Let’s take a look at some of the ManageEngine Free Active Directory Tools.

ManageEngine Free Active Directory Tools

Password Policy Manager

Admins in a crunch can use the Password Policy manager tool to quickly view and edit a domain’s password policy. Rather than hunting down the effective GPO, you can quickly “login” to the manager using an administrative username and password and view/set enforced password history, minimum and maximum password age, minimum password length, complexity requirements, and whether or not to use reversible encryption to store passwords. You can also restore the default settings for a new domain.

Free ManageEngine Free Active Directory Tools – Password Policy Manager

Get Duplicates Tool

Even experienced Windows administrators sometimes have to deal with duplicate object creep in their domains, something that can cause unexpected issues and waste considerable time. Among the AD Tools is the Get Duplicates tool, which simplifies duplicate object identification (but does not allow you to clean it up). Using Get Duplicates you can verify that your domain does not contain any messy duplicate objects.

ManageEngine Free Active Directory Tools – Get Duplicates Tools

Empty Password Checker

If you inherited a domain that did not enforce a password policy or you do not employ such a policy, you may inadvertently end up with accounts that do not have passwords. This is an obvious security risk and all accounts should have passwords (with very specific exceptions). You can use the Empty Password Checker tool to check for empty passwords in a particular OU or in your entire domain.

ManageEngine Free Active Directory Tools – Empty Password Checker

AD Replication Manager Tool

Possibly the most useful tool of the suite, the AD Replication Manager Tool makes manual, “push-button” replication a breeze. Instead of using command line tools or navigating through the clunky Active Directory MMCs, you can use the manager to force replication across your domain, between two domain controllers, or to view information about previous replications.

It is a pretty nifty tool – if you create a user in your Branch Office domain controller and need that user to be authenticated in another site (such as one where Exchange is located) you would normally have to wait for replication to occur. Using AD Replication Manager you can force replication to happen immediately between the two sites, easing potential headaches and reducing wait time. The replication information is also very useful for troubleshooting replication issues, displaying any errors that may have occurred in previous replication attempts.

ManageEngine Free Active Directory Tools – AD Replication Manager Tool

Terminal Services Manager

This tool allows you to shut off Terminal Service (and Remote Desktop) sessions remotely, which is great if you have encountered “this terminal server has exceeded the maximum number of allowed connections” error and need to eliminate a stale session. If you work in an environment with users who frequently leave administrative sessions hanging (and this is most certainly not optimal) you can clean up the mess as needed with a few clicks.

ManageEngine Free Active Directory Tools – Terminal Services Manager

Conclusions

AD Tools are great for the time-crunched administrator who wants a cost-and-worry free “toolkit” for some of the most common and annoying Active Directory tasks. While none of the tools are groundbreaking individually, and some administrators undoubtedly already have scripts that perform some functions, they are collectively very useful in a pinch. Give AD Tools a try today!

ManageEngine Free Active Directory Tools

• Raffle: Blackbird Auditor for Active Directory – Real-time Active Directory auditing (0)
• Microsoft Exam 70-640 – Operations Masters – Sample question (3)
• Microsoft Exam 70-640 – The Global Catalog – Sample question (0)
• Microsoft Exam 70-640 – The Global Catalog (3)
• Automatically fill the computer description field in Active Directory (9)

VMware vCenter and ESX(i) monitoring – Veeam ONE Free Edition

If you’re working on a budget, you can take it for a test drive with no commitment. Unlike other quote on quote “Free” management application out there, Veeam ONE Free Edition does include all of the core functionality of the full version. Those Core capabilities include:

• Full Data Collection
• Multi-User support
• Microsoft SQL Server backend

Not to mention that it comes with 125 pre-built alarms for real-time monitoring and alerting. All of these alarms are tied to an extensive knowledge base that will help you troubleshoot and pinpoint the root causes of alarms and resolve any potential issues you may find. I highly recommend their built-in storage alarms. They can notify you of any possible capacity issues when V-Disks reach their configured limit, and another good one is their datastore load alarms that can notify of disk utilization of all hosts and VMs using a particular datastore. All alerts generated from these essential alarms can be routed via email and SNMP, ensuring the right people are notified not matter where they are.

VMware monitoring – Veeam ONE Free Edition

Another key function of the Veeam ONE is its ability to produce near real-time documentation of your entire virtual infrastructure. Once installed and configured Veeam ONE Free Editon will automatically discover your virtual environments, and then you can start churning up documentation on your topology and performance of your entire virtual infrastructure. This is often a necessary task that gets thrown on the back burner while we tend to other fires.

If that isn’t enough, why not whip out some reports for management that you can use to summarize your environments workload and utilization. If there is one thing I learned, it is that management likes pretty pictures of graphs and charts “metrics”. So, one way to really make them happy is to give them access to Veeam ONE’s customizable dashboard. It’s a web based interface, so it will be a snap for them to pop open a browser and enjoy all the goodness. It is customizable, so you can control what they see just in case you take the less information is better approach with management.

Veeam ONE Free Edition – Dashboard

It is free so there are going to be some limitations. You can go take look at the detailed difference on Veeam’s site Veeam ONE: Free vs Full, but here are some of capabilities that won’t be available in the free version unless you upgrade that I chose to highlight:

• Alarm modeling and custom alarms
• Full access to the knowledge base
• Management of guest, host and vCenter processes
• Historical change management beyond the most recent 24 hours
• Microsoft Visio reports for multipathing, network, vMotion and datastore utilization
• Automated report generation and distribution

If you do choose to upgrade to their full version, however, it’s just as simple as installing a purchased license key. You don’t have to reinstall the application or worry about losing your configurations and historical data.

Like I mentioned before there are no limits at all on the number of hosts, virtual machines, users, or your data archive. On top of that, they are also going to be adding full support of Microsoft’s Hyper-V in the 2^nd quarter of 2012 with Veeam ONE version 6. This will be huge and give customers a single management pane for both of their virtualized infrastructures.

Veeam ONE Free Edition

• Windows 8 Hyper-V (0)
• FREE: FrameFlow – Web-based Windows monitoring (1)
• Hyper-V cluster – Part 7: Custer Shared Volume and manage virtual machines (0)
• Hyper-V cluster – Part 6: Create a cluster (0)
• Hyper-V cluster – Part 5: Quorums and disk configuration (0)

Developed to run on Windows, FrameFlow offers out-of-the-box web-based administration and reporting without tedious config files or a hefty price tag. Unlike other Windows monitoring products, FrameFlow does not utilize any client software to perform status checks, supplanting tedious client installation/patching with existing monitoring frameworks like WMI. Administrators are not limited to monitoring only Windows hosts, either: FrameFlow can handle Linux and BSD hosts with relative ease. Let’s take a quick look at the features FrameFlow has to offer.

FrameFlow – Main window

The FrameFlow Startup Wizard

After you install FrameFlow and navigate to the server’s web address (by default, it is bound to all IPv4 addresses on your machine at port 8080), you will be greeted by the FrameFlow startup wizard. The first thing you will notice about FrameFlow is that although it is a web-based product, it is very slick and polished: it almost feels like a desktop app. The startup wizard is no exception and guides you through the process of locating/adding hosts and providing credentials to set up the default host event monitors. Particularly useful is the host finder utility, which can scan your subnet to find available hosts for monitoring.

 FrameFlow Startup Wizard

More advanced users may require the SNMP, website, and database monitoring features to be configured in the startup wizard as well. For example, you can add your client or employee-facing websites, SQL Server instances, or other host-services to be added to the list for total peace of mind, though some of these options require paid add-ons to work.

Navigating around the FrameFlow interface

The FrameFlow interface is divided into two main areas: a navigation pane and a content area. The navigation pane, located on the left, provides you quick access to all of your dashboards, hosts, monitors, events, reports, tools, and settings. The designers provided right-click context menus for all of the navigation items, allowing you to quickly add a host, edit a dashboard, or view a report, among many other options. Savvy admins will appreciate the dashboards, which can be configured to provide an “executive summary” of infrastructure according to your top priorities.

For example, if availability is your largest concern, you could create an “availability dashboard” that simply provided status for host uptime status. Similarly, if you were managing a group of IIS hosts, you would configure a dashboard that checked for IIS errors in the Windows Event Logs – something that is possible without ever touching the client’s configuration.

Network Device view

Other navigation options provide a more in-depth look at the different objects in the monitoring suite. The Network Device view displays all of the hosts and their respective event monitors, events and statuses. You can add new hosts (devices), remove hosts, and re-configure your hosts in this view. A typical use of the Network Device view is adding device-specific credentials to non-domain hosts, like Linux servers.

