19
Ecora Auditor Professional Microsoft ® Windows Release 4.1 SP1 Evaluation Guide
Ecora Auditor ProfessionalMicrosoft® WindowsRelease 4.1 SP1
Evaluation Guide
Evaluation Guide for Microsoft® Windows Table of Contents
Table of ContentsIntroduction .................................................................................................................2Before You Begin ..........................................................................................................3
Select and Confirm Your Test Systems ........................................................................3Collecting Data .............................................................................................................5
Set Up the Collection ................................................................................................5Select Systems and Run the Collection........................................................................5
Scheduling Collection.....................................................................................................7Auditor Professional Reports ...........................................................................................8Generate a Documentation Report...................................................................................9
Set Report Output Options ........................................................................................9Generate the Report .................................................................................................9Browse the Report.................................................................................................. 10
Check Your Compliance with a Policy ............................................................................. 12Generate a Baseline Report .......................................................................................... 13Generate a Fact-Finding Report..................................................................................... 15Create a Consolidated Change Log Report ...................................................................... 17
Change the Guest Account Status............................................................................. 17Collect a New Data Set ........................................................................................... 17Create a CCL Report Definition................................................................................. 17Generate the Report ............................................................................................... 18
Congratulations! ......................................................................................................... 19
IntroductionThis Evaluation Guide provides an overview of the features of Ecora’s Auditor Professional and a cursory walk-through of the software functionality, aiming to consume not much more than an hour of your time. It attempts only to show the highlights of how the software might help you with compliance audits, security analysis, disaster recovery, and other projects; it is not meant to detail all of the software's capabilities. The online help system provides a more thorough explanation of Auditor Professional’s features and functions.
Ecora Auditor Solutions
Ecora offers solutions for:
• Active Directory • Microsoft Internet Information Services• Check Point servers • Microsoft SQL servers• Cisco routers and L3 switches • Microsoft Windows servers• Cisco PIX firewalls • Microsoft Windows workstations• Citrix • Novell NetWare servers & NDS• Lotus Domino servers • Oracle databases• IBM DB2 servers • Unix systems (HP-UX, AIX, Linux, Solaris)• Microsoft Exchange servers • VMWare servers
Auditor Professional Release 4.1 SP1 © 2007 Ecora Software Corporation – 2
Evaluation Guide for Microsoft® Windows Before You Begin
Before You Begin
In order to perform the exercises in this Evaluation Guide, your environment must meet the following conditions:
• Auditor Professional Release 4.1 SP1 has been successfully downloaded, installed, and configured for your environment.
• Auditor Professional Executive Dashboard Release 1.4 has been successfully downloaded and installed, and compliance policies have been configured for your environment.
• You are working in a domain environment, not a workgroup environment.
• You have administrative access to all target systems (that is, access to all the systems from which you will be collecting data).
You must also select and confirm the availability of the systems in your environment that you will be using for these exercises. We recommend that you select three workstations and three servers. The section below provides instructions for selecting and confirming the availability of these systems.
Select and Confirm Your Test Systems
1. Click the Systems icon on the Auditor console.
2. Click the Discover... button on the Systems Management form.
3. On the Discover Options form, select either the Active Directory or the NetBIOS radio button and click Next >. Discovery may take a few moments as the software locates all the domains in your environment.
4. The resultant Domain Selection list (below, left) identifies all the domains that Auditor found in your environment.
5. Double-click on one or more domain names to select the domain(s) containing the systems you will be using for these exercises.
6. Click Next > to have Auditor locate all devices in your selected domain(s).
7. The resultant Computer Selection list (above, right) lists all the servers, workstations, and domain controllers found in your selected domains. Double-click to select the systems for these exercises.
8. Click Finish to return to the Systems Management form.
Auditor Professional Release 4.1 SP1 © 2007 Ecora Software Corporation – 3
Evaluation Guide for Microsoft® Windows Before You Begin
9. In the Systems Management form, select all of the systems you will be using for these exercises, as illustrated below.
10. Click the Test... button to call up the Test Systems form, then click Start.
11. The resultant output indicates whether or not connectivity can be established with each of the systems you selected.
12. If any of the systems show connectivity failure, you must correct the problem before continuing with these exercises.
