Welcome to MSDN Blogs Sign in | Join | Help

My colleague and friend Feliciano started a Security-related Blog

Surely he will write more about security @microsoft than I do. Here he goes: http://blogs.technet.com/feliciano_intini/default.aspx
Welcome to the blogging scene, Feliciano! Keep up the great work!

Note: The blog above is written in italian, and it is addressed to italian IT Professionals having to deal with security.

Posted by dmuscett | 0 Comments
Filed under: , ,

Probably my last post here...


No, I am not leaving the company. It's just that I have been busy with *real* work (as opposed to blogging), busy with family, with a million of other things. In fact you can see that I have not written here in a while.

Not having written for a while, and writing now with this "title" of this one being the last post are results of the following issue: I am not into product teams, so I am not "authoritative" on anything really. Due to this, and due to my nature of enthousiast of many things (as opposed to specialized in a few), I have been increasingly afraid of being misunderstood, of possibly having my own personal thoughts confused for "official" statements when written here....

So I started using more and more again my personal blog at http://www.muscetta.com

At that point, I started being relaxed again about blogging, and actually writing my mind in it. Which is how it is supposed to be, IMHO. So I will keep writing there, and you can follow me up there, if you like. That said, in case you actually are one of my 5 readers. Thanks  :-)

Posted by dmuscett | 1 Comments
Filed under:

Using SharePoint WebService to generate a RSS Feed

This small progran is born to scratch a personal itch (like many others).
Before you read on, you HAVE to be warned that it is nowhere close to being "production quality" code, but it *just* works for me.
As you will see I am a TERRIBLE coder - I am mostly self-taught, and I DO NOT CODE FOR WORK - I mainly come from an IT Pro / System management background.
Also for this reason though, if you feel like giving (constructive) comments and criticism, or maybe even HELP OUT to clean this code, please feel free to comment here on the blog or drop me a line.
The purpose of the program is to be used as an example: it shows an approach, a technique that can be used for the problem at hand.
But which problem was it ?
I started using Sharepoint Portal Server to host a photoblog, but it did not natively support RSS to see when new photos were added. So it sounded more as a standard site than as a "blog" thing to me. It was nice an easy to edit and post photos and other things to it, but it did not feel "blog" enough due to the lack of RSS.
Searching on the web I did find some nice RSS Feed generator for Sharepoint, in the form of "web parts".
Which is ok for performance: they have te database very close, they can extract all of the IDs and the other interesting fields from lists, and re-publish those lists as RSS. Which works obviously great.
But the problem I encountered with those is that you basically need to have your own server to INSTALL them and configure IIS for them first, to be able to use them.
Or you would have to wait until when Sharepoint (next version, in the makings -  http://radio.weblogs.com/0001011/2005/09/17.html#a11176 ) will provide RSS out-of-the-box.
Yep, now it has been announced, but when I started feeling that this feature was lacking, nobody knew SharePoint would eventually get out-of-the-box-feeds, sooner or later.
Anyway, so far we are on the old version, I am in a situation where I couldn't "ADD" this functionality to it, even though I wanted it BADLY, as I am an RSS addict.
I did not have control on the Sharepoint I used, I couldn't install parts or modify it in any way - it is hosted and managed by someone else.


So I decided to make this quick and dirty hack to provide myself the functionality I wanted *without* having to do anything on the server itself.

This pet project passed thorugh several phases:
The first version of this was a VBScript based on WinHttp, which was parsing the HTML output remotely. That was REALLY ugly. It worked for ONE site, but it needed MAJOR readjusting to be used for another.
The intermediate version was also ugly, but with an attitude:
In fact it already referenced the WEBSERVICE for the Sharepoint site I mean to use, and it used it to retrieve the list of items I am interested in.
At this point it uses the information in the list to build the RSS feed, as output. The idea was there, but it was REALLY badly coded, there was a lot of hardcoded things (which forced you to recompile it to use a different site, or even a different list), and it used STRING functions to extract STUFF out of the XML the webserver gave you. HOW BAD!! HOW UGLY!! Still, it worked pretty well for what it had to do, but I wasn't happy with it.

So I went to a major rewrite of it, and this version changes a lot of things:
- it abandonds VB.NET in favour of C#;
- as a side-effect of the language change, it now works on MONO (http://www.go-mono.com) - thus not only on the MS .NET Framework - I tested it with success on mono version 1.1.8, with the only exception NOT tested being the code that handles the PROXY usage, which relies on Internet Explorer settings (GetDefaultProxy), so I doubt it will work. But I got it compiled on WIndows XP SP2 with Visual Studio 2003, just copied the executables to my Debian Linux box.... et voila'... it runs. I am running it from there without issues so far;
- it parses command line parameters (thanks to Mike Ellison for the CommandLineParser.cs code - http://www.codeproject.com/csharp/CpCommandLineEmailer.asp);
- it is indipendent from a single Sharepoint site: the way I build the reference to the webservice (allowing it to be replaced by a variable) is a dirty hack, but it should work for all Sharepoint sites of the ssame versions (I don't do the wsdl stuff properly, but can "point" to different sites using the same software and same webservice version... I don't have infinnite SharePoint sites to test this against, but I've tried a bunch of them without problems);
- it Can both enumerate lists on a given site, or the elements for a give list (and build a feed for it in the latter case);
- you can enable/disable the use of proxy (again, it relies on Internet Explorer Settings);
- it actually uses the proper XML handling classes and stuff and does not rely on string functions anymore;
- I am not crafting my output feed manually anymore as I was, I rather leveraged other people's work and adopte a "proper" RSS-generation library (RSS.NET - http://rss-net.sourceforge.net/);

 


So, how does it work ?
I provide the Visual Studio project, so full source code (or it wouldn't be useful as an example!).
You can run the executable in any DOS (CMD) box, and it will tell you its command line switches and some usage information:

  SURFCLI [-server:URL] [-list:List] [-proxy:YES] [-debug:YES]
          [-proxyuser:DOMAIN\username ||
user@domain.dom] [-proxypass:password]

for example a typical command line would be the following:

SURFCLI -server:http://www.mysite.com/sharepointsite -list:PHOTOS -limit:20

this will output the RSS to console, so in the DOS box.
To save it on a file you can simply pipe it to it:

SURFCLI -server:http://www.mysite.com/sharepointsite -list:PHOTOS -limit:20 >c:\directory\RSSFeed.xml

And this is an example of the feed you get:

(By the way, the above feed, you could look at it yourself, you can find it at http://www.muscetta.org/rss/RSSMuscettaWinIsp.xml).

 

Most command line switches are self-describing (like the proxy usage), with the exclusion (maybe) of the "-debug" switch, which will print some seemingly meaningless information (that is, debugging...) like the Xml returned from the webservice (uninterpreted), the list of fields, etc. Everything BUT a feed, anyway. This info is only useful if you are trying to figure out why a certain list gives you strage results (hey, I could not test everything!), but you won't use it normally.
Shorty, the "-debug" switch will NOT output a feed, but some garbage containing the fields which should have gone into the feed.
So you probably won't normally need to worry about it at all.

 


Why didn't I use the SharePoint object module ? Simple.... again, this is NOT meant to be running ON the sharepoint machine, otherwise it would have been nice and easy.

There are several examples of this other technique on the web (for example http://weblogs.asp.net/jan/archive/2004/04/16/114488.aspx), and it DOES make sense doing it that way if you are generating the feed locally at the server, and you can operate on it.
This is another "gateway" or "converter" approach. Since it is unconventional, I dubbed it "unortodox", and came up with a name of "S.U.R.F." (Sharepoint Un-ortodox RSS Feed).