FrameFlow – Event Monitoring

Configuring new event monitors is relatively straightforward – use the event monitors view to add, edit, or delete monitors of your choosing. The usual suspects (ping, Windows Event Log, etc) are configured by default for convenience but you are free to add custom monitors or modify the default monitors. For example, you may want to increase the “warning” latency if you know that you connect to a particular host on a high-latency connection.

Reporting in FrameFlow

FrameFlow’s reporting module makes generating expressive reports a breeze. In other monitoring solutions the reporting options are either easy to configure but hard to extend or the other way around. The developers of FrameFlow seem to have found a happy middle ground in the Report Builder tool, which allows admins to connect a specific report to a set of sorting and filtering criteria. For instance, you can configure the “System Health Bandwidth Usage” report to be run only on certain host groups, within an interesting date range, and sorted by date. You can also choose to have these reports automatically emailed to your team to deliver critical information in a timely manner.

Observations and conclusions

As a Nagios administrator, I see some similarities between FrameFlow and Nagios. Both feature a web-based interface, powerful reporting/notification options, and a similar object model. I felt at ease when initially configuring the FrameFlow instance. However, there are some substantive differences between FrameFlow and open-source offerings like Nagios.

Unlike Nagios, FrameFlow is a Windows-based solution. You will need a Windows machine to run the server. While it is true that you can access the web-based interface from any platform, it is clear that the configuration options – particularly regarding event monitors – are tailored towards Windows infrastructure. For admins like myself who monitor almost exclusively Windows infrastructure this is not a problem, but others may find Linux offerings more satisfying. Like many Windows-oriented products, FrameFlow is much easier to configure than its Linux/BSD counterparts. I would argue that this ease of configuration is its best selling point. You can expend your efforts solely focused on creating an optimal configuration rather than learning an obscure syntax for another monitoring system.

Finally, it’s important to reiterate that FrameFlow is free. However, the extensions for FrameFlow are not. These “Add-Ons,” such as “Virtual Machine Pack” and “Database Monitoring Pack,” are available for a la carte purchase. Depending on your infrastructure needs they may warrant a look, but remember that Icinga and Nagios are both free and open source. As a result they already have active extensions and a community of users who are eager to help (though sometimes for the right price). If you can afford to purchase the necessary add-ons, work in a primarily Windows environment, and like to make your life easy, you should definitely add FrameFlow to your monitoring product shortlist. After all, it’s free, so what do you have to lose?

FrameFlow

• FREE: Veeam ONE Free Edition – Real-time Hyper-V and VMware monitoring (0)
• Raffle: PA Server Monitor – Easy Windows server monitoring (0)
• Poll: Are you currently using a monitoring solution? (12)
• SCOM 2012 review – Part 8: Dashboards (0)
• SCOM 2012 review – Part 7: Linux and JEE monitoring (6)

One of the first things that struck me with PDQ Inventory was the ease in setup! Downloading PDQ Inventory is a breeze. Registering for the free version requires just your name, an email address, and your company. While waiting on the download link, take the time to read the confirmation page as it is sure to provide a chuckle or two.

The welcome screen for PDQ Inventory immediately begins guiding users through computer inventory collection.

The installation took less than two minutes in my environment. You have the option to select either the default free mode or the professional mode which requires a key. A nice feature of the setup is the ability to use a service or secondary account for scanning! A needed feature would be the ability to generate a trial key for the professional mode within the setup (though the setup does provide an external link where you can register for a trial key).

On the first startup, PDQ inventory displays an intuitive Get Started Guide. The first step is to add computers or to create a collection of computers. To make computer management (and reporting) easier, collections provide a way to group computers. Computers can be placed in multiple collections depending on the needs of your organization.

Collections can be Dynamic, Static, or based off your Active Directory hierarchy. With the ability to nest collections, some pretty powerful filters can be configured. For example, one could create a dynamic collection for an Organizational Unit containing all of your servers. Sub-collections of the server collection could dynamically divide the servers based on the operating system.

If a machine running Windows Server 2003 was upgraded to Windows Server 2008, the dynamic collection would automatically move it to the Windows Server 2008 collection. By planning out the collection hierarchy, a Windows administrator could potentially automate machine organization in PDQ Inventory and provide a quick way to view any common report!

A sample collection that divides servers based on the operating systems.

Overall, the inventory process is rather painless with the ability to import single computers, import through a list, or import all computers in an Active Directory structure. The scanning process was fairly quick on a small test environment. After scanning, you can begin generating a variety of reports. Useful basic reports include hardware/software inventory, displays, installed updates, and shared folders.

The built-in list of reports provides detailed information quickly for a Windows administrator.

Finally, PDQ Inventory aims to centralize common administrative tasks and does a pretty good job of it. Computers can be quickly filtered to by name or status. If you have used Group Policy Software installation to deploy an application, PDQ Inventory can quickly show you the machines that haven’t yet rebooted and thus haven’t installed the application. To make troubleshooting easier, PDQ Inventory provides an extensive Tools menu for each computer that allows quick access to the machines ADMIN$ share, the computer management window or a direct view to the event viewer. The Tools menu could be improved with the ability to add custom commands. This feature is available in the Pro Mode.

The tools menu is available when one or multiple computers are selected. The Wake feature is only available in Pro Mode.

Overall, PDQ Inventory provides a very solid resource inventory platform for small to medium organizations to build on. The free version is certainly compelling for any Windows administrator to try out and the Pro mode offers additional powerful features for a relatively cheap price. If coupled with PDQ Deploy, Admin Arsenal’s free software deployment suite, PDQ Inventory could very well be a central tool for your desktop and server management teams.

PDQ Inventory

• FREE: OCS Inventory NG – Inventory software for Windows, Mac, and Linux (0)
• FREE: EMCO Network Software Scanner – Audit installed programs (0)
• Raffle: ManageEngine Desktop Central – Part 2: Features (2)
• Raffle: Total Network Inventory 2 – Part 3: Reporting and software accounting (0)
• Raffle: Total Network Inventory 2 – Part 2: Software and hardware inventory (0)

SCCM Client Actions Tool

Often times I would end up working in environments where installing tools to get some basic troubleshooting and maintenance done is deeply frowned upon. If the software is not on the DoD’s approved software list, well then you are just out of luck. The same applies to many corporations that are trying to secure their environments as much as possible. You just have to get really crafty with your scripting skills or do it the hard way “manually”. Fortunately for SCCM admins, we have the “SCCM CAT ” hta.

This script is a life saver. It was created by Christjan Schumann of, for the very reasons I identified above. It is a very robust tool and can be downloaded here. SCCM CAT will also help you avoid the proliferation of installing the SCCM Console on every computer you use to administer your SCCM sites. In addition, over a period of time, our SCCM enterprises can start to get bogged down by the number of collections that are created. Instead of creating a collection for every single task you do, you can now simply populate a computer list to a file (XLS, XLSX, CSV, TXT), and run any of following tasks against it.

Client Schedule Actions

Depending on the size of your SCCM environment, you might have to schedule your Client actions to occur sparingly so that you can cut down on the amount of traffic between clients and your SCCM servers. Some environments might have their clients run inventories once a week and so forth. Which is why being able to launch these individual actions via the SCCM CAT tool is extremely useful.

SCCM CAT – Client Schedule actions

Let’s say you just conducted a hardware refresh for a department at a site office, and your boss wants updated numbers on the different hardware platforms. Rather than wait for the information to trickle in, you can simply launch a Hardware Inventory Cycle using SCCM CAT. You can also run other similar tasks like a:

Software Inventory Cycle – Initiates a full inventory of the installed software on the clients.

Running a Discovery Data Collection Cycle – initiates a heartbeat discovery of your clients which is useful when they get deleted by accident from SCCM and you want to speed up the discovery process to bring them back in.

Machine Policy Retrieval & Evaluation Cycle – when troubleshooting package deployments, it is sometimes necessary to initiate a Machine Policy Retrieval & Evaluation Cycle, which will force clients to immediately look for and process any mandatory advertisements. The default period for a scheduled Machine Policy Retrieval & Evaluation Cycle is 60 minutes, so using this function can save you some time.

Software Updates Scan Cycle and Software Updates Deployment Evaluation Cycle are closely tied together. A Software Updates Scan Cycle causes clients to start scanning against the Software Update Point (SUP) for compliance; once it is completed you can run a Software Updates Deployment Evaluation Cycle to trigger the downloading and installation of required updates. This can come in very handy when you have critical security patches that you want to deploy in a short amount of time.

File Collection Cycle – Allows you to initiate an inventory of all the file extensions that you have listed under the Software Inventory Client Agents properties. In some cases, you might have custom DLLs, you want to get an inventory of, for in-house applications.

