When you sit down at someone’s PC to fix whatever they’ve broken, do you find yourself always going through the same old process of trying to figure out how exactly the machine is configured? We have just stumbled across a solution: BGInfo written by Bryce Cogswell of the now famous SysInternals and Winternals.
When you sit down at someone’s PC to fix whatever they’ve broken, do you find yourself always going through the same old process of trying to figure out how exactly the machine is configured? We have just stumbled across a solution: BGInfo written by Bryce Cogswell of the now famous SysInternals and Winternals (recently acquired by Microsoft; see also this security blog).
BGInfo is a tiny utility (740KB) for Windows 95+ and Windows NT 4.0+ that, when launched, surveys the PC it is running on. Once the survey is completed BGInfo, by default, creates a bitmapped image of the configuration details and outputs it as an overlay on top of the current Windows wallpaper. Pretty cunning.
But wait, there’s more! Yes, BGInfo can not only modify the wallpaper; it can also output the data as a bitmap to any directory you please, or send it to a popup window or a popup that is invoked via a taskbar icon. BGInfo can also save the data to an .XLS, .MDB or .TXT file or log it to a SQL database (which allows you to keep a history of the configurations of multiple PCs on a network).
You can, of course, select what configuration details are reported. The default selection includes Host Name, User Name, Machine Domain, Logon Domain, Logon Server, Boot Time, CPU, Memory, OS Version, Service Pack, System Type, Default Gateway, DHCP Server, DNS Server, IP Address, MAC Address, Network Card, Network Speed and Network Type.
The full list is a long one, but if they are not enough, you also can create custom attributes (the program refers to them as “fields”). Custom fields can be created from environment variables, registry values, the output from a VB script, a Windows Management Instrumentation (WMI) query, the version information from a file or the file’s time stamp, or the contents of a file. You can also include an image file to be included in the output (useful for adding a corporate identity).
You can control how the data is displayed. That includes text attributes (the font, font decoration, font size, bulleting, and text color to use), alignment within the text block (left, right, or center), and position on the wallpaper (center, top, top right, right and so on).
When you launch BGInfo it will, by default, wait for 10 seconds before updating the data display and exiting. You can stop the countdown by clicking on a button. This countdown time can be changed using a command line option (a value of 0 immediately updates the display and exits without the GUI being shown).
You save the configuration in a file, and by launching BGInfo from the command line, you can load the configuration from any drive. This allows you to have all users collect the same data and display or store it in the same way.
BGInfo is a remarkable utility for network managers not only because it does so much but because it is also free!
While we’re discussing SysInternals’ utilities we should point you to another of it free tools that, like BGInfo, is fabulously useful: TCPView written by Mark Russinovich, the guy who became famous for discovering the Sony rootkit.
The purpose of TCPView is to display “detailed listings of all TCP and UDP endpoints on your system, including the local and remote addresses and state of TCP connections. On Windows NT, 2000 and XP TCPView also reports the name of the process that owns the endpoint.”
We found the need for this tool when we were testing a really powerful protocol analyzer that we’ll cover in a future column. This analyzer identified a conversation between our machine and the server karneval.cz, a server we knew nothing about. Worse, the analyzer couldn’t tell us what process on our machine was doing the talking.
With any server that you don’t know about that is in a European domain, your first thought is that it you might have acquired some malware such as a bot reporting back to its handler.
Thankfully, TCPView showed us that the server is just the endpoint for the Skype service. Breathing a sigh of relief, we gave thanks to the guys from SysInternals.
Next week, we’ll look at updates on a couple of products that were previously reviewed in Gearhead. Until then, we’ll be chilling at gearhead@gibbs.com or on Gibbsblog.
