Using OpsMgr for intrusion detection and security hardening

<!--[if lt IE 9]>


Comments (13)
  1. Kevin Holman says:

    Interesting.  Sure – you could make the recovery a script – that writes to a UNC path….  there isnt a simple way to make a workflow on one machine trigger a workflow on another…. but it is possible.  I will look at a sample MP I have and see if I can describe how they did it.

  2. Kevin Holman says:

    You can trigger or repeat on any params.  Either 5 attemps by the same user, or ANY 5 attemps from any user.

    1. Russ Jackson says:

      Hi Kevin,

      Kind of late to the party. I just stumbled on this great blog post. You said below “Either 5 attemps by the same user…”. How would you do that? Do I need to know the user name to put in the parm or something else. I’m not looking for a specific user, but the attempt by the same user. I may or may not know the user name.


  3. Excellent article, I came across this when I was asked to write a monitor for our NPS servers to detect when a user could be trying to brute force. My only concern, and this may be where the parameters may come in to play, I'm wondering at the moment if this is bring triggered due to 5 random people being denied access within 3 minutes.

    I need to read your other blog article to look, but I'm thinking that from NPS i would want subjectusername to be the same for each of those…

  4. andyinsdca says:

    Nevermind. I came up with a better way to do this. Create a notification channel that fires your batch script (that’d run on the RMS), take care of the subscriber/subscription info, voila!

    Much easier than monkeying with UNCs and whatever else can go wrong!

  5. andyinsdca says:

    Is there a way to get the recovery script to run something on the management server/RMS? For example, instead of updating the Windows Firewall on the affected system, we write to a unified text log file stored on the RMS.

  6. filip says:

    Hi Kevin,

    I saw in your monitor that you used Parameter 11 for the logon type.

    I'm wondering where you got that parameter11 from..

    Is there a list that states which parameter number corresponds with which variable?

    many thanks!


  7. tom says:

    should this be the same config for 2008 R2 servers as I'm not getting any joy triggering the alert in event viewer at all?

  8. Shahrokh says:

    Hi Mr.Kevin

    Really appreciate about yours knowledge sharing and tips that u teach ,I'm from Iran and just wanna thank u and other guys about what you have done .


  9. karthick kesavan says:

    Hi Kevin

    i dont understand about trigger on count sliding if it possible throw some light on this

    Thanks in advance!!!!!

  10. karthick kesavan says:

    i am eagerly waiting for your reply kevin

  11. Michael Hollis says:

    I am trying to do a similar thing using a repeated WMI monitor targeted to the Collector. My event provider is scoped to namespace "rootdefault" with a query of "SELECT * FROM AdtsEvent". My repeated even expression is "EventID = 4625". My Repeated Event
    Detection is set up with similar consolidation setting that you have, but I added Properties. I added "String02 (which is where ACS stores the IP address) and "TargetUser". I tried to trigger the monitor by logging into on of the servers being monitored by
    ACS with an incorrect password six times. I see the events being entered into the ACS database. The monitor didn’t get tripped though. I’m wondering if I need to add the entire XPath for the property like "$Data/EventData/DataItem/EventData/Data[@Name=’TargetUser’]$".
    Do you have guidance on that?

Comments are closed.

Skip to main content