Monitor any Windows NT4/2K/XP/2003/Vista/2008 group for additions or deletions -- finally, a way to know who changed what, when! Sends email, console or other alerts when group membership changes! Great for sending automatic notices of user account changes to various departments! Perfect for networks with multiple administrators! Keep detailed logs separate from NT event logs for added audit security!

Overview Greyware's Membership Monitor (GWMM) adds valuable second-level protection to your NT user groups by generating emails, event viewer records, and administrative alerts when there are any changes in the groups you select to monitor. Once a LAN gets beyond the size where one administrator can handle all the changes -- especially with multiple sysadmins and account managers at multiple sites -- it becomes easy to lose track of which user is a member of which group. An unwanted or unauthorized change can go undetected for days or months, by which time the damage has long been done. And if your network has any security holes that allow users to promote themselves, you may never know what happened...the user can join a privileged group, access restricted data, then unjoin the group without leaving any sort of record behind. Greyware's Membership Monitor prevents these kind of surprises. With a few simple clicks you can establish a monitor for any one -- or all -- user groups in your enterprise. Membership Monitor sits quietly in the background, watching for changes. When a monitored group has a member added or removed, the program silently sends out up to three alerts: An event viewer log entry An email An administrative alert to a computer(s) or user(s) In addition, Membership Monitor can keep a detailed log file, showing all changes to monitored groups.

Requirements

Membership Monitor is controlled by its Control Panel applet. The applet lets you set the options appropriate for your machine. You do not need to reboot or stop and restart the service after making changes; the service will automatically recognize and start using the new settings immediately.

The Membership Monitor Control Panel Applet
Monitored and Not Monitored Groups section
These controls allow you to select which groups you wish to monitor for changes.

Change Data Source... (button)
Used to select the machine used as the data source for monitoring groups.

By default, Membership Monitor uses the user account database on the machine where it is installed. This means that if you install Membership Monitor on a PDC or BDC, you will see the list of domain groups (both global and local). If you install Membership Monitor on a stand-alone server or workstation, you will see the list of groups on that machine only. In either case, Membership Monitor can check the database on its own machine using change event signalling (no polling), so CPU overhead and network traffic are close to zero, and alerts are generated within milliseconds of a change.

You may change this behavior by clicking the Data Source button and specifying another machine from which Membership Monitor should draw its groups. When getting group information from another machine, Membership Monitor cannot use change event signalling, and so must poll the other machine periodically for updates. This means that alerts can be generated only after a polling interval, and that both CPU usage and network traffic are increased during the poll.


The Membership Monitor Select Data Source Screen

If you install Membership Monitor on a stand-alone server or workstation, but set the Data Source to the the domain name (or to the domain's PDC or BDC), you can monitor the domain groups (both global and local). You could also use a workstation to monitor a server, a BDC to monitor a workstation, etc. This allows you to have all the benefits of domain-wide monitoring without installing Membership Monitor on your PDC or BDC. The only restriction is that the service account running Membership Monitor must have security access to the user database on the source machine (i.e., must be members of the same domain, or have the appropriate n-way trust in place).

Details

---

 Monitor Additions to this group
If this box is checked, Membership Monitor will generate alerts when users or groups are added to the selected group.

 Monitor Deletions from this group
If this box is checked, Membership Monitor will generate alerts when users or groups are removed from the selected group. (Note: If a group is being monitored, but neither Monitor Additions nor Monitor Deletions is checked, then Membership Monitor will still watch the group, but not generate any alerts.)

 Record Changes in Event Viewer Log
If this box is checked, Membership Monitor will create an event viewer log entry when users or groups are added or removed (based on which of the two monitor checkboxes you have checked).

 Send Email Notifications
If this box is checked, Membership Monitor will send an SMTP email alert when users or groups are added or removed (based on which of the two monitor checkboxes you have checked). This box will be grayed out until you have clicked the Email Setup... button in the Options section (see below) and specified a valid SMTP host, FROM address, and TO address.

 Send Administrative Alerts
If this box is checked, Membership Monitor will send an Administrative Alert when users or groups are added or removed (based on which of the two monitor checkboxes you have checked). You may specify multiple names, separated by commas or semi-colons. Each name must be

• An NT computer name, in which case the alert is sent to the console of that computer regardless of who is logged on; or

• An NT username, in which case the alert is sent to that user, no matter where on the network the user is logged on.

