The Curious Engineer

All blogs / Security

Working with System Center

learn.microsoft.com/en-us/archive/blogs/nathangau

SecurityDevOps / SRE / infrastructureMicrosoft blogsMSDN archive

’15’16’17’18’19’20’21’22’23’24’25’26
Posts
75 from 9 Apr 2015 to 8 Nov 2018
Posting
archived, read-only
Kind
personal blog
Feed
https://learn.microsoft.com/en-us/archive/blogs/nathangau/feed.xml

2018 24

  1. Last Post
  2. Security Monitoring–Additional PowerShell Detections Addendum
  3. Security Monitoring–Using SCOM to Detect Legacy TLS Protocol Usage
  4. Security Monitoring–Additional PowerShell Detections
  5. Security Monitoring–Configuring SCOM to alert on attempts to kill Windows Defender
  6. Security Monitoring–Using SCOM to Detect Executables Run in Writeable OS Directories Part 2
  7. Security Monitoring–Using SCOM to Detect Executables Run in Writeable OS Directories Part 1
  8. Security Monitoring–Updating Service Created on DC Rule
  9. Security Monitoring–Updating Scheduled Task Creation Rule
  10. Securing SCOM in a Privilege Tiered Access Model–Part 3
  11. Securing SCOM in a Privilege Tiered Access Model–Part 2
  12. Securing SCOM in a Privilege Tiered Access Model–Part 1
  13. Configuring SCOM to Monitor Dell Storage Solutions
  14. SCOM Installer Failure with RC4 Protocol Disabled
  15. SCOM Agent Stuck in a Not Monitored State
  16. Future Plans/Requests for Security Monitoring MP
  17. Updated Security Monitoring MP is Now Available
  18. Security Monitoring Change Log
  19. In Place Upgrading the SSRS for SCOM
  20. Updating GPO Monitoring in Security Monitoring for MSFT AGPM
  21. Distributing SCOM Run As Accounts and Security Implications
  22. Security Monitoring: Using SCOM to detect NTLMv1 and LanManager Authentication Types
  23. Security Monitoring: A Possible New Way to Detect Privilege Escalation
  24. Security Monitoring: Using SCOM to Collect LAPS Events

2017 26

  1. Reliable Time Monitor False Positives for AD Domain Member Monitoring
  2. Security Monitoring: Using SCOM to Detect Bypassed Authentication Package Back Door
  3. Security Monitoring: Detecting Wdigest Authentication
  4. Security Monitoring: Using SCOM to Detect SMB1 Authentications
  5. Security Monitoring: Using SCOM to detect NTLMv1 and LanManager Authentication Types
  6. Removing Local Admin Rights from the SCOM Action Account
  7. A Deep Dive into Dynamic Group Calculation and How it Affects SCOM Performance
  8. Stupid Little Problem with SNMP Version Tags
  9. SCOM Security Monitoring in Action: Detecting an Attacker
  10. Using SCOM to Capture Registering Remotely Located DLL Files
  11. Security Monitoring MP: Powershell Exploit Toolkit Rules
  12. Security Monitoring MP AppLocker Rules
  13. Security Monitoring Management Pack Summary
  14. Post Configuration Tasks for the Security Monitoring Management Pack
  15. Potential Areas for Noise in the Security Monitoring Management Pack
  16. Event Forwarding and How to Configure it For the Security Monitoring Management Pack
  17. Security Monitoring Management Pack GPO Summary
  18. Introducing the Security Monitoring Management Pack for SCOM (updated May 2018)
  19. Using SCOM to Capture Suspicious Process Creation Events
  20. Breaking apart the GPO Modification Process and Using SCOM to Detect GPO Changes – Part 2
  21. Windows Event Collector Discovery Management Pack
  22. Breaking apart the GPO Modification Process and Using SCOM to Detect GPO Changes – Part 1
  23. Using SCOM to Detect Scheduled Task Creation
  24. Using SCOM to Detect Service Creation
  25. Using SCOM to Detect Golden Tickets
  26. Using SCOM to Capture Events from the Forwarded Events Log

2016 18

  1. Using SCOM to Detect Overpass the Hash Attacks
  2. Using SCOM to Detect WDigest Enumeration
  3. Using SCOM to Detect Pass the Ticket Attacks
  4. SCOM 2012 and 2016 WebConsole and FIPS Compatibility
  5. Alert Management Tuning: The SQL Management Packs
  6. Using SCOM to Detect Failed Pass the Hash attacks (Part 2)
  7. Monitors vs. Rules and how they Affect Alert Management
  8. Using SCOM to Detect Successful Pass the Hash attacks (Part 1)
  9. Deploying and Troubleshooting SCOM on Unix/Linux machines
  10. The Stubborn Gray Agent
  11. Event ID 31553 in SCOM Arithmetic Overflow Error
  12. Creating the ‘Contained Objects’ Widget in SCOM
  13. So You Want to Roll Out SCOM: Decisions that you should make before you click Install.
  14. Certificate CRL Check Fails When Deploying SCOM Agents to a Unix/Linux Server
  15. The Anatomy of a Good SCOM Alert Management Process – Part 3: Completing the Alert Management Life Cycle.
  16. Using SCOM to Monitor SQL Logs
  17. The Anatomy of a Good SCOM Alert Management Process – Part 2: Road blocks to good alert management.
  18. The Anatomy of a Good SCOM Alert Management Process – Part 1: Why is alert management necessary?

2015 7

  1. Issue Deploying SCOM Agent to Solaris 10 Server
  2. What to know about Exchange 2013 Managed Availability and SCOM Part 1 - Architecture
  3. SCOM 2012 WebConsole and FIPS Compatibility
  4. SCOM 2012 Version Information
  5. SQL Management Pack for SCOM: Low Privilege configuration in Clusters
  6. SCOM 2012 - SharePoint WebPart shows only a blank page in a SharePoint 2013 HTTPS environment
  7. SCOM ACS for Unix and Linux Servers