Welcome

Navigation: »No topics above this level«

Return to chapter overview

Introducing the EventSentry SysAdmin Tools

EventSentry SysAdmin Tools v3.0

Thank you for using EventSentry SysAdmin Tools, we hope that the EventSentry SysAdmin Tools will improve and assist you with your server & network administration tasks!

The EventSentry SysAdmin Tools is a set of command-line and graphical utilities designed to help network administrators with various administrative tasks. The EventSentry SysAdmin Tools is freeware and constantly under development, and most of the tools found are spin-offs from EventSentry, our Hybrid SIEM solution which monitors log, system health, inventory, network devices, NetFlow and Active Directory.

If you have any questions regarding EventSentry SysAdmin Tools then please contact us through our support forums.

Your NETIKUS.NET team.


Requirements / Installation

Requirements

All EventSentry SysAdmin Tools applications require one of the following 64-bit Windows Operating Systems (referred to as "Windows" through this document):

·Windows Server 2003 x64

·Windows XP x64

·Windows Vista x64

·Windows Server 2008 x64

·Windows Server 2008 R2

·Windows 7 x64

·Windows 8 or 8.1

·Windows Server 2012 (R2)

·Windows 10

·Windows Server 2016

·Windows Server 2019

Unix

Version 2.0 of the NTToolkit (legacy name) includes Unix versions for some of the included utilities, however the most recent version of the EventSentry SysAdmin Tools only support the above listed Windows-based platforms. The following Unix-based platforms are supported in v2.0:

·Linux

·FreeBSD 8.x

·OS X 10.5 & 10.6

The above platforms will be simply referred to as Linux, FreeBSD and OS X through this document.

Windows 2008 and later: Some of the executables require administrative access, as such you will have to launch the command-line prompt with a user that has administrative permissions (right-click the icon and select "Run As Administrator").

Installation

To install the software, simply run the installer and select the components to be installed.

To update an existing installation, simply run the latest installer which should update the existing installation automatically. If the update fails, simply uninstall the existing version (if still possible) and reinstall the latest version.


PostgreSQL Vacuum Utility

Compresses files used by the specified table - using the built-in compression feature of Windows (NTFS) - prior to performing a full vacuum on the table, thus freeing up as much disk space as possible prior to the vacuum operation.

The compressed files will be automatically removed by the PostgreSQL database server after the full vacuum is complete and the table was re-created.


Usage

Command Line Parameters

dbpgsqlvacuum /u <USER> /p <PASS> /t <TABLE> /c /l <DSN|ConnectionString>

Argument | Description | Required | Default Value
/s <HOSTNAME|IP> | Hostname or IP address to connect to | NO | 172.0.0.1
/b <PORT> | TCP Port PostgreSQL server is listening on | NO | 5432
/d <DATABASE> | Database where TABLE is located | YES |
/t <TABLE> | SQL table (including schema) to perform full vacuum on | YES |
/u <USERNAME> | Username to connect as | NO | postgres
/p <PASSWORD> | Password for USERNAME | YES |

When using a connection string, both username and password need to be specified inside the connection string, the /u and /p options cannot be used.

Examples

Example 1: Perform a full vacuum on the eventsentry.eseventlogmain table in the EventSentry database

dbpgsqlvacuum /u postgres /p !$^&3jdk3 /d EventSentry /t eventsentry.eseventlogmain


adslist

ADSList analyzes one or more directories and lists any alternate data streams (aka as "hidden streams") that are associated with a file. When an alternate data stream is found, the name of the stream is displayed along with the regular file the stream is associated with. The output will also show a summary that lists:

·the number of files analyzed

·the number of files that have an alternate data stream associated with them

·the number of alternate data streams that have been found

·the elapsed time

The main purpose of adslist.exe is to give a System Administrator a command-line utility that can be run/scheduled on a regular basis to reveal any hidden streams on a server or workstation.

ADSList only works on NTFS volumes, since alternate data streams are only supported on the NTFS file system.

Return Code (%ERRORLEVEL%)

ADSList returns 0 when no alternate data streams have been found, and returns 1 if at least one alternate data stream has been found.

Interface

Command-line

Files

adslist.exe

Supported Platforms

Windows


Usage

Command Line Parameters

adslist /s /q <DIRECTORY>

DIRECTORY | The directory to analyze, uses the current directory if none is specified
/s | Include sub directories
/q | Quiet output, omit headers, omit error messages and only prints text when alternate data streams are found
/p <filter> | Exclude paths that match <filter>, wildcards are supported

You can schedule adslist.exe using the EventSentry Application Scheduler, which can analyze the return code and output of the utility and only log an event to the event log when one or more alternate data streams have been found.

Examples

Example 1: Look for alternate data streams in the %SYSTEMROOT% directory, including sub directories

adslist %SYSTEMROOT% /s

Example 2: Look for the alternate data streams in the C:\Windows\System32, including sub directories, and use the quiet output

adslist C:\Windows\System32 /s /q

Example 3: Look for the alternate data streams on the entire C drive but exclude any path that contains SYSVOL_DFSR\domain\DfsrPrivate\Staging

adslist C:\Windows\System32 /s /p *SYSVOL_DFSR\domain\DfsrPrivate\Staging*

Sample Output

C:\>adslist C:\ /s

0001: C:\\Documents and Settings\Administrator\Favorites\Download details Feature Pack for SQL Server 2005 Nov 2005.url

     favicon

0002: C:\\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\68B6GYDG\LSSetup_en_US[1].exe

     Zone.Identifier

0003: C:\\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\CUQF6SXR\launch[1].lsf

     Zone.Identifier

0004: C:\Images\temp\logo_v2_white.png

     ?Q30lsldxJoudresxAaaqpcawXc

     {4c8cc155-6c1e-11d1-8e41-00c04fb9386d}

0005: C:\Images\logo_v2_white.jpg

     ?Q30lsldxJoudresxAaaqpcawXc

     {4c8cc155-6c1e-11d1-8e41-00c04fb9386d}

Summary:

========

Time elapsed:                      5 second(s)

Files Processed:                   66680

Files with alternate data streams: 5

Alternate Data Streams found:      7


checksum

The Checksum Generator generates a one-way checksum of a file with a configurable algorithm (SHA256 by default) and displays it on the screen. This is useful to ensure the integrity of a file and make sure that it has not been modified.

This utility is also included in EventSentry as an Add-On to the "File (Integrity) Monitoring" feature which can automatically generate SHA 256 checksums.

To display and create a checksum of a file, simply supply the file name as the first argument. Please keep in mind that generating checksums of large files can take a significant amount of (CPU) time depending on the system where it's running.

This utility can also calculate the entropy (randomness) of a file and verify its digital signature.

A comparison checksum can be passed as a parameter to checksum.exe. If the actual file checksum does not match the comparison checksum, checksum.exe will set the return code (%ERRORLEVEL%) to 1, when it matches to 0.

Interface

Command-line

Files

checksum.exe

Supported Platforms

Windows


Usage

Command Line Parameters

checksum /s /a:ENTROPY|CRC32|MD5|SHA1|SHA256|SHA384|SHA512 <filename>

/a | algorithm to use, can be one of the following (case sensitive): ENTROPY, CRC32, MD5, SHA1, SHA256, SHA384 or SHA512. Default is SHA256. Note: Entropy is neither a cryptographic algorithm nor will it produce a checksum
/c | comparison checksum, affects %ERRORLEVEL% (match=0, no match=1)
/e | calculate the "Shannon" entropy of the specified file
/s | Verify the digital signature of the file and display its digital signature information (if available)
/b | Brief output, only displays checksum
/t | Display/guess file type regardless of extension
filename | path to the filename to generate the checksum from

The file entropy is only calculated for files with a file size of less than 512Mb .

Examples

Example 1: Create a SHA 512 checksum of file C:\Windows\notepad.exe

checksum /a:SHA512 c:\windows\notepad.exe

Example 2: Create a SHA 512 checksum and calculate the entropy of file C:\Windows\notepad.exe

checksum /e /a:SHA512 c:\windows\notepad.exe


datahog

DataHog is a command-line utility which analyzes all files and directories in a given path, usually a logical drive, to find the

·Largest sub directories, based on the file size

·Largest sub directories, based on the number of files

·Largest files (logical and/or physical size)

Note that datahog doesn't just find the largest top-level directories of the given path, it will use a unique algorithm to traverse the entire directory structure to find sub directories which are larger (or contain more files) than the other directories in the path.

Interface

Command-line

Files

datahog.exe

Supported Platforms

Windows (64-bit version available)


Usage

Command Line Parameters

datahog /fp /f /dc /d /l <max # of results> <path>

/fp | Find the largest files based on the physical file size
/f | Find the largest files (logical file size)
/dc | Find the largest sub directories (based on # of files contained)
/d | Find the largest sub directories (by size)
/l <max # of results> | Maximum number of results, 15 by default

Examples

Example 1: Find the largest 20 largest sub directories on the C drive

datahog /d /l 20 C:\

Example 2: Find the 10 largest files in the C:\Program Files directory

datahog /f /l 10 "C:\Program Files"

Example 3: Find the 10 sub directories which contain the largest number of files in the D:\ drive

datahog /dc /l 10 D:\


directorymonitor

The Directory Monitor utility monitors a directory (and optionally sub directories) and displays all file changes in real-time. Dirmon will show you when

·Files are added

·Files are deleted

·Files are modified

Dirmon also lets you specify include or exclude filters, so that you can skip files that you are not interested in or only show files that you are interested in.

