Monitoring Software for Domain Workstations

[pgudge]

Hello,

I am looking for some monitoring software that can be installed (Stealth) on all workstations in the office and on the network (All are Windows XP Pro, joined to the company domain) that can monitor and record ALL internet activity, and that can be viewed from the server or sole workstation with admin console etc. What websites have been visited and at what times, and from which user/workstation. Some users roam in the office, but all logon using their own credentials.

I have searched google, but this type of search returns thousands of hits, but most look like spam, or $2 resellers. I was hoping someone here had used or knew of some software that would fit my needs perfectly.

There is NO initail plan to "Block" or "restrict" access to any internet sites, so a net nanny application is not really needed, but if such an application is worth the money, offering excellent monitoring with the added benifit of blocking, that would be good.

Thanks for your time and help.

PaulG.

[Splash]

Would you not be better just using some kind of http proxy with logging capabilities?

[mycarsavw]

If you use Vista, it's all there under Parental Controls, no way (I think) to monitor from a central location though.

[peterb]

Its there in Internet explorer. All sites visited are recorded in the index.dat files. If you can access the machines remotely, you can access the files although (I think) you need a tool to read them

[Vroomparrot]

I agree with Splash - in a domain environment it's surely the most sensible option. You'd need something like MS ISA server with a web filterng plugin like websense or surfcontrol. Or you could do it all for free using something like Squid and Dansguardian on a Linux box - I installed a webproxy server at a school I used to work at using these. It was obviously used to stop the kiddies accessing stuff they shouldn't but you could just use it for logging.

[pgudge]

Thanks for the info.

mycarsavw - Vista is no good, they are all Windows XP Pro workstations.

peterb - IE. Most of the users use Firefox now, but that doesn’t stop them using IE. So I would rather capture everything, irrelevant of what application they use. But knowing that about the index.dat file is very useful, thanks.

Vroomparrot, Splash - ISA server is way over the top for the client. They are considering Windows 2003 SBS Standard as we speak, and the extra £400 for Premium to include ISA is a bit much for what they need. Using a HTTP Proxy is another option I suppose. This would help track URLs for sure.

I have come across a tool called eBlaster or Spector Pro, by a company called SpectorSoft, which looks on the button, but there is no Trial Its sounds perfect in that it installs and is not trace able like icons and running apps, it emails reports at designated times, and is only $59.99 a license.

I am a huge IPCop fan and have sued Dansguardian before, but they are reluctant to move away from their ISP Provided ADSL modem (I know, you don’t need to say anything). I just need a software solution in the mean time.

Thanks again.

PaulG.

[Splash]

ISA server is way over the top for a logging http proxy. Given that all you need is logging (not even filtering?) is it not feasible to have the setup

LAN----SBS----Smoothwall (or similar)----Internet

Or does the ADSL modem require a Windows box? Can you not make use of one of the free Windows proxies if that is the case? Client-side solutions really aren't the best way to deal with this kind of situation

[aidanjt]

peterb - IE. Most of the users use Firefox now, but that doesn’t stop them using IE. So I would rather capture everything, irrelevant of what application they use. But knowing that about the index.dat file is very useful, thanks.

I am a huge IPCop fan and have sued Dansguardian before, but they are reluctant to move away from their ISP Provided ADSL modem (I know, you don’t need to say anything). I just need a software solution in the mean time.

Just slap the proxy server inbetween the 'modem' (I assume you mean router/TA?) and the network, setup netfilter to transparently direct packets heading out to port 80 to the squid proxy server and log, squid will fire off the packets to the web, that way you a) don't have to configure all the workstations on the domain, and b) don't have to worry about people downloading new/different browsers or what not.

[Lucio]

Out of interest how do you configure ISA Server to do logging? We have it on our main server and I'd be interested to find out if people are misusing the internet.

[peterb]

peterb - IE. Most of the users use Firefox now, but that doesn’t stop them using IE. So I would rather capture everything, irrelevant of what application they use. But knowing that about the index.dat file is very useful, thanks.



PaulG.

I'm not surprised - it is a much better browser! However somecorporate environments only allow IE.

However, back on topic, a sqid proxy server on a linux box (doesn't have to be that high powered) would do the job cheaply and effectively. (You might have to learn a bit of Linux if you don't already have that experience - but then its good for the CV )

[aidanjt]

I'm not surprised - it is a much better browser! However somecorporate environments only allow IE.

However, back on topic, a sqid proxy server on a linux box (doesn't have to be that high powered) would do the job cheaply and effectively. (You might have to learn a bit of Linux if you don't already have that experience - but then its good for the CV )

Yeah, even some scrappy Pentium II or Pentium 3 laying around would do the job fine as a transparent, logging proxy server.

[peterb]

Yeah, even some scrappy Pentium II or Pentium 3 laying around would do the job fine as a transparent, logging proxy server.

Yes, you wouldn't need a gui (that takes quite a bit of processing and would be a complete waste) but you might need a fairly big disk to store the logs (and if you are going to use it as a caching proxy server) the cached pages. Start with 100GB, you can always add another one later, or download the logs to offline storage.

An interesting little project!

[peterb]

You can also run Apache as a proxy server, although squid seems a better alternative. (Squid, like apache will also run on Wondows platforms, although the developers consider that you get better performance under *nix)

The Squid home page is here http://www.squid-cache.org/

[Jay]

I would like to do the same

the problem I have is that the main windows domain server is also a "router" (ICS)

What can I do apart from buy software to install on the domain server?

[aidanjt]

I would like to do the same

the problem I have is that the main windows domain server is also a "router" (ICS)

What can I do apart from buy software to install on the domain server?

Use pfSense or something on an old box and put it between the ethernet TA and your domain server (maybe via a switch). pfSense has a web configuration for setting up a squid proxy server as well as high quality routing.

[Jay]

would this mean I would have to stop the domain server from acting like a router though?

It goes like this

Client---Switch---Domain Server---ADSL Router/modem--- Internet

you mean

Client---Switch--Domain Server---Switch--pfSense---ADSL Router/modem---Internet