13. Click Close to return to the Systems Management form, then click Close again to return to the Auditor console.
Auditor Professional Release 4.1 SP1 © 2007 Ecora Software Corporation – 4
Evaluation Guide for Microsoft® Windows Collecting Data
Collecting DataThis exercise will locate systems in your environment and collect and save configuration information about the systems you select. Since reports can always be run against existing data, you may want to get in the habit of performing collections such as these on a regular schedule, as described in the “Scheduling Collection” exercise that follows.
When you arrange to collect data (either right now or according to a schedule), you select the systems from which to collect data. This is your selection set; the collected data will be your data set.
Set Up the Collection
1. Click the Collect icon on the Auditor console.
2. On the form that follows, make sure the Data Collection Only radio button is selected. Since you are not generating a report, the report list is disabled.
3. Click Next > to display the Data Collection Options form, shown at right.
4. Click in the first seven (7) check boxes, then click Next > to display the Discover Options form.
Tip: Because these collection options can return large amounts of data, this is an ideal collection to schedule for off-hours or weekends. You can always run reports on existing data, so scheduling data collection provides the flexibility to generate reports on this data at a later time.
Select Systems and Run the Collection
1. On the Discover Options form, select either the Active Directory or the NetBIOS radio button and click Next >.
2. The resultant Domain Selection list identifies all the domains that Auditor found in your environment. Double-click on one or more domain names to select the domain(s) containing systems from which you wish to collect.
3. Click Next > to cause Auditor to locate all devices in your selected domain(s).
Auditor Professional Release 4.1 SP1 © 2007 Ecora Software Corporation – 5
Evaluation Guide for Microsoft® Windows Collecting Data
4. The resultant Computer Selection list identifies all the servers, workstations, and domain controllers found in your selected domains. Double-click to select the systems you wish to collect data from. As mentioned previously, we recommend selecting three workstations and three servers for these exercises.
5. Click Finish.
6. You may receive a notice telling you approximately how long the collection will take. If so, click Yes to continue.
7. Click Yes when asked if you want to save these selections into a selection set for scheduling (above, right). You will use this selection set for the “Scheduling Collection” exercise.
8. When prompted (below, right), assign a name to your selection set (these exercises use the name Evaluation), then click OK to save the selection set and start the collection.
9. Data collection immediately begins for the systems in your selection set. This process may take some time, depending on the systems you have selected.
10. You are notified when the data collection is complete, as illustrated below.
11. Click Finish to return to the Auditor console.
Auditor Professional Release 4.1 SP1 © 2007 Ecora Software Corporation – 6
Evaluation Guide for Microsoft® Windows Scheduling Collection
Scheduling CollectionThere are two basic tasks involved in scheduling: selecting the systems to collect from, and establishing the time, date, and frequency of the collection. Your selection set (created in the preceding exercise) contains the list of systems to collect from. Scheduling assigns a time, date, and frequency with which to regularly perform the collection.
1. Select the Scheduled Tasks tab on the Auditor console.
2. Click New task... (you’ll find it at the top left of the right-hand pane of the console) to display the New Task form.
3. Click the Data Collection radio button, then click OK.
4. When prompted to provide a task name, as shown above right, provide a name and click OK. In this exercise, the name Nightly is assigned to the schedule being created.
5. In the Collect Data dialog (right), accept the default Save Data To timestamp file name and choose Evaluation from the Selection Set list box and click OK. (Recall that Evaluation is the selection set you created during the “Collecting Data” exercise.)
6. In the Task Scheduler form that is displayed next, select the Task tab and click the Set password... button.
7. Enter a valid password twice and click OK.
8. On the same Task Scheduler form, select the Schedule tab and click New to create your scheduled collection.
9. Schedule the task to run Daily with a start time of 2:00 AM.
10. Click Apply. The form is updated to reflect the schedule you just created, as illustrated at right.
11. Click OK to save this schedule and return to the Auditor console.
Auditor Professional Release 4.1 SP1 © 2007 Ecora Software Corporation – 7
Evaluation Guide for Microsoft® Windows Auditor Professional Reports
Auditor Professional ReportsOnce you begin collecting data, that data is available for reporting, querying, and archiving. Auditor Professional offers more reporting options than ever, allowing you to answer virtually any question you might have about your infrastructure. Auditor’s range of reports provides an assortment of ways to extract valuable data in the best format for your needs.
Documentation Reports
These full-text reports preserve the strengths of past Auditor versions for compliance audits, detail disaster recovery plans, security assessments, migration plans, troubleshooting, and preserving IT knowledge and decisions.