Interface

Command-line

Files

dirmon.exe

Supported Platforms

Windows


Usage

Command Line Parameters

dirmon /d [path] /s (/i fileA.txt,fileB.txt,..) | (/e fileA.txt,fileB.txt,..) <path>

/s | Include subdirectories
/i *.exe,*.sys | When specified, only lists files that match items in the comma-separated list
/e *software.log | When specified, ignores files that match items in the comma-separated list

Both the /i and /e parameters support wildcards (* and ?), but you can only use one at a time. You can specify multiple file names with a comma. You cannot use both /i and /e at the same time.

Examples

Example 1: Monitor the C:\Windows directory, including subdirectories, but ignore files with the .log extension and files that end in ntuser.dat

dirmon /s /e *.log,*ntuser.dat C:\Windows

10/19/2007 13:37:26: ~MODIFIED     : WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP

10/19/2007 13:37:26: ~MODIFIED     : WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP

10/19/2007 13:37:26: ~MODIFIED     : WINDOWS\system32\wbem\Repository\FS\MAPPING.VER

10/19/2007 13:37:26: ~MODIFIED     : Documents and Settings\All Users\Application Data\Skype\Plugins\_sstore8.dat

10/19/2007 13:37:26: ~MODIFIED     : Documents and Settings\All Users\Application Data\Skype\Plugins\_sstore8.dat

7 filtered file transactions not shown.


directorysize

The Directory Size utility calculates the current size of a directory, including subdirectories, and displays it on the screen. The output shows the number of files and directories searched and the total size in physical (actual size taken up on the disk) and logical (actual file size) bytes.

Dirsize will process the current directory if no command-line arguments were passed.

Interface

Command-line

Files

dirsize.exe

Supported Platforms

Windows


Usage

Command Line Parameters

dirsize [path]

Examples

Example 1: Display the size of the C:\Windows\System32 directory

dirsize C:\Windows\System32

Summary (took 0 seconds):

=========================

Directories/Files searched: 954/9942

Logical  directory size   : 2,418,698,780 bytes

Physical directory size   : 2,390,917,120 bytes

Average logical file size : 243,280 bytes


filereplace

FileReplace parses a directory (including subdirectories) and replaces multiple occurrances of one template file.

Example

You have file C:\WebSite\Default\index.html and would like to replace all other index.html files in the directory D:\WWW (including subdirectories) with C:\WebSite\Default\index.html. File Replace will do that for you by typing in one command.

Interface

Command-line

Files

filereplace.exe

Supported Platforms

Windows


Usage

Command Line Parameters

filereplace /t <directory> <file>

file | The original file the other files will be replaced with
directory | The directory to parse and look for files with the same file name as <file>
/t | Do not actually replace the files, only show which files would be replaced

Example

Example 1: Replace all files named default.php in the folder E:\Data (including sub folders) with D:\Templates\default.php

filereplace d:\data d:\templates\default.php


purgetemp

PurgeTemp traverses the default %TEMP% directory (or a manually specified directory) and deletes files which have not been modified for a specified amount of days (120 by default).

Purgetemp is designed to be called from login scripts to automatically keep users' temp folders small.

When called without arguments simply shows the configured temp directory, the number of files in the directory and their cumulative size:

Directory analyzed:    C:/Users/JOHNNY~1.PEA/AppData/Local/Temp

Total file size:       1.48 Gbytes

Total number of files: 1626

Interface

Command-line

Files

purgetemp.exe

QtCore4.dll

Supported Platforms

Windows


Usage

Command Line Parameters

purgetemp /a <PATTERN> /d /r /s /l /t <days> /p <path>

/a <PATTERN> | Pattern which must be present in the %TEMP% environment variable
/d | Delete files, by default only lists statistics
/r | Delete files with read-only attribute set
/s | Delete files with system attribute set
/l | Delete hidden files
/t <days> | Delete files not modified in <days> days, 120 by default
/p <path> | Examine <path> path instead of %TEMP% directory

Examples

Example 1: Delete all files from the temp directory which have not been modified in 180 days:

purgetemp /d /t 180

Example 2: Delete all files from the C:\Temp directory which have not been modified in 2 months:

purgetemp /d /t 60 /p C:\Temp


superdelete

SuperDelete parses a directory (including subdirectories) and deletes multiple occurrances of one file.

Interface

Command-line

Files

superdel.exe

Supported Platforms

Windows


Usage

Command Line Parameters

superdel /v /r /t <directory> <file to delete>

/v /verbose | Verbose - show which files would be deleted (requires /t)
/r /ro | Removes READ-ONLY attribute if set on file(s)
/t | Doesn't delete file(s) but instead shows each file which would be deleted
File to delete | The filename to delete
Directory | The directory to parse and delete occurrences of this file

Example

Example 1: Delete all files named thumbs.db the folder "C:\Documents and Settings" (including sub folders).

superdel "c:\documents and settings" thumbs.db


checkdb

CheckDB verifies a database connection through ODBC to ensure that a connection to a database can be established. You can optionally also run a single SQL statement after a successful connection has been established. A connection can be specified either through a DSN (Data Source Name) or a connection string. The output from CheckDB can either be displayed in the command line or logged to the event log.

CheckDB can verify that:

·a database server is available

·the database specified in the DSN / connection string is online

·the specified user has permission to log into the database server and database

·the optionally specified SQL statement executed successfully

As with all ODBC-based utilities, you will need to ensure that the necessary ODBC drivers are installed on the machine from which you run this utility. Non-Windows platforms also need the respective ODBC framework (see "Prerequisites" below) installed.

Return Code (%ERRORLEVEL%)

CheckDB returns 0 when no errors have been encountered, and returns 1 if an error (e.g. database is unavailable, SQL query cannot execute) was encountered. Use event logging (/le) for detailed troubleshooting information.

Interface

Command-line

Files

checkdb(.exe)

Prerequisites

OS X: iODBC

Linux / FreeBSD: unixODBC

Supported Platforms

Windows (64-bit version available)

Linux

FreeBSD

OS X


Usage

Command Line Parameters

checkdb /u <USER> /p <PASS> /q <SQLQUERY> /c /l <DSN|ConnectionString>

DSN or Connection String | DSN or connection string to connect to
/u <USERNAME> | Username to connect as (DSN only)
/p <PASSWORD> | Password for USERNAME (DSN only)
/q <SQLQUERY> | SQL query to execute upon successful connection
/c | Log all output to console
/l | Log all output to event log

When using a connection string, both username and password need to be specified inside the connection string, the /u and /p options cannot be used.

Examples

Example 1: Check whether the database defined in DSN EventSentry is available and log output to the console

checkdb /u eventsentry_web /p !$^&3jdk3 /c EventSentry

Example 2: Check whether the database defined in the connection string is available and log output to the event log

checkdb /l "driver={SQL Server};server=mssqlserver;Network=DBMSSOCN;database=EventSentry;uid=eventsentry_svc;pwd=1234"

Example 3: Check whether the database defined in DSN EventSentry is available, verify that the table ESEventlogLog exists and log output to the console and event log

checkdb /u eventsentry_web /p !$^&3jdk3 /q "select top 1 * from ESEventlogLog" /c /l EventSentry

Sample Output

C:\>checkdb /u eventsentry_web /p password /q "select top 1 * from ESEventlogLog" /c /l SQLSERVER

Connect  : OK

DB Type  : Microsoft SQL Server

Time     : 1 second(s)

SQL Query: select top 1 * from ESEventlogLog -> OK

Example event from the event log


Event Log Logging

When specifying the /le option, CheckDB will log all actions to the event log with the event source ESAdminTools and the event category CheckDB. All successful checks will be logged as informational events, whereas all errors will be logged as error events.

CheckDB logs the following events to the event log:

Event ID | Event Message
1100 | Connection: OK Database Type: %1 Time Elapsed: %2
1101 | Connection: OK Database Type: %1 Time Elapsed: %2 SQL Query: "%3"
1102 | Connection: ERROR Reason: %1
1103 | Connection: OK Database Type: %1 Time Elapsed: %2 SQL Query: "%3" -> ERROR Failure Reason: %4


checkurl

CheckURL verifies availability of a web page and can also check for content inside the page and/or verify the checksum of that page. CheckURL can also log its actions to the event log and supports web-based authentication for password-protected web pages.

CheckURL can:

·verify that a web page exists and is accessible

·alert if a TLS certificate expires in fewer than X days

·check if a particular text exists or does not exist in a web page

·verify that credentials for a web page work

·log all output to the event log or console

·automatically create checksums to be notified when the content of a web page changes

·login via a proxy login page

Checksum Monitoring

With checksum monitoring, CheckURL downloads the specified page and creates a SHA checksum which it stores in the registry (HKLM\Software\netikus.net\NTToolkit\CheckURL). Upon a subsequent check, CheckURL compares the current checksum with the previously stored checksum and notifies you when it has changed. You can optionally log results to the event log with the /evt switch (use CHECKSUM_CHANGE and CHECKSUM_EQUAL).

Content Monitoring

With content monitoring, CheckURL looks for a specific string in a page and notifies you whether the string has been found or not. You can optionally log results to the event log with the /evt switch (use TXT_FOUND and TXT_NOTFOUND).

Return Code (%ERRORLEVEL%)

CheckURL returns 0 when no errors have been encountered, and returns 1 if an error (e.g. unable to establish connection with web site) was encountered. Use event logging (/le) for detailed troubleshooting information.

