 Monitor any Windows membership group for additions or deletions -- finally, a way to know who changed what, when! Sends email, console or other alerts when group membership changes! Great for sending automatic notices of user account changes to various departments! Perfect for networks with multiple administrators! Keep detailed logs separate from Windows event logs for added audit security!
Installation Documentation
|
| ||||||||||||||
If Membership Monitor is already installed, the Install button will not
be present. Instead, setup will present an Upgrade button.
If older versions of any of the distribution files
already exist on your machine, the program will upgrade them automatically when you
select Upgrade.
In some cases, it may be necessary for you to reboot your machine to complete
installation or an upgrade. If so, you will be prompted to restart.
Membership Monitor installs to the system directory (usually C:\WINNT\system32).
Removal
Upgrading
Command-line Options
To assist with automated installations, the program also supports the /quiet command-line switch.
You may use the /quiet switch in conjunction with /remove, /install, or /upgrade.
When the /quiet switch is specified, the program only displays dialog boxes if errors are encountered;
otherwise, the program performs the requested function and exits immediately. This feature makes it easy to
handle installations or upgrades network-wide with a simple batch file.
Administrative Options and Remote Installation
Examples
Note: For remote installation or removal to work (i.e., specifing a target machine name as in the above two examples
using \\fred and \\barney), both the machine you are working on and the target machine must be NT/2K/XP, and you
must be logged on under an account that has administrative privileges on the target machine.
The applet lets you set the options appropriate for your machine. Any changes you make will not take effect until you click the "Apply" button or close the
applet. You do not need to reboot or stop and restart the service after making changes.
Group Lists
Enter the flat name (NetBIOS name) of each additional domain to enumerate, one name per line, i.e.
Restart the Membership Monitor service to apply the changes.
The groups listed are displayed based on Windows own internal domain group discovery methods. If your groups are not listed, you will need to verify that the machine's domain membership,
Active Directory access, etc. are working correctly. You will also need to provide security credentials to each domain (see below).
Monitoring Groups
See the Timings section of the Advanced Settings page for details on changing the polling rate and method to optimize notification rates.
Membership Monitor works with Windows Auditing to report the username of the account responsible for making changes. Membership Monitor will automatically
enable the correct local policy to permit this (
Setting the Alert Actions
Email Notifications
Custom Alert Actions
Changes you make here will override the Default Alert Actions settings (the Default settings are shown in light grey). If you want to ensure an action occurs even if the Default Actions change,
change a setting so the checkbox is solid black. To be sure an action does not occur, be sure the checkbox is cleared completely.
You may also set custom email recipients for this group using this dialog. Recall that you must also have defined your email servers on the Default Alert Actions dialog (see above).
Audible Alert Options
Note: You must have the System Tray applet loaded in order to hear audible alerts. See the System Tray Icon section of the Advanced Settings page to enable/disable the tray.
Logging Options
Set the options for each type of log by choosing their dialog screens from the Options menu.
Advanced Settings
Timings
You can sometimes increase the efficiency and timeliness of notifications by enabling the Trigger option which can result in collection of the necessary data when
Membership Monitor detects a change.
Runs on Windows XP, 2003/2003 R2, Vista, 2008/2008 R2, Win7, Win8, Win8.1, Win2012/Win2012 R2, Win10, Win2016, Win2019.
Both 32 and 64-bit versions provided.
Installation
Membership Monitor requires Windows NT/2K/XP, and runs as a system service.
You must be logged on using an account with administrative privileges to install or remove the service.
After you download the zip file, unzip the contents to a temporary directory on your
machine (or a shared network directory), then double-click setup.exe and click
the Install button.
Run setup.exe again, and click the Remove button on the setup dialog.
You may also run gwmm.exe /remove from the system directory. The Remove
button will only be enabled if setup determines that the service is already installed.
To upgrade to a new version, download and unzip the new version to a temporary
directory. Double-click the new setup.exe and click the Upgrade button.
The Upgrade button will only be visible if setup determines that an older version
of the service is already installed. Otherwise, only the Install and Remove
buttons will be shown.