Fact-Finding Reports
These reports more closely resemble database queries for several reasons: they pull data from the cross-platform configuration database, and they allow use of operators so you can search for values greater than, less than, or unlike a threshold value you set. These reports are very surgical in their precision – you can pull precisely the data you need – but they also offer a wealth of data through hundreds of built-in reports created by experts. In addition, you can export the results to comma-separated value (CSV) files that can be imported into other applications.
Baseline Reports
Everyone understands the value of keeping consistency in configurations...keeping machines to current patch levels for security, maintaining QA or policy standards, compatibility and maintenance of core technology, passing compliance audits, performance, and much more. Baseline Reports are the best way to quickly locate differences among systems in your environment. Choose any machine as your baseline configuration (sometimes called your “gold standard”), and then a single report shows how any other systems you select deviate from that machine's configuration setup.
Change Reports
Change Reports offer the ability to quickly see “before” and “after” snapshots of systems in your environment. These reports are extremely useful for pinpointing a setting change that could indicate a security breach or is the cause of a problem you are troubleshooting. These concise reports find planned, unplanned, and even unauthorized changes.
Consolidated Change Logs (CCL) Reports
These reports add a valuable dimension to change tracking. In addition to “before” and “after” data, CCL reports can show every change that occurred in a given time period – across multiple platforms. These reports answer the call for change histories for auditors and intensive security monitoring systems.
Auditor Professional Release 4.1 SP1 © 2007 Ecora Software Corporation – 8
Evaluation Guide for Microsoft® Windows Generate a Documentation Report
Generate a Documentation Report
Set Report Output Options
In order to see the full range of documentation reports available, you must change the default Output Formats settings.
1. From the File drop-down menu on the Auditor console, select Settings...
2. Click the Output Formats tab.
3. Beneath the Enabled Report Outputs heading, make sure the first four boxes are checked, as shown at right.
4. Click OK.
Generate the Report
1. Click the Document icon on the Auditor console.
2. If you get the Quick Report dialog box, select Standard Report.
3. In the Determine Report Type form (shown below), verify that the Documentation Report radio button is selected, and select the Security - Shares report.
4. Click Next >.
5. Choose to Use Existing Data and click Next >.
Auditor Professional Release 4.1 SP1 © 2007 Ecora Software Corporation – 9
Evaluation Guide for Microsoft® Windows Generate a Documentation Report
6. Select the data set that you collected during the “Collecting Data” exercise.
7. Click Next > to generate the documentation report from this data set.
8. When notified that the report has been generated, make sure the View report now box is checked and click Finish.
Browse the Report
Your browser opens to display the report in HTML format. Within a few moments, a directory tree is displayed in the left pane and the report content is displayed in the right. The directory tree is both an overview and a navigational device, allowing you to locate and open specific sections of the report.
1. Click on the Domain node plus sign to expand the tree.
2. Expand the Computers node to display the available systems.
3. Expand one of the system nodes.
4. Click on the File and Print report to display the report contents in the right pane.
5. Use the scroll bar on the right edge of the report to review its contents. Are any of the shares a security concern?
Auditor Professional Release 4.1 SP1 © 2007 Ecora Software Corporation – 10
Evaluation Guide for Microsoft® Windows Generate a Documentation Report
6. Browse through the remaining sections of the report to get a feel for the scope of the information.
7. Click on the link labeled Click here for the long version (at the top of the report) to display the detailed long form of the report. Look for the tips, notes, alerts, and references provided by Microsoft® Windows experts. These icons call your attention to important information, such as security risks or relevant articles and resources.
8. Click on the Click here for the short version to display the abbreviated form of the report. You can easily toggle between the two versions.
9. Close your browser when you have finished reviewing the report.
Auditor Professional Release 4.1 SP1 © 2007 Ecora Software Corporation – 11
Evaluation Guide for Microsoft® Windows Check Your Compliance with a Policy
Check Your Compliance with a PolicyAuditor Professional includes the ability to define policies for security, federally regulated standards, and corporate standards. The Auditor Professional Executive Dashboard graphically displays compliance information for a quick, concise visual of your compliance status. Ecora provides a number of policies with the Auditor software that you can use to check your environment for compliance; you can also customize these policies to suit your needs.
