In my previous article, we defined services and service accounts and also examined what options there are for selecting a service account for use with a particular service or application.

Here we take that fundamental knowledge and put it in more of a practical context. In real world multi-tier Web application scenarios, a Windows administrator can quickly become overwhelmed in keeping track of which service account he or she used with which application or service.

Consider the following example diagram:

A typical multi-tier Web application topology

Think of how many service accounts we require in the preceding scenario:

• Client services (likely if the client is using anything beyond a simple Web browser to access the Web application)
• IIS services
• AD and related infrastructure services (DNS, DHCP, etc.)
• Application services (SharePoint 2010, for instance, requires an entire suite of service account-attached services and applications
• SQL Server services
• “Standard” Windows services (Server service, etc.)

What is a busy Windows systems administrator to do? Well, read on and I’ll tell you.

Tip #1: Remember the Principle of Least Service

The IT security principle of least service means, in a nutshell, if you don’t absolutely require a specific service, disable it. Just turn it off. By performing this action we not only conserve system and possibly network resources, but we also reduce the number of attack vectors a malicious user can employ to penetrate your network.

As you know, we can manage all aspects of Windows services by using either the Service Control Manager (services.msc) MMC console or (even better) through Group Policy. The relevant Group Policy path is \Computer Configuration\Preferences\Control Panel Settings\Services.

Managing services with Group Policy

Tip #2: Know exactly what your applications and services are doing

Microsoft does a fairly decent job of enumerating the system privileges and file system permissions that its enterprise applications grant automatically to service accounts. For instance, check out the following links and prepare to be surprised:

• SharePoint 2010 Account Permissions and Security Settings
• SQL Server 2008 R2: Setting Up Windows Service Accounts
• Exchange 2010: Roles, Rights, and Permissions

You need to remain ever-aware of any “out of the box” privilege escalation that your line-of-business applications grant to service account. The best way to do this is to keep a wary and scrupulous eye on the vendor’s documentation.

Tip #3: Be Vigilant regarding the Everyone and Authenticated users groups

Everyone and Authenticated Users are dynamic security principals, which means that their membership is controlled by your network environment itself and that we administrators cannot control membership to these group identities.

The Everyone identity includes all authenticated and unauthenticated network users (this includes Local Service, people).

The Authenticated Users identity includes all domain user and computer accounts who have successfully authenticated to Active Directory. This group includes the Local System and Network Service built-in service account identities.

Thus, our “take-home” message is to keep a careful eye on where and how we are assigning access permissions to these two special groups.

We can control which accounts have which system privilege by using Group Policy; the relevant Group Policy path is \Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment.

Managing user rights with Group Policy

NOTE 1: System privileges are also called user rights. Either way, we refer to system-wide abilities such as logging on as a service, logging on locally, changing the system time, and so forth.

NOTE 2: Be sure to exercise due diligence and perform research prior to making user rights assignments in Group Policy. We don’t want to inadvertently break LOB application access.

Tip #4: Remember that network service authenticates as the Computer

If you opt to associate the built-in Network Service service account to a network-aware service, be aware that when that service makes a remote connection, it does so under the security context of the “calling” computer account (not user account).

Thus, you may need to adjust the discretionary access control lists (DACLs) on relevant target systems to include an access control entry (ACE) for the calling computer.

Editing a DACL for an IIS Web application

Tip #5: Use separate domain user accounts for services and applications

The main reasons why I suggest that you use dedicated domain user accounts for service accounts instead of the built-in identities are as follows:

• By using domain user accounts as service account logons, you can more granularly audit access locally and across your network
• For applications that support them, managed user accounts (MSAs) enable you to use domain password policy with your service accounts
• A domain user account has unquestioned visibility throughout your entire domain and Active Directory forest
• Domain user accounts can be more definitively targeted with Group Policy
• Using domain user accounts consistently makes it easier to manage multi-tier application infrastructures

Speaking of Group Policy, you might want to ensure that your domain service accounts are denied the Log on Locally user right at the very least. This action will prevent a malicious user from succeeding in an interactive logon attempt by using a breached service account.

With regard to my final point about consistent use of service accounts, Microsoft recommends that you assign different service accounts to different services within each enterprise application. The thinking here is that an attacker would have to compromise more than one account to “own” your application.

The only “gotcha” with using multiple service accounts is the pure confusion factor that can happen if you deploy the service accounts with no consistency. To reduce the confusion, (a) store your service accounts in separate organizational units (OUs) in Active Directory; and (b) name the accounts in an intuitive manner.

Conclusion

In this lesson we learned some industry best practices for using service accounts in a Windows-based, multi-tier application infrastructure. To be sure, we have truly only scratched the surface of this behemoth of a topic.

Please feel free to share your own experiences, war stories, tips, etc. in the comments portion of this post. The Windows admin community deeply needs a vibrant yet solid knowledge base for this subject.

Further reading

• Service Accounts Step-by-Step Guide
• Services and Service Accounts Security Planning Guide

• FREE: PhoneFactor – Mobile phone based two-factor authentication (1)
• How to disable USB drive use in an Active Directory domain (2)
• Service Account best practices Part 1: Choosing a Service Account (0)
• Four fast ways to improve security in SQL Server 2008 R2 (12)
• Managed Service Accounts in Windows Server 2008 R2 (7)

It is a common mistake for entry-level Windows systems administrators to associate a local or domain Administrator account with Windows services and applications. I hope that you can see how dangerous a practice this is. If a malicious user were to compromise a service account, then that malicious user accesses your domain up to and including all level of privilege of the associated service account.

It is my goal in this mini-series on Windows service accounts to teach you exactly what these accounts are, what options we have in using them, and what specific best practices Microsoft recommends for their use. Let’s get to work.

What is a Service?

A service is compiled code that is typically long-running and executes with no user interaction. By “long-running” we mean that many services are configured to start automatically with Windows. By “no user interaction” we mean that the service typically runs in the background with no visible front-end user interface.

As you know, we can view and modify services by using the Service Control Manager (services.msc) MMC console. We can also view active services by using Task Manager or Sysinternals Process Explorer.

NOTE: Process Explorer is a far superior choice for viewing live processes because we can “drill into” the svchost.exe generic host processes to see individual service names.