Interface

Command-line

Files

checkurl.exe

Supported Platforms

Windows


Usage

Command Line Parameters

checkurl /auth <basic|digest|ntlm|kerberos> /u <USER> /p <PASS> /loginpage <loginurl> /loginformdata <form data for loginpage> /proxyhost <proxyserver> /proxyport <proxy port> /proxyuser <proxy username> /proxypass <password for proxyuser> /checksum /checksums_clear /t <TEXT> /lc /le /evt <OPTIONS> /certdays <DAYS> <URL>

/u MyUser | Authenticate as user MyUser to web page
/p "my pass" | Use specified password for /u option
/proxyhost | Host name or IP address of proxy server
/proxyport | IP port of proxy server
/proxyuser | Username for proxy server (if required)
/proxypass | Password for <proxyuser>
/loginpage <login page> | URL of page to login in prior to contacting URL
/loginformdata <form data> | Form data for "loginpage" in key value pairs (e.g. user=admin,pass=secret)
/checksum | Create or compare checksum of page
/checksums_clear | Delete all cached checksums from the registry
/t "text to look for" | Search for specified text on page (not case sensitive)
/certdays <days> | Alert if certificate it expires in <days> or fewer days, requires https URL
/certonly | Only performs certificate check and ignores errors related to authentication, requires /certdays
/f | Follow HTTP redirect (302) responses
/i | Ignore non-trusted certificates
/usewininet | Use built-in Windows (Internet Explorer) HTTP-engine
/lc | Log all output to console
/le | Log all output to event log
/evt "options" | Rules for event log logging

Examples

Example 1: Log an error to the event log when the page http://www.eventsentry.com/downloads/version-history changes:

checkurl /checksum /lc /le /evt "CHECKSUM_CHANGE=Error,CHECKSUM_EQUAL=Ignore" https://www.eventsentry.com/downloads/version-history

Example 2: Log a warning to the event log when the string "About Google" is not found in URL http://www.google.com and log results to the event log:

checkurl /t "About Google" /le /evt "TXT_FOUND=Information,TXT_NOTFOUND=Warning" https://www.google.com/

Example 3: Log a warning to the event log when the string "Island Life" is not found in URL https://www.dharmainitiative.com and log results to the event log. Log in first via URL "https://www.dharmainitiative.com/login" with accepts the form elements "username" and "password":

checkurl /loginpage https://www.dharmainitiative.com/login /loginformdata "username=john@locke.com,password=Iamlost" /t "Island Life" /le /evt "TXT_FOUND=Information,TXT_NOTFOUND=Warning" https://www.dharmainitiative.com/

Example 4: Connects to a HTTPS-enabled site to check a certificate, ignores any non-connection related errors such authentication

checkurl /certdays 60 /certonly https://myinternalsite.mycorp.com


Event Log Logging

When specifying the /le option, CheckURL will log all actions to the event log with the event source ESAdminTools and the event category CheckURL. Depending on the options specified in the /evt parameter, CheckURL will either log an informational, warning or error event to the event log.

Event Log Rules (/evt)

The event log rules allow you to specify with which severity certain checks will be logged to the event log. For example, you can log an ERROR to the event log if a particular text is not found in an URL, or a WARNING when the checksum of a page has changed.

You can create the event log rules with the following pattern pair: ACTION=SEVERITY,ACTION=SEVERITY,...

Actions

The following actions are available:

·CHECKSUM_CHANGE A checksum change has been detected

·CHECKSUM_EQUAL A checksum has not changed

·TXT_FOUND The specified text has been found in the page

·TXT_NOTFOUND The specified text has not been found in the page

·CERTIFICATE The remote certificate expires

Severities

Events can be logged with the following severities:

·Error Logs event as an error

·Warning Logs event as a warning

·Information Logs event as a warning

·Ignore Does not log an event to the event log

Some examples for rules are:

·TXT_FOUND=Ignore,TXT_NOTFOUND=Warning

·CHECKSUM_CHANGE=Error,CHECKSUM_EQUAL=Information

Events

CheckURL logs the following events to the event log:

Event ID | Event Message
1000 | Unable to connect to "%1" due to error "%2" (%3).
1001 | The checksum of URL "%1" was initialized to "%2".
1002 | The checksum of URL "%1" changed to "%2".
1003 | The checksum of URL "%1" did not change.
1004 | The TLS certificate for URL "%1" expires in %2 day(s), on "%3".


checktcp

CheckTCP determines whether a single or a range of TCP ports on a host are open. Additionally you can receive initial data sent from the remote host through an open TCP connection, such as when connecting to most SMTP hosts.

CheckTCP uses multiple threads when scanning a range of ports for a fast port scan.

CheckTCP returns an %ERRORLEVEL% of 0 when the port is open and an %ERRORLEVEL% > 0 when the port is not open.

Interface

Command-line

Files

checktcp.exe

Supported Platforms

Windows


Usage

Command Line Parameters

checktcp /s /t:timeout <hostname|ipaddress> <port>

hostname / ipaddress | Hostname or IP address to connect to
port | TCP port on host to connect to. Specify a single port or a range of ports (e.g. 100-1000)
/s | Displays any data sent by the remote host through the TCP connection. Only supported when checking a single TCP port.
/t:timeout | Max amount of seconds to wait before interrupting a TCP port check (applies to TCP port checks only, default is 2 seconds)

Examples

Example 1: Check whether port 25 on host smtp.aol.com is open

checktcp smtp.aol.com 25

Example 2: Check whether port 25 on host mail.hotmail.com is open and display data

checktcp /s mail.hotmail.com 25

Example 3: List all ports in range 1000-5000 on server01

checktcp server01 1000-5000

Sample Output

c:\>checktcp /s mail.hotmail.com 25

Status: mail.hotmail.com:25 is open

Data: 220 mc9-f37.hotmail.com Microsoft ESMTP MAIL Service, Version: 5.0.2195.6824 ready at  Sun, 9 May 2004 19:11:01 -0700


listsuspended

Lists any process which has at least one thread in a suspended state.

Interface

Command-line

Files

listsuspended.exe

Supported Platforms

Windows


Usage

Command Line Parameters

listsuspended /m /n:<number> /p /l

/p | Show PIDs only
/n:<count> | Repeat query <count> times
/l | Loop indefinitely, assumes /m
/m | Minimal output, only show counter value

Examples

Example 1: List all processes with suspended threads

listsuspended

Suspended processes found:

==========================

explorer.exe (3604)

livecomm.exe (3776)

HELPMAN.EXE (4400)

Suspended processes: 3

Example 2: List processes with suspended threads, show PIDs with minimal output:

listsuspended /p /m

3604

3776

4400


perfquery

Queries a performance counter or SNMP OID and displays its current, minimum, maximum and average value.

When querying remote SNMP values, only numerical values are supported.

Interface

Command-line

Files

perfquery.exe

Supported Platforms

Windows, remote hosts with SNMP support


Usage

Command Line Parameters

perfquery /n:<count> /l /m <query path | oid>

<query path> | Performance counter to read, e.g. "Processor(_Total)\% Processor Time"
/n:<count> | Repeat query <count> times
/l | Loop indefinitely
/i:<seconds> | When looping, sleep <milliseconds> between iterations, default is 500ms
/m | Minimal output, only show counter value
/s | Query SNMP instead of a local performance counter
/f | Display values as floating point (windows performance counters only)
/host:<remote host> | Host name to send SNMP GET request to
/instance:<instance> | When returning table data through SNMP, specify the OID which describes each instance
/u:<community | user> | SNMP v1/v2c community name or SNMP v3 user name
/a:<MD5 or SHA> | SNMP v3 authentication algorithm
/passauth:<password> | SNMP v3 authentication password
/c:<DES | 3DES | AES> | SNMP v3 encryption algorithm
/passcrypto:<password> | SNMP v3 encryption password

Examples

Example 1: Query performance counter "Processor(_Total)\% Processor Time" 5 times with regular output:

perfquery.exe "Processor(_Total)\% Processor Time" /n:5

Processor(_Total)\% Processor Time: [_Total] now=8, min=0, max=8, avg=7.61

Processor(_Total)\% Processor Time: [_Total] now=1, min=1, max=1, avg=4.45

Processor(_Total)\% Processor Time: [_Total] now=1, min=1, max=1, avg=3.46

Processor(_Total)\% Processor Time: [_Total] now=8, min=1, max=8, avg=4.61

Processor(_Total)\% Processor Time: [_Total] now=1, min=1, max=8, avg=3.95

Summary

=======

Iterations: 5

Duration: 3 seconds

Processor(_Total)\% Processor Time: [_Total] min=1, max=8, avg=3.95

Example 2: Query CPU usage from SNMP host 192.168.10.1 with SNMP community "secret" 5 times, wait 250ms between each query

perfquery.exe /s /host:192.168.10.1 /u:secret "1.3.6.1.4.1.2021.11.9.0+1.3.6.1.4.1.2021.11.10.0" /n:5 /i:250

1.3.6.1.4.1.2021.11.9.0+1.3.6.1.4.1.2021.11.10.0: now=1, min=0, max=1, avg=1.00

1.3.6.1.4.1.2021.11.9.0+1.3.6.1.4.1.2021.11.10.0: now=0, min=0, max=0, avg=0.67

1.3.6.1.4.1.2021.11.9.0+1.3.6.1.4.1.2021.11.10.0: now=0, min=0, max=0, avg=0.50

1.3.6.1.4.1.2021.11.9.0+1.3.6.1.4.1.2021.11.10.0: now=0, min=0, max=0, avg=0.40

1.3.6.1.4.1.2021.11.9.0+1.3.6.1.4.1.2021.11.10.0: now=0, min=0, max=0, avg=0.33


fping

fping (Fast Ping) includes the following functionality:

·Ping (sends ICMP requests) remote host

·Attempt a TCP port connection at a remote host (to determine whether the remote host or service are up and running)

·Scan a subnet to find IPs that are online

fping is intended to be a replacement for the ping.exe utility that ships with Windows and offers the following benefits over the built-in ping.exe utility:

·Faster

·Supports TCP port checks

·Finds active IPs

·Supports specifying partial IP addresses when pinging hosts in a local subnet

·Audio support

·Additional output options

·Support for storing presets

FPing returns an %ERRORLEVEL% of 0 when the remote host (or TCP port) was reachable and an %ERRORLEVEL% > 0 when the remote host did not respond to the ICMP echo requests or the TCP port was closed.