1. Start Auditor Professional Executive Dashboard from the icon on your system desktop.
2. The Dashboard displays a compliance overview in your browser, as illustrated below.
3. In the Policy table (directly beneath the pie chart), click on the Sarbanes-Oxley policy.
4. The display is re-drawn to show your compliance to Sarbanes-Oxley. Review the pie chart in the upper right to see the percentage of your systems that are compliant (green), non-compliant (red), marginal (yellow), or pending (blue).
5. Click on a system in the System Details by Policy table to see how the settings for this particular system compare to the rules that define the Sarbanes-Oxley policy.
6. Click on the All Systems group in the navigation tree to return to the compliance overview.
7. Select a different policy, such as the HIPAA policy, from the Policy table.
8. Review the pie chart and system details for your compliance to this policy.
9. Close your browser when you are finished reviewing your compliance status in the Dashboard.
The Dashboard tables provide the ability to change the view to see compliance of a group, a single system, or to drill all the way down to a single rule applied to a single system.
If you’re interested in creating custom policies, there is a tutorial on Ecora’s website about creating a policy. Click here to view the tutorial.
Auditor Professional Release 4.1 SP1 © 2007 Ecora Software Corporation – 12
Evaluation Guide for Microsoft® Windows Generate a Baseline Report
Generate a Baseline ReportBaseline reports identify deviations from a selected standard. The ability to identify deviations can be invaluable in locating non-standard configurations, insecure settings, or compromising access rights.
1. Click the Baseline icon on the Auditor console.
2. In the Determine Report Type form, make sure the Baseline Comparison Report radio button is selected, then select Full Report from the list of reports.
3. Click Next > to get to the Baseline Comparison form (top, right).
4. Click the Use an existing data set radio button (located at the top of the Baseline Object area on the highlighted left side of the form).
5. Within the Baseline Object area, choose a baseline system and data set. For this exercise, use the data set you created during the “Collecting Data” exercise to serve as your baseline, or gold standard, system.
6. Click Next > to highlight the Comparison Objects area on the right side of the form (bottom, right).
7. Click the Collect a new data set radio button.
8. Select system(s) to compare to the baseline data set.
9. Click Next >.
Auditor Professional Release 4.1 SP1 © 2007 Ecora Software Corporation – 13
Evaluation Guide for Microsoft® Windows Generate a Baseline Report
10. In the Selection Editor (right), click OK to accept the default settings and begin collecting the new data set.
11. After the new data has been collected and the report generated, click Finish to view the Baseline Report.
12. Within a few moments, your browser opens to display the report in HTML format, as illustrated below.
13. Browse the split-screen baseline report, using the directory tree to compare each system to your standard. The top section of the right frame contains the gold standard baseline system; the bottom contains the selected target system’s differences when compared with the baseline.
14. In particular, check the password policy differences. Are all your systems secured?
15. Browse the other sections of the report to see where the systems differ.
16. Close your browser when you have finished reviewing the report.
Auditor Professional Release 4.1 SP1 © 2007 Ecora Software Corporation – 14
Evaluation Guide for Microsoft® Windows Generate a Fact-Finding Report
Generate a Fact-Finding ReportMicrosoft® Windows experts defined a variety of reports that solve common problems or target IT projects; these are included with the Auditor software. These report definitions act like templates, creating the structure of the report which is then filled in with actual content from your environment. These report definitions can be used or customized to your specifications.
1. Click the Fact-Finding icon on the Auditor console. The Select a Fact-Finding Report Definition form is displayed (shown at right).
2. Click on the Database node to expand the tree. The tree lists categories of available report definitions. Each category includes a variety of existing report definitions.
3. Take a moment to explore the categories of reports in the tree hierarchy, as well as the report definitions available within each category (listed on the right side of the form).
4. In the tree, locate and select the Users and Groups category.
5. Select Local User Info by Computer from the list of Users and Groups report definitions.
6. Click Next > to call up the Report Definition form (below).
Auditor Professional Release 4.1 SP1 © 2007 Ecora Software Corporation – 15
Evaluation Guide for Microsoft® Windows Generate a Fact-Finding Report
7. If you would like to see what this report definition includes, click Edit Table to view the Database Definition Table, shown at right. For the purposes of this exercise, do not make any changes to the report definition.