Software Inventory Client Agent Properties – Inventory Collection

Software Inventory Client Agent Properties – File Collection

Windows Installer Source List Update Cycle – Have you ever installed Microsoft Office, and just did a minimal install? You decided you didn’t need the install files loaded on your machine. Months later, you realized the need to load the speech tools. When you attempt to install them, the setup program asks you for the install CD, but you have no idea where it’s at. Well, Windows Installer Source Location Manager can automatically search Configuration Manager 2007 distribution points for the source files, even if the application was not originally installed from a distribution point. So when you launch this particular cycle, you are asking for the Product Source Update Manager to complete a full update cycle.

Software Metering Usage Report Cycle – Software Metering in SCCM allows you to monitor and collect software usage data on Configuration Manager 2007 clients. Triggering a report cycle will cause the Software Metering Client Agent to evaluate the Metering rules on Configuration Manager Client computers, collect metering data, and report it back to the site database. This is useful when you want to get a good handle on how much a particular application is utilized, and it will give you a good idea if you are under licensed or over licensed.

Branch Distribution Point Maintenance Task – Sometimes, pre-staging packages on a branch distribution point will minimize the bandwidth otherwise necessary to download the packages. When you manually launch Branch Distribution Point Maintenance Task that is essentially what you are doing. This task will verify the pre-staged package and download any packages that do not exist on the branch distribution point. A success status message is sent to the management point, and server records are updated to reflect the availability of the package on the branch distribution point.

Certificate Maintenance Task - This task can help troubleshoot communication problems between client and management point or with Active Directory Services. This is only useful when you’re using SCCM in native mode. Once you execute this action, you can monitor CertificateMaintenance.log file for process on client.

Client Agent Actions

These are the actions that interact with the SCCM client agent. Usually all actions in SCCM CAT can be run against any number of remote computers, but there are two actions in this category that are only available if the target list contains up to 5 computers. These are actions to open client log folder and client setup folder. These might come in handy if a tool is used to troubleshoot a small number of computers at a time. A lot of these are pretty self explanatory so I won’t go into too much detail.

SCCM CAT – Client agent actions

Open SCCM client log folder – Opens client logs folder on target machines. This will only work on 5 clients at a time.

Open SCCM client setup folder – Opens a client setup folder on target machines. This will only work on 5 clients at a time.

Get Management point – Returns the management point for every client listed. A Management point is the SCCM server that manages that particular client.

Reassign site code – Used to redirect SCCM Clients to a Specific SCCM server that is designated by a three letter site code. Comes in handy when you are moving clients between different Sites.

Generate new SMS GUID – This action forces the client to generate a new GUID (Globally Unique Identifier ). At times you might come across another client that has the same GUID in the same environment.

Delete trusted root key – This action removes instance of TrustedRootKey in root\ccm\locationservices WMI namespace and restarts ccmexec service. The client will then obtain trusted root key again from the primary site. A very common reason for the root key to change is when reinstall and restore has been done on central site. It may also be helpful when moving the client from one hierarchy to another.

Delete certificates (re-register client) – This action stops ccmexec service, removes subkeys of “SOFTWARE\Microsoft\SystemCertificates\SMS\Certificates” and starts ccmexec service. This results in client requesting new registration.

Re-register ATL.DLL – If you ever run into error 1904 while installing the SCCM client, you are going to want to run this action to fix those client.

• Configuration Manager Client — Error 1904. Module C:\WINDOWS\system32\CCM\VAppRegHandler.dll failed to register.  HRESULT -2147221164.  Contact your support personnel.

Change client cache size – You can change the amount of disk space that the Configuration Manager 2007 client can use to store downloaded packages by running this task. The default size of the temporary program download folder is 5120MB.

Uninstall SCCM client – This action does the full uninstall of SCCM client. It removes SMSCFG.ini, deletes certificates and runs ccmsetup.exe /uninstall.

Install SCCM client – This action will install SCCM client from scratch by running ccmsetup.exe.

Client Health Actions

Common SCCM client health checks. Each check can be run with or without fixes. It’s highly recommended to run the checks first and then think about fixing.

SCCM CAT – Client health actions

Check WMI – WMI check is pretty simple – it just makes sure root\cimv2 can be connected to. WMI fix will stop WMI and dependent services, re-register all DLL, EXE, MOF and MFL files in correct paths (x86 and x64 supported) and then start the services again.

Fix WMI – When running the WMI fix action on remote computers, the tool first creates a fixing batch file “%TEMP%\fixwmi.bat” on administrator’s computer. This batch file is then copied to each remote computer (in “%windir%\temp\” folder) and the execution of the script is scheduled to run after 1 minute. All batch file output is written to “%windir%\temp\fixwmi.log” file on each remote computer.

Check services – Checks if winmgmt, lanmanserver, rpcss, wuauserv, bits and ccmexec services are running and their startup mode is “Auto” (except BITS and wuauserv as BITS can be manual and wuauserv can be manual on Vista+). Running the fix will change the startup mode if needed and start the services.

Check admin$ share; Check & Fix admin$ share - You can run either one of these actions to help troubleshoot client admin share issues. The admin share is required for SCCM client to function properly. The Check admin$ share portion checks if the administrative share is enabled. While running the Check & Fix admin$ share modifies the registry to enable the share and then restart the lanmanServer service.

Check assigned site; Check & Fix assigned site – Check assigned site – Checks if a client is assigned to a site.

Check & Fix assigned site – initiates a client auto-discovery on each client you direct it to.

Check registry – This task checks the following values in the HKLM\Software\Ole registry hive to see if they are set correctly:

§ EnableDCOM = Y

§ EnableRemoteConnect = Y

§ LegacyImpersonationLevel = 2

§ LegacyAuthenticationLevel = 2

When running the fix, the values will be set according to the list above.

Check inventory ­– Checks hardware and software inventory dates and compares them to maximum number of days passed. Default is 5 days for hardware and 7 days for software.

Check & Fix inventory – Fix triggers a full hardware and/or software inventory if they’re too old.

Check client version – Checks if the client version is the same or newer than the expected version.

Check & Fix client version – Client installation will be initiated automatically in case the installed client version is older than the expected version.

Full health check – This will run all the checks above on every computer.

Full health check with fixes – Full health check with fixes initiates the needed fixes for each health check.

Advertisement actions

This category includes administrative tasks for advertisements.

SCCM CAT – Advertisement actions

Query advertisement status – The “Query advertisement status” action simply shows available advertisements on remote computers that match the specified keyword.

Get all active advertisements – Lists machine based advertisements

Get all active user advertisements – List advertisements for currently logged on user. The action succeeds only when there is currently a user logged on the remote computer.

Rerun advertisement – This re-launches a specific advertisement that you specify by providing the advertisement ID.

Rerun user based advertisement - This will re-launch a specific user based advertisement that you specify by providing the advertisement ID.

Other actions

This category includes actions that are not exactly SCCM related, but otherwise helpful for administrators. So it’s possible to refresh group policies, ping a list of computers, gather information about logged on users or execute a command-line remotely. “Execute Remotely” action schedules the specified command-line on a remote computer and it will be run in the SYSTEM account context.

There are also actions for logging off users and restarting or shutting down remote computer(s). They ask for confirmation first, but are really helpful even if you don’t have SCCM running in your environment.

SCCM CAT – Other actions

SCCM Client Actions Tool (SCCM CAT)

• System Center 2012 – Orchestrator 2012 – Integration Packs (0)
• System Center 2012 – Orchestrator 2012 – Runbooks best practices (0)
• System Center 2012 – Orchestrator – Creating Runbooks (0)
• System Center 2012 – Orchestrator – Installation (0)
• System Center 2012 – Orchestrator Review (0)

Submitted by Matthew Borcherding – BorchTech Consulting

The OCS Inventory NG backend can run on Windows or Linux. Inventories are done daily or on demand, and take very little CPU time. Inventories include very detailed lists of hardware and software components. The inventory software allows you to display all systems that have particular software installed.  Access to server is web-based, usually via Apache.

Free inventory software – OCS Inventory NG

OCS Inventory NG can be used for automated software distribution as well. The developers are French, but the software is available in English. Fast, excellent, and open-source freeware. I use it all the time.

Free inventory software – OCS Inventory NG

OCS Inventory NG

• FREE: PDQ Inventory – Track software and hardware (1)
• FREE: EMCO Network Software Scanner – Audit installed programs (0)
• Raffle: ManageEngine Desktop Central – Part 2: Features (2)
• Raffle: Total Network Inventory 2 – Part 3: Reporting and software accounting (0)
• Raffle: Total Network Inventory 2 – Part 2: Software and hardware inventory (0)

Submitted by Doug – Website: Power Admin

The launched program can run as a specific user, or as the Local System account.  It can run visibly or silently.  It’s very useful for opening a quick terminal-like session to the server, checking configuration or remotely installing other software. Command-line options can be seen at the PAExec site.