Viewing services in Sysinternals Process Explorer

The IT security principle of least service means, simply, that if we don’t need a particular service on a system, we should disable said service. Note that I said disable the service and not simply set its startup type to Manual.

By applying the least service principle, we not only conserve system resources but we also minimize the attack surface of the system.

What is a Service Account?

A service account is a Windows user identity that is associated with a service executable for the purpose of providing a security context for that service.

More broadly, we can say that service accounts are used not only for Windows services, but also for many enterprise applications. For instance, SharePoint 2010 requires service accounts not only for its registered Windows services, but also for its internal application components.

Microsoft introduced managed service accounts (MSAs) in Windows Server 2008 R2 as a way to ease our administrative burden in managing service account passwords. The great thing about MSAs is that we don’t have to worry about our domain password policy messing up our service accounts and breaking our line-of-business (LOB) applications.

The bad thing about MSAs is that because they are still so new, their use is not supported universally, even among Microsoft’s own enterprise application portfolio.

NOTE: Surprisingly, MSAs are supported in SharePoint 2010 but not in SQL Server 2008, which is the data store used by SharePoint.

Because of this compatibility problem, we will not include the use of MSAs in this discussion of service account best practices.

Options for Service Accounts

In terms of selecting a user account for a service or application, our choices fall along two lines:

• A built-in operating system identity
• A local or domain user account

The following table summarizes the major aspects of the built-in OS identities that are used as default service accounts in Windows.

I would like to point out some additional facts concerning the account identities in the previously given table:

You don’t have to manage their passwords. Because these built-in identities are created by Windows itself, the operating system manages their account passwords. In this respect these accounts function like MSAs.

The System account is very highly privileged. The Local System identity is granted system privileges that make this account in many ways more powerful than the built-in Administrator account. Although Local System was designed for access on a local computer only, this account can be associated with services and applications that move across your network. In this case, the credential that is presented to remote processes is Domainname\machinename$.

Be wary of Local Service and Network Service account group membership. Again, the ‘Local’ and ‘Network’ parts of these account names inform us that the Local Service and Network Service accounts are targeted at local and network use, respectively.

However, you should always keep in mind that the Local Service account runs locally as a member of the computer’s Local Users group (Domain Users on domain controllers) and runs remotely as an anonymous connection.

By contrast, the Network Service account runs locally as a member of the local Users or Domain Users groups, and runs remotely as a member of the Authenticated Users group. In addition, Network Service inherits any permissions that have been granted to the source computer account in Active Directory.

User Accounts as Service Accounts

You can sidestep some of the complexities of running services with the built-in service accounts by instead using a local or domain user account. One “gotcha” to keep in mind is that Windows automatically grants additional privileges (most notable the Log on as a Service user right) to user accounts we associate with services.

Service account privilege escalation

In addition, applications that leverage service accounts may grant additional permissions on top of the OS system privileges.

For this reason, it is imperative that you never use a service account for interactive logon. In other words, a human being should never log on to a system by using a service account identity.

We can again use the wonderful Sysinternals Process Explorer tool to retrieve “at a glance” data concerning specifically which system privileges have been granted a service account-driven process.

Sysinternals Process Explorer – System privileges service account

So Which Account Should I Choose?

According to Microsoft, Windows administrators should choose service accounts based upon the following hierarchy. This hierarchy is ordered from least privilege to greatest privilege:

1. Local Service
2. Network Service
3. Unique domain user account
4. Local System
5. Local Administrator account
6. Domain Administrator account

Obviously, options 5 and 6 in the list represent “worst-case scenarios” in which a given service or application simply will not run with a service account containing lesser privilege and permissions.

Conclusion

In this lesson we learned the basic terminology governing service accounts in Windows. We also examined the options available to us in service account use. In the next installment of this series, we will cover the practical application of service accounts in a multi-tier network application context.

• Service Account best practices – Part 2: Least Privilege implementation (0)
• Raffle: VisualCron – An advanced task scheduler for Windows (0)
• AutoAdministrator 2.3 – Part 3: Remote execute: Programs, services, shutdown/reboot (0)
• Prevent restarts triggered by third-party applications (1)
• Four ways to stop a shutdown or reboot (7)

VisualCron raffles off three licenses of their central task scheduling software for Windows to 4sysops readers. The winner will receive a 5-Server license worth $717 USD. The two runners-up will each receive a 1-Server license worth $197 USD. The deadline of this contest is July 26, 2011. If you want to take part in this raffle, please send an email with the subject VisualCron to .

I reviewed an earlier version of VisualCron in 2009. Many new and interesting features were added since then, which is the main topic of this post. For an overview of the capabilities of this advanced task scheduler, I recommend reading my former posts about VisualCron. Most of the text is still valid.

VisualCron- Advanced Task Scheduler

Before I discuss the enhancements in the new version 5.7.5, let me summarize the main advantages of VisualCron over the Windows Task Scheduler.

Central management of scheduled tasks

VisualCron allows you to manage all scheduled tasks in your network on a central server. You can connect with VisualCron clients from any workstation and configure scheduled tasks for all servers and workstations in your network.

Powerful task scheduling features

VisualCron offers many more triggers and task types than does the Windows Task Scheduler. A sophisticated notification system informs admins about the status of scheduled tasks.

One task scheduler for all Windows versions

Different Windows versions have task schedulers with different user interfaces and capabilities. VisualCron provides a uniform task scheduling environment for older Windows versions (Windows 2000/XP/2003/Vista/2008) and, of course, Windows 7 and Windows Server 2008 R2.

User tasks with admin rights

VisualCron enables you to run Windows tasks with administrator rights in the context of a standard user.

VisualCron Job definition

These are the new features of VisualCron 5.7.5:

Tasks

• Exchange tasks: Allows you to run tasks on an Exchange server
• SNMP tasks: Lets you perform queries against SNMP products
• WCF services: Provides extended support for executing Windows Communication Foundation (WCF) services

Triggers

• System start/shutdown: Triggers a task when a computer starts or a shutdown is initiated
• Performance counters: Monitors performance counters for changes (for example, if CPU utilization exceeds 50% for a configurable time period)
• Internal VisualCron trigger: Notifies you about VisualCron changes (for example, if a job has been added)
• RSS trigger: Allows you to monitor remote RSS feeds for specific content

Tools

• FTP explorer: Provides a built-in SSH and FTP client for testing FTP tasks
• Calendar: Lets you view your scheduled jobs in calendar mode
• New log: Increased log size enables you to access information about former tasks and jobs

VisualCron API

The VisualCron API is a DLL that allows you to use all VisualCron client features in your .NET programs. For instance, you can create your own GUI for VisualCron (perhaps a web interface) by leveraging the VisualCron API. You can also easily integrate VisualCron functionality in your own applications—for example, to receive output from tasks and to run jobs.

