Businesses are no stranger to Active Directory (AD). The identity and access management service has been relied upon by the vast majority of organisations for many years - 90% of them, according to Gartner - but a more agile approach is needed for the hybrid professional work environment that’s now very much a reality.

Indeed, the pandemic shook businesses from all corners and while AD was the reliable backbone of most organisations when all their workers bundled into the same building, the widened cyber attack surface of a hybrid workforce means there are now added complications when deploying AD across a business.

"Active Directory is like the spinal column of an enterprise and it must be closely protected,” explains Matt Lock, technical director at data security firm Varonis. “If an attacker manages to seize control of AD, they effectively hold the keys to an organisation’s digital kingdom and have privileged access throughout the domain, where they can cause serious damage.”

The issues boil down to visibility, it’s much more difficult to oversee all the assets within a business when its workers are so geographically fragmented. Factor in, too, the complexities that come with the rising popularity of bring your own device (BYOD) policies and the way in which workers customise their software with additional assets like add-ons from third-party marketplaces.

Pushing more business processes to the cloud has traditionally been the easy, go-to approach for all-things digital transformation and the deployment of AD is no different. The cloud offers a swathe of benefits to businesses looking to maintain tight security controls across office and remote workers, including a more comprehensive view of the organisation’s digital assets and more streamlined security controls.

With the cyber security landscape now being so wide and businesses being targeted from all angles, it’s more important than ever to have the organisation’s asset management in top shape. Shifting AD to the cloud is the best approach for businesses looking to stay safe in a hybrid working world.

AD transformation

For most organisations, asset management pre-COVID was a relatively straightforward exercise in user and device tracking. Now the working and threat perimeter has moved to the homes of their workforce, keeping track of the entire IT estate and ensuring high levels of security are maintained has become much more complex. Migrating AD to the cloud can deliver more oversight and integrated support to users who need this to secure their equipment and network connections.

Dan Conrad, field strategist at One Identity, tells IT Pro: “Since the rollout in 2000, AD has changed significantly and the impact of Zero Trust campaigns will change this further. At its core, AD is an SSO (Single Sign-On) solution designed for an easy user experience by providing easy access to objects. Active Directory and Azure Active Directory (AAD) have changed the game a bit by still providing the good user experience but detaching some of the vulnerabilities. For instance, the idea of joining every corporate system to the AD is no longer necessary. AAD and solutions such as Intune allow management of the systems without the vulnerability that goes with every system being ‘trusted.’”

Many companies see the continued migration of AD to the cloud as the solution to the issues they face managing the array of assets their businesses use. With security front of mind, migrating an AD to a cloud platform can deliver a level of insulation from some cyberattacks.

The holistic approach to managing what could be a diverse range of devices now being used across your business, requires your control and security systems to change. Businesses are increasingly creating domain-joined and BYOD/non-domain-joined systems to give themselves the maximum flexibility with the assets their staff uses, simultaneously delivering a security infrastructure that is more resilient than a simple cloud or on-prem solution.

The business of consumerisation

The threat surface all businesses now face requires a new approach to network management and device security. As early as March 2020, IDC predicted that within two years, over 90% of enterprises worldwide will have a hybrid cloud deployment. As the COVID-19 pandemic took hold, there has been a rush to implement this approach, with businesses being pushed to radically alter how they manage their workforces and the technologies and services they use.

Rajesh Ganesan, vice president at ManageEngine, tells IT Pro: "A cloud-native hybrid IT infrastructure helps organisations respond to change and uncertainty better. That said, even as organisations move to a cloud-first or cloud-dominant approach, it’s important that application, infrastructure, and data security are not compromised.”

Alastair Pooley, CIO of Snow Software, adds: “As we switch to more SaaS applications, you either need to use Azure Active Directory (along with the relevant licenses) or something like Okta to provide that single sign on experience to your staff. Either approach allows you to maintain a corporate directory to control access to resources. It is worth noting that you should re-examine your endpoint security, as traditional group policy (GPO) doesn’t deliver for remote workers. Microsoft’s Defender ATP coupled with Intune is a powerful combination but again you need new licenses to deliver that.”

How your business will manage its human resources and digital assets in a post-COVID-19 environment remains to be seen, as enterprises have yet to make firm plans regarding where the vast majority of their employees will work from. Some workers will return to centralised offices.

However, a high percentage will remain as remote workers. In this scenario, putting place a flexible and secure system to manage your company's assets is a sensible move. The agility migrating AD to the cloud can deliver is a desirable option. Review your business's asset management as it stands today. With some realistic forward planning, you will be able to create bespoke asset management protocols that are right for your staff, and the long-term security of your business.

This article was first published on 01/02/2021, and has since been updated

SMBs that want a storage appliance that'll slip easily into their Windows network might find WD's Sentinel DX4200 fits the bill nicely. The brain behind this 4-bay desktop box comes courtesy of Windows Storage Server 2012 R2 (WSS) so anyone familiar with Microsoft's standard server OSes will feel right at home.

It's a significant upgrade over the Sentinel DX4000 which still chugs along with Windows Storage Server 2008 Essentials R2 at the helm. The DX4200 has a more useable 4GB of server-grade DDR3 and although its dual-core 1.7GHz Atom C2338 CPU doesn't offer much of a speed boost, it does support up to 16GB of memory.

You can't buy a diskless appliance as WD only offers it in 8TB or 16TB capacities. We have the latter on review which came with four 4TB WD Se SATA hard disks included.

Another smart feature is the OS is installed on a 500GB SFF SATA drive tucked away in the side of the chassis. You can also fit an identical SFF drive in the carrier on the other side for a fault tolerant mirror.