Although not generally needed, you may specify the following command-line options when
running setup.exe or gwmm.exe. You may use a dash or a forward slash before the option. Slashes
are shown below for clarity. Options may also be specified by just the first letter.
The setup program, setup.exe allows you to specify parameters on the command line for remote installation
or removal:
setup [ -install | -remove | -upgrade ] [ -quiet ] [\\targetmachine]
Membership Monitor is controlled by its Control Panel applet. To start the applet, find the Membership Monitor icon in the Windows Control Panel and click it.
HKLM\SOFTWARE\Greyware\Membership Monitor\Parameters\Additional Sources
The Membership Monitor Control Panel Applet [Click for larger size]
When you start the applet, the program will attempt to display all user groups visible from the machine on which you are running Membership Monitor. If the machine is
a member of a domain, the groups associated with that domain will be listed under a tab named for the domain. If the machine can discover and has rights to other domains (such as
child domains), the other domains will be listed on their own tab. If the machine is a stand-alone machine, its groups will be listed under a tab named for the local machine.
Note:
By default, only domains that are discovered through Active Directory will automatically appear in their own tabs. If you have other domains with a trust relationship
that allows interrogation of group accounts from the domain hosting Membership Monitor, then you may add them manually by editing the following key in the regsitry:
OTHER_DOMAIN
ANOTHER_DOMAIN
etc...
Credentials
Membership Monitor needs sufficient rights to be able to read the security logs from domain controllers in each domain it monitors. Since the program runs as a background service, you will
need to provide an account with Domain Admin rights to each domain you will be monitoring. You do this by clicking the Security
Credentials for [DOMAIN] link on the bottom-left of each domain tab page. This brings up the Credentials Dialog.
The Credentials Dialog [Click for larger size]
IMPORTANT:
You MUST provide a valid credentials account for each domain you monitor. Membership Monitor will not be able to detect group
changes without this access.
To monitor a group for changes, simply click the group's checkbox. Membership Monitor will begin tracking members in in the group.
Keep in mind that group changes will not necessarily be visible immediately. The actual time it takes a change to become visible will depend
on which domain controllers were involved with the change and the replication schedule of your domain. If you are looking for
the fastest notification possible, you should run Membership Monitor on the PDC-Emulator.
Security Settings | Local Policies | Audit Policy | Audit Account Management | Success) for you. However if you have
group policies that override this setting, you will need to edit them to ensure the Success auditing remains enabled.
When Membership Monitor detects a change to a monitored group, it will take the actions you specify to alert you or log the event. You may choose use the Default Actions
or define custom actions for any group. The selected type of action for any group will be displayed in the Alert Actions column.
The Default Actions
The Default Actions are set using the Options -> Alert Options item from the applet menu.
The Default Alert Actions Dialog [Click for larger size]
If you want email notifications for change events, you will need to click the Email Setup... button to define default email servers and recipients. You can also use the
setup dialog to send test mails and to advanced email troubleshooting. You MUST have a default email user and email servers defined if you plan to use email notifications.
To define a custom alert action for any monitored group, right-click the desired group name and choose Set Custom Alert Actions... from the context menu.
The Custom Alert Actions Dialog [Click for larger size]
You may want to have an audible alert when your monitiored groups change. To enable this option, choose Options -> Audible Alert Choices... from the applet menu.
The Audible Alerts Dialog [Click for larger size]
Membership Monitor has the ability to write data to several types of logs:
Pick the Options -> Advanced Settings... from the applet menu to set the following options:
The Advanced Settings Dialog [Click for larger size]
Membership Monitor obtains information about changes to groups and who made the changes by polling domain controllers. The main polling functions happen on the schedule set here.
You will want to set a schedule that alerts you in a timely manner but does not result in excessive network activity. On most networks, this will not be a concern, even at a high
polling rate, but if you have underpowered systems or have a very large network with groups with many hundreds or thousands of members, you will want to moderate this setting.
System Tray Icon
Sets whether the System Tray Icon is displayed, and whether alerts are shown in balloon notifications. You must have the tray loaded if you want to receive audible alerts (see above).