You can download a free trial of VisualCron.

• Microsoft Desktop Optimization Pack (MDOP): MED-V (0)
• Microsoft Desktop Optimization Pack (MDOP): Advanced Group Policy Management (AGPM) (0)
• Microsoft Desktop Optimization Pack (MDOP): Asset Inventory Service (AIS) (0)
• Microsoft Desktop Optimization Pack (MDOP): Overview (0)
• Service Account best practices – Part 2: Least Privilege implementation (0)

In my last post, I discussed the AutoAdministrator’s functions that enable you to query remote computers. Today, I will cover the remote execution functions: programs (processes), services, and shutdown/reboot.

Note: 4sysops readers get a discount on AutoAdministrator of $20 USD until the end of 2010, which means that you pay only $49 USD instead of the regular price of $69 USD. indicating that you are a 4sysops reader.

Remote execute programs

Remote process execution is another feature that was not available when I reviewed AutoAdministrator a while back. It enables you to execute all kinds of programs against remote computers, which is quite powerful since it allows you to leverage tools such as psexec and plink.

The former, as you probably know, enables you to execute processes remotely, whereas plink lets you run UNIX commands through SSH. So with this feature, you can issue SSH commands on any number of UNIX machines and see the output right in AutoAdministrator.

In the screenshot, you see how I executed the net time command, which returns the date and the time of the remote machines that are displayed in the results pane.

Remote execute Windows services

This function is certainly another highlight of AutoAdministrator. Managing system services on multiple machines is a feature that many expensive system management solutions lack. AutoAdministrator enables you to remotely query, start, stop, continue, pause, and restart services. Furthermore, you can configure the startup type remotely. You can use this feature, for example, to set the startup type of the Remote Registry service on all your machines to “automatic” to ensure that you can use all of the features of AutoAdministrator. It is also possible to remove services or to configure their logon account.

AutoAdministrator displays only services that are available on the computer where AutoAdministrator has been installed. However, if you want to remotely configure the services of third-party applications that are not installed on your PC, you can just enter the service name. You can find the service name in the Windows Service tool by accessing the service properties. Don’t confuse the service name with the service display name.

Remote shutdown/reboot

This function lets you shut down or reboot multiple computers in your network. You can configure a timeout period, after which the computers will shut down. AutoAdministrator will notify users with a message that you can customize. It is possible to force open applications to close, and you can also cancel shutdowns remotely.

My next post will outline AutoAdministrator’s remote editing features.

• Microsoft Desktop Optimization Pack (MDOP): MED-V (0)
• Microsoft Desktop Optimization Pack (MDOP): Advanced Group Policy Management (AGPM) (0)
• Microsoft Desktop Optimization Pack (MDOP): Asset Inventory Service (AIS) (0)
• Microsoft Desktop Optimization Pack (MDOP): Overview (0)
• Service Account best practices – Part 2: Least Privilege implementation (0)

Deploy updates during off-hours

The main reason why third-party applications may initiate restarts is because an update has to replace open files. If users are currently working with an application while you deploy updates, the likelihood is high that you will interrupt their work. Hence, I recommend using a software deployment solution that supports scheduled software updates and WAKE-ON-LAN so you can boot-up computers before the deployment process starts.

Deploy the latest Windows Installer

The Windows Installer is a Windows component that is used for installing, updating, and removing software. Since the Windows Installer usually informs the Restart Manager whether a reboot is required or not, it is a crucial component when it comes to preventing reboots. New Windows Installer versions sometimes can prevent system restarts. To find out which Windows Installer version you are using type msiexec.exe /? in the Run dialog box.

In particular, Windows Installer 4.0 (which was introduced with Windows Vista) offers quite a few new features to manage restart requests. You can disable the interaction of the Windows Installer with the Restart with a Group Policy setting: Computer Configuration\Administrative Templates\Windows Components\Windows Installer\Prohibit Use of Restart Manager. However, this will only increase the likelihood of restarts. Thus, I recommend leaving this setting untouched.

Windows Installer 4.5 is the latest installer for Windows XP/Vista and Windows Server 2003/2008. Windows 7 and Windows Server 2008 R2 were delivered with Windows Installer 5, which is not available for older Windows versions.

Turn off automatic termination of applications

Whenever Windows receives a restart request, it attempts to close all open applications. Developers can equip their applications with the ability to block or cancel shutdowns. However, if the application doesn’t have visible top-level windows open, Windows will ignore these attempts. This default setting can be changed through Group Policy: Computer Configuration\Administrative Templates\System\Shutdown Options\Turn off automatic termination of applications that block or cancel shutdown. If you want to prevent unwanted restarts, enable this setting. Windows will then display the shutdown dialog window and inform the user which application is blocking the shutdown.

In my next post I will cover the troubles that Windows Update can cause and how to prevent automatic restarts.

• Raffle: SmartDeploy Enterprise – Easy OS deployment – Part 2 (1)
• Raffle: SmartDeploy Enterprise – Easy OS deployment – Part 1 (0)
• Windows deployment preflight checks – Part 2: The script (0)
• Windows deployment preflight checks – Part 1: Introduction (2)
• MDT Workbench and Windows deployment (0)

The problem is that “now” is usually the wrong time from the user’s perspective, and sometimes Windows insists that “then” is too late. There are many reasons why Windows can initiate a restart without user consent, including during the processing of automatic Windows updates or when an updated application just wants to be sure that everything will work properly. Or perhaps you just initiated the shutdown at the moment your boss calls to ask for some important data and you want to stop it.