PAexec – Run programs on remote Windows servers

1. It’s similar to Microsoft’s PsExec utility with a few extra features:
2. Command line parameters (username/passwords) are scrambled instead of sent in clear text
3. It can be redistributed by anyone
4. Has some extra often-requested features like logging, and not deleting a file that is copied to the server

PAExec

• Raffle: SolarWinds DameWare NT Utilities – Remote administration tools (3)
• Windows-to-Mac remote management with VNC and SSH (1)
• Query free disk space details of remote computers using PowerShell (3)
• FREE: EMCO Remote Console – Remote command tool for Windows (0)
• FREE: Remote Desktop Manager – Manage remote connections (4)

Submitted by David Vella – Blog: Altaro Blog for Hyper-V & Windows Administration

Altaro Hyper-V Backup

Features

• Back up Hyper-V VMs “live” – no need to save, suspend, or shut down
• ReverseDelta ™ technology – the most recent version of files are saved in their entirety for rapid restores. Older versions of files are saved only in differential block-level chunks. This allows for both rapid restoring and reduced space requirements on backup media.
• Restore a Hyper-V VM in only five clicks
• Volume Shadow Copy Service (VSS)-aware applications in virtual machines, such as Microsoft Exchange and Microsoft SQL Server, will commit their databases.

Free edition limitations

• Only two virtual machines can be backed up
• Only stores backups for the past four weeks

Altaro Hyper-V Backup

• Windows 8 Hyper-V (0)
• FREE: Veeam ONE Free Edition – Real-time Hyper-V and VMware monitoring (0)
• Hyper-V cluster – Part 7: Custer Shared Volume and manage virtual machines (0)
• Hyper-V cluster – Part 6: Create a cluster (0)
• Hyper-V cluster – Part 5: Quorums and disk configuration (0)

Submitted by Chris Wright – Website: Cjwdev

NTFS Permissions Reporter is a new tool from Cjwdev, with a completely free edition available for anyone to download and use without any registration or time limits imposed. It makes auditing and reviewing permissions on your file system quick and easy, as you can simply right click on any directory in Windows Explorer and choose Report Permissions to launch the program and instantly see how permissions are assigned to that directory and all of its sub directories.

What are the NTFS permissions? NTFS Permissions Reporter

The report results can be viewed in either tree format (which mimics the explorer style view of directories that we are all used to) or in a sortable table format. Different levels of permissions are highlighted in different colours to make it easy to see at a glance what level of access a particular user or group has to a directory.

This is taken a step further in the standard edition as filters can be used to limit the results to only permissions where a specific account is used either directly or via group membership, and various other attributes can be filtered on as well. Even the free edition lets you automatically expand groups to show their members in the report though (both direct and nested members), giving you a true view of everyone that has been granted or denied permission to each directory.

NTFS Permissions Reporter – Report settings

Results can be exported to HTML file (and CSV file in the standard edition) for viewing at a later date or for sharing with colleagues.

NTFS Permissions Reporter

• FREE: Smart Defrag – A defragmentation tool (9)
• FREE: Disk Defrag – A disk defragmenter (3)
• FREE: MyDefrag – Script defragmentation (4)
• FREE: Fast Duplicate File Finder – Find and delete duplicate files (2)
• Raffle: StarWind Enterprise CDP Edition – iSCSI SAN Storage Software for Windows (0)

PhoneFactor is free for up to 25 users and reasonably priced after that. The beauty of PhoneFactor is that it utilizes something users already have – a mobile phone – as a token rather than a proprietary device.

PhoneFactor Agent, the software behind the service, acts as a RADIUS server for authentication to network resources such as a VPN. When a user attempts authentication, he will still first be prompted for a user name and password. After he enters those details, the service will place a call to his phone and require the user to answer the call and press the “#” button. Once this is completed, the user is successfully authenticated.

In this tutorial we will install the Agent on Windows Server 2008 R2, integrate with Active Directory, link a few user accounts, and set up a RADIUS server.

Getting started

You can download the PhoneFactor Agent after registering here. You will need a mobile phone to register since PhoneFactor utilizes their own system on their customer portal. Run the installer and launch the PhoneFactor Agent. You will be greeted by the Authentication Configuration Wizard, where you can:

• Enable replication between agents: Allows you to replicate data between multiple installations. Since we are only installing it on one server, do not check.
• Select Applications: You can apply PhoneFactor to a variety of applications, including Citrix, Outlook Web Access, and Remote Desktop. For our purposes, we will only choose VPN.
• VPN with Radius: Specify your VPN server IP address as well as a strong shared secret between the VPN server and PhoneFactor. Leave the default port options as-is.
• VPN Target: Since we want to authenticate against a Windows domain, we will choose Windows domain. However you can also use another RADIUS server (some firewalls have built-in RADIUS servers, so you can redirect back to the firewall).

Phonefactor Agent Configuration

Click Finish and let PhoneFactor do its magic. Once the setup is complete, you can begin using the Agent.

Locking down PhoneFactor

By default, PhoneFactor will allow any user who successfully authenticates against AD to sign in – if no user is defined (and no phone number is linked), it will just authenticate the user. In most cases, you would not want this to happen. Navigate to Company Setup and choose “Fail Authentication” when user is disabled.

Fail authentication

We will also want to specify a default search domain for AD users. Choose the “Username Resolution” tab and specify a default search domain for the option “Use Windows security identifiers (SIDs) for matching usernames.”

Security identifiers (SIDs)

Finally, if your Active Directory user account setup is non-standard, you should navigate to Directory Integration and confirm in the “Filters” and “Attributes” tabs that the data fields you wish to use are the ones that PhoneFactor will use. Most administrators will not need to do this.

Directory Integration

Adding users

Now we can begin adding users to our PhoneFactor implementation. Because of our previous setup, only users who have been added to PhoneFactor with a phone number defined will be able to authenticate successfully against AD. After all, not all users will require remote access. Navigate to the Users section and click “Import from Active Directory.”

This powerful interface allows you to select users by OU or filter terms. You can import all users at once – which is not advisable – or specify which ones to import in a granular fashion. The users you have selected will appear in the window on the right. You will notice that by default, “Only New Users with Phone Numbers” are enabled. This is the behavior you want, since users without a phone number will authenticate using only their AD credentials. Once you are ready, click “Import.”

Import users

In many cases, you will not have defined phone numbers yet for your users in Active Directory. This is OK; you will just need to do so now for each authorized user. Double-click the user, then define a phone number and enable the user.

Phone number – Enable user

Finally, you will see your newly-enabled user in the users listing. Once you have defined all of your users, you will need to configure your VPN server to authenticate using RADIUS.

User listing

VPN Server Configuration with PhoneFactor RADIUS

Since there are so many VPN servers out there, we will focus on a few general tips for setting this up. You will typically need to provide:

• PhoneFactor Agent IP
• PhoneFactor Agent Ports: Typically, 1645,1812 for authentication and 1646,1813 for accounting. Make sure the firewall on your Agent server does not block this traffic
• Shared Secret: This is the secret you had defined in the wizard and it should be strong since it will serve as a barrier between your VPN server and the RADIUS server.
• Timeout: Make sure you set a fairly high timeout value; by default, most VPN servers do not give you a lot of time to authenticate because the RADIUS server is local to the network and does not take long to perform the lookup. However, since PhoneFactor takes about 3-5 seconds to place the call, and the user can take anywhere from 2-20 seconds to actually respond, I would recommend a timeout of at least 30 seconds.

That’s it! Though PhoneFactor offers more powerful features (especially in paid versions), you are already set up and ready to authenticate. For small businesses with fewer than 25 users, PhoneFactor is a free and easy to implement two-factor authentication solution. Give it a try today!

PhoneFactor

• How to disable USB drive use in an Active Directory domain (2)
• Service Account best practices – Part 2: Least Privilege implementation (0)
• Four fast ways to improve security in SQL Server 2008 R2 (12)
• Managed Service Accounts in Windows Server 2008 R2 (7)
• Raffle: SetACL Studio – Set Windows permissions (1)

Nmap is a tool that needs no introduction. Quite arguably it should be in the hands, or at least the back pocket, of most systems administrators. Nmap can perform network host and service discovery, security scans, OS fingerprinting, and a whole lot more. Zenmap, a highly functional GUI for nmap, helps ease the learning curve by providing a user-friendly interface for both building scans and viewing scan results or reports. Plus, Zenmap is a multi-platform application that runs on Windows as well as Linux and Mac.