 

What is still missing and could improved ?
Simple Answer: A lot of things.
Detailed Answer, or a list of what I think should be addressed (but I haven't got time to do it right now):
- Better input filtering to avoid security issues (I have not paid a lot of attention to it, I have to be honest);
- Better error handling and especially a more consistent one thorugh the program (maybe incorporating all errors in the "debug" switch/routines);
- Adding an "-outputfile" or similar switch, to let the program WRITE the feed instead of piping from console, to avoid messing up the generated feed... which gets written to console now;
- Fix the proxy code not to rely on Internet Explorer Settings, so that it would also work on MONO;
- test it with https (currently only http is the tested protocol) - it should make no difference, but I am afraid "http://" is hardcoded somewhere. I just did not bother doing this as my sharepoint were not using SSL. This should be easy to change, you need to manipulate the strings differently;
- This is currently limited to lists which are "photo collections" or albums... thus a thumbnail of the pic is included.... should be made more generic so that it can support other lists (it already does, just the output is strange in that case);
- could xsl transforms be used to convert from one XML format to another ? maybe.
- some comments in the code are in Italian - bear with me, many others are in english on the contrary :-)

...and possibly so much more!
But again, if you want to improve it, please feel free to help me :-)

Oh! I was nearly forgetting one important bit of information: where the code actually IS...
and here we go: it's attached to this post.

 


References:
http://www.microsoft.com/sharepoint/server/downloads/tools/SDK.asp
http://rss-net.sourceforge.net/
http://weblogs.asp.net/jan/archive/2004/04/16/114488.aspx
http://www.codeproject.com/csharp/CpCommandLineEmailer.asp



Disclaimer:
The information in this weblog is provided "AS IS" with no warranties, and confers no rights. This weblog does not represent the thoughts, intentions, plans or strategies of my employer. It is solely my own personal opinion. Inappropriate comments will be deleted at the authors discretion. All code samples are provided "AS IS" without warranty of any kind, either express or implied, including but not limited to the implied warranties of merchantability and/or fitness for a particular purpose.
THIS WORK IS NOT ENDORSED AND NOT EVEN CHECKED, AUTHORIZED, SCRUTINIZED NOR APPROVED BY MY EMPLOYER, AND IT ONLY REPRESENT SOMETHING WHICH I'VE DONE IN MY FREE TIME. NO GUARANTEE WHATSOEVER IS GIVEN ON THIS. THE AUTHOR SHALL NOT BE MADE RESPONSIBLE FOR ANY DAMAGE YOU MIGHT INCUR WHEN USING THIS PROGRAM.

 

What do I actually do for work ?

I am a TASE, which is the acronym for "Technical Account Support Engineer". I work for Microsoft in the Premier Organization, Services Division. I am part of the worldwide group of people who are in charge of Customer Support and Satisfaction.

Basically my role is that of a Support Engineer who is pretty much dedicated to a specific customer (but I won't get into details about who my customer is).
This means I am very often at the customer site, and seldom in the office, often connected through extranet and VPN if I need accedd to corporate resources.

But this especially means that I am the first line with this customer in everything: I am already there, so they usually first ask ME if something is doable and how.
I *am* Microsoft for them, and that brings expectations on their side and responsibilities on mine. Which is fair enough, and they are usually happy with what I do: I am a tech person, so I mainly solve their problems, but in a broader fashion, with which I mean that a "problem" does not have to be strictly seen as a MALFUNCTION.
A problem might well be a pain of a customer who's got everything working fine but he can't decide on his own which approach would be best to do something, with the technology he already has. So I also help them to better understand the value of the technology they are using: how to use them better, how to get most out of them, how to PREVENT problems. PREVENT: This means that my role is not quite reactive as it is PRO-Active. In fact, I constantly try to spot where issues MIGHT arise, BEFORE they actually can have a chance to do it, and I suggest and implement solutions and workarounds as well as I push the use of best practices to AVOID problems in the first place.

While the classic reactive support person usually is evaluated on the basis of how many TOUBLEs he managed to fix, I get considered ass doing a better job when customer DON'T actually have ANY trouble. At least, no big trouble. For my managers, "no news is good news" in a way. This does not mean they don't care, of course! Nor it does mean that problems aren'r there at all; sometimes is not possible to anticipate or prevent everything. But even when I don't manage to ANTICIPATE the problems and prevent them from happening in the first place, at least I fix them quick while on-site, when they are little, before they explode or grow bigger, before there's a need for escalating them (to one of the reactive engineers mentioned above).