I know of four ways to stop or prevent shutdowns and reboots:

1. Click the clock

If you are sitting in front of the PC and recognize that one application window after the other magically closes without your intervention, then you have to be very quick to convince Windows that “now” is not “then.” This can be done by clicking the clock in the systray to change the date to a time in the past. This makes Windows believe that “now” is still in the future and so it stops the shutdown or reboot process. The problem with time machines is that they need a lot of energy and, in this case, a lot of speed to be put into action. If you only have a few applications open for Windows to close, you will see the “Shutting down…” message before you even had the chance to click the calendar.

2. Shutdown -a

The “click the clock” trick is not the official way to cancel shutdowns. An alternative is to open a command prompt and type “shutdown -a”. However, only a young PowerShell geek who doesn’t have arthritis in his fingers yet would be fast enough for that. To be prepared for the future, you can just create a Windows shortcut and use the “shutdown -a” command as the “location of the item.” If you copy this shortcut to the quickstart bar or to the Windows 7 taskbar, then you can stop a shutdown with a single click in the future.

3. Shutdown Event Tracker

Click the clock and shutdown -a only help if you are currently working on the PC. Besides, only John Wayne in his early days would have been fast enough to always win the duel with Windows. For seasoned admins like me, it makes sense to activate the Shutdown Event Tracker. If this setting is enabled, Windows will always display the Shutdown Event Tracker dialog before it actually shuts down the computer. You probably know this feature from Windows Server; enabling this GPO setting will activate it for Windows clients as well. This means an extra click to shut down Windows, but, at least, you will always have enough time to load your rifle and pull the trigger when you are ready. The corresponding Group Policy setting to activate the Shutdown Event Tracker can be found here: Computer Configuration\Administrative Templates\System\Display Shutdown Event Tracker.

4. ShutdownGuard

If you don’t want the Shutdown Event Tracker to ask for a reason every time you reboot, then you might be interested in ShutdownGuard. This tiny free tool sits in the systray and can be enabled or disabled with a mouse click. If enabled, it will prevent every shutdown. In Windows XP, ShutdownGuard displays its own warning message in the systray; in Vista and Windows 7, the integrated new shutdown warning dialog appears. You can then either cancel the shutdown or just click “Force shut down”.

Do you know of another way to cancel or prevent shutdowns?

• Service Account best practices – Part 2: Least Privilege implementation (0)
• Service Account best practices Part 1: Choosing a Service Account (0)
• FREE: SetACL – Manage access control lists (acl) (0)
• FREE: Console – Windows Command Prompt alternative for Windows and PowerShell (9)
• Raffle: VisualCron – An advanced task scheduler for Windows (0)

If you have a quick look at this tool’s Windows Explorer-like user interface, you will get a first impression of its capabilities. I will only discuss those features that seem to be most interesting to me.

One usage scenario of System Explorer is the investigation of a system with suspicious behavior. You can quickly access many Windows components where malware can hide: processes, modules (system DLLs), drivers, auto starting applications, network connections, Internet Explorer addons, Explorer extensions (protocol filters, protocols, shell extensions, column handlers), and installed software. An important feature here is that you can hide all Microsoft system entries so you can get a swift overview of third-party components.

Most useful is that you easily get more information about the displayed components through their context menus. System Explorer allows you to search at SystemExplorer.com, ProcessLibrary.com, Google, VirtusTotal.com, and VirusScan.jotti.org.

Also very helpful is the history function that logs the activity of processes, network connections, events, and file changes. All activities are displayed chronologically, which helps you understand how a malware program operates. For example, you would see that it first starts a certain process, changes a file, and then connects to the internet. The only thing I miss here is a filter-like Sysinternals Process Monitor has that allows you to limit the output.

But System Explorer is not only for hunting malware. You can use this tool for all kinds of troubleshooting and system cleaning. Although, some of its features are included in Windows, System Explorer’s main advantage is that you can switch quickly between its functions. So if you have to repair a computer that a user messed-up, you will instantly get an overview of the whole chaos and then use the tool to uninstall software, remove auto starting programs, disable drivers, etc. System Explorer also allows you to export a complete system report into a text file.

Another nice feature is the snapshot function. Its purpose is to compare two system states. For example, if you want to know what files or registry entries a setup program adds, you can create a snapshot before and after the installation, and then compare the two snapshots. The results can be displayed as a text file in chronological order and in a tree view. It is just a pity that the snapshots can’t be used to revert system changes.

The WMI explorer completes this mighty system tool. Unfortunately, System Explorer 2.1.0 had problems with Windows 7 when I tested it, despite its publisher claims that the latest Windows version is supported. The General View of Additional Info folder (which offers an overview of many system settings) didn’t work, the Opened Files folder (which allows you to close the handle of opened files) didn’t show up at all, and the Startup folder (which displays auto starting apps) didn’t display all relevant registry keys. It is possible that other features don’t work properly under Windows 7. After I had these problems, I continued my test on Windows Vista where everything worked properly.

• Microsoft Desktop Optimization Pack (MDOP): MED-V (0)
• Microsoft Desktop Optimization Pack (MDOP): Advanced Group Policy Management (AGPM) (0)
• Microsoft Desktop Optimization Pack (MDOP): Asset Inventory Service (AIS) (0)
• Microsoft Desktop Optimization Pack (MDOP): Overview (0)
• Service Account best practices – Part 2: Least Privilege implementation (0)

First to consider is its modern user interface, complete with ribbon and tabs. This UI doesn’t just look better; it is also more convenient than Process Explorer’s old style interface. But, of course, some fancy icons are not enough to remove the king from the throne.

I can’t discuss all of Yet Another Process Monitor’s (YAPM) features. Everyone’s opinion may differ regarding which features matter, but here are the features I like most:

Remote process management

YAPM supports two types of remote connections: through WMI (Windows Management Instrumentation) and via the YAPM Server. If you use WMI, not all features will be available. For example, you can’t kill a process tree or kill a process by method (see below). If you connect via the YAPM Server, you first have to install YAPM on the remote computer and then start the server on that machine using the Windows Start menu. You can find the remote function on the client through YAPM’s start button. You have to click “disconnect” first before you can connect to a remote machine. By default YAPM is connected to the local machine when you launch the tool. Make sure that the server and the client use the same port.

