1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Change detection software

Discussion in 'Software' started by derkit, Jul 25, 2008.

  1. derkit

    derkit Gigabyte Poster

    1,479
    54
    112
    I'm not sure this exists, and at the moment its purely a mental exercise whilst taking a break in ITIL revision, but is there software available that can detect specific changes anywhere on a computer when you say change a tick box??

    While that reads OK in my head, I'm sure it makes no sense, so I'll give an example:

    I need to untick/tick the selection on the "Mouse applet > Buttons tab > Turn on ClickLock" (random choice) on a number of computers - whilst I can visit each workstation I want to implement it via a script remotely.

    I'm assuming this changes something in the registry, perhaps does something to a file (makes an amendment) - is there a piece of software that will take a snapshot before the change, another after the change and then display the difference - ie, what was actually changed.

    If my example can be done as a group policy (and I have no idea whether it can or cannot be done as I haven't dealt with GPs yet!), then use your imagination for another crazy example! :biggrin

    I just thought it may be useful in some circumstances.
    Anyone???
     
    Certifications: MBCS, BSc(Hons), Cert(Maths), A+, Net+, MCDST, ITIL-F v3, MCSA
    WIP: 70-293
  2. NightWalker

    NightWalker Gigabyte Poster

    1,172
    25
    92
    All the settings are held in the registry somewhere. You can use InCtrl5 to find the exact reg keys easily, then use Administrative Templates to push the settings out in a GPO.
     
    Certifications: A+, Network+, MCP, MCSA:M 2003, ITIL v3 Foundation
  3. zebulebu

    zebulebu Terabyte Poster

    3,748
    330
    187
    Two things spring to mind. For a 'quick & dirty' evaluation, you could try using WinDiff to make comparisons before and after, or, if you need something more robust (and, unfortunately, infinitely more expensive) you could investgiate Tripwire. The latter is used extensivley in environments that require very tight audit controls (financial environments etc)
     
    Certifications: A few
    WIP: None - f*** 'em
  4. NightWalker

    NightWalker Gigabyte Poster

    1,172
    25
    92
    I have tried using Windiff to compare a before and after export of the registry in .reg files. It didn't work. You try and expand the file contents and just get a load on nonsense :(
     
    Certifications: A+, Network+, MCP, MCSA:M 2003, ITIL v3 Foundation
  5. zcapr17

    zcapr17 Nibble Poster

    64
    8
    34
    Have you tried using Process Monitor from the Windows SysInternals Suite?

    http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx

     
    Certifications: MCSE:2K3 MCTS:Vista VCPv3 ITILv3 Sec+ L+
    WIP: MCITP Enterprise Admin 2008, CCA
  6. derkit

    derkit Gigabyte Poster

    1,479
    54
    112
    Hi fellas - thanks for the tips, now I've passed the exam I can now look at this in more depth (at some time!!)

    I haven't used any software yet zcapr17, as I said it was purely a mental exercise - but want to read/play with the SysInternals Suite anyway so will specifically check it out.
     
    Certifications: MBCS, BSc(Hons), Cert(Maths), A+, Net+, MCDST, ITIL-F v3, MCSA
    WIP: 70-293
  7. BosonMichael
    Highly Decorated Member Award

    BosonMichael Yottabyte Poster

    19,136
    462
    374
    ...not to be confused with Tripwire45, although he's pretty robust himself. :thumbleft
     
    Certifications: CISSP, MCSE+I, MCSE: Security, MCSE: Messaging, MCDST, MCDBA, MCTS, OCP, CCNP, CCDP, CCNA Security, CCNA Voice, CNE, SCSA, Security+, Linux+, Server+, Network+, A+
    WIP: Just about everything!

Share This Page

Loading...