This also means that I need to know a bit of everything of the amount of products Microsoft produces,  that I don't follow any specific technology in particular: I use them ALL.
It is not uncommon though that I solve things myself while on the frontline ("in the Field" as you might say).
This might be REALLY anything: any technology on every platform. You have some days where you do the most diverse things: you have to optimize the configuration of a connector in Exchange, prepare that backup plan for a sQL Server, fix a piece of ASP.Net code, find out that fix for that silly outlook behaviour, help the IT manager of the customer in defining operational policies, configure that rule in ISA Server, know the impact of the Security Patches and Bulletins that have been released and explaining them, roll-out Service Packs... whatever, really.
...basically I get to use nearly every product we ship, and provide advice on all of them.

Does this by any chance clarifies the title of my blog ? (Ref.: "a security enthusiast Tech Support Guy at MSFT... doing everything else as well when needed :]")

 

At the same time, though, I don't have to be a GURU in any of them specifically: when a SERIOUS problem arises I can escalate to the structure that's behind me in this amazing company, where you have all sort of specialists, vertically and specifically skilled in depth on just one OR another technology in particular.

Basically I act as as someone who FACILITATES the Operations at the customer site, keeping the infrastructure running at best, and helping driving its satisfaction to high levels.


My proactive tasks sometimes include some support to developing custom solutions that are too small to be considered a "project" (which would otherwise be dealt by Microsoft Consulting Services) but that nonethless requires implementing new things, new code, new stuff, as well as coordinating people, setting schedules and this kind of things.


And also, someone might be thinking: "WHY didn't I move the blog from MSDN (developer-centric) to Technet (IT pro-centric)?". Many colleagues did so.
Well I got two answers, the first is very simple: It has maynly been lazyness.
The second is as follows: I know I might sound more of an "IT Pro" than a Developer (an probably am)... on the other end I have to do with System Administration and Operations stuff, but also it is not uncommon to write small scripts and procedures, deal with SQL Server and SQL Reporting Services, checking web applications for security issues.... how does it qualify ?
I never liked too-stricly-defined drawers and categories, and I am afraid of those too clear specializations: I never fit in any of them really, I tend to see myself as someone who likes to SPAN multiple categories.


For example, together with the customer I created a whole bunch of cool reports on the usage of email in the company, pulling data out of MOM, where MOM was not natively providing that kind of reports out of the box.
The same day I am testing the impact of a service pack on the operating system. YOu never know, every day is different, every day you learn something new, every day you got new things to tackle, or old ones to repeat. It really depends.


Why do I tell you all of this ?
Firstly, because I have not been blogging (here) in a while. I did blog on my PERSONAL site instead, but they were personal stuff: they were just personal rants, so they are probably not interesting for anyone here. And the last post HERE was so old that it started stinking :-)

Second, because I thought it would be interesting for at least someone tou know WHO I am and what I do, and I think it is an important thing to know who are you talking to.
Otherwise, bear with me.
But.... if you read till here and it wasn't of interest... why did you read it then ? :-)

Cheers.

In the good old days it was md5sum, now it's FCIV.EXE - A good tool for host security

Michael Howard mentions he has found the File Checksum Integrity Verifier:
http://blogs.msdn.com/michael_howard/archive/2005/05/12/416741.aspx
You can find it too, on
http://support.microsoft.com/default.aspx?scid=kb;en-us;841290

This little tool is awesome, and I was also unaware of it.

In fact, in the unix world is quite common to calculate hashes of *everything* on a machine (usually md5 hashes, but it doesn't matter which kind) to keep on a CD or floppy just in case the machine has been compromised. This way the machine is "prepared" for an incident.
In the HoneyNet Project's challenges, this has often been the key (see http://www.honeynet.org/scans/scan29/ for example) to figuring out what happened.

There are some implementations of the md5sum command on windows on the Net, but still this method of operating is not very widespread and known to the "average" admin....
In fact I had been looking for such a thing in the past years, and I had not figured out it was available on windows now.
It would be very cool if we started including this kind of things in the OS, and not just as an extra tool to be downloaded, IMHO, but that's not really up to me to decide.
But I think it is very important to point people to it, to start off with!