Tasks / Jobs / Services / Performance Monitoring

YAPM not only allows you to manage processes but also tasks, jobs, and services. Tasks are what you can see under Applications in the Windows Task Manager, a feature that Process Explorer lacks. Jobs group processes together so you can manage them as a single item (for example, you can kill a couple of processes in one go if you terminate the corresponding job). You can add a process to a job through its context menu. Moreover, you can use the tool to monitor all Windows performance counters.

Kill method

Like Process Hacker, YAPM supports different kinds of kill methods. For instance, you can close all handles of the process or terminate all its threads. In some cases, this helps to get rid of the more persistent processes (malware for instance) that can’t be killed by a simple terminate command.

Dependencies

This feature allows you to view the DLLs that a process depends on. This can be helpful if you have to troubleshoot an application. Unfortunately, this feature seems to be working only on Windows XP and Vista but not on Windows 7.

Search

YAPM comes with three search features. You’ll find the first one, a search box, right below the ribbon. This search box also appears in the task and the services tab. YAPM sorts processes as you type. Strangely, the hits are displayed at the end of the process pane and not at the top.

On the search tab, you’ll find more sophisticated search functions. You can limit your search to processes, modules, environment variables, services, handles, and windows. The search box also appears on this tab so that you can easily search within the search results.

The third search feature allows you to look for processes on Google. You can access this internet search function through the process’s context menu. This feature comes in handy if you detect suspicious processes on a machine.

Network

YAPM also has network monitor that displays all TCP/IP connections. What’s nice about this feature is that you can locate the process to which a certain connection belongs by right-clicking the connection.

Just one further note: If you are trying YAPM on Vista or Windows 7, and you right-click a process, you have to hold the mouse button a few milliseconds longer than you are used to until the context menu shows up. (I observed this behavior under VMware Workstation. I didn’t have this problem with Windows XP.)

Yet Another Process Monitor

• Service Account best practices – Part 2: Least Privilege implementation (0)
• Service Account best practices Part 1: Choosing a Service Account (0)
• Raffle: VisualCron – An advanced task scheduler for Windows (0)
• AutoAdministrator 2.3 – Part 3: Remote execute: Programs, services, shutdown/reboot (0)
• Prevent restarts triggered by third-party applications (1)

It is also possible to run multiple programs with admin privileges this way. You just have to select the corresponding icons and move them onto the Elevation Gadget. You can also type commands inside the widget to launch programs. The tool’s history buffer allows you to start previously launched programs.

I think, the Elevation Gadget is most useful if you have to fire up elevated scripts often. It is faster than through an elevated command prompt, because the gadget always sits on your desktop.

Unfortunately, one can’t drag text files onto the tool. For example, it would be nice if one could launch an elevated notepad with a text file from the Programs folder, by just dragging the text file to the Elevation Gadget. I still find it quite inconvenient that I can’t edit a file in these restricted folders by just double clicking on it. What is your solution to this problem?

Elevation Gadget

• FREE: PhoneFactor – Mobile phone based two-factor authentication (1)
• How to disable USB drive use in an Active Directory domain (2)
• Service Account best practices – Part 2: Least Privilege implementation (0)
• Service Account best practices Part 1: Choosing a Service Account (0)
• Four fast ways to improve security in SQL Server 2008 R2 (12)

If your computer behaves sluggishly, then there are usually three possible causes: An application occupies too many CPU resources, needs too much RAM, or keeps your hard disk busy. Free Extended Task Manager tool adds a third graph to the Performance tab that displays the disk input/output activity. This way, you’ll see all three important parameters (CPU usage, RAM usage, Disk I/O) at a glance.

Once you know which of the three parameters is affected, you can hover with the mouse over the corresponding chart. Extended Task Manager will then display the process that occupies most of the resources.

Another interesting feature is the “freeze function”. It allows you to stop a process without terminating it. As soon as you resume the process, it will just continue where it stopped. Thus, if an application demands too many resources at an inconvenient moment, you can just freeze it and let it continue once you have finished your work. A typical example is if a backup program keeps your hard disk so busy that the whole system performance is affected. However, I am not sure if all applications will like such rude intervention.

I also like the features that enable you to determine by what process a file has been locked. Locked files can’t be deleted or moved, which can be annoying at times. Free Extended Task Manager can display all files locked by a selected process and it can find all processes locking a specified file.

Free Extended Task Manager

• Service Account best practices – Part 2: Least Privilege implementation (0)
• Service Account best practices Part 1: Choosing a Service Account (0)
• Raffle: VisualCron – An advanced task scheduler for Windows (0)
• AutoAdministrator 2.3 – Part 3: Remote execute: Programs, services, shutdown/reboot (0)
• Prevent restarts triggered by third-party applications (1)

The tool has two different displays, one for the drivers and one for the services. The operations you can perform are similar to those for Windows tools. For example, you can start or stop services or change their start type. ServiWin also supports starting and stopping of drivers, but this won’t work with most system drivers. The main benefit of ServiWin is that you can gather information about services and drivers more easily than with the Windows tools. This is the list of additional ServiWin features:

Better overview

ServiWin has a few more columns than the built-in Services tool. For example, you see the last error messages, the dependencies, the application to which the service / driver belongs, the file name etc. This can be quite useful in some situations. For instance, if you want to find out what services a certain application has installed, you can just sort the list using the corresponding column.

Search function

Also very useful is the search function. It allows you to search for phrases in all columns. If you forget the exact name of a certain service, it can be quite cumbersome to find it in a long list with the Windows tool. Of course, the search function is also very useful for locating drivers.

Reports

If you want to compare the services or driver configuration with another computer, you can easily create reports with ServiWin. The tool supports HTML and text reports. You can create a report of all services / drivers or only of selected items.

Manage multiple services or drivers

The built-in Services tool allows you to only manage one service at a time. With ServiWin, you can select multiple services or drivers and change their start type (automatic, manual disabled) or status (start, stop, restart).

I tested ServiWin v1.37 on Windows 7 x64.

ServiWin

• Service Account best practices – Part 2: Least Privilege implementation (0)
• Service Account best practices Part 1: Choosing a Service Account (0)
• Raffle: VisualCron – An advanced task scheduler for Windows (0)
• AutoAdministrator 2.3 – Part 3: Remote execute: Programs, services, shutdown/reboot (0)
• Prevent restarts triggered by third-party applications (1)

You can install the frontend (the documentation calls it the client) and the backend (server) separately. The frontend can be used to manage jobs remotely for one or multiple servers. Of course, you can also install the client and the server on the same machine.

