ddady
(Getting the hang of it)
2007-07-01 07:44 AM
Sending Message via Network

Good Morning All.

I have a domain with few subnets, all subnets connects through IPVPN to the center where i'm at. In every subnet there is one computer which runs one very important application.

There are two things i need to do:

1) To find out whether the application runs or not.
2) To send me a message to notify me about it.

Now, i have tried just to send a message to myself using the SendMessage function but it doesn't work. Is this function uses the Messenger Service which is disabled cause of security issues?

Any help will be appreciated.


AllenAdministrator
(KiX Supporter)
2007-07-01 07:49 AM
Re: Sending Message via Network

1. Checkout Enumprocess() and see if it will do what you want.
http://www.kixtart.org/forums/ubbthreads.php?ubb=showflat&Number=83681
2. Possibly use BLAT.exe to send yourself an email.


ddady
(Getting the hang of it)
2007-07-01 08:38 AM
Re: Sending Message via Network

Thanx Allen,

I'll try the BlAT thing.

BTW, i have searched the Kix Reference before i asked but from some reason the Enumprocess() doesn't exist there.


LonkeroAdministrator
(KiX Master Guru)
2007-07-01 12:00 PM
Re: Sending Message via Network

enumprocess is a UDF:
http://www.kixtart.org/UDF/UDF_lister.php?what=post&code=83681

in the post allen linked to, you see the same stuff as in my link.
the code you need to include in your script bottom and the instructions how to use it.


ddady
(Getting the hang of it)
2007-07-01 02:13 PM
Re: Sending Message via Network

mmmm.....OK.

Since i'm new to kix, can someone please explain in short how to use it?

Do i use the exact code?
Where it comes in my script?
How do i know if the process i need is working?

I'm sorry for all those questions, but as i said. i'm new to kix.

Thanx


Les
(KiX Master)
2007-07-01 04:01 PM
Re: Sending Message via Network

There is an FAQ that answers most of those.

Mart
(KiX Supporter)
2007-07-01 06:41 PM
Re: Sending Message via Network

UDF are add-on function for kixtart. They are cerate by users and can be inserted in the script or called from the script. They will get loaded into memory when the script starts and if all goes well they can be used as any other function native to kix. UDF come as they are and should not have to be changed unless you want something extra from it. Enumproccess in this case does exactly what you want it to.

Here's an example that uses enumproccess to see if notepad is running and does something when notepad is not running You should change notepad.exe in the $pid= EnumProcess("notepad.exe") line to the app you want to monitor and you should add a line that actually uses Blat (or some other mail app) to send you a message that app x is no longer running.

 Code:
Break on

$pid= EnumProcess("notepad.exe")

If $pid = ""
	?"Notepad is NOT running."
	Sleep 5
EndIf


;Function EnumProcess($exe, optional $terminate, optional $Computer)
;
;To enumerate OR kill specific processes
;
;$exe: the process name OR numeric PID
;$terminate: null/notnull value to terminate the specified process(es)
;$Computer: the PC to Execute against. Null = local PC
;
;returns an array of PIDs (pipe seperated), If $exe is a process name
;
;To Return the pid of setup.exe
;$pid= EnumProcess("setup.exe")
;
;to terminate all running Internet Explorer windows
;$kill= EnumProcess("iexplore.exe",1)
;
;To terminate a specific exe by it's PID
;$pid=694
;$kill=EnumProcess($pid,1)
;
;Code: 
Function EnumProcess($exe, optional $terminate, optional $Computer)
	Dim $winmgmts, $ExecQuery, $Process, $id, $GetObject, $
	If NOT $computer	$computer=@wksta	EndIf
	$winmgmts="winmgmts:{impersonationLevel=impersonate}!//$COMPUTER"
	Select
		Case Val($exe)>0
			$ExecQuery="select * from Win32_Process where ProcessId='$exe'"
			$GetObject=GetObject($winmgmts).ExecQuery($ExecQuery)
			For Each $Process in $GetObject
				If $terminate		$=$Process.Terminate	EndIf
				$EnumProcess = $Process.name
				Next
			$GetObject=''
		Case VarType($exe)=8
			$ExecQuery="select * from Win32_Process where Name='$exe'"
			$GetObject=GetObject($winmgmts).ExecQuery($ExecQuery)
			For Each $Process in $GetObject
				If $terminate		$=$Process.Terminate	EndIf
				$id=$Process.ProcessId
				$EnumProcess = "$Id" + "|" + "$EnumProcess"
				Next
			$EnumProcess=Left($EnumProcess,Len($EnumProcess)-1)
			$GetObject=''
		Case 1
			Exit 1
		EndSelect
	EndFunction


Les
(KiX Master)
2007-07-01 07:00 PM
Re: Sending Message via Network

 Originally Posted By: ddady
Is this function uses the Messenger Service which is disabled cause of security issues?
Why not just start the messenger service and test it?


