Loading ...

Month: February 2016

Windows Event Logs Intrusion Detection

Big thanks go out to the folks at SANS Institute for this write-up on Detecting Security Incidents Using Windows Workstation Event Logs that gave the guidance for this article on Windows Event Logs Intrusion Detection. These are the basics of creating Custom Views in Event Viewer on Microsoft Windows 2012, but the actual monitoring for these events should be done by more complex log parsing software that is beyond the scope of this article. Here are the basic steps towards finding these events:

Create Windows Event Logs Intrusion Detection Custom View

  1. Open Event Viewer
  2. Right click on Custom Views then choose “Create Custom View…”
  3. Make sure to select all event levels and all Windows Logs
    Windows Event Log - Create Custom View
  4. Add the following event id numbers into the space provided:

    1001,4624,4625,4657,4688,4697,4698,7034,7035,7036,7040,64004

  5. Click OK. Give the Custom View a name then Click OK again.
  6. Right click on the newly created Custom View and select “Attach Task To This Custom View…”
  7. Work through the wizard based interface and select the desired task. Email is a nice one but is depreciated and will require the setup of an SMTP Relay unless there is an onsite Exchange server or dedicated email setup for this purpose with your email provider.

These are just the basics the article from SANS goes into greater depth on how to configure event log monitoring software to parse these for you. Better yet contact us to setup remote monitoring and maintenance to do the heavy lifting for you.

Branded Email using Custom Domain Name

There are many reasons your business needs to use a branded email address using a customized domain name. Let’s look at what the top ones are:

Branded Email Establishes Legitimacy

Customers want to trust a companies before they choose to give their business to them. This is the number one reason businesses should use branded email – not only does it give your business a deeper level of branding, but it establishes the business' legitimacy. This is because your email is often the customer’s first impression of you, especially if email or print marketing had an email for contact. It makes your business look professional and can set it apart from the competition. Phishing schemes are a very real concern these days and many of these fake emails come from people trying to pose as a legitimate business. The best way for your customer to know if the email is really from you or a potentially dangerous location, is by the email address' domain name. If the customer can look at the sender address and see your business’ domain, they will feel more confident clicking links or replying back with sensitive information.

Branded Email Builds Your Brand

A business can never have too much company branding. From business cards to bumper stickers to coffee mugs, there are branding opportunities everywhere. This should includes your business email too. Every time your employees send an email, it reinforces your business brand to the customer. It not only reminds the customer that you have a website, but gives them a peek into what your company is all about.

Branded Email Separates Company Departments

Having a branded email allows you to create multiple email addresses or email aliases for different departments and company objectives. This is a huge benefit as yourname@mycompanyname.com may not always the best address to email or your business may not want the customer to directly contact your employees. It helps compartmentalize the work and make sure that the right person / department receives the correct emails. You can create emails like support@mycomanyname.com, info@mycompanyname.com, sales@mycompanyname.com and many others that can point to one or more members of the organization. It also helps the customer, by pointing them to the right email address for the issue they need addressed.

Branded Email Isn’t Expensive

With Office 365’s Hoste Exchange service your business can add as many individual email addresses and email aliases to your company's branded domain on an as needed basis, access email from anywhere across all major platforms, get industry leading anti-malware / anti-spam filtering built in, send email attachments up to 150MB in size and get 50GB of storage per mailbox. Prices start at just $4 per user per month. Microsoft manages the email server and Farmhouse Networking handles the setup / administration of the rest, which making it simple for you to have a professional branded customized business email address.

If you don’t have a branded email address, now is the perfect time to get one. Small businesses often think they don’t need one or can’t afford it, but that is simply not true. Help your business by setting up a branded email today by giving us a call or email to let our Office 365 experts get your business started on the path to better branding.

Server Battery Backup Best Practices

It is astounding to think that many servers in small businesses are plugged directly into the wall for power without any protection from outages or dirty electric current. It is easy to mitigate up to 44% of data loss incidents that are due to hardware failure by providing clean and consistent power to servers on the network. Installing a server battery backup is quite easy to do and the possible return on investment will never be seen due to the possible issues being taken care of. Here is a basic list of best practices for purchasing and setting up the monitoring software that comes with the unit:

Server Battery Backup Purchasing:

  • Budget to purchase new battery backup devices every 5-6 years
  • Replace internal battery on unit at the 3 year mark
  • Based on maximum load (think power supply total watts) select an Uninterupted Power Supply (UPS) that will not be loaded over 80% which protects the unit from undue wear and allows for some growth
  • Consider redundant UPS configuration for larger servers with multiple power supplies
  • In high production environments, consider adding an UPS for each workstation to allow for file saves before file server shutdown occurs.