Interface

Command-line

Files

fping.exe

Supported Platforms

Windows


Usage

Command Line Parameters

fping /count:packets /size:packetsize /delay:delay /loop <hostname|ip|partial-ip|hostnameWithPort|IpWithPort>

/a

Resolve IP addresses to host names

/u

Shows unhelpful comments when performing a brief ping

/b

Performs a quick ping and only indicates whether target host is up or down. Cannot be used with /verbose

/v

Verbose output (default)

/x

Clears all stored defaults

/w

Use current options as default

/f <1|2|3|4>

Play one of 4 built-in sounds on ping failure

/p <1|2|3|4>

Play one of 4 built-in sounds on ping success

/c packets

Sets the number of ICMP packets to send, default are 4

/s packetsize

Sets the payload size of the ICMP packets in bytes, default are 32

/t timeout

Max amount of seconds to wait before interrupting a TCP port check (applies to TCP port checks only, default is 2 seconds)

/d delay

Determines how long (in ms) to wait between each ICMP packet, default are 150ms.

/loop

Pings host indefinitely, abort with CTRL-C

hostname|ip|CIDR|*

The host to ping, CIDR format to scan an entire subnet or * to scan the current subnet.

To connect to a TCP port instead of using ICMP, append the port separated with a colon (e.g. myserver:445)

A partial IP address may be specified by skipping up to the first three octets; fping will try to guess the remainder of the IP address based on the current IP address and subnet mask.

Examples

Example 1: Ping host www.netikus.net

fping www.netikus.net

Example 2: Ping host www.eventsentry.com with 8 packets and 64 bytes in size

fping /c 8 /s 64 www.eventsentry.com

Example 3: Continuously ping 10.10.0.1 and play sound if ping times out

fping /l /f 1 10.10.0.1

Example 3: Ping www.netikus.net with 2 packets, play sound on success, and use these options as a default for all future pings

fping /c 2 /p 2 /w www.netikus.net

Example 4: Check if port 80 is available on host www.netikus.net

fping www.netikus.net:80

Example 5: Discover all IPs that are online in the 192.168.1.0/24 subnet

fping 192.168.1.0/24

Example 6: Discover all IPs in the current subnet with an open port 80

fping *:80

Example 7: Find all IPs in the current subnet

fping *

Example 8: Ping 192.168.1.1 (with the local IP address being 192.168.1.50/255.255.255.0)

fping 1

Sample Output

c:\>fping /c 2 /s 128 /d 300 www.eventsentry.com

Binging www.eventsentry.com@216.92.10.83

Reply from 216.92.10.83: bytes=128 time=15ms ttl=49 seq=0

Reply from 216.92.10.83: bytes=128 time=17ms ttl=49 seq=0

Roundtrip Summary:

Average: 16 ms, Minimum: 15 ms, Maximum: 17 ms, Rate: 100%


gethttp

GetHTTP retrieves files through the HTTP protocol. Please note that SSL is not currently supported.

Interface

Command-line

Files

gethttp.exe

Supported Platforms

Windows


Usage

Command Line Parameters

gethttp /u <USER> /p <PASS> /proxyhost <proxyserver> /proxyport <proxy port> /proxyuser <proxy username> /proxypass <password for proxyuser> /i /q /a /r /t <timeout> /f <filename>

/u MyUser | Authenticate as user MyUser to web page
/p "my pass" | Use specified password for /u option
/proxyhost | Host name or IP address of proxy server
/proxyport | IP port of proxy server
/proxyuser | Username for proxy server (if required)
/proxypass | Password for <proxyuser>
/I | Ignore SSL certificate warnings
/r | Resume transfer (if supported by remote host)
/t <timeout> | Connection timeout in seconds
/q | Quiet output
/a | Print HTTP headers
/d | Display content (instead of downloading)
/f <filename> | Store downloaded file in this local file

Existing local files will be overwritten without a prompt.

Examples

Example 1: Download the file http://www.netikus.net/downloads/rpm_update.pl.gz

gethttp www.netikus.net/downloads/rpm_update.pl.gz

Example 2: Download the file http://www.netikus.net/downloads/getconfig.sh and save it locally as getconfig

gethttp /f getconfig http://www.netikus.net/downloads/getconfig.sh

Example 3: Download the document http://www.experts-exchange.com/Programming/System/Windows__Programming/MFC/Q_22133017.html and save it locally as answer.html

gethttp /f answer.html  http://www.experts-exchange.com/Programming/System/Windows__Programming/MFC/Q_22133017.html

Example 4: Display the most recent measurement of the average concentration of carbon dioxide in the atmosphere

gethttp /d http://www.hqcasanova.com/co2/

Sample Outputs

>gethttp www.netikus.net/downloads/getconfig.sh

Saved file "getconfig.sh" in current directory

Received 9.53 kb in 0.310 seconds (30.76 kb/sec)

>gethttp /d http://www.hqcasanova.com/co2/

410.20 ppm


ipmon

IPMon utilizes the WinPcap network driver to monitor IP traffic to the local host for troubleshooting and monitoring purposes. Unlike full blown network sniffers, IPMon only shows the IP addresses and ports (for TCP/UDP) affected, and groups output so that repetitive traffic is not being displayed. For example, any IP address that communicates with the local host where IPMon runs is only displayed once.

Using IPMon, a system or network administrator can quickly see which TCP/UDP/ICMP communication is taking place from the local host, without having to parse through thousands of lines network captures. IPMon currently supports the following IP protocols:

·UDP

·TCP

·ICMP

and has the following filtering / output capabilities:

·Filter based on TCP port number

·Filter based on UDP port number

·Filter protocols (UDP, TCP, ICMP)

·Show any IP address only once, even when communication is flowing to/from multiple ports

·Show any IP address / remote port combination only once

·Resolve IP addresses to host names

Simply running IPMon without arguments will, in most cases, reveal interesting information about the IP traffic to the local host.

In this version IPMon only shows incoming traffic sent from remote hosts to the local machine. Outgoing traffic, as well as traffic sent to interfaces other than a local one, are not shown.

IPMon outputs captured traffic to the command line as follows:

[Timestamp] [IP Protocol] [Remote IP Address] [Source Port->Destination Port] [Resolved Host Name]

·Timestamp: Current time as Hour:Minute:Seconds

·IP Protocol: The IP protocol used, either UDP, TCP or ICMP

·Remote IP Address: The IP address of the remote host sending a packet to the local host

·Source Port: The UDP/TCP source port (from the remote host)

·Destination Port: The UDP/TCP destination port (on the local machine)

·Resolved Host Name: The FQDN of the remote host, when run with /resolve option. Only available when the IP address can be resolved through DNS.

Figure 1: All TCP and UDP communication

Figure 2: IPMon quickly shows questionable traffic via UDP (in this case Skype is the "culprit")

Requirements

WinPcap network driver

Interface

Command-line

Files

ipmon(.exe)

Supported Platforms

Windows

Linux

FreeBSD

OS X


Usage

Command Line Parameters

ipmon [/i INTERFACE] [/udp] [/tcp] [/icmp] [/dport PORT] [/sport PORT] [/list] [/group-port] [/resolve]

/i INTERFACE | The interface ipmon should be capturing packets on. If not interface is specified and only one interface with a valid IP address exists on the system, then that interface will automatically be used. If multiple active interfaces exist, a list of interfaces will be presented for a selection.
/u /udp | Capture UDP traffic (activated by default)
/t /tcp | Capture TCP traffic (activated by default)
/c /icmp | Capture ICMP traffic (not activated by default)
/d PORT | Only include UDP/TCP packets that are sent to local port PORT
/s PORT | Only include UDP/TCP packets that are sent from remote port PORT
/l | List all available interfaces (always promopt)
/g /group-port | By default, IPMon shows each remote IP address that sent a packet to the local machine only once, even when packets have been sent from different remote ports. Activating this option will result in more output since the same IP address will be shown multiple times if communication between different ports is taking place.
/r /resolve | Resolves the remote IP address to a host name. Please note that using this option when capturing large amounts of packets may incur a delay with real time monitoring.

Examples

Example 1: Display all UDP + TCP communication from the default interface.

ipmon

Example 2: Display all UDP, TCP and ICMP communication from the default interface and resolve all host name where possible

ipmon /udp /tcp /icmp /resolve

Example 3: Display all UDP, TCP and ICMP communication from the default interface and resolve all host name where possible

ipmon /udp /tcp /icmp /resolve

Example 4: Display all TCP communication from interface \Device\NPF_{E84D78AB-18AC-4705-A7CA-221EC0CDAE12}

ipmon /i \Device\NPF_{E84D78AB-18AC-4705-A7CA-221EC0CDAE12} /TCP


IPMon+

IPMon+ is the graphical version of IPMon, and also offers additional functionality not available in the command-line version. IPMon+ shows all TCP, UDP, ICMP and ARP connection endpoints between the local computer (default) and remote hosts, including the amount of data being transmitted, current transfer rate and threat intel. IPMon+ also supports promiscuous mode.

IPMon+ is primarily intended for:

·Troubleshooting network connections

·Revealing incoming and outgoing network traffic

·Discovering traffic to potentially malicious hosts

IPMon+ monitors all network traffic on the specified interface, and shows:

·which hosts communicate with the local host

·how much data is being transferred between IP connection

·the direction of traffic

·which UDP/TCP ports are used in the communication

If IPMon+ runs in promiscuous mode then traffic from hosts not involved with local traffic is displayed as well if the switch is configured to send all traffic.