The Windows Zenmap GUI

How it works

You can think of Zenmap as a “syntax builder” for nmap. Rather than sitting on top of nmap, it simply sends commands to the platform-specific nmap executable and pipes the output back. This is very useful for nmap beginners who would like to harness the power of nmap while learning some of the deep syntax options it provides.

Zenmap makes it easy to build out command line options like this

The basic operation in nmap is network scanning and Zenmap allows you to perform and save scans as well as the results from those scans. Zenmap uses Profiles, which are basically nmap parameter presets, to specify how scans are performed. It ships with some handy preset profiles, such as Intense scan, which scans hosts with “all advanced/aggressive options,” Quick scan, which scans hosts without those advanced options, and Slow comprehensive scan, which is exactly as it sounds. Budding administrators can choose profiles that match their needs. For example, if your goal is host discovery, Quick scan might do the job. If your goal is to map out every single TCP port, you’ll need to do an Intense scan, all TCP ports at a minimum.

Defining a target

Every scan must be associated to a specific target, which can be a single host, an interval range of hosts, or a full subnet. Nmap uses the following syntax for target definitions:

• Single host: Just a hostname or IP address will do, like localhost or 127.0.0.1
• Interval: Intervals are denoted by a dash in the IP address; for example, if you want to scan 192.168.1.0/24 through 192.168.10.0/24, you would use 192.168.1-10.0-255
• CIDR Notation: Nmap accepts CIDR target specification, like 192.168.5.0/24
• Lists: Separate different targets with a comma; for instance, 10.1.1.0/24, 192.168.1.0/24

Reporting window

Zenmap provides different tabs for reporting on scan results. These tabs either directly report the output of nmap or expand on the output with diagrams and user-friendly reports. The tabs include:

• Nmap output: The piped output of the nmap command sent by Zenmap
• Ports/Hosts: If a host is selected on the left, this will display open and unknown ports. If a service is selected on the left, this will display all hosts for that service
• Topology: A neat diagram of the network topology as understood by Nmap
• Host Details: Displays a condensed report of pertinent host information from the scan

A sample Nmap output window from an Intense scan

Useful tools

Zenmap also ships with some useful tools that can help you track changes between scans and drill down to useful information within long scan results. The Compare Results tool provides an interface for differentiating between two scans, which can be used to monitor daily changes in network topology or available hosts. The Search Scan Results tool is great for finding specific text in results, and the Filter Hosts tool does exactly what you would imagine – it filters hosts, which comes in handy when scanning large subnets or lists of networks.

Saving scans

By going to File > Save Scan, you can save a scan result report in XML or plain text format for later consumption. This comes in handy when you perform a large scan and do not want to repeat the scan again later while reviewing results. The XML format is also very friendly for consumption by third party report generation packages as well as web service reporting.

A sample XML report generated by Zenmap

Custom profiles

Perhaps the best feature of Zenmap is its Profile Editor, which empowers users who are unfamiliar with nmap syntax to build powerful and custom scanning profiles. These profiles can be saved for later use and even exported to other interested admins. The Profile Editor window contains the following tabs:

• Profile: The name and description of your profile
• Scan: The most important tab, where you can specify targets, scan type (TCP, UDP, IP), timing template, and much more
• Ping: Specifies ping behavior. You can suppress pings or build a specific ICMP packet
• Scripting: Include nmap scripts in your scan. Zenmap comes with many useful scripts
• Target: Allows for greater target specification flexibility, including excluded hosts, target list files, and fast scan support
• Source: Specify how you would like the scanner to behave with respect to scanning identity, IP address, port, and interface
• Other: Includes options for verbosity level, TTL, and other scanner behaviors
• Timing: Defines timing profile with respect to maximum scan time, scan delay, and timeouts, among other things

Use the Profile Editor to develop custom profiles that meet your enterprise needs

Saving profiles saves time because it allows the administrator to quickly perform familiar and repetitive scans without specifying the target and options. Using saved profiles also ensures that when comparing two scan results you are working from the same scan options.

Wrapping up

Zenmap is an excellent Windows GUI for nmap and takes the edge off of the learning curve. Administrators who are versed in basic networking will have little trouble jumping into the simple, yet powerful interface that Zenmap offers. Since ZenMap is Open Source, it represents a great cost savings for the budget-strapped admin with excellent community support and regular updates. If you haven’t checked out Zenmap yet, give it a try! Achieving IT security is a moving target, and Zenmap makes it easier to reach your goal.

Zenmap

• Kiwi CatTools – Back up and manage network configs (0)
• FREE: SolarWinds Real-Time Bandwidth Monitor (0)
• Set up a 802.1x in a Active Directory domain – Part 2 (5)
• Set up an 802.1x Wi-Fi network in a Windows Active Directory domain – Part 1 (0)
• FREE: WhatsUp Gold TFTP Server (0)

Submitted by Igor Vinnykov

According to the Windows 7 Programs and Components info, I have 85 applications and 118 updates installed on my PC. No doubt, it’s hard to keep in mind all these installed programs even for a single PC, and I have to open the Programs and Components view every time I need to check the software installed on the PCs in my network. If you use the same approach when you need to audit installed software, let me show how you can optimize your software inventory procedures using the free Network Software Scanner utility from EMCO Software.

The Welcome screen of EMCO Network Software Scanner

EMCO Network Software Scanner Overview

As it should be evident from its name, EMCO Network Software Scanner is a network application that allows scanning network PCs to collect information about installed software. The collected information is stored in a centralized database and can be referred to anytime. Thus, you can use the application to check the list of installed software on a particular PC, detect changes in the list of installed application, export the software inventory information to a file and perform other actions. Let’s see how these features work.

The Application Requirements

In order to use the application, you should have an administrative access to the network PCs, because otherwise Windows security won’t allow you to connect to remote computers and extract software inventory information. It is worth mentioning that the application extracts inventory info directly from Windows Registry and doesn’t use WMI, so it should work in most network environments with no specific configuration of client computers required. If the application can’t connect to a remote PC or can’t extract information from it, a detailed error report is shown on the Application Log tab with useful hints how to resolve the problem, so it worth checking the log in case of problems.

Installed Software Scanning

To start a network scanning, you can click the Enumeration Wizard button on the Welcome screen. You will be prompted to select the enumeration scope by choosing from the available domains and workgroups or specifying the IP range of PCs manually. Once a scanning is started, you can start reviewing the scan results for already scanned PCs immediately, without waiting for the entire scan to complete. To see the scan results, switch to the Machine Scans tab and select the required PC in the Network Browser.

The list of installed applications on a selected PC

Installed Software Audit

For every PC, the application can display a list of installed applications and updates. Applications and updates are displayed in different views, and you can switch between them using the toolbar buttons. The default inventory view displays only general inventory information such as Application Name, Publisher and Version in the same way this info is displayed in the Programs and Components view in Windows. However, you can see more information if you choose to display additional columns in the grid. All the collected inventory information is also available when you export the data to a CSV file. Besides, you can use this information to create custom software inventory reports, if you like.

Using the described approach, you can collect software inventory information from network PCs, but what about auditing changes? That’s quite easy. You may notice that every time you perform a scan the application creates a new scan entry with a list of detected installations and updates, so you can compare two scans to see the applications and updates that were installed or uninstalled in the meantime. Any detected changes are displayed in a special view on the screen and can be exported to a file.

The detected installation changes

Conclusion

You can use EMCO Network Software Scanner as a basic software audit tool that can help you to quickly collect software inventory information from all PCs in the entire network, audit installation changes and export the collected data to files.

EMCO Network Software Scanner

• FREE: PDQ Inventory – Track software and hardware (1)
• FREE: OCS Inventory NG – Inventory software for Windows, Mac, and Linux (0)
• Raffle: ManageEngine Desktop Central – Part 2: Features (2)
• Raffle: Total Network Inventory 2 – Part 3: Reporting and software accounting (0)
• Raffle: Total Network Inventory 2 – Part 2: Software and hardware inventory (0)

Does your organization employ a virtual machine (VM) infrastructure for server and/or desktop systems? Are you considering migrating some or all of these VMs to a cloud-based hosting infrastructure?

VM cloud pricing details

The research that is involved in this process is pretty staggering, to be sure. SolarWinds, has addressed this situation in an elegant and cost-effective (free!) manner: SolarWinds VM-to-Cloud Calculator.

