Active Directory Reporting/Software Enforcement

Question

Got a two questions, and I am hoping to get the same answer for both =)

1) Got a small AD, about 150ish objects. Need a tool for reporting and auditing changes (e.g. computers added to domain, empty passwords, last login date). I know you can script a lot of this, but looking for a more of a professional tool, but reasonably priced given it's a small AD. What does everyone else use?

2) I need to be able to "enforce" that certain software (like AVG, M$ Office) is installed on a computer. Some things, like Office, can be deployed through GPO software deployemtns, where as AVG can't. I want to check a PC on start up or log on if it has certain software, and it if doesn't move it to an lock down "quarantine" OU or lock it up. Any ideas?

Maybe there is a product for both.

Answer 1

For 1) you can live with Windows security logs and some GPOs (if empty passwords are a problem, just require them to be at least X characters long); if your DCs are Windows 2008, you can even have centralized logging, which was unavailable with 2003.

For 2) System Center Configuration Manager is the best answer, if you're sticking with Microsoft solutions; but it sure can be a bit too much for a simple network like yours. Windows 2008 introduced Network Access Protection, which can also be quite useful:

http://www.microsoft.com/windowsserver2008/en/us/nap-main.aspx

http://technet.microsoft.com/en-us/network/bb545879.aspx

You didn't state which Windows version is your AD based on, but it probably is 2003; I'd recommend an upgrade to 2008 (lots of new and improved GPOs, also).

Answer 2

For 2), the Desired Configuration Management feature of System Center Configuration Manager is exactly what you're looking for. It also gives you a more flexible way of deploying software to your machines in the first place (like the ability to run unattended setup.exe installs instead of only MSI's through group policy). It's a really great product in general, but it does cost money.

I can't really help with 1) unfortunately. I know products exist, I just haven't used them before.

Answer 3

I have answers for your question 1:

For the below requirements: Need a tool for reporting and auditing changes (e.g. computers added to domain, last login date).

Try ManageEngine ADAudit Plus - The software is licensed based on the number of Domain controllers starting at $495 for 2 DCs and this could rightly fit in for your need. You can take a 30 day trial before your purchase. http://www.adauditplus.com

For a report on empty passwords : ManageEngine provides a free tool "ADManager Plus Free Active Directory Tools 4.1" www[dot]manageengine[dot]com

Hope the tools meet your requirements. Let me know if you require any assistance with these products.

Thanks, Ashok Marketing Analyst. ManageEngine

Answer 4

For question 1) at least the simple requirements you have listed I find oldcmp.exe to work wonders. It's older, and originally designed for computer accounts, but has since been modified to work equally well on User accounts. In fact includes abilities to disable accounts fitting a specific criteria. It's been a very useful tool to help clean up to meet audit requirements.

http://www.joeware.net/freetools/tools/oldcmp/index.htm

Answer 5

Hyena can perform most, if not all of the tasks that you require. Additionally, if you are willing to spend a little effort (as much as learning any new tool), check out PowerGUI. It's sort of like a tool to assemble Powershell scripts, which should enable you to build the same kinds of reports as Hyena. You'll want to leverage the Filters, but it's very powerful. (You'll need Powershell 2.0 installed.)

-Waldo

Answer 6

To ensure that Windows machines have the right software/settings at $WORK I have implemented wpkg. It is basically a script that parses xml files where you define what machines should have installed. It works really well and it's open source. I guess it does the same things Systems Configuration Manager does, but it costs you nothing and you can ask the developers to introduce new functionality. It requires some learning on your part though.