remove those. (did you ever check if the default root hints are still valid nah I know, if you use em you should also update them) Now for all your outgoing lookups the windows server queries the opendns servers. Why is this safe? Block the bad sites and whitelist the good. Phishing Protection We operate PhishTank.com, the world's most trusted source of phishing data. We integrate that data into an intelligence feed on our DNS servers to keep everyone on your network safe from phony sites trying to steal personal information. Domain Blocking You want to secure your network and have control over what resolves. We give you that control by providing the tools to block any website or DNS zone on the Internet, all through an easy-to-use interface. ...

A new era of network sniffing has begun at Microsoft with the soon to be released Network Monitor 3.0. So, it seems appropriate that we create a Network Monitor Blog site to accompany it. [So this is what a Blog feels like, nice!] The Essentials Microsoft Network Monitor 3.0 Beta 2, where is it? We currently have a Beta version of Network Monitor 3.0 available on our Microsoft Connects site (http://connect.microsoft.com), you'll need a passport account. Select "Available Connections" and look for Network Monitor 3.0. Once you sign up, it will appear in your "My Participation" section. Feel free to download, provide feedback, and use the newsgroups. Microsoft Network Monitor 3.0 Beta 2, what is it? Network Monitor 3.0 is a total overhaul of our previous Netmon2.x program. We actually threw out everything and started from scratch. This has produced a much easier and safer way to analyze network traffic.. DLLs for parsers have the inherent problem of overru...

Wow, its already Wednesday; time for another entry. Last week I wrote about the new user profile policy settings for Windows Vista. This week, I want to highlight a couple policy settings included in the Windows Logon Options. The Windows Logon Options policy settings are located under both the Computer and User Configurations\Administrative Templates\Windows Components\Windows Logon Options. This policy category has six policy settings, equally divided between user and computer configurations. These policy settings apply to computers running and users logging onto Windows Vista. Earlier versions of Windows will ignore most of these policy settings. Read the explain text of each policy setting before you combine these policy settings with earlier policy settings in a single Group Policy object. I’ll start with highlighting two of the three policy settings under the Computer Configuration. The first of these is the Display information about earlier logons during user logon. When enabl...

This time around I’m going to spend some more time on working with Event Logs from the command line. I’ll cover some how to perform some common tasks using wevtutil.exe. Enumerate Event Logs Wevtutil el – This command will list out a lot of logs but the main logs you’ll want to look at are Application, System, and Security. In addition, the Setup log is helpful if you are having problems installing roles, features, or patches. When viewing a log it’s a good idea to redirect the output to a text or xml file to make it easier to read. Common switches that come in handy /c:5 – Count. Specifies how many records you want returned, in this example 5 /rd – Reverse Direction. By default the oldest events are displayed first, so if you used the /c switch to dump 5 events you would get the first 5 in the log, probably not the events you’re most interested in. To see the 5 most recent events you would specify /c:5 /rd:True /f: - Format. By default the output is raw xml and when dumped out t...

http://www.cert.org/tech_tips/WIDC.html This document outlines suggested steps for determining whether your Windows system has been compromised. System administrators can use this information to look for several types of break-ins. We also encourage you to review all sections of this document and modify your systems to address potential weaknesses. The term "Windows system" is used throughout this document to refer to systems running Windows 2000, Windows XP, and Windows Server 2003. Where there is a distinction between the various operating system versions (e.g., a capability available to only one OS version) the document will note this as such. In this document, we make a distinction between the terms "auditing" and "monitoring". We use auditing to indicate the logging or collection of information and use monitoring to indicate the routine review of information obtained by auditing to determine occurrences of specific events. This document does not provi...

From Technet: If you are living on the edge and are already done testing the RC1 5600 build, head on over to http://download.windowsvista.com/preview/rc1/en/download-5728.htm and see about the latest published 5728 build. Please heed the following advice from the site: "This build (5728) has a number of improvements and updates from RC1, but has not been put through the same internal testing process as RC1 and therefore may be unstable in certain installations. We are making this release available for a limited time only (and only by download) in order to get broad distribution and testing in a variety of PC configurations. Please note: This build may not have the same level of support or servicing via Windows Update, and you may not be able to upgrade to the final version of Windows Vista."