Running as Non-Admin (LUA)


http://msmvps.com/bradley/archive/2005/04/26/44743.aspx

Susan says that her kids are running as LUA now... I actually decided it was about time to pull the plug and run as LUA myself last week.

Even though I was sincerely convinced of the benefits of this approach for quite a long time now, I figured out with pain that a lot of things just could not be properly done without privileges. At least until some time ago. It's weird having to say that, but I have always been running as LUA in Linux for example, and only become root when necessary. But in Windows it just wasn't "comfortable" enough... well, it WASN'T.... for now it is. RunAs has got better, and there are many more things you can do as LUA.

Now after the first couple of weeks experiments, there's basically no application that I'm using (and I'm using MANY of them) which doesn't run, and I am not having issues at all. There's a couple of things which you might have got used to do in some way that now you will have to do in another way... but it is entirely possible and not that bad as an experience. Those things that get a bit trickier are those that your average user won't do anyway.

For reference on how to run as Non Admin, or Limited User Account (LUA), there are some resources out there. Best of all, Aaron Margosis's weblog:
http://blogs.msdn.com/Aaron_Margosis/

But this terminology (LUA) is starting to become mainstream, and there are articles appearing here and there, such as this:
"Increasing Security with Limited User Accounts and Restricted Groups" - http://www.WindowSecurity.com/articles/Increasing-Security-Limited-User-Accounts-Restricted-Groups.html

Posted by dmuscett | 4 Comments

Java, Ruby, Python, Apache, RedHat caps and the rest...

I've already written a post on the corporate blog about people using Unix and OSS: http://blogs.msdn.com/dmuscett/archive/2005/03/08/389487.aspx and now I figure out there's plenty of more crazy people out there.

Check out these two posts for example (both referring to the same episode, from the two guy's perspectives...):
http://neopoleon.com/blog/posts/13798.aspx
http://geekswithblogs.net/jolson/archive/2005/04/22/37434.aspx

Another person with these attitudes is Dare, comparing C# and Java: http://www.25hoursaday.com/weblog/PermaLink.aspx?guid=e077aeff-6b47-4d5b-a618-71d6ba487d4a

And as a final note, today I saw this: http://blogs.msdn.com/devenkamp/archive/2005/04/25/411965.aspx
lol and behold, Deven! 

I guess it is just that we are all techie people and we like pretty much *everything*, as long as it runs :-)

Well, after all I have already written about this some time ago http://www.muscetta.com/b2.php?p=33&c=1

When talking specifically about webservers is that when I started working in the IT field I've had a lot to do with IIS 3 for example, then 4, then 5... now 6. I also use Apache, but for some other stuff I would really like to use IIS 6 now on the Internet. I can't *afford* the hosting myself and I don't like to have something managed where i can't configure the OS myself. I want full admin access to *my* box.
<rant>
But I guess that for this I will have to wait till broadband arrives where I live (which looks like it is finally going to happen.... ) for now on dial-up is not much fun to keep your server on the Internet with the cost of the telephone calls in Europe.... assuming one *wants* to forget about the speed :-)
</rant>

Talking of IIS and Apache, I've got some friends running a site, for example, which is an IIS running behind an Apache reverse-proxy... and the whole lot runs off the same physical machine, as the IIS is virtualized. And that is quite cool.

I like interoperation, definitely.

Microsoft SQL Server Report Pack for IIS

http://www.microsoft.com/downloads/details.aspx?FamilyID=2805d337-14c7-40e3-820b-e7ee653c68c0&DisplayLang=en

I am testing this with a customer, who's very keen on developing a whole bunch of reports with SQL Reporting Services (they have done some very nice stuff about Exchange too, taking data out of MOM Datawarehouse...).

I have always liked Web-Based consoles, especially for security analysis, and I think there's the potential for many more log-analysis and parsing solutions built on .NET, even tough I haven't seen many to date.

 

 

 

Posted by dmuscett | 0 Comments

The end of the quest for the perfect RSS reader

I just read this: http://www.broobles.com/blog/posts/6
And having also switched myself to RSS Bandit last week, I cannot agree more :-)

 

Posted by dmuscett | 0 Comments
Filed under:

Blogs, Blogs, Blogs...