Server Battery Backup Setup:

  • Make sure buildings elecrical breakers are rated to handle the 80-100% load of the UPS
  • If single UPS used in multiple power supply server scenario then put one plug into the wall and the other into the UPS, but please consider redundant power supplies.
  • Plug in serial, usb or network management and install the management software that comes with it
  • Configure the management software to gracefully shutdown the Operating System (OS) of all connected servers
  • If using sequential shutdown of servers then shutdown database servers first, file servers second and domain controllers last.
  • Configure either SNMP alerting or email alerting to get status updates from the device
  • Configure regular self-test of the battery to make sure there is no failure of the internal battery before the replacement period

Taking the time to do this right the first time will save headaches later when things go wrong. Call or email us to do an evaluation of your power infrastructure.

Office 365 Meeting Rooms

Shared calendars for the use of shared meeting space reservation is becoming a thing of the past. Office 365 has a better type of calendar specifically made for rooms. This guide will show you how to set up these Office 365 Meeting Rooms in Microsoft’s Office 365 admin portal. Login to the Office 365 Portal with an administrator account and do the following:

Setup Office 365 Meeting Rooms

  1. Click on the Meeting Rooms tab on the left of the Office 365 admin center.
  2. Click on the + symbol to begin the creation of the meeting room object.
  3. Fill in the needed information (Name, Email Address and Room Capacity) then click Create.
  4. Now users can access these meeting rooms when creating a new Meeting in Outlook by clicking on the Rooms button and selecting them.
  5. Once selected that room for that date at that time will be marked off on the associated calendar. There are also color coated indicators as to the availability of the meeting rooms on the selected date in the calendar.

The meeting room will also now appear in their Calendar tab of Outlook and can be used similarly to other calendars. If you have any issues setting things up for your site, please feel free to contact our Office 365 experts to guide you through the process.

UmbreCrypt RansomWare Hits Terminal Server

This one scares me to read about. A new variant of ransomware called UmbreCrypt RansomWare is out there that is getting into business networks via hacking of terminal servers. This is even more reason to use the best practice of connecting to a Virtual Private Network (VPN) before connecting to your company terminal server. Please take the time to read this article from BleepingComputer.com to find out the frightening details. Feel free to call or email us to discuss how to proactively protect your business computer network with managed antivirus and offsite backups. Schedule a full network security audit to determine just how vulnerable your systems are and to determine what can be done to mitigate the risks.

Farmhouse Networking goes HTTPS

We undertook the task of complying with Google HTTPS-Everywhere on the web standards that are incentivising the move to HTTPS by increasing search rankings for those that comply. The first step in this process was acquiring an SSL certificate for our websites domain name from a provider. We went the cheap route and went with StartSSL using their Level 1 certificate that is good for one year and FREE. The process was not for the faint of heart as it included encryption keys, decryption of public keys, downloading of several certificates and importing them properly into our webhost. As you can see it is just a basic certificate with no verification information, so no green bar in the browser as some other sites have:

Farmhouse Networking HTTPS Certificate

If you need to acquire a SSL certificate (especially those with wildcards or extended validation) or looking for help getting your SSL certificate configured on your website, just drop an email and I would be happy to help.

The next step in the process was to change the .htaccess file in the public_html folder on the webserver (this is for Linux hosts and is different for Windows IIS users as they will be editing web.config file). Once this is done the server will start automatically sending people to the same pages you already have on the server but will use https:// instead of http:// to display them. This is universal if you put it in the public_html folder, so be careful. I had some non-relative, absolute links on my pages that were causing issues with displaying them – had to go through each link to my own pages and update them to either be relative or the correct absolute values (this does not apply to any external links). As you can see things are running great now in SSL mode on our site.