Administrative Alerts generate a pop-up message box on the target machine. In order for the Administrative Alert to be received, the built-in NT Messenger Service must be running on the target machine. The Messenger Service is an unreliable transport; it does not guarantee delivery, and may deliver multiple copies of the same message. In most LAN enviromnents, Administrative Alerts are fast and dependable; however, we recommend that you not reply solely on Administrative Alerts for notifications.

Options

---

 Show System Tray Icon
If this box is checked, the Membership Monitor system tray icon will be displayed in the Start Bar System Tray.

 Look up responsible person
If checked, Membership Monitor will attempt to determine the user account responsible for making the change, if possible.

This information may not always be available due to the different methods and locations that NT (and especially Win2000) uses to record auditing information (see KB2001.815).

In order for the lookup to succeed:

1. Windows NT4/2K/XP/2003/Vista/2008 Security Auditing must be enabled. Specifically, the machine or domain being monitored must have Success auditing for User and Group Management enabled in the Security Policy. To learn how to enable auditing, Microsoft's Knowledgebase articles Q157238 (NT4) and Q300549 (Windows 2000).

   To test that auditing is functioning properly, use Event Viewer to inspect the Security log on your PDC (or PDC Emulator on Win2000). Look for events with the Category Account Management, Souce Security, and Type Success Audit.

2. The user account used for running the Membership Monitor service must have sufficient rights to read the event logs on all machines being monitored. To test this, log in with the service account and use the Event Viewer to connect to the remote machines and verify that you are able to read both the local and remote event logs (particularly on the PDC, or the PDC emulators on Win2000 trees).

Important Note: Due to the way Windows NT4/2K/XP/2003/Vista/2008 records account information in the event logs when using domain trusts, the person responsible reported may be incorrectly listed as coming from the local domain. For example if a trust exists between the domains LOCALDOMAIN and REMOTEDOMAIN and a change made on a LOCALDOMAIN system by a trusted account from REMOTEDOMAIN (i.e. \\REMOTEDOMAIN\AdminUser), it may be incorrectly reported as having been made by a LOCALDOMAIN account (LOCALDOMAIN\AdminUser).

 Record changes in gwmm.log file
If checked, Membership Monitor will record all changes to monitored groups (whether or not the change generates an alert) to your %systemroot%\system32\gwmm.log file.

Max size KB
Controls the maximum size of the gwmm.log file. If set to zero, the log file size is limited only by available disk space. Any other number represents the number of kilobytes for the log file. Membership Monitor trims the log file by removing old entries from the top of the file. The most current entry will always be the last line in the log file.

Email Setup... (button)
Used for setting default email settings.


The Membership Monitor Email Setup Screen
When you click the Email Setup button, you are presented with another dialog box that allows you to specify:
• SMTP host -- you may give either an Internet-style name or an IP number.
• FROM address -- the email address from which the mail is sent.
• A Default TO address -- the email address to which the mail is sent if no other email address is specified for a particular group's alerts.
• Whether email should be sent in HTML format or as plain text.
• Whether your machine is permanently wired to a LAN and can send email at any time, or uses Dial-Up Networking and can only send email when connected.

  Email names may be either plain or decorated. A plain name is one like person@place.com. A decorated name is one like "Tech Support" <techsupport@yourdomain.com>. The quotation marks are required by some SMTP servers if the decorated portion of the name contains space characters.

Advanced... (button)
Used for setting additional options.


The Membership Monitor Advanced Settings Screen
When you click the Advanced button, you are presented with another dialog box with the following options:
 Enable debug output in logfile
If this box is checked, Membership Monitor will produce a verbose version of the gwmm.log file, which includes a substantial amount of additional information. You should choose this option only if you are attempting to resolve an issue. The log can grow quite rapidly when this option is enabled.

 Check all Domain Controllers for Event Log records
If this box is checked, Membership Monitor will poll all Domain Controllers for change information. You only need to enable this option if you are running Active Directory in mixed-mode and Membership Monitor is not reporting all of the changes made to a monitored group.