It’s not easy managing a Windows-centric network, which is why we like Configuresoft’s latest version of Enterprise Configuration Manager.
While its roots are in traditional desktop configuration, ECM now hones in on policy management and compliance by collecting and correlating information from servers and workstations and taking action when they are out of compliance with the defined policy.
ECM employs an agent-based collection mechanism. The agents for which are pushed out to the Windows machines via a simple process facilitated by the management console.
The three-tier ECM server architecture is made up of the Collector, a database, and the console. The Collector is the mid-tier application that manages the jobs of gathering and analyzing the data collected from the systems. The database is the central repository for data.
The console is a four-module, Web-based management program that provides access to all of ECM features. The Console module provides access to the raw data collected from the managed systems. The Compliance module shows the rules and reports supported for setting policy. The Reports module provides templates to view system information, driven by a Crystal Reports engine. The Administration module provides all the ECM configuration settings, such as agent installation, user management, etc.
Installing the agent software out to the managed systems is a simple process that takes only a few mouse clicks. Once the agents are installed and data collected, ECM is ready for use. By default, ECM uses DCOM for agent communications. HTTP communication is a second option. If you opt for HTTP, an HTTP service (a mini Web server) is installed on the remote system to facilitate that. We would like to see Configuresoft upgrade these communications to support more secure protocols like HTTPS.
Using the Console module, administrators can directly change configuration settings for individual systems or across a whole group. A few of the settings managed by ECM include Windows users and groups, NTFS audit settings, NTFS directory permissions, installed Microsoft hot fixes and registry key permissions.
One of the best features of ECM is its auto compliance functionality. With this feature, administrators can set a baseline configuration that all systems must follow. If a system comes online out of compliance, or if someone makes a manual change while it’s on-line, ECM automatically enforces the required settings, leaving a full audit trail. ECM gets very granular in its ability to look at registry key permissions, file permissions, password settings and patch levels, and then take corrective action if the administrator has set it to do that.
While ECM offers automatic compliance makes configuration changes, if you want to tie in patch deployment, you need to use Configuresoft’s Security Update Manager (SUM) add-on.
ECM’s polish lies in its Web Console. The layout, color scheme, icons, and workflow all work together to make the user experience one of the best we have seen across our tests of security management products.
ECM’s reporting is flexible, customizable, and granular. Reports can be generated that show which systems are not in compliance with a single setting, a pre-defined template, or custom policy. You can also generate reports on what remediation actions have been taken to enforce policy settings.
For managing Windows systems configuration and automating policy enforcement, we have not found a better product. The ease-of-use and flexibility of ECM provide administrators with the means to deploy a secure, self-sustaining Windows infrastructure.
For the full report, go to:
