Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Inspired by this question:

What tools are available to audit security on an existing Windows server, say Windows 2003, for my case, but what else, for which Windows Server version?

What can I do to test the existing protections on the network?

I'm looking for tools that can identify configuration errors, common and less common flaws, known issues, antivirus tools, any tool at all that can help identify and fix problems in the server. Extra bonus karma feel-good coffee bean points for tools that can be used network- or domain-wide.

share|improve this question
up vote 2 down vote accepted

The Penetration Testing Framework may be worth reading as a starting point. For the tools, there is a lot of them for auditing security, for example you may be interested in the following ones among many others:

Eeye retina





and the many others that are gonna be reported in this thread.

share|improve this answer
This is going to be useful, thanks! – MrZombie Aug 14 '09 at 12:46

For starters there is the MBSA

This is a windows based scanner that will give you errors in configurations as well as patch levels.

There is also nessus which is a far more capable scanning and auditing tool, with plenty of plugins for diferent types of scans.

share|improve this answer

Have you looked into Nessus? It's been a Linux tool but they have a port for Windows now.

share|improve this answer

Depending on the number of Windows servers you need to manage, Microsoft's own System Center Operatinos Manager comes with all kinds of management packs that contain rules and baselines for pretty much all aspects of windows server operations. If you need an out-of-the-box ready solution it's a very good choice. For smaller environments, look into System Center Essentials.

share|improve this answer

A good place to start is the Center for Internet Security benchmark for securing Windows.


share|improve this answer

Free, Nessus is good to use, but it has a bit of a learning curve as you'll have to work to tweak your exact config. It's a vulnerability scanner. Eeye, Qualys, and others like them are purchasable vulnerability scanners.

Otherwise, System Center Operations Manager/Configuration Manager, Symantec's Control Compliance Suite, and Altiris' equivalent to System Center can all determine configuration settings. These solutions also give you additional options beyond just a vulnerability scanner. For instance, they can manage configuration settings, too.

Another option you have is to determine what settings you want to enforce and build them as GPOs. That way you have mandatory enforcement.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.