North America
  • North America
  • Europe
  • United Kingdom
  • Asia & Pacific
  • Australia
  • South America
  • Africa
Tags
Xcitium NUMsp Adobe Adobe Flash Secure Internet Gateway Stolen Linux Devices Office scan Trend micro wallpaper style colour count uninstall slack slack Windows server backup Event id Retrieve Implementation module Toast send VBScript next logon generation Locked Unlock AD Computer tickets desk AD User AD Cylance Protect cylance Remote Control by ITarian Itarian Communication Client Encrpyt Uptime test internet properties serial shadow Lockscreen Hardening Enumeration Net Session netcease DLP attack Brute force Trace CPU repair mask Subnet Public IP Internet explorer 11 Nitro Upgrade Assistant Spiceworks agent forticlientssl vpn activate dates between mailbox exchange save CES comodo endpoint security CAVS image files photo webcam capture unblock close opened Generator Random power plan hash bandwidth MODEL Hunter Unknown CA trusted root cerficate avira shortcuts arrow icon user folder log file full scan sorting policy video audio File types System Boot Time Boot time speed Trend Micro Worry-Free Business Security Services Instance US EU C1 apache wallpaper Education Consumer sentinelone without reboot decrypt comdom ESM agent ESM without authentication with authentication No restart authentication Upload Documents Cobian backup triggering defender without with CisReportTool C1 logs printer port name ping pubnub zip file file transfer winscp adifosensu Recovery key synchronize NTP server caskroom Existing Firewall Rule match expire loggedin user internet connection windows lock Dome agent website certain time priority product keys msoffice word macros dotm file dotm windows 10 outlook PST Image vaccine Petya ransomware local drive permission interval interva; browser .msu win 7 workstation TKINTER ethernet windows update metered Virtual manager FTP states windows features teamviewer host SQL workgroup contents resume pause free edition maxthon browser QualityCompact Panda Antivirus HP one operation system fastboot and labtech Vulnerability SEP Software Inventory WEBROOT comodo dome agent comodo cloud antivirus Vipre Business Agent Malwarebytes Anti-Exploit plugged in sleep uptodate Time out zip autostart client agent encryption recover sub system software distribution screenshot product key ms office Drive username an Credential BITS speed control WSUS Onedrive search google chrome UK blank page internet Explorer metric interface metric date patch management agent bginfo LAN Wake environment Dome Standard Agent crash kernal same the within a your on WinRM Setup collecting appropriate error in Erase approve EDR delayed ITSMService Veeam different service from RAM Usage Reaches Value Level Log RAM sockets available HTTPS TCP Port Server cis autorun Batch file three largest pm spm rmm availability Power management Ability Connectivity Virtual Private Network VPN online Shutdown unzip 24 hours Success Failed virusscan mcafee public installed Trendmicro Antivirus INTEL AMT Laptop updates KB spooler print Action center 48 older Web Page Cdome Trusted Root Certification Authorities store Certificate Motherboard Health Status Hard Drive Changes space Threshold Modify host screen Legal start menu install comodo patch management agent installed programs Installed Programs and identifying number property remote Transfer SFTP idle time capacity resize activity Hard disk Smart Missing Font Network Share SCEP System Center Endpoint Protection Ownership Recursively Extension clean Find Unhide Empty Rename SHA1 Checksum MD5 Modification creation time last File Modification older than UTC time Projects Corrupted Copy Blacklisted root Storage Display Top Microsoft Installer Recent Windows Management Instrumentation Command WMIC Consuming Last Logged on already restore created format Delete partion CCleaner problems Interrupt saving Kill balanced plan Running high memory maintenance Kaspersky Security Center Agent Critical Kaspersky Endpoint Security 10 Kaspersky defragmentation auslogics using Defragment Decompress Compress Background Tool commands all Demand Task summary Recycle bin Shared file Task Scheduler Clear Cache Renew ESET Desktop Setting BookMark Mapped Removable Machine Processor Architecture Interaction failure Current User Temporary Local Group days open Computer updated Guest User Sophos except Path remove Byte size directory Microsoft Essentials Malwarebytes TCP/IP Folder DHCP Dynamic Host Configuration Protocol Symantec Sub Directory All files Dynamic IP Text content specified path Network Adapters RDP Remote Desktop connection BitDefender Agent Security Tools BitDefender DNS netman Delete Values Registry-key share folder wireless network License Status Microsoft Office Office Microsoft .NET 3.5 SP1 id product lisence shortcut Comodo Client Communication operations AVG CloudCare AVG Sub-keys Browser history volume target Teamviewer WMI statistics usage Anti-viruses limit quota Popup Message Task Bar Quick Icon restart notifications disconnected logoff logon enabled disabled JRE JDK Java Development kit Java Runtime Environment Java reboots pending infections detected uncleaned certificates expired URL Unauthorised not activated License Key Number permissible USER ACCESS CONTROL UAC triggers actions Multiple changed Local User Environmental Variables partition stop BIOS startup services local accounts plug and play run reboot drives bitlocker drivers workstation lock restorepoint performance power active connections ram process Guid Comodo Client Security patches windows updates Windows command Python 2 Dome shield hardware servers Security Configurations Process management Script Procedures Task automation MSP automation Script monitroing Email ITSM Procedures Domain User accounts MSP Log collection integration File operation C1 automation System opearations Patch managment MAC Powershell VB script script Remote managment
More

Monitor Admin Actions.

Download JSON Download Python
Ratings
Release Time
06/05/2017
Downloads
1370 times
Update Time
11/20/2024
Views
1663 times
Share-it:
Categories
Monitoring
Published on:
7 years ago
Tags

Please refer the Script for monitor admin actions.

It will give an alert when the below conditions are triggered.

1) Microsoft UAC "requests" for privilege action toward user

2) Usage of the user account with admin rights (in the case of user authenticate with an admin account, or use admin account in a UAC request.

3)To receive an alert when a user accept UAC (or) input admin account in UACuac and to know for which process it was requested and track in audit report this kind of actions to investigate in case of security issue.
Based on the ACTIONS respective EVENT ID's the script will work.

Tested in os: WIN 10, WIN 8, WIN 7

Please refer the wiki guide for how to use the custom monitoring scripts 

 https://forum.mspconsortium.com/forum/products/other-comodo-products/comodo-device-management/wiki-faq-how-to/11486-how-to-use-custom-script-procedure-monitoring

Procedure's Instructions