VisualCron’s product name fits very well because its graphical user interface makes it easy for you to track all of your jobs. The user interface resembles the ribbon interface used in some Office 2007 applications. Microsoft introduced the ribbon in Office because the features had become too numerous for the menus and toolbars of the old interface style to handle without being cumbersome. I suppose this was also the reason why VisualCron chose a ribbon-style interface type.

I will describe each of the ribbons shortly, but let me first explain the main part of the user interface—the task area. This area is basically a grid designed to keep track of numerous servers and jobs. Each server is displayed separately and has two child “tracks,” the first one for the job and the second one for the job’s tasks.

List ribbon

The columns in the grid display the most important job and task parameters. Using the tools in the List ribbon, you can customize the grid layout. You can select which parameters are displayed, you can group jobs, and you can use filters to display only specific jobs (for example, you can limit the display to the jobs that will run next).

Tools ribbon

VisualCron offers a few useful tools that can come in handy when you are configuring jobs: a file explorer (for remote servers), an SQL Explorer, a reporting tool (to print job configurations), a flow chart (to display relations between triggers, conditions, tasks, and notifications), and an object search tool (to find jobs, tasks, notifications, etc.).

Server ribbon

The Server ribbon allows you to define several objects that can be used in job definitions. For example, you can configure credentials or notifications that you can use in multiple job configurations (see screenshot for the other object types). Notice that these defined objects are only available for the selected server. Thus if you plan to copy a job definition to other servers, you must configure the corresponding settings for each job separately.

File ribbon

This ribbon allows you to configure some general settings, import and export settings from another VisualCron installation, and add remote servers to the frontend.

Conclusion

VisualCron is a very powerful task scheduling tool. Even three posts were not enough to describe all of its features. If task scheduling plays a role in your environment, you should definitely look closely at VisualCron. You can download a 45 days free trial with full functionality and without registering. Also check out the active user forum.

If you to have the chance to win VisualCron license, just send an email to:

with the subject line

VisualCron.

Please, add your name and the name of your organization for which you want to use the license. The deadline of this contest is December 4, 2009.

• Service Account best practices – Part 2: Least Privilege implementation (0)
• Service Account best practices Part 1: Choosing a Service Account (0)
• Raffle: VisualCron – An advanced task scheduler for Windows (0)
• AutoAdministrator 2.3 – Part 3: Remote execute: Programs, services, shutdown/reboot (0)
• Prevent restarts triggered by third-party applications (1)

Before we dive into the details, let us have a look at how VisualCron works. The diagram below shows how a job has to be configured with VisualCron. For most jobs you have to configure one or more tasks (the actions you want to perform), triggers (defined circumstances that will initiate the task), and optional conditions (states that can prevent a task from being launched even if a trigger is present). As you can see in the diagram, VisualCron supports many more task types than the Windows Task Scheduler supports. Once the task has been launched, VisualCron can notify administrators by several means.

Triggers

Triggers can be time-based or event-based. A time-based trigger can be a certain point in time or a time interval such as weekly or daily intervals. VisualCron has more options to offer here than does the Windows Task Scheduler. For example you can tell the tool that the task has to be launched on specific days of the week or hours of the day. VisualCron also supports scheduling based on seconds and years.

VisualCron comes with eight different event-based triggers: VisualCron, File, Mail, Process, Service, Registry, Event log, and Custom (WMI). A VisualCron trigger refers to a state of another VisualCron task. For example, you can launch a new task only if a specific former task has been completed. The names of the other trigger types speak for themselves. For example, the Process trigger can be used to launch a task whenever a certain process starts running. The Custom trigger is certainly the most powerful one because it allows you to use almost any Windows state as a trigger using WMI queries.

The only trigger I miss in VisualCron is the Idle trigger from the Windows Task Scheduler. This trigger probably doesn’t play an important role in server environments because servers are seldom idle; however, on desktops I found this trigger useful.

Conditions

As noted above, conditions are additional states that have to be present for a task to get started. For instance, the Process Condition allows you to specify a certain process that has to be running. If the condition is not met, then the trigger won’t be able to launch the task. A Process Trigger becomes active whenever a process starts running, whereas a Process Condition is met if the process is already running. The other Condition types are VisualCron (check if a VisualCron task is already running), File (check if a certain file is present), and Folder (check if a certain folder is present).

Time Exceptions

Time Exceptions are to time-based triggers as Conditions are to event-based triggers. The options for Time Exceptions offer the same flexibility as time-based triggers. For example, you can configure a VisualCron job that is triggered every 13 seconds, but not on Fridays in the year 2013 (just in case you are a little superstitious ).

Timeouts

Once the task is running, the Timeout specifies how much time the job has to complete. If the Timeout is reached before the task has finished, VisualCron will terminate the job. You can configure Timeouts based on hours, minutes, and seconds. You can also tell VisualCron to consider Timeouts as errors that can trigger notifications or other tasks.

Tasks

As you probably have noticed, the different ways to schedule a task in VisualCron go far beyond the possibilities of the Windows Task Scheduler. This also applies to the supported task types. Whereas the Windows Task Manager supports only three different kinds of actions (start a program, display a message, send an email), VisualCron knows 13 different task categories: Process (execute, kill), File (copy, rename), XML (read / create node), Net (HTTP, SSH), Messaging (email, instant messaging), Database (SQL, Execute DTS package), Encryption (PGP), Service (start, stop), Office (macro), System (Registry, restart, control monitor), Interactivity (desktop macro, send keys), Internal (VisualCron task control, set variables), and Active Directory (create / modify objects). Each of the task categories comes with a couple of different task types. The texts in parentheses are only examples. I can’t discuss all of the different task types, but I think you have an idea now of how mighty VisualCron’s task management is.

Notifications

VisualCron supports seven notification types: Email, File, SQL, Popup, Event log, Sound, and Syslog. Syslog is a standard for forwarding log messages in the UNIX and Linux world, although third-party solutions exist for Windows. You can use this feature to log VisualCron notifications on a remote Syslog server. The most fancy notification form is certainly the SQL notification. It allows you to execute an SQL query or procedure using OLEDB or ODBC. This is especially useful if you work with many different tasks and want to keep track of them in your own application.