More information:

· Usage

· Screenshots

Requirements

Npcap packet sniffing library (recommended) or WinPcap network driver

Since WinPcap is no longer under active development, it's recommended to install the Npcap driver instead.

When installing, make sure that Install Npcap in WinPcap API-compatible Mode is checked.

Interface

Graphical

Files

ipmonplus(.exe)

Supported Platforms

Windows

Linux (NTToolkit v2.0 only)

FreeBSD (NTToolkit v2.0 only)

OS X (NTToolkit v2.0 only)


Usage

Capturing Traffic

To capture traffic, click the Options button and select the interface to capture traffic on. The first interface with a valid IP address will be selected by default. As such, you will only need to manually select an interface if the computer that you are capturing on has more than one network interface with a valid IP address.

The Options dialog also allows you to enable promiscuous mode, which ensures that all packets, even when not sent to the local MAC address, are captured and displayed. If the network card is connected to a switch, then the port to which the NIC is connected to will need to be configured to forward all network traffic to this port. Most managed switches support this functionality.

Once the correct interface is selected, clicking the Start button will start capturing traffic. Once clicked, the start button will be renamed to Stop. Click Stop to suspend capturing traffic. Clicking the Stop button will not automatically clear collected information. Clicking the Clear button will erase all collected information from the display.

Threat Intel

IPMon+ can provide threat intel on all processed IP addresses in real time utilizing the OTX black list along with supplemental threat details from AbuseIPDB. Supplemental threat details are only available if an AbuseIPDB API key (free plan available as of 4/2019) is configured in the Options dialog. Checking the "Threat Intelligence" check box will enable the collection of threat intel, also checking the "Threats Only" check box will only display traffic with hosts that are deemed potentially malicious.

Filtering Traffic

By default, all UDP, TCP, ICMP, ARP traffic statistics are displayed in the main grid window. By toggling the check boxes next to a protocol name (e.g. TCP), all traffic matching this protocol will immediately be hidden. Toggling the check boxes will not affect traffic being captured, it will only filters information from the main grid. All UDP, TCP, ICMP, ARP traffic statistics are always captured, regardless of the display filter.

You can also filter traffic based on UDP/TCP ports. Simply enter the port number in the Port(s) field, and only traffic that was sent to or from those ports will be displayed. You can specify multiple ports by separating them with a comma (e.g. 80, 443).

Threats Only

Requires that "Threat Intelligence" is checked. Will only display traffic from hosts that are deemed potentially malicious.

Statistics

Displays how many network packets and total number of kbytes that have been captured. Changing the current filter has no effect on the statistics, which always show the overall total.

Sorting, Copy & Paste

Data in the grad can by sorted by clicking any of the column headers. Rows in the grid an be selected and copied to the clipboard by pressing the CTRL+C key combination.


Screenshots

IPMon+ running on Windows Server 2012R2

IPMon+ running on Ubuntu Linux (deprecated)

IPMon+ running on OS X 10.6 (deprecated)


MXQuery

MXQuery displays all MX records associated with a domain or email address, including the MX preference level. Simple only shows the first (best) mail server. MXQuery can also attempt to connect to port 25 of the mail server to verify that the SMTP service is reachable.

Interface

Command-line

Files

gethttp.exe

Supported Platforms

Windows


Usage

Command Line Parameters

mxquery /s /v <domain|email>

/s | Simple mode, only returns the best mail server. Cannot be used with /v.
/v | Verifies connectivity by attempting to connect to port 25 of each mail server returned. Cannot be used with /s

Examples

Example 1: Return all mail servers registered for domain netikus.net

mxquery netikus.net

Example 2: Return only the best mail server for domain bbc.co.uk

mxquery /s bbc.co.uk

Example 3: Return all mail servers for domain bbc.co.uk and verify connectivity with each one

mxquery /v bbc.co.uk


ntpclient

NTPClient returns the current time as reported by a NTP server and calculates the local clock offset based on RFC 1315 and RFC 2030. NTPClient supports the NTP (Network Time Protocol) up to version 3.

NTPClient can optionally adjust the local time to match the time reported by the NTP server. Network latency is taken into consideration when calculating the clock offset, with a precision down to milliseconds.

Interface

Command-line

Files

ntpclient.exe

Supported Platforms

Windows


Usage

Command Line Parameters

ntpclient /set <NTP Server>

/set | Set the local time to the time retrieved from the NTP server
NTP Server | host name or IP address of the NTP server

Examples

Example 1: Retrieve the current time from host time-a.nist.gov

ntpclient time-a.nist.gov

Example 2: Set the local time to the time reported by host mydc.mydomain.local

ntpclient /set mydc.mydomain.local


pagesnpp

PageSNPP (SNPP stands for Simple Network Paging Protocol) sends short messages to pages using the SNPP protocol. You can only use PageSNPP if your paging provider supports SNPP.

PageSNPP itself has a message limit of 1500 characters, but check with your paging provider to see what their maximum supported message length for your plan and device are (usually less than 500).

For a list of SNPP servers check the web site http://www.notepage.net/snpp.htm.

PageSNPP returns an %ERRORLEVEL% of 0 when the message was sent successfully, and an %ERRORLEVEL% > 0 when the message could not be sent.

Interface

Command-line

Files

pagesnpp.exe

Supported Platforms

Windows


Usage

Command Line Parameters

pagesnpp <snpp server> <snpp port> <pager id> <message>

SNPP server | The SNPP server to use, check with your provider
SNPP port | The TCP port to us when talking to the SNPP server
Pager ID | The ID of the pager
message | The actual message to send to the pager

Examples

Example: Send the message "It is time to download & install EventSentry" to the pager ID 443234 via snpp.skytel.com:

pagesnpp snpp.skytel.com 7777 443234 "It is time to download & install EventSentry"


snmpinfo

Snmpinfo retrieves and displays a variety of information from a SNMP-enabled host. The information displayed depends on the data made available by the remote host and may include the following:

·System Information (e.g. Description, Operating System)

·CPU Usage

·Uptime

·Network Interfaces

·Disks (mount points)

·Running processes

·Virtual Machines (VMWare ESXi)

·Switch port mappings

The type of information retrieved reflects the data utilized by EventSentry, more data will likely be added over time.

Interface

Command-line

Files

snmpinfo.exe

Supported Platforms

Windows


Usage

Command Line Parameters

snmpinfo /u public <host>

<host> | Host name or IP address of host to query
/u <community | user> | SNMP v1/v2c community name or SNMP v3 user name
/a <MD5 or SHA> | SNMP v3 authentication algorithm
/passauth <password> | SNMP v3 authentication password
/c <DES | 3DES | AES> | SNMP v3 encryption algorithm
/passcrypto <password> | SNMP v3 encryption password
/e <EngineID> | SNMP v3 EngineID
/co <Context Name> | SNMP v3 Context Name
/coeid <Context EngineID> | SNMP v3 Context Engine ID

Examples

Example 1: Retrieve all available SNMP information from host webserver1.plasticoceans.org

snmpinfo.exe webserver1.plasticoceans.org


wakeonlan

The WakeOnLAN (WOL) utility sends a "magic" package to a network card, based on the MAC address. If the network card supports the "Wake On Lan" feature (and the feature is enabled in the BIOS of the computer), then the computer will power on automatically after receiving the packet.

if a router supports direct broadcasts, magic packets can also be sent to a router.

Interface

Command-line

Files

wakeonlan.exe

Supported Platforms

Windows


Usage

Command Line Parameters

wakeonlan /i <ip-address> <mac address>

/i ip-address | Optional: The IP address of a router or computer that is to receive the packet. Instead of sending the magic packet to the local broadcast address (255.255.255.255), you can also send it to a router which can then forward the packet to the local subnet. The router must be configured to allow direct broadcasts for this to work.
mac address | The MAC address of the NIC that is to be woken up

Examples

Example 1: Wake up the computer with MAC address 00-19-A9-06-F0-23

wakeonlan 00-19-A9-06-F0-23

Example 2: Wake up the computer with MAC address 00-19-A9-06-F0-23 but send the packet through router with IP address 192.168.3.1

wakeonlan /i 192.168.3.1 00-19-A9-06-F0-23


Password Assistant

Password Assistant is a GUI application that lets you update passwords of user accounts on multiple Windows NT, Windows 2000 or Windows XP machines. A good example is updating the Administrator password on all of your networks workstations.

You can obtain computer names to update from the network neighbourhood (with a filter option) or from a text file. The update process can also be logged to a text file.

AutoAdministrator has the same functionality than Password Assistant, plus many more features such as manipulating the remote registry, rebooting servers, controlling services and more.

Interface

Graphical

Files

PasswordAssistant.exe

Supported Platforms

Windows


Usage

To update a password on multiple machines launch the application and specify the username whose password you would like to update, the current password, and the new password.

Then you need specify which computers to update. Either choose a file that contains one computername per row or enter a wildcard into the "Filter" field:

Specifying a filter

Getting computers from a text file

To log the password update process to a text log file, specify it here:

To fill the computer list now press the Fill List button and you should see a screen similar to the one shown below:

To peform the update now press the Change Now button. If the update was successful then you will see an OK in the Status column:

If the update is not successful then you will see ERROR in the Status column with the respective error message in the Error Message column:

In the previous example above the password update was not successful because the current password for the user was incorrect.


Hints

Filter

You can use the "*" and "?" wildcard characters in the filter field. The asterix stands for any character ocurring zero or more times while the question mark stands for any character occurring one time only. The wildcard characters work just like they do in the Windows command line.

Note that computernames start with a \\, make sure you take this into consideration when typing your filter.

