I've been contacted by two partners in a small professional firm. They are concerned about their other partner and want to take some steps to be absolutely sure that the company's data and systems are safe from "any eventuality."
They have one server (Windows 2003) that's used as a file and print server (all important files are on the server), Exchange 2003 Server, and it runs a few applications that make up their financial system. I don't know much more than that about their setup because I haven't had a chance to go in yet. The two guys I'm dealing with don't want to let the other partner know they have someone looking at their systems, so I need to minimize the footprints I leave while doing anything.
One thing I realize I need to get up to speed on is physical to virtual tools. I'll want to convert the server to a VM that I could then bring up somewhere else. If the legal stuff gets ugly, they might lose access to the building, or if it gets really bad, the other guy might take off with the server.
So far, the things I'm planning on are:
Go in and make notes on the server hardware and software configuration, with the goal of being able to re-create the server from scratch if necessary.
As part of the above, make sure they have all the original installation disks or files and make copies of them
Do a bunch of backups:
- make a copy of all their shared files
- figure out how to back up the data from their financial applications
- backup the mailboxes, convert them to PSTs
- backup and ghost the entire machine.
The reason for the first three backups is that I want them to have access to files and their application data outside of an image of the server in case they need to find something quickly. I can't set up recurring jobs for this, but I might end up going in every week or so to do a new full backup and maybe once a month doing another backup of files/databases/mailboxes.
Until I look at their accounts, I'm not sure exactly what I'll do, but I'll either create another Admin account, or make the partners' accounts Admins or something like that - the idea being to have some account(s) the other partner doesn't know about be an admin.
Verify that their PCs are all set up to store files on the server.
Look for anything the other partner might have had installed that could compromise the systems. Based on what I've been told, this isn't very likely, which is good because I'm not sure where I'd start looking for malware...
My question is: am I missing anything important? What other things would anyone suggest doing?