Solved

Monitoring RWW Connections on SBS Server

Posted on 2009-05-08
9
927 Views
Last Modified: 2012-06-21
I want to see who has connected through RWW on my usage reports.  My usage report gives me Mailbox and OWA information but nothing regarding RWW.  

I have IIS checked on the usage report.  

0
Comment
Question by:merikm
  • 4
  • 3
9 Comments
 
LVL 25

Expert Comment

by:DrDave242
Comment Utility
From what I've read, there's no built-in RWW usage report.  There are third-party products for it, though.  The first one I ran across is RWWGuard, which looks like it does a few other things as well:

http://www.scorpionsoft.com/products/rwwguard/
0
 

Author Comment

by:merikm
Comment Utility
where can you do access logging?  To see from an active directory standpoint, when people are logging on and what they are accessing.  Maybe as an alternative to RWW reporting.
0
 
LVL 25

Expert Comment

by:DrDave242
Comment Utility
You'll need to enable auditing on the SBS server.  To do this, go to Start > Admin Tools > Domain Controller Security Policy.  Expand Local Policies and click Audit Policy.  You'll see nine different items in the right pane that you can enable as you please.  Since you're actually modifying a GPO with these settings, any changes won't take affect until Group Policies are updated.  You can wait for this to happen automatically, or you can force it with the gpupdate command.  Also note that any other DCs you have in this domain will be affected by these settings as well.  Finally, the actual audit events are recorded in the DC's security log, and enabling some audit policy settings (especially if you choose to audit successes and failures) can result in a LOT of events being logged.  This can make sifting through the security log cumbersome and can fill up the log completely.
0
 

Author Comment

by:merikm
Comment Utility
so this is supposed to set all network accesses, like file access and such to show up in the security log?
0
Maximize Your Threat Intelligence Reporting

Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

 
LVL 25

Expert Comment

by:DrDave242
Comment Utility
Anything you enable in that policy will show up in the security log, yes.
0
 

Author Comment

by:merikm
Comment Utility
is there any particular events that would show as web interactive logon/logoff tied with a particular user.  I am looking to recognize events for reporting.  to try to track the rww logon.
0
 
LVL 25

Expert Comment

by:DrDave242
Comment Utility
Sorry, I went on vacation and forgot about this when I returned.  I don't know if an RWW-based logon would show up any differently from a normal network logon in the log.  You may have to test it to see.
0
 

Accepted Solution

by:
ee_auto earned 0 total points
Comment Utility
Question PAQ'd, 500 points refunded, and stored in the solution database.
0

Featured Post

Top 6 Sources for Identifying Threat Actor TTPs

Understanding your enemy is essential. These six sources will help you identify the most popular threat actor tactics, techniques, and procedures (TTPs).

Join & Write a Comment

Introduction At 19:33 (UST) on Tuesday 21st September the long awaited email arrived with the subject title of “ANNOUNCING THE AVAILABILITY OF WINDOWS SBS 7 PREVIEW”.  It was time to drop whatever I was doing and dedicate as much bandwidth as possi…
Because virtualization becomes more and more common, and, with Microsoft Hyper-V included in Windows Server at no additional costs, and, most server hardware nowadays is more than capable of running a physical Small Business Server (SBS) 2008 or 201…
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…
When you create an app prototype with Adobe XD, you can insert system screens -- sharing or Control Center, for example -- with just a few clicks. This video shows you how. You can take the full course on Experts Exchange at http://bit.ly/XDcourse.

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now