SAG:  eSecurity Analysis Tool

Although primarily intended for use on Windows Vista, or later, versions of Windows® this utility may be run on Windows NT4, 2000 (Server or Workstation), XP, Server 2003, Vista, Server 2008 (or 2008R2), Windows 7 and Server 2011.  It is not needed on Windows 95, 98, 98SE or ME which do not have security issues with “legacy” applications.  The remainder of this topic explains how this utility can be used.

When the eSecurity icon is double-clicked in a Windows Explorer window, or run from a shortcut, or via eCopilot, or from a Command Prompt window with no parameters, a GUI window will be created to allow the user to control what analysis options are used.  The initial window is similar to this [image is ¾ scale with notes overlaid in red]:

The default is to perform all analyses.  That is the Full context choice in the GUI window, but the user may change to the Only choice which will enable the option boxes for individual selection of the analysis options.  When the Analyze button is pressed those options which have a tick in their box will be performed.

Here is an example of what the window would look like after performing the analysis with only Computer and User options selected for analysis:

In the example above the results thus far can be seen in the scrollable central pane of the window.  At this point the user may choose to press the Exit button.  Or select other options and press Analyze again to include them.  However, when all options have been analyzed the Analyze button will be disabled and the window will look like this:

After the Exit button is pressed and the window closes the text eSecurity.log file, in the same folder as the executable, will contain the results of the security analyses performed.  This file should be interpretable by inhouse IT staff or it may be emailed, as a text attachment, to Syscob Support staff for analysis.

The following table contains nine [9] sample eSecurity.log files, but with extension changed from “.log” to “.txt” for maximum browser compatibility.  They illustrate the differences between the Administrator user, a member of the Administrators group and a member of the Users group on Windows 2000 SP4, Windows XP SP3 and Windows 7 SP1.  All are for a local logon (domain logon security must provide a similar security context for “legacy” applications):

All of the links in the table above will open the sample log in a new browser tab or window.  Be aware that the examples in the bottom row do not have sufficient privileges and permissions to run a “legacy” application.

When eSecurity.exe is run with command parameters, as from a Command Prompt window or batch command file, it will run “silently” without a Graphical User Interface [GUI] window.  The valid command line parameters will be interpreted from left-to-right and may include one or more of these values:

• computer  evaluates security context on this host,
• user      evaluates user logon security for this host,
• windir    evaluates security of Windows® directory,
• registry  evaluates security on Syscob Registry keys,
• folders   evaluates security of Syscob application folders,
• winsta    evaluates security on the WinStation,
• desktop   evaluates security on the Desktop, and
• all       means all of the options above and is the default.

Any of the options above may be preceded by a minus sign [“-”] to indicate the option is not desired.  For example, the command “esecurity all -winsta -desktop” would analyze all of the options except for the WinStation and Desktop security contexts.  But should the command “esecurity -user all” be used it would include all options since the “all” parameter follows, and thus overrides, the exclusion of user security analysis.  If any parameter is not valid then this dialog would be displayed:

Should any mixture of valid and invalid parameters be present on the command line the dialog above will be displayed, the invalid parameter(s) will be ignored and any valid options (or the “all” default when none) will be performed.  Thus the normal convention (i.e. an “esecurity ?” command) would show the valid parameter options, but it would also run the analysis for all options.

After the command completes the text eSecurity.log file will be located in the same folder as the executable with the results of the security analyses performed (just as for interactive use).