However, VisualCron’s user interface will suffice in most cases since it provides a good overview and is highly customizable. This will be the topic of my next post.

If you to have the chance to win VisualCron license, just send an email to:

with the subject line

VisualCron.

Please, add your name and the name of your organization for which you want to use the license. The deadline of this contest is December 4, 2009.

• Service Account best practices – Part 2: Least Privilege implementation (0)
• Service Account best practices Part 1: Choosing a Service Account (0)
• Raffle: VisualCron – An advanced task scheduler for Windows (0)
• AutoAdministrator 2.3 – Part 3: Remote execute: Programs, services, shutdown/reboot (0)
• Prevent restarts triggered by third-party applications (1)

VisualCron is the most sophisticated task scheduling tool I have ever tried. I was already quite impressed with the Task Scheduler in Vista and Server 2008, but VisualCron comes with far more advanced features. The ability to manage task scheduling on multiple machines from a central location, in particular, makes the tool an interesting alternative for large organizations. VisualCron targets task scheduling for server environments, but you can also use the tool on desktops.

In the first post of this series I will give you a general overview of VisualCron’s advantages over the Windows Task Scheduler.

One task scheduler for all Windows machines

First of all, if you have different Windows versions in your network, then you also have to work with different task schedulers. As you probably know, the differences between Task Scheduler in Windows Server 2003 and Windows Server 2008 are huge. With VisualCron, you only have to deal with one tool for all your servers regardless of the Windows version.

Central management

Secondly, and this could be even more important in some environments, VisualCron provides one central management console for all Windows machines. Although you can connect to a remote computer with the Windows Task Scheduler, you can only manage one remote server at a time. VisualCron can display multiple machines in its modern and well-thought-out interface. It is even possible to drag and drop scheduled jobs from computer to computer. Since VisualCron uses SSL to connect to remote machines, you can also use the tool to centrally manage servers through unsecured Internet connections.

Execution context

Thirdly, VisualCron has an interesting feature regarding the execution context. In the Windows Task Scheduler you can run tasks in the context of a certain user or without user context in the background. The latter means that user session-specific information, such environment variables or mapped network drives, is not available. VisualCron also makes this distinction but offers quite a few additional options. VisualCron distinguishes between user credentials and user context, which allows you to run a task in the standard user context with admin privileges. You can also target a specific session if the user is logged on multiple times, and you can even target all desktop sessions. The latter feature is most interesting in Terminal Server environments.

Sophisticated scheduling features

And last but not least, VisualCron has even more task scheduling options than the powerful Server 2008/Vista Task Scheduler offers. The term “task scheduler” seems to imply that you can use the tool to only run tasks at a certain time. However, VisualCron supports numerous triggers and conditions that can be used to launch a task. Moreover, VisualCron knows many different task types and has a sophisticated notification system. I will tell you more about these features in my next post.

If you want to take part in this raffle, just send an email to:

with the subject line

VisualCron.

Please, add your name and the name of your organization for which you want to use the license. The deadline of this contest is December 4, 2009.

• Service Account best practices – Part 2: Least Privilege implementation (0)
• Service Account best practices Part 1: Choosing a Service Account (0)
• Raffle: VisualCron – An advanced task scheduler for Windows (0)
• AutoAdministrator 2.3 – Part 3: Remote execute: Programs, services, shutdown/reboot (0)
• Prevent restarts triggered by third-party applications (1)

For instance, if you have started an admin tool on a user’s desktop and want to leave the place for a while. You can then let the tool finish its work while the user continues working with the computer. This way, you don’t have to worry that the user will interfere with your work. Another way to use the tool is to reduce the number of icons in your taskbar if it is cluttered with too many apps.

WinRAP is a tiny standalone tool which doesn’t have to be installed. It displays all running applications in the upper pane. You can hide each of the applications with a mouse click which moves the app’s name to the lower pane. The application’s interface will then disappear from the desktop. Of course, you can also unhide an application, if you want to access its interface.

To make sure that users don’t use WinRAP to unhide applications, you can protect the tool with a password and hide the tool itself. It is also possible to disable the Windows Task Manager, so users can’t just kill WinRAP.

WinRAP can lock out the average user, but it certainly won’t prevent IT pros from accessing your applications. For instance, it is possible to bring hidden applications to the foreground with Process Explorer. You only have to right click on the on the corresponding process and then select “Bring to Front” from the Window menu.

I tested WinRAP 1.0. Please let me know if you know a comparable tool that can’t be outsmarted so easily.

WinRAP

• Service Account best practices – Part 2: Least Privilege implementation (0)
• Service Account best practices Part 1: Choosing a Service Account (0)
• Raffle: VisualCron – An advanced task scheduler for Windows (0)
• AutoAdministrator 2.3 – Part 3: Remote execute: Programs, services, shutdown/reboot (0)
• Prevent restarts triggered by third-party applications (1)

To access such data, you have to open the process’s properties. Process Explorer (left hand) and Process Hacker (right hand) differ here (see screenshot). I am missing the open TCP/IP connections in Process Hacker’s process properties. However, the main user interface has an extra tab that lists all processes with their open network connections.

Process Hacker’s capabilities are far superior to Process Explorer’s when it comes to searching of data in the memory the process occupies. The tool gives a good overview of the process’s memory usage, and it supports literal search (hex code), string search, regular expressions and more. Another nice feature is Process Hacker’s ability to find hidden processes. This feature enables you to track down some simple rootkits. For this, Process Hacker attempts to open PIDs sequentially from 8 to 65536. This will show not only hidden processes but also terminated processes that are still referenced by other processes.

But Process Hacker’s real strength comes to light when you have to manipulate, that is “hack” processes. The process’ context menu lists all the available functions. If you compare it to Process Explorer’s context menu (right hand), you have to admit that Process Hacker (left hand) has quite a few additional features to offer here (see screenshot). Most noteworthy are Reduce Working Set (empties the selected process working set), virtualization (virtualizes registry and system folder), Create Dump File (dumps the process’s memory contents), Inject DLLs, and Terminator.