File Server Audit Logging via Group Policy

Recently going through the HIPAA compliance standards and dealing with “accidentally” deleted items on a file share has lead to a need for a standard file server audit logging policy that can be deployed to all servers via Group Policy Object (GPO). Here is the summation of my research:

File Server Audit Logging Policy GPO

1. Create a GPO and name it File Server Audit Policy
2. Set the following settings to enable advanced features and disable shutdown:

[Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\]
Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings – Enabled
Audit: Shut down system immediately if unable to log security audits – Disabled

3. Move down the tree structure to the following and edit these various auditing settings:

[Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\]
Account Logon: Credential Validation – Success and Failure
Account Management: Computer Account Management – Success
Account Management: Other Account Management Events – Success and Failure
Account Management: Security Group Management – Success and Failure
Account Management: User Account Management – Success and Failure
Detailed Tracking: Process Creation – Success
Logon-Logoff: Logoff – Success
Logon-Logoff: Logon – Success and Failure
Logon-Logoff: Special Logon – Success
Object Access: File System – Success
Policy Change: Audit Policy Change – Success and Failure
Policy Change: Authentication Policy Change – Success
Privilege Use: Sensitive Privilege Use – Success and Failure
System: IPsec Driver – Success and Failure
System: Security State Change – Success and Failure
System: Security System Extension – Success and Failure
System: System Integrity – Success and Failure

4. Change the following Maximum Log Size (KB) settings according to http://support.microsoft.com/kb/957662:

[Computer Configuration\Administrative Templates\Windows Components\Event Log Service\Security\]

5. Open the Properties of the shared folder needing Auditing, click on Security tab and then on the Advanced button
Folder Security Properties Page
6. Click on the Auditing tab, if there is UAC prompt then click Continue and then click on the Add button

Folder Advanced Security Settings
7. Click on Select Principal, search for the Everyone security group and then click on the OK button
8. Change the Type to All, click on Show advanced permissions, check the boxes next to “Delete subfolders and files” and “Delete” and then click on the OK button
File Server Audit Logging Entry
9. Put a check next to “Replace all child object auditing with inheritable auditing from this object then click on the OK button
If your company is using a Windows Server for network file access and need help getting the File Server Audit Logging setup property for HIPAA compliance, then contact us for assistance.

Terminal Server Lockdown Group Policy

Recently have had to setup a couple terminal servers and wanted to create a list of standard lock downs that can be added via a Terminal Server lockdown Group Policy Object (GPO).

Terminal Server Lockdown Preparation

1. Open Active Directory Users & Computers
2. Create Organizational Unit (OU) for Terminal Server.
3. Move all terminal servers to this OU.
4. Create Security Group in this OU for users who will use Remote Desktop Host (i.e. Terminal Server Users).
5. Add all users who will use the terminal server as members of this security group. 6. Open Group Policy Management, right click the new Terminal Server OU and “Create a GPO in this domain, and Link it here” (i.e. Terminal Server Lock Down).
7. In Security Filtering delete Authenticated Users, add Terminal Server Users security group created in previous step.

Configure users who can connect to the server remotely:

1. Log into the terminal Server
2. Open Control Panel, open System, click on Remote Settings then click on the Remote tab.
3. Click on Select Users, Remove any groups/users and then Add the Terminal Server Users security group.

Disable Server Manager Pop Up at user log on:

1. On Terminal Server open Task Scheduler.
2. Navigate to Task Scheduler Library\Microsoft\Windows\Server Manager.
3. Disable task “ServerManager” which triggers at log on of any user.

Configure Group Policy for Terminal Server Lock Down:

Loopback Processing:

[Computer Configuration\Policies\Administrative Templates\System\Group Policy]

Configure user Group Policy loopback processing mode: Enable – Merge

Disable Control Panel Items:

[User Configuration\Policies\Administrative Templates\Control Panel]

Hide specified Control Panel items: Enable

Add following items to the disallowed Control Panel items:
Microsoft.AdministrativeTools
Microsoft.AutoPlay
Microsoft.ActionCenter
Microsoft.ColorManagement
Microsoft.DefaultPrograms
Microsoft.DeviceManager
Microsoft.EaseOfAccessCenter
Microsoft.FolderOptions
Microsoft.iSCSIInitiator
Microsoft.NetworkAndSharingCenter
Microsoft.NotificationAreaIcons
Microsoft.PhoneAndModem
Microsoft.PowerOptions
Microsoft.ProgramsAndFeatures
Microsoft.System
Microsoft.TextToSpeech
Microsoft.UserAccounts
Microsoft.WindowsFirewall
Microsoft.WindowsUpdate
Microsoft.DateAndTime
Microsoft.RegionAndLanguage
Microsoft.RemoteAppAndDesktopConnections
Install Application On Remote Desktop Server
Java
Flash Player