Updating Samba

It is possible to update user passwords on servers running Samba as well. This is not a feature of Password Assistant, instead Samba supports the standard Windows NT method of remotely changing a user password.


servicesecure

ServiceSecure resets service passwords by specifying the username and password rather than having to specify the service names themselves or changing the password manually.

Password changes of user accounts that are being used for services no longer have to be feared. Just run ServiceSecure and tell it what username has changed to what password, the rest is done automatically. ServiceSecure even restarts services after the password has been changed (optional).

ServiceSecure you change the password of service accounts in seconds on a number of machines (when used in a batch file).

Interface

Command-line

Files

srvsec.exe

Supported Platforms

Windows


Usage

Command Line Parameters

srvsec /r /c /u <username> /p <password> <hostname>

<without options> | enumerates all services, grouped by service account username
\\servername | Perform all actions on computer "servername"
/u <username> | List only services running under the specified username
/p <password> | Set the password to password. Only valid in conjunction with username.
/c /changepwd | Changes the password in the SAM database (or Active Directory, depending on network configuration)
/r /restart | Restart running service(s) after the password has been changed. Only valid in conjunction with the /u and /p options.

Examples

Example 1: Enumerate all services on host \\server1

srvsec \\server1

Example 2: Show all services on host \\fileserver that are using the DOMAIN\Administrator account

srvsec /u DOMAIN\Administrator \\fileserver

Example 3: Change the service password of all services that are using the DOMAIN\SrvAcc username to "yUye$#34ww:"

srvsec /u DOMAIN\SrvAcc /p yUye$#34ww:

Example 4: Change the service password of all services running on \\dbserver1 that are using the .\User1 username to "blaUip432" and restart the modified services

srvsec /u .\User1 /p blaUip432 /r \\dbserver1

Example 5: Change the service password of all services running on \\dbserver1 that are using the wupdup username to "blaUip432" and restart the modified services

srvsec /u wupdup /p blaUip432 /c /r \\dbserver1


Hints

Specifying Usernames

ServiceSecure distinguishes between builtin, local and domain accounts. To see how ServiceSecure specifies user accounts simply run it once without command line parameters (or with only the \\server parameter).

Builtin, Local and Non-Domain accounts should be prefixed with a ".\", like ".\Administrator".

Domain accounts should be prefixed with the domain name, like "DOMAIN\User1".

Service Dependencies

When specifying the /restart option the modified services will also be restarted. Note that services that depend on the modified services, even though unaffected, will also be restarted.

Example: You are modifying the service MSSQLServer which runs under the account "DOMAIN1\SQLUser". The service SQLServerAgent, which depends on MSSQLServer, runs under the LocalSystem account. However in order to stop and restart the MSSQLServer service the SQLServerAgent service will also have to be restarted. This is done automatically when the /restart switch is specified.


Navigation: Security Tools > servicesecure >

Return to chapter overview

Screenshots


tasksecure

TaskSecure resets scheduled tasks passwords by specifying the username and password rather than having to manually open and reset each scheduled task on your network after a password change.

Password changes of user accounts that are being used for scheduled tasks no longer have to be feared. Just run TaskSecure and tell it what username has changed to what password, the rest is done automatically.

TaskSecure can change the password of scheduled tasks in seconds on a number of machines (when used in a batch file). TaskSecure works on both the local host and remote machines.

Interface

Command-line

Files

tasksec.exe

Supported Platforms

Windows


Usage

Command Line Parameters

tasksecure /a /u <username> /p <password> /s <\\hostname>

<without options> | enumerates all scheduled tasks, grouped by account username
/s <\\hostname> | Perform all actions on host "servername"
/u /username | List only scheduled tasks running under the specified username
/p /password | For all tasks running under <username> set the password to password. Requires /u

Examples

Example 1: Enumerate all scheduled tasks on host \\server1

tasksecure /s \\server1

Example 2: Show all scheduled tasks on host \\fileserver that are using the DOMAIN\Administrator account

tasksecure /u DOMAIN\Administrator /s \\fileserver

Example 3: Change the account password of all scheduled tasks that are using the DOMAIN\SrvAcc username to "yUye$#34ww:"

tasksecure /u DOMAIN\SrvAcc /p yUye$#34ww:


Compliance Validator

A graphical utility which utilizes EventSentry's validation scripts to compare security (and other) settings of the local host with best practices, security frameworks and compliance requirements such as NIST, STIG, CMMC and many more.

EventSentry can continuously evaluate all applicable validation scripts on your entire network infrastructure - automatically in the background. Extensive reporting capabilities show results in seconds, and ensure that the entire network is in compliance.

Usage

The status bar (bottom left) will show the number of available scripts, tags and the release date of the validation scripts. Click the "Tags" button to display the list of available tags. Select one or more tags and click the "Run" button to start the verification. Individual checks can be skipped by clearing the check box. Results can be exported to a text file using the "Export" button.

Tags

To select a single tag, simply double-click the tag. Use either the CTRL or SHIFT buttons to select multiple tags and then click OK. Click the "X" button to clear the selected tags and display the scripts stats in the status bar. Tags are stored in the registry when the application is closed, and restored when the application is re-opened.

Results

Clicking the "Run" button will start the evaluation process, by launching each listed (and checked) scripts sequentially. Each script has 4 possible statuses:

·PASS

·FAIL

·WARNING

·N/A

PASS: Indicates that the test was successful and the system passed the check.

FAIL: Indicates that the current (security) settings on the host did not pass the check.

WARNING: Indicates that the test was successful and the system passed the check, but that additional steps may be necessary for full compliance.

N/A: Indicates that the check is not applicable to the local host, e.g. if the local system is a workstation but the check is for domain controllers.

The result of the check is displayed in the "Status" column and also indicated in the icon on the left side. Clicking a respective row will display details about the validation script status on the bottom of the dialog. To learn more about the check, including how to resolve a failure, either double-click the row or click the "More Information" button.

The status bar will show how many checks were successful and how many failed in the status bar, along with the overall duration of checks so far.

Export

Clicking the "Export" button will export the results to a text file, similar to the text shown below:

Time,Hostname,ID,Status,Executed,Errorlevel,Duration(s),Description

2023-10-31 20:04:27,somehost.somedomain.local,b505fc16-70d3-4275-bcc5-02fac2fdb3af,FAIL,OK,1,0,Accounts: User Account Control approval mode for the built-in Administrator must be enabled

2023-10-31 20:04:29,somehost.somedomain.local,3f0d630e-d744-450e-8e8a-6478118649fb,PASS,OK,0,0,Exploit Protection: system-level mitigation, Validate exception chains (SEHOP) must be on

2023-10-31 20:04:30,somehost.somedomain.local,bf06c136-7223-41ac-8288-e0940126a884,FAIL,OK,1,0,General: Machine inactivity limit must be set to 15 minutes or less, locking the system with the screen saver

2023-10-31 20:04:31,somehost.somedomain.local,20a8c861-e142-4e51-bf82-b0ef8bd1343c,PASS,OK,0,0,Remote Desktop Services: Must require secure Remote Procedure Call (RPC) communications

Interface

Graphical

Files

ComplianceValidator.exe

Supported Platforms

Windows


Event Message Browser

The Event Message Browser lets you review all the installed Message DLLs used by various system services and applications that log events to the event log. Additionally, you can also generate events to test any event log monitoring solutions (e.g. EventSentry) you have in place.

Please see the Online EventSentry Documentation for more information.

Interface

Graphical

Files

EventMessageBrowser.exe

Supported Platforms

Windows


Usage

The main dialog is context sensitive, and you can start browsing by selecting an event log from the top left. Once you have selected an event log, select one of the associated event sources to see a list of all registered event messages. Click an event to see a full preview of it, you may also generate a test event if the event appears in the event preview.

Please see the Online EventSentry Documentation for more information.


isadmin

IsAdmin detects whether a user is a member of the local Administrators group, either through direct membership in the Administrators group or through indirect membership through another group.

IsAdmin by default evaluates the currently logged on user (in whose context IsAdmin runs) but you can also specify a different username through the command line.

Workstation / Member Server vs. Domain Controller

If IsAdmin is executed on a workstation or member server then it will check the local Administrators group, but you can also force IsAdmin to check the Administrators group of the domain instead. When executed on a domain controller, IsAdmin has to check the domain's Administrator group.

Return Code (%ERRORLEVEL%)

IsAdmin returns 0 if the specified user is an Administrator or 0 if the user is not an administrator or an error occurred.

Interface

Command-line

Files

isadmin.exe

Supported Platforms

Windows


Usage

Command Line Parameters

When executing isAdmin, either batch mode (/b) or debug mode (/d) always need to be specified.

isadmin /b|d /e /f /u <username>

/b /Batchmode | Batch-mode, only outputs TRUE or FALSE. Cannot be used with /d
/d /Debugmode | Debug-mode, logs additional output. Cannot be used with /b
/e /uac | Only outputs "TRUE" if app is running inside an elevated shell (use with /b)
/f /ForceDomain | Always check the domain's Administrators group (instead of local Administrators group)
/q /NoQuickCheck | Disables a quick check which evaluates the security token of the current process instead of enumerating security groups. Quick check only works if the process is elevated.
<USERNAME> | Checks if USERNAME has administrative rights. If no username is passed then the currently logged on user is used. Always specify the username without the domain prefix.

Examples

Example 1: Check if user "john.doe" is a local Administrator

isadmin /b /u john.doe

Example 2: Checks if the currently logged on user is a member of the domain's administrator group

isadmin /f /d

Example 3: Output "TRUE" if isadmin.exe is running inside an elevated shell

isadmin /b /uac


LogEvent

LogEvent writes an event from the specified event source and event id to the application event log.

