Greyware Membership Monitor 1.3b

If an unauthorized user adds a username to a privileged Windows 2000 or Windows NT user group, the consequences could be serious. And if the user later removes the username from the group, the security violation might be difficult to track. Neither Win2K nor NT can audit changes to user group membership, leaving a key security area vulnerable.

Greyware Membership Monitor (GWMM) 1.3b monitors and reports any change to the membership of a configured Win2K or NT user group. GWMM operates on all Win2K and NT platforms. However, the product is best suited for installation on one server per domain, and preferably on a domain controller (DC). Installing GWMM on a DC enables the product's realtime alerting capabilities.

Installation on my Win2K server took less than 30 seconds. A remote installation function lets you install the product on remote systems and systems in trusted domains. The product installs and runs as a service, and the administrative interface, which Figure 1 shows, is a Control Panel applet. The interface lets you configure a variety of group-membership-related functions to monitor. Two boxes list monitored and unmonitored groups, and the Add and Remove buttons let you move groups between the boxes. GWMM gives you the flexibility to monitor any or all groups.

When you select a group in the Monitored Groups box, check boxes let you configure which change functions you want to monitor, what kinds of alerts to send, and where you want GWMM to send the alerts. You can tell GWMM to monitor group additions, group deletions, or both, and you can specify whether to record changes in the event log. GWMM can use email alerts and administrative alerts. Both alert modes are simple to configure and send alerts almost instantly when the product detects group changes.

GWMM monitors the DC's user account database to detect group changes. Consequently, when GWMM runs on the DC, the software can provide realtime alerts in response to changes in group membership. If you install the software on one machine and want to monitor another system's user database for group changes, you can use the Data Source function to connect to the remote system's database. This function worked well, but by design it relies on a scheduled synchronization between the local and the remote systems and thus can't provide realtime alerts.

One shortcoming of GWMM is that it runs as an NT service, using the system account logon. Any privileged user can stop the service and make group changes. Although GWMM will log the changes, the software can't send an alert until you restart the service. Consequently, the system's integrity relies on the trustworthiness of administrators on the machine on which the product is installed. However, many products rely on a level of personal trust within the Admin group. Because this deficiency is a limitation of Windows security rather than a problem with Greyware's implementation, it didn't compromise my overall good impression of GWMM.

End of Article