First of all, last week I have been playing a bit more with sharepoint, and decided that I could give it a go for a photoblog.
Of course SharePoint is much more than a photoblog, with all sort of cool collaboration features.... We use all of those internally, but for my *private* use, I am just using it for button-uploading of my photos right now. You can find it on http://muscetta.sts.winisp.net.

Another thing is that over the weekend I worked a bit on my old site http://www.muscetta.com and I actually decided I want to use it more than I've been doing lately.

This space is very nice, but I also like the cosy feeling of that small, unknown, little blog: no community thing, just my personal space on a hosting paid out of my pocket (where I can personalize the whole lot much more than on any managed service, be it the company's space or any other), just putting down some things on a place that does not necessarily *identifies* me with my employer, but that's *just* my personal place, where I can even mess about with the code, do whatever.

Posted by dmuscett | 0 Comments
Filed under:

IPv6 Tunneling, XP, ISA

I've been doing some tests with IPv6 on Windows lately.
I wrapped some of my tests, discoveries and impressions in a technical article:
http://www.muscetta.org/research/papers/IPv6ISA2004.html

Disclaimer

Posted by dmuscett | 0 Comments

Consuming MapPoint Web Service in PHP

I've just spotted this *wonderful* article :
"Consuming MapPoint Web Service in PHP"
http://msdn.microsoft.com/mappoint/mappointweb/mappointwstechart/default.aspx?pull=/library/en-us/dnmapnet30/html/MWS_PHPLoc.asp

which shows how to interact with MapPoint Web Service from PHP code.
That's awesome, as that's the most cool characteristic (IMHO) of web services: you might want to use them from your language of choice, and that CAN be done, for TRUE interoperability :-)

 

Posted by dmuscett | 0 Comments
Filed under:

Rootkit Detectors

MS Research has published some papers about Rootkit technologies and especially RootKit detection:
http://research.microsoft.com/rootkit/

This stuff is VERY GOOD to read, and has been positively commented by a lot of people, including Bruce Schneier: http://www.schneier.com/blog/archives/2005/02/ghostbuster.html

The straightforward links to some of these papers are:

Detecting Stealth Software with Strider GhostBuster
http://research.microsoft.com/research/pubs/view.aspx?type=Technical%20Report&id=875

GhostBuster tech report
http://research.microsoft.com/research/pubs/view.aspx?type=Technical%20Report&id=775

Of course I am not the first person to blog about this, there are loads of other people who spotted the thing earlier than I did, and this new has been commented by many people.
But it is very interesting, and I encourage everybody who hasn't done it yet to read it.

Some other comments I spotted about these papers can be found at:
http://windowsir.blogspot.com/2005/02/rootkit-detection-ms-way.html


Also, Sysinternals has released today a Rootkit detector (looks like RootKits are finally getting a lot of attention these days...)
http://www.sysinternals.com/ntw2k/freeware/rootkitreveal.shtml

 

--edited again at 1:10 am [GMT+1]
now I see that Robert Hensing has been quicker than me, posting even twice about this subject today:
http://blogs.msdn.com/robert_hensing/archive/2005/02/22/378363.aspx
http://blogs.msdn.com/robert_hensing/archive/2005/02/22/378371.aspx

 

Posted by dmuscett | 1 Comments
Filed under: ,

Physical Security (Bug Id: LUCA)

My kids are - of course - "button freaks": they both love buttons and keys and knobs, and all of that category of things... and of course you could not expect anything different from a family of geeks with all sort of devices in the house.

Having said this, I figured out again that I must re-implement "physical security" measures (read: plastic tape on the ON/OFF switch on the computer case to avoid it from being pressed...) to maintain "high availability" and block these "kiddies" from running "Denial-Of-Service Attacks" against my test servers....

Of course I'm having fun on Luca's behaviour now, but Joshua (the older boy) used to be just as enthusiast as his brother is now and he shut down my firewall and several test machines in more than one occasion....