This free Windows utility enables us to automatically inventory our VMware-based virtualization infrastructure and perform cost comparisons among three leading cloud hosting providers:

• Amazon Elastic Compute Cloud (EC2)
• Rackspace
• Microsoft Windows Azure

Let’s have a closer look at what this tool can do for you.

Creating a VM inventory

You can download the VM-to-Cloud Calculator tool simply by registering a new SolarWinds account.

After you’ve downloaded and installed the VM-to-Cloud Calculator (the .MSI installation package weighs in at less than 5 MB), start the app and enter your host credentials. These credentials consist of the following:

• IP address or hostname of your VM server
• Username
• Password

This screen is shown in the following screenshot.

Entering your VMware credentials

It is very important to note that the previously mentioned “VM server” must be an instance of one of the following virtualization server technologies:

• VMware vCenter Server
• VMware ESX/ESXi

Therefore, at least as of this writing in November 2011, the VM-to-Cloud Calculator is not compatible with virtualization servers such as Microsoft Hyper-V Server or Citrix XenServer.

Once you verify connectivity to your target VMware server, go ahead and let the application run the inventory for you. Sample results from a VM inventory scan are shown in the following image:

VM inventory report with cost information

NOTE: In order to show you appreciable real-world data with this tool, some of the screenshots in this piece are borrowed from SolarWinds product documentation.

The VM inventorying piece alone justifies the VM-to-Cloud Calculator’s utility, in my opinion. The report, which is exportable to various file formats including Excel, Adobe PDF, and CSV, can definitely save you quite a bit of time in undertaking manual analysis.

Performing Price Comparisons

The centerpiece of the SolarWinds VM-to-Cloud Calculator is its automatically generated cloud hosting price comparison matrix. A sample report is shown in the following image:

VM cloud pricing details

As you can see, the VM Cloud Pricing Details report gives you at-a-glance price comparisons among the Amazon EC2, Windows Azure, and Rackspace hosts on a VM-by-VM basis. And yes, you can export this report data as well.

You might be wondering how current the calculator’s pricing data is, and how it applies to a person depending upon where he or she lives in the world.

We can click the Settings tab to configure calculation/pricing metadata, such as:

• Your preferred currency units
• Disk size threshold to differentiate “true” VMs from storage instances
• The data refresh (“calculation”) period
• Data polling during application runtime

The Settings dialog is shown in the following screen image.

VM-to-Cloud Calculator Settings page

Conclusion

The SolarWinds VM-to-Cloud Calculator is a valuable tool for Windows systems administrators who currently leverage locally hosted VMware virtual machines and want to increase their availability by migrating them to a cloud service provider. I will leave you with a tip: SolarWinds offers an enterprise virtualization solution called SolarWinds Virtualization Manager; this software won the Best of VMworld 2011 Gold Award in Virtualization Management (a high honor, indeed). You can download a trial version if you’d like.

• Decaf – Amazon EC2 client for Android (0)
• Office 365 review – Part 8: SharePoint Online and conclusion (0)
• Office 365 review – Part 7: Lync Online (0)
• Office 365 review – Part 6: Exchange Online Hybrid, Archiving and IRM (2)
• Office 365 review – Part 5: Migrating to Exchange Online (0)

One of the duties of many Windows systems administrator is network management. That is, you may be called to detect, diagnose, troubleshoot and resolve network interface slowdowns.

As your network grows in complexity to include multiple line-of-business (LOB) Web applications, load-balancing configurations, and the like, interface troubleshooting and performance monitoring can easily become extremely cumbersome and complex.

Monitoring an interface with SolarWinds Real-Time Bandwidth Monitor

To assist us in this effort, SolarWinds gives us the Real-Time Bandwidth Monitor. This is a free utility that enables us to monitor network bandwidth utilization statistics for multiple interfaces in real time.

Setting up interface bandwidth monitoring

The Real-Time Bandwidth Monitor software can be installed on any modern 32- or 64-bit edition of Windows desktop and server operating systems.

However, it should be noted that because the interface polling and statistics gathering in this product relies upon Simple Network Management Protocol (SNMP), you need SNMP turned on for any device you will be monitoring, which it will be by default for your network devices.

In some cases, you will prefer to have an SNMP server in place in your domain prior to using this tool.

For instance, you can fire up Server Manager in Windows Server 2008 R2 and install the SNMP Server feature, as shown in the following figure.

Windows Server 2008 R2 – Install SNMP Server feature

Once you have SNMP Server installed, you can configure SNMP-related metadata like the community name and trap destinations by modifying the properties of the SNMP Service Windows service. This process is depicted in the following screen capture.

SNMP Service Windows service

Upon first launch of the application, you are asked to create a monitor. This task includes three pieces of information:

• The IP or hostname of a device (desktop PC, server, switch, router, wireless access point, etc.)
• The SNMP version in use on your network (1,2, or 3)
• The SNMP credentials (community name for SNMPv1 and v2; username, context, and authentication method for SNMPv3)

Configuring the device

The next step in the setup process is selecting the desired interface. If you are connected to a switch, then you will be able to monitor individual port IDs; if you are connected to a Windows server, you can choose among physical and virtual network interfaces.

Selecting an interface to monitor

We are almost finished. The final step in the configuration process is setting threshold values. The percentages that you specify for warning and critical values enable the Real-Time Bandwidth Monitor to give you feedback regarding degrees of bandwidth utilization.

Note in the following screenshot that you can also limit the chart date to a particular time interval or data points (sampling is performed at the half-second rate). Click Launch Monitor to start the monitor. Yes, you can have more than one monitor running on a host computer simultaneously.

Setting threshold values

Monitoring an interface

As you can see in the following screenshot, the monitoring screen is a resizable dialog box that is laid out in a very easy-to-understand manner. Inbound and outbound traffic on the selected interface are color-coded, as is the data line if it exceeds a threshold value.

Monitoring an interface

The line chart is active; you can analyze data points simply by hovering your mouse over them. This is shown in the following screen capture.

Analyzing a data point

You can make use of another of SolarWinds tools (this one is not free) called WAN Killer to simulate loads through monitored network interfaces.

While we are on the subject of related SolarWinds software, the Real-Time Bandwidth Monitor is a “smaller sibling” to their enterprise Orion Network Performance Monitor (NPM) software. NPM is a one-stop solution for automatically discovering and monitoring interfaces in your LAN and WAN environments. You can download a free demo from SolarWinds if you are so interested.

Conclusion

In summary, the SolarWinds Real-Time Bandwidth Monitor gives us systems/network administrators the ability to visualize network bandwidth utilizations on our interfaces. This data is extremely important not only for troubleshooting speed and access problems, but also for application performance tuning and enhancing the overall health of our network. Please feel free to leave your questions in the comments portion of this post.

Real-Time Bandwidth Monitor

• FREE: Veeam ONE Free Edition – Real-time Hyper-V and VMware monitoring (0)
• FREE: FrameFlow – Web-based Windows monitoring (1)
• Raffle: PA Server Monitor – Easy Windows server monitoring (0)
• Kiwi CatTools – Back up and manage network configs (0)
• Poll: Are you currently using a monitoring solution? (12)

Would you like to reduce your reliance on Windows roaming user profiles and the hassle that can be caused by corrupt profiles? How about having sub 20-second logon for all users? What about settings that work across all platforms and architectures, configured from one central place? Or applying just-in-time settings to applications as needed rather than all at the beginning of the user session?

Workspace Manager Express

Sounds great? All of this functionality is available for free with a tool that’s been around for a while: Workspace Manager Express from RES Software.

To install Workspace Manager Express, you need a SQL database that can be accessed by all your client machines. Workspace Manager Express supports the following database systems:

Microsoft SQL Server, 2000 or later, including express editions Microsoft SQL Azure Oracle, 9i and later IBM DB2, 8.1 and later MySQL, 5.0 and later

On each client there is a small software agent that caches a copy of all the settings. Thus, it only needs to check in with the DB server periodically for updates. This also means that settings can be applied even when a client is disconnected from the corporate network.

With Workspace Manager Express, user settings are applied across all OS platforms. For example, you can configure a folder that contains their Internet Explorer favorites that will be available on any platform on which you are running the RES agent.

The user preferences are stored in a SQL database and applied by the RES agent. This also works with all popular VDI and remote desktop solutions.

When you log on to a PC, lots of stuff is happening in the background. One of these is the processing of Group Policies. With Workspace Manager Express, not all settings are applied at the same time. That is, the agent applies them as needed; this, in turn, will give you faster logon times. For instance, if you only want an application to be able to print to a particular printer, that customization could be applied just before the application is run.