Interface

Command-line

Files

logevent.exe

Supported Platforms

Windows


Usage

Command Line Parameters

logevent /s <eventsource> /i eventid /c <eventcategory> /<logInformation|logWarning|logError> insertionString1 insertionString2 ...

/s <eventsource> | The event source under which to log the event (required)
/i <eventid> | The event id of the event (required)
/c <eventcategory> | The event category of the event (optional). This is a numerical ID that is defined in the event message file that is associated with the event source.
/logInformation /logWarning /logError | Log as information event Log as warning event Log as error event

Examples

Example 1: Log event id 500 from event source "Saturn Surveillance" to the event log with the warning severity

logevent /s "Saturn Surveillance" /i 500 /logWarning

Example 2: Log event id 550 from event source "Milky Way Reporting" with the insertion strings 15:00 and Successful to the event log as an information event

logevent /s "Milky Way Reporting" /i 550 /logInformation 15:00 Successful

In this example, the string "15:00" will be insertion string 1 (%1) and "Successful" will be insertion string 2 (%2). See this article for more information on insertion strings in event messages.


Logoff Delay

Logoff Delay logs off a user in a specified amount of time. This can be useful if you want to restrict the logon time of users.

In order to relay on Logoff Delay you will need to make sure however that users have no ability to kill running processes since Logoff Delay runs as a user process and can therefore be killed.

Interface

Command-line / None

Files

logofdel.exe

Supported Platforms

Windows


Usage

Command Line Parameters

logoffdel /t <timeout> /l <logfile> /f /i

/t timeout | Seconds after which the user will be logged off
/l logfile | Full path to a debug log file
/f | Force a logoff, no questions will be asked and unsaved data will be lost
/i | Detach from the console and become "invisible". The process can still be seen and controlled through task manager

Examples

Example 1: Logoff a user after 5 minutes and hide the application

logoffdel /i /t 300

Example 2: Logoff a user after 10 minutes, write information to the logfile c:\logoff_delay.txt, hide and force a logoff

logoffdel /l c:\logoff_delay.txt /f /i /t 600


ProcessDmp

ProcessDmp creates a process (memory) dump of the specified process that can later be used by various debugging tools such as WinDbg. Dump files can be optionally compressed. The file name used is compromised of the process name, PID and a timestamp, e.g. notepad.exe_17576_1586210388.dmp.

Interface

Command-line

Files

processdmp.exe

Supported Platforms

Windows


Usage

Command Line Parameters

processdmp /f /c /o <outputdirectory> processName

/f | Create full memory dump instead of minidump
/c | Compress dump file
/o <outputdirectory> | Change output directory, default is current directory
processName | The name of the process for which the dump file should be created, e.g. "notepad.exe". ProcessDmp will create multiple dump files if multiple instances of the process exist

Examples

Example 1: Create a dump file for Notepad in the current directory

processdmp notepad.exe

Example 2: Create a compressed dump file for all instances of myapp.exe in C:\Dumps 15:00 and Successful to the event log as an information event

processdmp /c /o C:\Dumps myapp.exe


servicescheduler

ServiceScheduler is a scheduler service which controls (stops, starts, ...) services at specified times. It is independent from the Windows built-in scheduler service.

Example

For example, you can stop the SQL Server service every weekday at 2am in the morning, and start it again at 5am in the morning.

Logging

ServiceScheduler logs its activity to the log file %systemroot%\servicescheduler.log. This behaviour cannot currently be disabled.

Interface

None

Files

servicescheduler.exe service file, will be copied to %systemroot%\system32

servicescheduler.ini configuration file, needs to be present in %systemroot%

Supported Platforms

Windows


Installation

The ServiceScheduler service and files are automatically installed with the setup routine. To install the service manually, without the installer, follow these steps:

1. Copy the files servicescheduler.exe and servicescheduler.ini to the machine where you want to install the service. The configuration file servicescheduler.ini may be created from scratch.

2. Run servicescheduler.exe /install to create the service and have the file servicescheduler.exe copied to the %SYSTEMROOT%\system32 directory.

3. Copy the servicescheduler.ini to the same directory where servicescheduler.exe is located

3. Configure the service configuration file servicescheduler.ini (see next chapter on syntax)

4. Run servicescheduler.exe /start to start the service


Configuration

The ServiceScheduler service is configured with the configuration file servicescheduler.ini which needs to be located in the same directory as servicescheduler.exe (the installation directory by default).

Lines starting with a hash # or and exclamation mark ! will be treated as comments and not interpreted. The syntax for the actual instructions is as follows:

[Service Name],[Service Action],[Time],[Mon.Tue.Wed...Sun]

Service Name | The name of the service. This is not the display name of the service, but the real name of the service
Service Action | The action you want to be taken. Actions include: ·start ·stop ·restart ·pause ·continue
Time | The time at which the action should be performed. Note that the European time format is required, for example: 02:50 11:35 15:30 21:00
Weekdays | The weekdays on which the action should be performed. You may specify between one and seven weekdays. Weekdays include: ·Mon ·Tue ·Wed ·Thu ·Fri ·Sat ·Sun Multiple weekdays have to separated by a dot (.). Please see below for configuration examples.

Important: You will need to stop and restart the ServiceScheduler service whenever you make changes to the configuration file servicescheduler.ini.

Configuration Examples

Example 1: Stop the Print Spooler ("spooler") service weekdays at 10pm, and start the service again at 10:15pm

spooler,stop,22:00,Mon.Tue.Wed.Thu.Fri

spooler,start,22:15,Mon.Tue.Wed.Thu.Fri

Example 2: Stop the MS SQL Server service daily at 3am and restart it again at 4am

MSSQLServer,stop,03:00,Mon.Tue.Wed.Thu.Fri.Sat.Sun

MSSQLServer,start,04:00,Mon.Tue.Wed.Thu.Fri.Sat.Sun

If you only know the service display name but not the service name, then open regedit.exe and navigate to HKLM\System\CurrentControlSet\Services to determine the service name.


Security

When running ServiceScheduler in secure environments you can take the following steps to make ServiceScheduler more secure:

·Assign an account other than the SYSTEM account to the service. Make sure this account has the privileges to control the desired services.

·Make sure only authorized users can access the configuration file servicescheduler.ini in the installation directory.


sleep

Sleep sleeps for X milliseconds and is designed to be used in batch files.

Sleep returns an %ERRORLEVEL% of 0 when the sleep received a valid argument and paused processing for > 0 milliseconds.

Interface

Command-line

Files

sleep.exe

Supported Platforms

Windows


Usage

Command Line Parameters

sleep milliseconds

milliseconds

Milliseconds to wait

Examples

Example 1: Sleep for 1 second

sleep 1000

Example 2: Sleep for 2.5 seconds

sleep 2500


ShutdownTimer

ShutdownTimer performs certain system actions either at a certain time or in a specified amount of time. The conditional feature allows you to make the selected action based on whether certain files open over the network. See Usage for more information.

Examples

·Shut down your computer in 1 hour

·Logoff the current user in 10 minutes

·Hibernate the computer at 23:30:00

·Reboot a server at 4AM in the morning

·Reboot a server when no users have files open for WRITE access

Interface

Graphical

Files

ShutdownTimer.exe

Supported Platforms

Windows


Usage

Selecting an Action

You can choose one of the following actions in the What? section:

·shut down (power off)

·reboot

·stand by (only Windows 2000+ and if supported)

·hibernate (only Windows 2000+ and if supported)

·logoff

·lock screen

Forcing applications to close: Check the Force checkbox to force applications to close when you perform a Power Off, Reboot or Logoff action.

Selecting this option might result in the loss of data if open applications contain unsaved data.

Choosing the Timer Type

You can either perform the select action by using a countdown, by specifying the exact time or by selecting a conditional countdown.

Countdown:

Performs the selected action after the countdown has expired.

Time:

Performs the selected action at the specified time.

Conditional Countdown:

Performs the selected action as soon as no remote users have files open over the network on this machine (server). The selected action will be performed immediately if there are no files open at the time you click the START button. The specified timer (e.g. 3 hours) is basically the maximum period of time you are willing to wait for. While the countdown is running, ShutdownTimer will continuously enumerate all open files and only proceed with the selected action if there are no open files.

ShutdownTimer will not do anything if the countdown has elapsed and there are still files open, UNLESS you check the "Proceed even if files are open at end of countdown" option.

For more information see Conditional Countdown Options.

Starting the countdown

To start the countdown, enter the desired time interval / time in the Timer section and click on Start. You can pause the the countdown anytime by clicking the Pause button either in the dialog or in the context menu of the tray icon. To pause and clear the entered time press the Clear button.

Command Line Parameters

To start ShutdownTimer minimized (as a tray icon) execute

shutdowntimer.exe /hide

with the /hide command line parameter.


Conditional Countdown Options

The conditional countdown feature is useful when you need to restart a server, but need to wait until (almost) nobody has network files (office documents, databases, etc.) open on the server. Rather than checking the open files periodically, you can have ShutdownTimer do the work for you.

For example, to perform a conditional reboot when all files are closed over the network follow these steps:

1.Select the appropriate action, Reboot in this case. You may want to check Force as well.

2.Set the timer to the maximum amount you want ShutdownTimer to wait, for example 8 hours.

3.Select the Conditional Countdown option, watch the "Currently Open Files" list.

4.Check either the READ, WRITE or both check boxes.

5.Exclude any files and/or users that can be ignored - ShutdownTimer will still proceed even those are open. For example, specify *.tmp.

6.Set the timeout period, for example 6 hours.

7.Click Start.

