Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Got a two questions, and I am hoping to get the same answer for both =)

1) Got a small AD, about 150ish objects. Need a tool for reporting and auditing changes (e.g. computers added to domain, empty passwords, last login date). I know you can script a lot of this, but looking for a more of a professional tool, but reasonably priced given it's a small AD. What does everyone else use?

2) I need to be able to "enforce" that certain software (like AVG, M$ Office) is installed on a computer. Some things, like Office, can be deployed through GPO software deployemtns, where as AVG can't. I want to check a PC on start up or log on if it has certain software, and it if doesn't move it to an lock down "quarantine" OU or lock it up. Any ideas?

Maybe there is a product for both.

share|improve this question

closed as off-topic by Michael Hampton Feb 21 '14 at 3:39

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions seeking product, service, or learning material recommendations are off-topic because they tend to become obsolete quickly. Instead, describe your situation and the specific problem you're trying to solve." – Michael Hampton
If this question can be reworded to fit the rules in the help center, please edit the question.

up vote 1 down vote accepted

For 1) you can live with Windows security logs and some GPOs (if empty passwords are a problem, just require them to be at least X characters long); if your DCs are Windows 2008, you can even have centralized logging, which was unavailable with 2003.

For 2) System Center Configuration Manager is the best answer, if you're sticking with Microsoft solutions; but it sure can be a bit too much for a simple network like yours. Windows 2008 introduced Network Access Protection, which can also be quite useful:

You didn't state which Windows version is your AD based on, but it probably is 2003; I'd recommend an upgrade to 2008 (lots of new and improved GPOs, also).

share|improve this answer

For 2), the Desired Configuration Management feature of System Center Configuration Manager is exactly what you're looking for. It also gives you a more flexible way of deploying software to your machines in the first place (like the ability to run unattended setup.exe installs instead of only MSI's through group policy). It's a really great product in general, but it does cost money.

I can't really help with 1) unfortunately. I know products exist, I just haven't used them before.

share|improve this answer

I have answers for your question 1:

For the below requirements: Need a tool for reporting and auditing changes (e.g. computers added to domain, last login date).

Try ManageEngine ADAudit Plus - The software is licensed based on the number of Domain controllers starting at $495 for 2 DCs and this could rightly fit in for your need. You can take a 30 day trial before your purchase.

For a report on empty passwords : ManageEngine provides a free tool "ADManager Plus Free Active Directory Tools 4.1" www[dot]manageengine[dot]com

Hope the tools meet your requirements. Let me know if you require any assistance with these products.

Thanks, Ashok Marketing Analyst. ManageEngine

share|improve this answer

For question 1) at least the simple requirements you have listed I find oldcmp.exe to work wonders. It's older, and originally designed for computer accounts, but has since been modified to work equally well on User accounts. In fact includes abilities to disable accounts fitting a specific criteria. It's been a very useful tool to help clean up to meet audit requirements.

share|improve this answer

To ensure that Windows machines have the right software/settings at $WORK I have implemented wpkg. It is basically a script that parses xml files where you define what machines should have installed. It works really well and it's open source. I guess it does the same things Systems Configuration Manager does, but it costs you nothing and you can ask the developers to introduce new functionality. It requires some learning on your part though.

share|improve this answer

Hyena can perform most, if not all of the tasks that you require. Additionally, if you are willing to spend a little effort (as much as learning any new tool), check out PowerGUI. It's sort of like a tool to assemble Powershell scripts, which should enable you to build the same kinds of reports as Hyena. You'll want to leverage the Filters, but it's very powerful. (You'll need Powershell 2.0 installed.)

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.