Managing printers with Workspace Manager Express

The functionality included in the express version of Workspace Manager may be all you’ll ever need. You can also review the functions that are available in the paid version; they are displayed but are unavailable unless you temporarily change the version you are using. Alternatively, you can hide the advanced features completely so that you can concentrate on just using the free functionality.

Feature of Workspace Manager’s full version

With Workspace Manager Express, you probably cannot do away with Windows user profiles altogether. However, you can replicate any setting that would normally have been applied via Group Policy. As there are literally hundreds, it would be quite easy to get lost; however, the RES help menu is very valuable here and even links you through to video tutorials on their YouTube channel.

Resources

Introduction to Workspace Management

Getting Started with RES Workspace Manager 2011 – This is for the full product but the Express version will set up the same.

Check out Virtual Engine for another free nifty tool currently in Beta that allows you to migrate GPO to WSM.

More great stuff can be found over at RESguru.

Workspace Manager Express

• Microsoft Desktop Optimization Pack (MDOP): MED-V (0)
• Microsoft Desktop Optimization Pack (MDOP): Advanced Group Policy Management (AGPM) (0)
• Microsoft Desktop Optimization Pack (MDOP): Asset Inventory Service (AIS) (0)
• Microsoft Desktop Optimization Pack (MDOP): Overview (0)
• Raffle: ManageEngine Desktop Central – Part 2: Features (2)

Now more than ever before in your career as a Windows systems administrator, you may find yourself partially or fully responsible for the availability of your company’s Web applications. “But I’m not a Web admin!” you might exclaim. Like it or not, the migration of applications from the desktop to the Web browser means that we systems admins must take ownership of application uptime, regardless of form factor.

Here are some thought questions for you to consider: Does your organization do business over the Web? If so, how can you verify that your e-commerce engine is functional at any particular point in time? How can you diagnose bottlenecks and latencies in your Web application from the user’s’ perspective?

Many organizations rely upon internal line-of-business (LOB) Web applications. Again, we administrators are often faced with service-level agreements (SLAs) or organizational mandates that guarantee application availability for our users.

SolarWinds offers the free tool Web Transaction Watcher that enables you to run live transaction tests against your Web applications in a completely no-code, graphical environment.

The typical workflow for running Web application transaction tests is to author and run often complicated shell scripts or programming language scripts. By contrast, Web Transaction Watcher includes an intuitive recorder with which we step through a typical Web transaction and store those steps for analysis and future reuse.

Recording a Web transaction

To download Web Transaction Watcher, simply provide SolarWinds with a contact e-mail address. Once you have the software installed (the disk footprint is tiny; the installation .MSI weighs in at under 5 MB), fire up Web Transaction Watcher; the application view defaults to the Recording tab. Next, use the tool’s integrated Web browser to navigate to your desired Web application. The Web Transaction Watcher main interface is shown in the following screen capture.

Web Transaction Watcher main interface

Let’s use the previous screen capture as our reference as we walk you through the process of recording a Web transaction. After you have the integrated browser pointed at the proper page within your Web application, press the Record button (A) and begin your desired transaction. For our purposes, a Web transaction is simply a series of steps that an end-user might take in your app; these could include:

• Adding an item to an online shopping cart
• Completing an online purchase
• Posting a message to an online forum
• Downloading a file

You’ll notice that the Time Line (C) records each step in the transaction process in much the same way the macro recorder traces your steps in Microsoft Office applications. However, what sets Web Transaction Watcher apart from its competition is that you can actually edit and delete any step in your Web transaction during recording.

The process of editing a task sequence is easy; simply right-click the appropriate transaction step and select Edit or Delete from the shortcut menu. This is shown in the following screen capture.

Editing a Web transaction step

When your Web transaction is complete, press the Stop button (B). Make sure to save your recorded transaction for future playback. Web Transaction Watcher recording files use the intuitive .recording file extension.

Analyzing and replaying Web transactions

To analyze your recorded Web transaction, navigate to the Monitoring Console tab in the main interface. Web Transaction Watcher stores the last five runs of your recorded transaction and displays the status of each with a color-coded bubble icon (shown at A in the following screen capture).

Monitoring a Web transaction

In the Steps area of this interface (B in the above screen capture) you can check the status of individual steps in the captured transaction. Again, the feedback is color-coded: errors are shown with a gray callout bubble. Clicking the status indicator bubble calls up a dialog with timing information to help you diagnose and troubleshoot latency.

Examining latency

Do you see the hyperlink that says Try the SEUM evaluation for configurable thresholds? This is a reminder that the SolarWinds Web Transaction Watcher is the free “little sibling” to their enterprise product Synthetic End User Monitor (SEUM).

SEUM is cool because it greatly broadens and deepens the Web transaction monitoring functionality contained in the Web Transaction Monitor. For instance, SEUM has robust scheduling capability (Web Transaction Watcher includes limited functionality for automatically replaying your stored Web transaction sequences).

Moreover, SEUM makes it easy to run your Web application tests from multiple hosts. For example, you may want to simulate your Web app user experience from multiple locations around the world using various Internet connection speeds.

Conclusion

You should know that Web Transaction Monitor is only one of over 20 completely free utilities that are offered by SolarWinds. I’ve been a fan of these tools for many years; their Advanced Subnet Calculator has historically been one of my favorite free utilities from any vendor.

Web Transaction Watcher

• IEAK Boot Camp – Part 4: Maintaining Internet Explorer 9 (0)
• IEAK Boot Camp – Part 3: Deploying a custom build of Internet Explorer 9 (0)
• IEAK Boot Camp – Part 2: Creating a custom build of Internet Explorer 9 (0)
• IEAK Boot Camp – Part 1: Whys and Initial Configuration (0)
• Chromebooks – Eight disadvantages – Part 5: Costs and conclusion (2)

Submitted by Eugene Rublovka

Verax NMS supports network elements (CISCO, Juniper, Adva, Foundry , etc.), applications (MySQL, Oracle RDBMS, Microsoft Internet Information Server, Apache Tomcat, IBM WebSphere, etc.), and data center elements (IP cameras, power supplies, etc.) in a single, integrated system.

Network and application monitoring – Verax NMS – Sensor summary

The Rich Internet Application (RIA) front-end GUI is a differentiator, as well as built-in business reports (users can design their own), plugin based architecture (SDK available) and rules engine (for event processing and IT automation).

Network and application monitoring – Verax NMS – Business Reports

Verax NMS

• FREE: Veeam ONE Free Edition – Real-time Hyper-V and VMware monitoring (0)
• FREE: FrameFlow – Web-based Windows monitoring (1)
• Raffle: PA Server Monitor – Easy Windows server monitoring (0)
• Poll: Are you currently using a monitoring solution? (12)
• SCOM 2012 review – Part 8: Dashboards (0)

Submitted by Igor Markin

The program allows you to manage users, groups, client computers, servers and domains. Metro interface makes the program easy. You do not need to install software on the server.

Active Directory Management -SysAdmin Anywhere

SysAdmin  supports these features:

Computer Management

• Quickly search for a computer in the list of computer
• View and edit properties
• View events on a remote computer
• View processes on a remote computer
• Monitor a remote computer’s performance (CPU, available memory)
• Run any command on a remote computer
• View the list of hardware installed on a remote computer
• View the list of software installed on a remote computer
• Reboot a remote computer
• Shutdown a remote computer
• Quickly view basic information about your computer

User Management

• Quickly search for a user in the list of users
• View and edit properties
• Add photos
• Add a new user with filling all required fields automatically and creating a login by using a template
• Include and/or exclude certain groups
• Reset a user’s password
• Quickly view basic information about a user

Group Management

• Quickly search for a group in the list of groups
• View and edit properties
• Include and/or exclude certain groups
• Quickly view basic information about a group
• Contacts Management
• Quickly search for a contact in the list of contacts
• View and edit properties
• Include and/or exclude certain groups
• Quickly view basic information about a contact

Reports

• Print out various reports
• Set up document parameters before generating a report
• View a report at different scales

SysAdmin

• Raffle: Blackbird Auditor for Active Directory – Real-time Active Directory auditing (0)
• FREE: ManageEngine Free Active Directory Tools (0)
• Microsoft Exam 70-640 – Operations Masters – Sample question (3)
• Microsoft Exam 70-640 – The Global Catalog – Sample question (0)
• Microsoft Exam 70-640 – The Global Catalog (3)

Now that we have configured WPKG on the server side, all that remains to be done, is to tell our client system to run the WPKG script (with administrator privileges). WPKG should then manage our software as per our config files. Whereas the WPKG project does provide a client, I prefer to use the alternative WPKG-GP client.

The reason I prefer WPKG-GP is that it hooks into the startup process via Group Policy extensions, and runs WPKG before users have a chance to login, so you don’t need to worry about applications being open when you are trying to upgrade them.

