MOnitoring .encrypted file

[matrix_rm]

Hi,

I don't know it is possible to monitor appearance encryupted files on servers.

How can I do it?? Any idea's??

[GarthMJ]

What do you mean by this question? Are you trying to protect against a virus?

[matrix_rm]

No, I want to know when the .encrypted files appears on the servers disk's.

[GarthMJ]

I would think that you could do this with a script and therefore create a SCOM rule for it.

[matrix_rm]

OK, I do it but it still don't work. hire is my script

 

Dim fs, f, foldername,fd

set oAPI=CreateObject("MOM.ScriptAPI")

set oBag=oAPI.CreatePropertyBag()

Set fs = CreateObject("Scripting.FileSystemObject")
foldername="c:\"

status="OK"
Set fd = fs.Getfolder(foldername)

for each f in fd.files

if instr(f.name,".encrypted") then

status="NOT OK"

exit for

end if

next

Set fs = CreateObject("Scripting.FileSystemObject")
foldername="d:\"

status="OK"
Set fd = fs.Getfolder(foldername)

for each f in fd.files

if instr(f.name,".encrypted") then

status="NOT OK"

exit for

end if

next

Set fs = CreateObject("Scripting.FileSystemObject")
foldername="z:\"

status="OK"
Set fd = fs.Getfolder(foldername)

for each f in fd.files

if instr(f.name,".encrypted") then

status="NOT OK"

exit for

end if

next


Call oBag.AddValue("Status",status)
Call oAPI.Return(oBag)

 

I have 3 leters of disk on my server.

and it runs every 15 minutes. why it dont work?? where I cant find where is the problem?

[GarthMJ]

My quick look at this suggest the problem is with the script. Basically unless there is an encrypted file on Z:\ nothing will show up. So you need to go back to the drawing board and re-write you script.

[toratb]

I would rather use Configuration Manager (if you got it). It has file inventory built in. Using a script would really be a heavy duty job... Running the script would strain the server's resources a lot...

[GarthMJ]

I have CM and I would never recommend using the SW inventory. Here is one of the reason why. http://www.enhansoft.com/blog/slow-software-inventory-cycle-in-sccm-2012

[toratb]

I know the SW inventory takes a long time to complete, but thats the price to pay for not impacting the server... Just "Create Custom Client Device Settings" and deploy it to a device collection containing only the file server. Also, make sure you run this at a time when it's convenient.

 

If you are worried about "Slow Software Inventory Cycle", then set it up to only collect a few subdirectories from the server. This way you will get a few sample directories instead of the entire disk making the inventory cycle much faster since it's not gathering so much information.

 

Thats just my two cents on the matter.

[GarthMJ]

It would be more than the impact to the servers as to why you should never user SW Scan. SW scan has a 4 hour (runtime) timeout, once the timeout occur, the task is rejected and no results are returned to CM. So particularly for servers, you would never know if the server has no results or if the SW Scan failed to complete. Since SW scanning is runtime not realtime, your SW scans can take days… Yes I said days before it finally timeout. To top this off, while the SW scanning occurs, no other inventory task can happen. This mean you Heartbeat and Hardware inventory will never happen until SW scans are done.

 

So… CM’s SW scans are useless. You would be far better off using a script or a CM CI script for this.

As an aside scripts are usually executed as “Normal” process, therefore it will share all the “normal” CPU cycles but anything higher will get whatever it needs. You could run the script as “below Normal” task, this would take longer with less impact on the computer. This would still be far better than what CM SW scanning does.