Remove Administrative Tools and Powershell:

Restrict access to Administrative tools:

1. Navigate to:

[Computer Configuration\Policies\Windows Settings\Security Settings]

2. Right click on File System, choose Add File… .
3. In the Add a file or folder window, type the following in the Folder field and click OK:

%AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Administrative Tools

Terminal Server Lockdown - Folder Security Settings
4. On the next window, Database Security, remove Users and check that Administrators have Full Access.
Database Security for Server Manager.lnk
5. On the Add Object window choose Configure this file or folder then Propagate inheritable permissions to all subfolders and files then click OK.
Terminal Server Lockdown - Add Object
6. Repeat the above steps for the PowerShell shortcut (in addition delete Creator Owner in database security):

%AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\System Tools\Windows PowerShell.lnk

7. Repeat the above steps for the Server Manager shortcut:

%AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Server Manager.lnk

File Explorer Configuration:

[User Configuration\Policies\Administrative Templates\Windows Components\File Explorer]

Enable – Restrict A, B, C and D drives only: Hide these specified drives in My Computer

Enable – Remove Hardware tab

Enable – Hides the Manage item on the File Explorer context menu

Enable – Remove Security tab

Disable Registry Modification:

[User Configuration\Policies\Administrative Templates\System]

Enable – Prevent access to registry editing tools

Configure Windows Installer and Windows Updates:

[Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Installer]

Enable: Prevent users from using Windows Installer to install updates and upgrades

Enable Always: Turn off Windows Installer

[Computer Configuration\Administrative Templates\Windows Components\Windows Update]

Enable: Do not display ‘Install Updates and Shut Down’ option

[Computer Configuration\Administrative Templates\Windows Components\Windows Update]

Enable: Do not display ‘Install Updates and Shut Down’ option

Disable: Allow non-administrators to receive update notifications

Additional Policies:

[Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits]

Enable (i.e. 30 minutes): Set time limit for disconnected sessions

[Computer Configuration/Policies/Administrative Templates/Windows Components/Remote Desktop Services/Remote Desktop Connection/Remote Desktop Session Host/Session Time Limits]

Set time limit for logoff of RemoteApp sessions: Enable (i.e. logoff delay 1 hour)

[Computer Configuration/Policies/Administrative Templates/Windows Components/Remote Desktop Services/Remote Desktop Connection/Remote Desktop Session Host/Session Time Limits]

Set time limit for active but idle Remote Desktop Services sessions: Enable ( i.e. 1 hour)

[User Configuration/Policies/Administrative Templates/Start Menu and Taskbar]

Go to the desktop instead of Start when signing in or when all the apps on a screen are closed: Enable

[User Configuration/Policies/Administrative Templates/Start Menu and Taskbar]

Remove the Action Center icon: Enable

[User Configuration/Policies/Administrative Templates/Windows Components/Windows Update]

Remove access to use all Windows Update features: Enable (0 = Do not show any notifications)

[User Configuration/Policies/Administrative Templates/Windows Components/File Explorer]

Remove CD Burning features: Enable

[User Configuration/Policies/Administrative Templates/Windows Components/File Explorer]

Prevent access to drives from My Computer: Enable (choose the drives)

[User Configuration/Policies/Administrative Templates/Windows Components/Credentials User Interface]

Do not display the password reveal button: Enable

[User Configuration/Policies/Administrative Templates/Windows Components/AutoPlay Policies]

Turn off Autoplay: Enable (CD-ROM and removable media drives)

[User Configuration/Policies/Administrative Templates/Windows Components/Remote Desktop Services/Remote Desktop Connection]

Do not allow passwords to be saved: Enable

For detailed explanations of what each of these items does please see the notes in each individual Group Policy setting.

Archives

Categories

Plant a Seed @ 541-761-9549
233 Rogue River Hwy #873 Grants Pass, OR 97527
Mon-Fri: 9:00am-5:00pm
support@farmhousenetworking.com
© 2016-2023- Farmhouse Networking. All rights reserved
Terms and Conditions Privacy Policy

Evaluation Signup

[contact-form-7 id="452" title="Free Network Evaluation"]