With the above settings, the server will be rebooted as soon as no files are open over the network, files ending in .tmp will not count. This means that a reboot might be triggered as early as one second, or as late as 5 hours, 59 minutes and 59 seconds later. To reboot the server even when files are open at the end of the countdown, check the "Proceed even if files are open at end of countdown" checkbox.

Conditional Countdown Options

The following options are only available when selecting "Conditional Countdown" as the timer type. These options allow you to specify which open files ShutdownTimer should take into consideration during the countdown.

Check files in READ mode

Enumerate files that open for READ access. You will have to check either READ and/or WRITE access.

Check files in WRITE mode

Enumerate files that are open for WRITE access. You will have to check either READ and/or WRITE access.

Proceed even if files are open at the end of countdown

If there are still files open when the countdown has expired, then proceed with the selected action anyway.

Ignore the following files

You can ignore certain files by listing the file names or parts of the file names (use wildcards) here. For example, you can ignore all temporary and text files by specifying *.tmp,*.txt.

Ignore the following users

You can ignore files from one or more users by listing the user names, separated by comma. You can use wildcards with the usernames as well, e.g. *johndoe*.

Currently Open Files

This field shows you the first five open files on your server and is updated every second. If you specified files and/or users to be ignored, then those files/users will not show up in this field.


Tray Icon

To minimize ShutdownTimer to the System Tray you can:

·Simply minimize ShutdownTimer

·Click on the To Tray button

·Enter ALT+T on the keyboard

·Right-Click the system tray icon and choose "Minimize"

To reactivate it:

·double-click the icon

·right-click the icon and choose "Maximize"

Clicking Exit will close ShutdownTimer.


uptime

Uptime displays the current uptime of the local host. Uptime can either update the current uptime every second and display it on the screen, or it can return the uptime one time and return. You can also have uptime return the uptime in seconds.

Interface

Command-line

Files

uptime.exe

Supported Platforms

Windows


Usage

Command Line Parameters

uptime /s /o

/o /once | displays the current uptime one time and returns
/s /secs | displays the uptime in seconds, instead of a formatted date and time

Examples

Example 1: Display the current uptime on the screen and automatically refresh it automatically every second

uptime

Example 2: Display the current uptime, in seconds, one time on the screen

uptime /o /s


EventSentray (Tray App)

Navigation: Windows Tools >

Return to chapter overview

EventSentray (Tray Application)

EventSentray is a background application that resides in the system tray and provides the user with a system status of the host where it's running on.

Tray Icon

The tray icon is dynamic and will show the EventSentry logo by default. Hovering over the icon will show the current host name along with the current uptime. The app monitors the CPU and disk queue length in the background and will dynamically change the tray icon to either a CPU or DISK icon if high utilization is detected:

CPU Alert: CPU usage 85% or higher

CPU Warning: CPU usage 70% or higher

Disk Warning: Disk queue length 3 or higher

Internet Test

Verifies the current Internet connection by performing a number of tests every second.

DNS: Verifies whether a DNS query was successful.

Gateway: If available, pings the gateway IP address

Packet Loss / Delay: Ping results

IP Address / Hostname: Public IP address and host name (if available)

WiFi SSID: The current Wifi SSID, if adapter is connected to a WiFi network

System Information

The sytem information dialog shows additional performance stats and system information and can be displayed by either double-clicking the tray icon or by right-clicking the icon and selecting "System Information".

The system information dialog shows the following information:

·CPU utilization

·Memory utilization

·Disk utilization

·Disk space usage of all physical disks

·Top 3 processes (CPU utilization)

·Top 3 processes (memory utilization)

·Current IP address and link speed

·Indication whether host needs a reboot

·Battery health (when applicable)

·Other logged on users (if any)

Since the EventSentray application does not run elevated, the top processes shown may not include system processes or processes from other users that are not accessible with the default process elevation level.


SeriMon

Serimon reads data from a COM port and displays it in the command line. Data is either displayed as is in ASCII mode, or formatted for select sensors (currently only the DEVMO SDS011 is supported).

Interface

Command-line

Files

serimon.exe

Supported Platforms

Windows


Usage

Command Line Parameters

serimon /c <COMPORT> /s DEVMO_SDS011 /l /d <DELAY>

/c COM[1..9] | the COM port to open, virtual COM ports are fully supported
/s DEVMO_SDS011 | ASCII | how to interpret the data
/l | lquery data indefinitely, abort with CTRL-C
/d delay | use with "/l", delay in ms between continuous iterations
/header | shows header (only useful when used with /s other than ASCII)

Examples

Example 1: Display all data returned on COM3 as text

serimon /c COM3 /s ASCII

Example 2: Display results from the DEVMO SDS011 sensors on COM4 and keep refreshing every 2 seconds

serimon /c COM4 /s DEVMO_SDS011 /l /d 2000


Credits

We would like to thank the following companies and projects, without which the EventSentry SysAdmin Tools in its current form would not be possible:

· Artua

· tcpdump/libpcap project

· WinPcap project


WinPcap

Copyright (c) 1999 - 2005 NetGroup, Politecnico di Torino (Italy).

Copyright (c) 2005 - 2008 CACE Technologies, Davis (California).

All rights reserved.

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.

2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

3. Neither the name of the Politecnico di Torino, CACE Technologies nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

This product includes software developed by the University of California, Lawrence Berkeley Laboratory and its contributors.

This product includes software developed by the Kungliga Tekniska Högskolan and its contributors.

This product includes software developed by Yen Yen Lim and North Dakota State University.

Portions Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997 The Regents of the University of California. All rights reserved.

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.

2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

3. All advertising materials mentioning features or use of this software must display the following acknowledgement: "This product includes software developed by the University of California, Berkeley and its contributors."

4. Neither the name of the University nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Portions Copyright (c) 1983 Regents of the University of California. All rights reserved.

Redistribution and use in source and binary forms are permitted provided that the above copyright notice and this paragraph are duplicated in all such forms and that any documentation, advertising materials, and other materials related to such distribution and use acknowledge that the software was developed by the University of California, Berkeley. The name of the University may not be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.

Portions Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan (Royal Institute of Technology, Stockholm, Sweden). All rights reserved.

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.

2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

3. All advertising materials mentioning features or use of this software must display the following acknowledgement: "This product includes software developed by the Kungliga Tekniska Högskolan and its contributors."

4. Neither the name of the University nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Portions Copyright (c) 1997 Yen Yen Lim and North Dakota State University. All rights reserved.

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.

2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

3. All advertising materials mentioning features or use of this software must display the following acknowledgement: "This product includes software developed by Yen Yen Lim and North Dakota State University"

4. The name of the author may not be used to endorse or promote products derived from this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Portions Copyright (c) 1993 by Digital Equipment Corporation.

Permission to use, copy, modify, and distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies, and that the name of Digital Equipment Corporation not be used in advertising or publicity pertaining to distribution of the document or software without specific, written prior permission.

THE SOFTWARE IS PROVIDED "AS IS" AND DIGITAL EQUIPMENT CORP. DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL DIGITAL EQUIPMENT CORPORATION BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

Portions Copyright (C) 1995, 1996, 1997, 1998, and 1999 WIDE Project. All rights reserved.

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.

2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

3. Neither the name of the project nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE

ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS

OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY

OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. Portions Copyright (c) 1996 Juniper Networks, Inc. All rights reserved.

Redistribution and use in source and binary forms, with or without modification, are permitted provided that: (1) source code distributions retain the above copyright notice and this paragraph in its entirety, (2) distributions including binary code include the above copyright notice and this paragraph in its entirety in the documentation or other materials provided with the distribution. The name of Juniper Networks may not be used to endorse or promote products derived from this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.

Portions Copyright (c) 2001 Daniel Hartmeier All rights reserved.

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

- Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.

- Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTOR "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Portions Copyright 1989 by Carnegie Mellon.

Permission to use, copy, modify, and distribute this program for any purpose and without fee is hereby granted, provided that this copyright and permission notice appear on all copies and supporting documentation, the name of Carnegie Mellon not be used in advertising or publicity pertaining to distribution of the program without specific prior permission, and notice be given in supporting documentation that copying and distribution is by permission of Carnegie Mellon and Stanford University. Carnegie Mellon makes no representations about the suitability of this software for any purpose. It is provided "as is" without express or implied warranty.


Questions or Problems?

Questions

If you still have questions after reading this manual then please post a question in our support forums:

forums.netikus.net

and include the following information:

·The Operating System (incl. Service Pack Version) on which EventSentry SysAdmin Tools is running

·The version of EventSentry SysAdmin Tools

·Your question

Problems

If you are experiencing problems with EventSentry SysAdmin Tools then please visit our support forums:

forums.netikus.net

and include the following information:

·The Operating System (incl. Service Pack Version) on which EventSentry SysAdmin Tools is running

·The version of EventSentry SysAdmin Tools

·An exact description of the problem. Include information such as:

- Does this problem occur on one or more installations?

- Did it happen once or does it happen repeatedly?

· - What can we do to reproduce the problem?


Suggestions?

Nobody is perfect and neither is EventSentry SysAdmin Tools. We have implemented many features from customer suggestions in the past!

If you are missing a feature and would like to see it in a future release then please write to:

support@netikus.net

and include all or some of the following information:

·A description of the feature

·Why and how this feature would benefit you

·An example

After looking through your request we will get back to you and let you know if and when we will add your feature to EventSentry SysAdmin Tools.


Other Software from NETIKUS.NET

If you like the EventSentry SysAdmin Tools then you might just want to check out our other software:

 | Description | License
EventSentry | Event log, system and network monitoring software with many features | Commercial
EventSentry Light | Free version of EventSentry with limited functionality | Freeware
EventSentry Admin Assistant | Software to automate common tasks of Administrators | Freeware
Gateway IP Monitor | Monitor the IP address of your default gateway when using NAT | Freeware