MOM (=MY dear Operations Manager)

On Channel9 India, Vij Rajarajan speaks about MOM
http://channel9.msdn.com/India/ShowPost.aspx?PostID=29481

MOM is a product I love. It is an amazing technology. Back then it was already, and Microsoft saw it.
Saying "back then" I am referring to some years ago; in fact, I have been working with MOM a long time ago, actually before it got the first "M" in its name: I was working for a Microsoft Partner company, and we were the distributors for Italy of "missioncritical software" at that time - I "discovered" those products and have been one of the first people in Italy using them..... I saw Sentry EEM (Enterprise Event manager) 2.x becoming Operations Manager 3.0 through all its beta versions and first (badly unstable - but cool) releases, and then saw that sold to Microsoft by NetIQ which had acquired missioncritical before.
Sentry EEM 2.x was COM technology, while Operations Manager had been written to be based on COM+ (one of the first applications ever to adopt the new technology, because we are talking of the time when WindowsNT 4.0 was the standard, and Windows2000 was being awaited. Operations manager was amazingly more scalable than its predecessor.
It was a difficult sell at that time to companies, who did not realize the power of LOG CONSOLIDATION - and not everybody does now, either.

Anyway, times change, so I have not really been working with MOM anymore for the last three years - I changed company and I did loads of other things: I found myself doing other jobs, more focused on security, still having a lot to do with log analysis. The analysis of logfiles in the market eveloved, and it passed from being "pure" system management (with an eye to reliability) to security management and intrusion detection (btw one of my favourite blogs lately is http://www.trustpath.com/logmatters - if it wasn't for the fact that its RSS feed does not want to work with SharpReader.... but that's another story....).
There are some indipendent (=non Microsoft) papers at the SANS institute about using MOM to do Intrusion Detection, anyway:
www.sans.org/rr/papers/30/1127.pdf - Assignment One: Intrusion Detection with MOM - Going Above the wire
www.sans.org/rr/papers/10/786.pdf - Using MOM 2000 to Secure Servers

Back to my early time with it tough, I was just trying to figure out who accessed what using the known Event IDs for the security log. http://search.microsoft.com/search/results.aspx?st=b&View=en-us&s=1&c=0&qu=security%20event%20description

In this time when I was being "multiplatform", "Microsoft-classic" people were "discovering" Operations Manager.
Now of course is nothing new anymore, and a lot of people know it better than I do. 

And for the purpose of security auditing, Audit Collection Services will take care of this specifically.


But, going back to MOM, back then I was among those "finding out" about this great product, and taking it out of the "underground"! I was young and unexperienced, very ingenuos (yes even more than now), and also much sillier than now, but I felt that that was just a piece of software that rocked! I've got great memories of that time.

Same story applies to ADMT, also originally developed by missioncritical software (I remember showing/demoing the "domain migrator" in 1999 to some italian people of Microsoft Consulting Services at SMAU that year). Since then the word of mouth spread, someone else more influencial than I was eventually understood what was clear to me in 1999: that such a migration technology was simply AMAZING and badly useful.

This was eventually going to lead to the ADMT deal the year after....... now pretty much everybody who's had to do with migrating domains has used ADMT....

I feel a sort of "affection" to those products I once mastered, they're something I really liked in the past - it was "love at first sight" so to say - so now that I find myself using it again since I am in Microsoft, I am very happy of being able to use them. It is like having found an old companion..... but being a rather new Microsoft's employee I did not know of all the new stuff that appeared lately, like the SDK for example http://www.microsoft.com/mom/downloads/previous/sdk/default.mspx for MOM 2000) and then the new MOM 2005, of course (and there's an SDK for MOM2005 too, of course).
Of course I don't master them anymore, but some stuff is like riding a bike: once you've learned you don't really forget it - you knees might get a bit old and "rusty", but you get back on track pretty soon anyway.

Oh, and mentioning MOM 2005, among several other changes, my favourite one: I am so glad we replaced that MS Access "toy" that used to be there for reporting and replaced it with SQL Reporting Services! That is so much better, so much nicer, so much more professional and scalable!

More Posts Next page »
 
Page view tracker