Preparing Windows 9x machines for auditing

In order to be able to audit Windows 95/98 machines, you will need to install the following piece of software:

• WMI Core version 1.5 for Windows 95/98. This can be obtained as a free download from http://microforge.net/links/wmi.htm. Once you have installed WMI Core 1.5, you should be able to audit the machine to an Audit Snapshot File, using our command line auditing utility: EntAudit.exe. Further information can be found in the documentation for ENT NetCenter under the topic Auditing disconnected machines

Configuring Windows 9x machines to be audited remotely

In order to be able to audit Windows 95/98 machines over the network, using Microforge.net ENT NetCenter, the following software must be installed on the Windows 95/98 machines that you wish to audit remotely:

• DCOM for Windows 95/98, version 1.3. The appropriate DCOM installation may be downloaded from http://microforge.net/links/dcom.htm. Make sure you also download and install the DCOM configuration utility, since this will be required to configure DCOM once it is installed.

Configuration

Once you have installed the required software, you will also need to grant access privileges on the Windows 95/98 machine, which must match the network security credential supplied in the Network Details dialog in ENT NetCenter.

In the above example, we have configured ENT NetCenter to use the credential of the Admin user, who is a member of the Domain admins group on the MICROFORGE domain. Later, we will grant access permissions on the local Windows 95/98 machine for this group.

There are three things that need to be configured on each of the Windows 95/98 machines on your network before you will be able to audit these remotely:

1. Configure WinMgmt server to start at system startup
2. Configure the workstation for user-level access
3. Configure DCOM to allow remote connections

The following is a detailed description of how to perform each of these three steps.

1. Configure WinMgmt server to start at system startup.

Windows 95/98 cannot start a DCOM server on demand, so the WinMgmt server which is installed on Windows 95/98 by WMI Core 1.5, must be launched during windows startup by adding a new string value to the windows registry

Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name: WinMgmt

Value:  C:\WINDOWS\SYSTEM\WBEM\WinMgmt.exe

The following screenshot shows the registry editor for a system with these changes already made.

2. Configure the workstation for user-level access

You will also have to change the workstation’s network security settings to allow user-level access, as follows:

• Go to the control panel and open the Network applet;
• From the Access Control tab, select “User-level access control” and provide the name of a security provider on your network (i.e. the name of a Windows NT domain, workstation or server which can then act as a security provider for the Windows 95/98 machine).
  
  
  
• Reboot the workstation when prompted.

3. Configure DCOM to allow remote connections.

DCOM is configured, by default, not to allow remote connections. As such, we need to modify the security settings for DCOM to allow remote connections. This can be accomplished by using the DCOM configuration utility, as follows:

• Run dcomcnfg.exe (the default install path is “C:\WINDOWS\system\”)
• On the Default Properties tab, select Enable Distributed COM on this computer.
• Set Default Authentication Level to Connect.
• Set Default Impersonation Level to Impersonate.