Once you downloaded WPKG-GP, run the setup, and install all components. For simplicity we will enable local policies, although it is possible to configure WPKG-GP via Group Policy. During the setup process you will need to browse to the file share where you copied the WPKG files to. The final screen of the installer will ask you for an account that has permissions to connect to the WPKG share. I suggest creating a dedicated account for WPKG for this.  Don’t forget to give this account read access to your WPKG share!

At this point we have our WPKG configuration files on our server and the WPKG-GP client installed. If we reboot and carefully watch the bootup process, just after “Applying computer settings…” you should see WPKG-GP kick in and do its thing. If all went well, WPKG-GP will install the 7-Zip package.

WPKG-GP installing 7-zip

Occasionally, you might encounter a problem with WPKG, where your package isn’t correctly installing (It might be attempting to install every time, but never appearing on the client). We can locate the problem by running the WPKG.js from the command line, and watching the output. Fire up an administrator command prompt and run the following command:

cscript \\SERVER\WPKG\wpkg.js /debug /synchronise |more

This will run the WPKG engine and display its progress step-by-step. While writing this article 7-Zip wasn’t installing and the output of the above command told me that the installation was returning error code 1619.  A quick search revealed that this error means the installer package couldn’t be found. I corrected the typing mistake in the MSI path in my packages.xml, increased the revision number, then retried to find that 7-zip installed without problems.

WPKG installation progress

Once you are happy with your WPKG software deployment setup, it’s relatively simple to tie it in so that it kicks in after a system deployment via WDS.

From WDS we just need to run the WPKG-GP client installer as a “FirstLogonCommand” in our unattend.xml. Luckily, we had already configured the batch script postbuild.cmd which we can use for this purpose. Just add the following command to the batch script:

wpkg-gp-version_x86.exe /S /NetworkUsername CONTOSO\WpkgInstallUser /NetworkPassword Pa$$w0rd /WpkgCommand \\server\Wpkg\Wpkg.js shutdown /t60 /r

Obviously you will need to replace the relevant parts to suit our environment. This will cause the WPKG-GP client to be silently installed, reboot system, and then start installing the software packages.

You should now have a configuration that is ready for remote bare metal system and software deployment. While it does take a bit of time and patience to get all your software properly installing with WPKG, it will certainly make life a lot easier in the long run.

WPKG-GP

• Raffle: SmartDeploy Enterprise – Easy OS deployment – Part 2 (1)
• Raffle: SmartDeploy Enterprise – Easy OS deployment – Part 1 (0)
• Windows deployment preflight checks – Part 2: The script (0)
• Windows deployment preflight checks – Part 1: Introduction (2)
• MDT Workbench and Windows deployment (0)

The great thing about WPKG is that it doesn’t require any infrastructure other than an SMB network share, oh, and it’s free! To follow this introductory tutorial to WPKG, head over to the download page to get the latest version of WPKG, unzip the file and copy hosts.xml, packages.xml, profiles.xml and wpkg.js to C:\WPKG or a location of your choice. You should also share this folder, as you will need to access it over the network.

WPKG configuration files

The wpkg.js file is the main engine of WPKG. It first looks through the various XML configuration files, and then runs any required commands to install, upgrade or remove software from your client systems.

So-called profiles are defined in profiles.xml. A profile basically contains a list of software packages that will be installed on the remote system.

In hosts.xml you can assign computers to a WPKG profile. For example, you could assign all hosts that belong to accounting to the finance profile.

Finally, packages.xml contains information about all the available software packages that  you can manage with WPKG. Each package definition should include a “check” to determine if the software is installed or not, a set of installation commands, a set of upgrade commands, and finally commands to remove the software.

If you take a look at the files you have copied to your WPKG folder, it should be relatively easy to gain an understanding of the way the WPKG configuration works:  A host is allocated to a profile, and a profile then refers to packages which contain information about the way how the software has to be installed.

To keep this example easy, we will just deploy a single application( 7-Zip) to our clients. Download the 32-bit MSI and then save it to C:\WPKG\Software\7-zip\7z920.msi.

WPKG sample configuration

First, open profiles.xml. Take note of how the example profiles define dependencies. The “other” profile section includes the openoffice package and refers to the software packages in the “default section”.  The definition of default packages is useful for deploying a base set of applications to all workstations.

<?xml version="1.0" encoding="UTF-8"?>

<profiles>

 <profile id="default">
 <package package-id="firefox" />
 <package package-id="thunderbird" />
 </profile>

 <profile id="custom">
 <depends profile-id="default" />
 <package package-id="openoffice" />
 </profile>

 <profile id="administration">
 <depends profile-id="default" />
 <package package-id="openoffice" />
 <package package-id="acrobat7" />
 </profile>

 <profile id="other">
 <depends profile-id="default" />
 <package package-id="openoffice" />
 </profile>

</profiles>

Remove the example configuration from profiles.xml, and insert this very basic profile, containing just one package:

<?xml version="1.0" encoding="UTF-8"?>
<profiles>
 <profile id="default">
 <package package-id="7-zip" />
 </profile>
</profiles>

The example hosts.xml file adds any unknown/unmatched clients to the “other profile”, so we don’t need to edit this file for now, although you probably will want to do that later when you’re getting more adventurous with WPKG.

Packages.xml also contains examples, which you should remove and replace with a simple configuration containing just one package. In a common WPKG setup, you would have multiple packages listed here. Replace packages.xml with the following configuration:

<?xml version=”1.0″ encoding=”UTF-8″?>

<packages>

<package id=”7-zip” name=”7-Zip” revision=”9.20″ reboot=”false” priority=”1″>

<check type=’uninstall’ condition=’exists’ path=’7-Zip 9.20′ />

<install cmd=’msiexec /qn /norestart /i “\\SERVER\WPKG\Software\7-Zip\7z920.msi” REBOOT=ReallySupress’ />

<upgrade cmd=’msiexec /qn /norestart /i “\\SERVER\WPKG\Software\7-Zip\7z920.msi” REBOOT=ReallySupress’ />

<remove cmd=’msiexec /qn /norestart /x “\\SERVER\WPKG\Software\7-Zip\7z920.msi”‘ />

</package>

</packages>

I will quickly outline what’s going on in this file, as the packages.xml is certainly the most complex configuration aspect of WPKG. You can find the full documentation for packages.xml at WPKG.org.

Package id – The ID of the package, must be unique and match the package-id that you used in profiles.xml so that WPKG can create the link between the two.

Package name – This is just a friendly name that is displayed while the software is being installed.

Package revision – I usually use the software version, although you can just use an incrementing number – if you increase the revision number, WPKG will run the upgrade commands for the package.

Package reboot – Some packages might require an immediate reboot, in this case you should set reboot to “true”. In our example the package won’t require a reboot, so I’ve left it at “false”.

Package priority – Defines the order in which packages will be installed by WPKG. The higher this number is, the higher the priority of the package is (5 will be installed before 1).

Check – This section defines how WPKG will verify whether the package is installed on the client. There are a number of different checks that can be performed. In my example, I am just checking for a certain entry in the “Add/Remove programs” control panel applet. You can combine multiple checks if required.

Install – This is the command used to install the software for the first time. For automated software deployment, it is important that this command runs without any user intervention (unattended installation). It can sometimes take a bit of time to find out the required command line arguments for unattended installation. WPKG wiki and appdeploy.com are great resources if you are searching for command line parameters of well-known installers. Luckily the 7-Zip installer comes as a Microsoft Installer package (MSI) . You can use “/qn2″ for quite (unattended installs). As you probably already guessed, “/i  stands for “install”. You can see the full list of command line arguments for MSI installers by running “msiexec /?” If you add multiple install commands, WPKG will run them sequentially.

Upgrade – Upgrades work the same way as installations, however this command is only executed when the revision number of the package is increased.

Remove – If a package has been removed from a profile, but is still present on the system, WPKG will run the remove command(s) to uninstall application from the system. This takes the same options and format as the install and upgrade commands.

If there are any syntax errors in your XML files, WPKG will not process the configuration. It is often helpful open the files in Internet Explorer as this will highlight syntax errors.

In my next article, I will show you how to set up the WPKG client WPKG-GP.

WPKG

• Raffle: SmartDeploy Enterprise – Easy OS deployment – Part 2 (1)
• Raffle: SmartDeploy Enterprise – Easy OS deployment – Part 1 (0)
• Windows deployment preflight checks – Part 2: The script (0)
• Windows deployment preflight checks – Part 1: Introduction (2)
• MDT Workbench and Windows deployment (0)