LonkeroAdministrator
(KiX Master Guru)
2007-07-02 01:25 AM
Re: Sending Message via Network

I never understood the security issue fuzz about that service...

NTDOCAdministrator
(KiX Master)
2007-07-02 04:07 AM
Re: Sending Message via Network

Not per say a real security issue as I recall (been a while) more an annoyance.

Les
(KiX Master)
2007-07-02 04:58 AM
Re: Sending Message via Network

http://support.microsoft.com/kb/330904

ddady
(Getting the hang of it)
2007-07-02 08:25 AM
Re: Sending Message via Network

Thanx MART for the explanation and the example and to the rest of you guys who took the time to help.

ddady
(Getting the hang of it)
2007-07-02 08:37 AM
Re: Sending Message via Network

Thanx Les, That is the reason why this service is disabled. It's better to be safe than sorry, anyhow there is no use for me in the domain with that service so i see no reason to enable it.

LonkeroAdministrator
(KiX Master Guru)
2007-07-02 10:03 AM
Re: Sending Message via Network

hmm...
this spam-problem should never occur in firewalled network.
you guys who disabled it, not using firewalls???


Arend_
(MM club member)
2007-07-02 10:32 AM
Re: Sending Message via Network

 Originally Posted By: Jooel
hmm...
this spam-problem should never occur in firewalled network.
you guys who disabled it, not using firewalls???


Apparantly, in all our networks we make sure it's enabled through gpo.
A Network firewall should disable all ports by default except the ones you actually use.


LonkeroAdministrator
(KiX Master Guru)
2007-07-02 12:03 PM
Re: Sending Message via Network

well...
our gpo sets workstation firewall disabled when connected to domain, to ease administration.

anyways, I see no point in disabling the service.
you never know when you need it and if you have firewalls & AV in place there is no risk either.
disabling the service is imo same as disabling server service on servers cause someone might be able to access the sensible data.

just my 4BUSD


Arend_
(MM club member)
2007-07-02 05:11 PM
Re: Sending Message via Network

I agree, we already disable windows xp firewalls in the ris image, and at gpo level as well.

Witto
(MM club member)
2007-07-03 12:57 AM
Re: Sending Message via Network

we enable WXP SP2 firewall but configure it through GPO to ease administration. The messenger service is running on al the computers.

NTDOCAdministrator
(KiX Master)
2007-07-03 09:37 AM
Re: Sending Message via Network

Well the firewalling should be done at the perimeter to keep outside systems from spamming your internal systems, not internal systems firewalled from each other.

If you can and want to manage internal firewalls that's cool - just think a lot of us Admins are too busy (lazy) to setup and test everything and make sure all applications and our remote admin tools work on all systems so we shut off the XP firewall.



LonkeroAdministrator
(KiX Master Guru)
2007-07-03 11:35 AM
Re: Sending Message via Network

well, that's really lazy.
just set the domain policy to be off and otherwise on...


NTDOCAdministrator
(KiX Master)
2007-07-03 11:37 AM
Re: Sending Message via Network

I do, but that is being lazy. Doing it the "MS best practice" way is to leave it on and only open the ports needed, thus the lazy remark. I'm willing to bet that most Admins just turn it off.

LonkeroAdministrator
(KiX Master Guru)
2007-07-03 11:49 AM
Re: Sending Message via Network

and then there are admins that install some weird client security products, which then disables controll capabilities altogether.

Witto
(MM club member)
2007-07-03 01:49 PM
Re: Sending Message via Network

Maybe like this:
  • via GPO, set the minimum you need to administrate a computer (protocols, ports, networks, etc...)
  • do not enable or restrict the use of firewall via GPO, just add the minimum of policies needed
  • during installation or imaging of computers, set the firewall on
  • a common user cannot switch his firewall on or off, so the firewall will stay on
  • during installation of software, the ports, protocols, programs, networks etc. needed can be added to the local firewall policy


LonkeroAdministrator
(KiX Master Guru)
2007-07-03 02:18 PM
Re: Sending Message via Network

the thing is, you need a separate full blooded policy for out-of-office.
otherwise the administration holes will be open in the wild too.
right?


Witto
(MM club member)
2007-07-03 11:11 PM
Re: Sending Message via Network

In a lot of the rules, the allowed network(s) can be defined. Only in the case the computer is used in (a) network(s) with the same adress(es), certain ports are open.
It is in any way better than doing nothing.


LonkeroAdministrator
(KiX Master Guru)
2007-07-04 12:17 AM
Re: Sending Message via Network

ja, that will work in most of the cases.
that is, in such setup that the networks outside are different.


ddady
(Getting the hang of it)
2007-07-08 01:12 PM
Re: Sending Message via Network

Thanks for all the comments. I have managed to do what i have wanted too. It's working perfectly.