The last feature deserves a more detailed explanation. You can terminate processes with Process Hacker the soft way (as in Process Explorer and Task Manager) by letting Windows send a terminate signal to the process. However, sometimes this doesn’t work, especially when the process hangs. The Terminator feature does something different, though. It uses a couple of uncommon techniques to get rid of a rebellious process. For example, it can terminate all the process’s threads, close the process’s handles, and terminate the process in kernel mode (see screenshot for a complete list).

The authors claim that the Terminator feature gives you full control over processes that are protected by rootkits and security software. They named a few applications that can’t be killed with Task Manager but can with Process Hacker. One of them is AVG, the antivirus software. I tried the Terminator with AVG, but Process Hacker failed to terminate the process under Vista. Perhaps AVG has modified their antivirus software in the meantime. By the way, to use the Terminator feature, you have to enable the kernel mode driver in the advanced options. And, of course, you must run Process Hacker as an administrator (elevated).

I haven’t covered all of Process Hacker’s features. If you try the tool, I recommend having a look at the (sparse) manual. The only real downside of Process Hacker is that it is relatively unstable. It crashed several times on my Vista box. It is interesting to note that I wasn’t able to kill the hanging Process Hacker process from a second instance of the tool. However, I am sure there are cases where Process Hacker succeeds in killing protected or hanging processes where Process Explorer fails. This is the main reason why I will keep Process Hacker in my toolbox. I would just be very careful if you run a it a server environment.

Process Hacker

• Service Account best practices – Part 2: Least Privilege implementation (0)
• Service Account best practices Part 1: Choosing a Service Account (0)
• Raffle: VisualCron – An advanced task scheduler for Windows (0)
• AutoAdministrator 2.3 – Part 3: Remote execute: Programs, services, shutdown/reboot (0)
• Prevent restarts triggered by third-party applications (1)

Process Lasso is the perfect name for a tool that brings a mad program to its senses. The program’s ProBalance feature constantly monitors all processes, and if an application’s claim for CPU resources exceeds a configurable threshold, Process Lasso will reduce the priority of that program’s process. As soon as the process’ CPU usage falls below a second threshold, Process Lasso will restore the original process priority.

To understand how Process Lasso works, you can use Cpukiller, the tool I blogged about yesterday, as a demonstration. Cpukiller runs at high priority and as a foreground process. Thus, you have to allow Process Lasso to manage foreground process, and processes with non-normal priority, and (see screenshot). If you then let Cpukiller consume 100% of your CPU’s resources, Process Lasso will automatically set Cpukiller’s CPU priority to “Below Normal.”

Even though Cpukiller is still running, your PC’s responsiveness will be normal. If you then reduce Cpukiller’s slow-down factor to below Process Lasso’s threshold, Cpukiller’s process priority will be automatically reset to “High.” You might also like to try running Cpukiller at a slow-down factor of 100%, without letting Process Lasso interfere. The responsiveness of your PC will then be close to 0.

Process Lasso has a couple of other features that can be helpful in improving the responsiveness of a computer. You can configure default process priorities, default CPU affinities, boost foreground processes, configure disallowed processes, limit the number of instances of a program and more.

Process Lasso is only free for private and academic use. The prices for the professional version start at $24.95 per seat.

• Troubleshoot slow logon – Part 2: The 3-headed monster (0)
• Troubleshoot slow logon – Part 1: Profile size (0)
• Service Account best practices – Part 2: Least Privilege implementation (0)
• Service Account best practices Part 1: Choosing a Service Account (0)
• How to disable the Shutdown Event Tracker in Windows Server 2008 R2 (1)

I never understood why Windows won’t allow me to remove a hanging print job. I understand that the operating system has to wait for the confirmation from the printer. But if the printer also hangs, the print job is stuck in the queue. In my opinion, this is a bug. It is an old Windows XP problem and it still hasn’t been resolved in Windows Vista. I haven’t experienced it yet in Windows 7 though.

One way to solve the problem is to reboot. In most cases the undeletable print job will disappear after the restart. But, I have also experienced cases when even a reboot wouldn’t remove the erroneous print job from the queue. However, there is a way that always works and is also faster.

First, you have to stop the Print Spooler Service, then you have to delete all files under C:\WINDOWS\System32\spool\PRINTERS. Once you’ve restarted the Spooler Service, you might have to press F5 in the print queue applet to make the hanging print job disappear. Of course, you will need admin’s rights for this procedure. If you require more detailed instructions, you should take a look at this post from the help desk geek.

• Service Account best practices – Part 2: Least Privilege implementation (0)
• Service Account best practices Part 1: Choosing a Service Account (0)
• Raffle: VisualCron – An advanced task scheduler for Windows (0)
• AutoAdministrator 2.3 – Part 3: Remote execute: Programs, services, shutdown/reboot (0)
• Prevent restarts triggered by third-party applications (1)

AnVir Task Manager Free provides full set of Windows enhancements that help in every-day work.

Security & Performance

• Full information about processes, services, Internet connections, drivers, DLLs
• Detects Trojans with security analysis and get alerts on new startups
• Speed up boot time (Delayed Startup), balance CPU usage, optimize memory
• Run programs as services on Windows startup before user login

Windows enhancements

• Tray icons shows status of disk, network, memory, CPU, battery
• (new) Click on title of any application to hide the window to tray, make it transparent, set it ‘always on top’
• (new) List of recently used folders in “Open”/”Save” dialogs
• Tray menu keeps last launched programs and folders

Capabilities

• Nice user interface
• Can replace Windows Task Manager
• Can run as portable application
• Compatible with all popular antivirus engines
• Check files with 30+ antivirus engines
• Search on Google with one click
• Save HajackThis log

AnVir Task Manager Free

• FREE: PhoneFactor – Mobile phone based two-factor authentication (1)
• How to disable USB drive use in an Active Directory domain (2)
• Service Account best practices – Part 2: Least Privilege implementation (0)
• Service Account best practices Part 1: Choosing a Service Account (0)
• Four fast ways to improve security in SQL Server 2008 R2 (12)

Process Monitor and Process Explorer

• Service Account best practices – Part 2: Least Privilege implementation (0)
• Service Account best practices Part 1: Choosing a Service Account (0)
• My favorite Sysinternals utilities (7)
• Raffle: VisualCron – An advanced task scheduler for Windows (0)
• AutoAdministrator 2.3 – Part 3: Remote execute: Programs, services, shutdown/reboot (0)