8. Click Close once you’ve reviewed the report structure.
9. In the Report Definition form, select the Most Recent check box that appears at the bottom right corner of the form.
10. Click Generate >.
11. When prompted for a report name, accept the default timestamp name and click OK to generate the report.
12. When report generation finishes, click View Report... to display the report in your browser.
13. Scroll down to see the user settings information. In particular, note whether the Guest account is enabled or disabled; you need to keep this in mind for the “Create a Consolidated Change Log Report” exercise which follows.
14. Close your browser when you have finished reviewing the report, and Close the Select a Fact-Finding Report Definition form.
Tip: Remember that a Fact-Finding Report – as is true of all other reports – can be generated according to a regular, convenient schedule.
Auditor Professional Release 4.1 SP1 © 2007 Ecora Software Corporation – 16
Evaluation Guide for Microsoft® Windows Create a Consolidated Change Log Report
Create a Consolidated Change Log ReportAn important function of Consolidated Change Logs (CCLs) is to create audit trails of all changes in the environment as a means to detect unauthorized or unintended changes. For this exercise, we use a CCL report to detect a change made to the Guest account.
Change the Guest Account Status
1. From the Windows environment on one of the systems you’re using for these exercises, select Administrative Tools from the Control Panel, then select Computer Management.
2. In the navigation tree, expand the Local Users and Groups node, then expand the Users node.
3. Select the Guest account from the list, then right-click and open Properties.
4. Change the status of the account by clicking in the Account is Disabled check box.
5. Click OK to save your change.
Collect a New Data Set
To detect this change, you must perform data collection again to create a new data set that reflects the change you just made. Repeat the “Collecting Data” exercise to generate a new data set. Be sure that your collection includes the system on which you just changed the Guest account status.
Tip: During this collection, you can click No when asked if you want to save your selection set for scheduling.
Create a CCL Report Definition
You must create a CCL report definition that is tailored to detect the change you made to the Guest account.
1. From the Edit drop-down menu on the Auditor console, select Consolidated Change Log Definitions... to display the list of existing CCL report definitions.
2. Click New... to display the Report Definition Editor (shown at right). You use this editor to create your new CCL report definition.
3. In the navigation tree, locate and expand the Servers node and select Users + Groups.
4. Scroll through the list of Available Settings that are now displayed in the center pane of the form, and select User Disable. This is the setting you want your CCL report to detect.
Auditor Professional Release 4.1 SP1 © 2007 Ecora Software Corporation – 17
Evaluation Guide for Microsoft® Windows Create a Consolidated Change Log Report
5. Click the > button to add this setting to the Selected list (on the right side of the form).
6. Return to the navigation tree and repeat these steps to add the User Disable setting for Workstations to your list as well.
7. Your display should now look like the example on the preceding page.
8. Click Next > to display the Selection Refinement form.
9. Beneath the Report Criteria heading, leave the setting for Relative time range set to 1 Week.
10. Select Change from the Report type drop-down list.
11. Select the All Systems - All Platforms check box. Your display should now look like the example (above, right).
12. Click Finish.
13. In the dialog box that follows, provide a name and description for your CCL report definition. In this exercise, Change Test is the report definition name and Guest Enable is the description.
14. Click OK to exit the dialog box, then click Close to close the CCL Report Definition form.
Generate the Report
1. Click the Change Log icon on the Auditor console to display the list of available CCL reports. The list now includes the Change Test report definition you just created, as illustrated at right.
2. Select Change Test from the list and click Next >.
3. The Report Definition form that follows shows the report definition you just created, so simply click Next > to continue.
Auditor Professional Release 4.1 SP1 © 2007 Ecora Software Corporation – 18
Evaluation Guide for Microsoft® Windows Congratulations!
4. In the Selection Refinement form, make sure that the Relative time range is set to 1 Week and the Report Type is Change.
5. Select the All Systems - All Platforms check box and click Generate >.
6. Accept the default Save Report To timestamp name and click OK to begin generating the report.
7. A dialog box tells you when the report has been generated. Click View Report... to display the CCL report in your browser.
8. Use the navigation tree to browse the report and verify that the change to the Guest account was detected, as illustrated by the report segment below.
9. Close your browser when you have finished reviewing the report.
10. Click Close to exit from the Select CCL Report Definition form and return to the Auditor console.
Congratulations!You have completed the Auditor Professional evaluation. There are many more reports, alerts, creative queries, and practical applications for the software, but we hope that this Evaluation Guide helped you quickly learn some of the highlights.
Auditor Professional Release 4.1 SP1 © 2007 Ecora Software Corporation – 19