The StorCentral app shows appliance utilisation but hands you over to the Windows Server Manager for all configuration tasks

Software features

The DX4200 runs the Workgroup Edition of WSS and is good for up to 50 users a doubling over the DX4000. There are some provisos, though, as it can only join an existing Active Directory domain, doesn't support the Hyper-V role and is stripped of Microsoft's global data deduplication feature.

After attaching a local monitor, keyboard and mouse, we ran through a quick start wizard which just sets the language and asks for a password to secure administrative access. After a reboot, you can enable email alerting and apply WD's software updates.

The DX4200 is app sparse as you only get WD's StorCentral which provides a basic dashboard showing storage status, alerts and system utilisation graphs. When we wanted to configure storage it simply stepped aside and handed us over to the Windows Server Manager interface.

The physical drives are placed in a storage pool within which you create virtual disks

Storage spaces

Hardware RAID is not available for the four main drives which are configured as Microsoft Storage Spaces. These combine selected drives into a single pool which can be expanded on the fly into any spare ones.

Within our four-drive pool, we created virtual disks and chose from two- or three-way mirrors or parity resiliency which is essentially software managed RAID5. An advantage of Storage Pools is thin provisioning can be enabled on a virtual disk and will apply to all NAS shares and iSCSI targets within it.

Before creating NAS shares, you'll need to install the File and iSCSI Services feature in the File and Services Role as this isn't preloaded. For IP SANs, we also had to install the iSCSI Target Server feature as well. These aren't issues though, as when we attempted to create our first share or iSCSI target, it fired up wizards which loaded the features for us.

During virtual disk creation you can choose from three levels of resiliency with mirrors offering the best performance

Parity volumes provide the best redundancy but they'll hurt write speeds. Copies of a 50GB test file from a Dell PowerEdge R730 rack server to a share on a parity disk returned a write speed of only 55MBps.

Read speeds aren't affected as copying the file back to the server saw 113MBps. The poor write speeds of parity disks will be an issue if you're planning on using the DX4200 as a backup device securing our 22.4GB test folder and its 10,500 small files returned only 47MBps.

Running the same tests on a mirrored virtual disk delivered superior speeds. The 50GB file copy gave us an average write speed of 106MBps while the 22.4GB folder mustered a much more respectable 77MBps.

IP SAN performance is very similar with a 500GB target on a parity volume returning Iometer raw read and write speeds of 113MBps and 51MBps. Moving over to an iSCSI target on a mirrored volume saw read speeds increase to 112MBps.

Our test client has a share mapped from the DX4200 but the SmartWare Pro software couldn't see it.

SmartWare Pro

The DX4200 includes a 25-user license for the SmartWare Pro backup software but if WD has bothered to test it they'd have found, as we did, that it doesn't actually work. The bottom line is the appliance's mapped shares and iSCSI volumes don't show up as backup targets in the software's interface.

We discussed this with WD which passed our findings on to its US development team. It eventually came back and confirmed that we had, indeed, found a bug in the software and assured us it was working flat out on a fix.

That was over a month ago and since then WD has remained ominously silent. For the time being, the SmartWare Pro software can only be used to backup data to another local volume, an external USB drive or a Dropbox account.

Verdict

The Sentinel DX4200 scores for ease of use and offers a generous storage capacity for the price. It works hand in glove with Windows networks but performance is a mixed bag and you should ignore the buggy SmartWare Pro software

Chassis: Desktop

CPU: 1.7GHz Intel Atom C2338

Memory: 4GB ECC DDR3 (max 16GB)

Boot disk: 500GB WD AV-25 SFF SATA boot disk (max 2)

Storage: 4 x hot-swap 4TB WD Se SATA hard disks

RAID: Windows Storage Spaces

Ports: 4 x USB 3

Network: 2 x Gigabit

Power: External PSU (max 2)

Software: Windows Storage Server 2012 R2 Workgroup Edition

Warranty: 3yr limited

Microsoft has re-released a security fix after it's original Patch Tuesday security update caused caused problems with Active Directory.

The software giant was forced to pull patches last week for Microsoft Exchange Server 2013 and Active Directory Federation Services (ADFS) 2.0.

The Microsoft Exchange Server 2013 patch, MS13-061, was pulled after it emerged that installing the update stopped users from searching the contents of their inboxes.

Meanwhile, the ADFS patch, designed for use with Windows Server 2008 and 2012, was intended plug a security flaw that could disclose unwanted information.

Once installed, it is thought to have caused functionality issues in ADFS, which prompted Microsoft to revoke it.

However, the firm has now released a re-worked version of the latter patch and is urging business users to install it as a matter of urgency.

"Customers who already installed the original updates will be reoffered [this one] and are encouraged to apply it at the earliest opportunity," the company said in an alert on its support pages.

At the time of writing, Microsoft Exchange 2013 users were still awaiting details of when a replacement for the MS13-061 patch will be rolled out.

Graham Cluley, independent infosecurity market watcher, said Microsoft will be keen to put last week's Patch Tuesday troubles behind it.

"This isn't the first time Microsoft has been forced to re-release a security patch after problems were found in the original version, and it surely won't be the last," he said in a blog post.

"I'm sure the company is hopeful, however, that it can keep such incidents to a minimum because of the disruption and downtime buggy security patches can cause it's customers."

Now in version 15, WhatsUp Gold (WUG) provides IT administrators with a suite of tools to help them monitor and manage the devices on their networks. As long as your network nodes are configured for SNMP, discovery is easy. Simply supply the discovery tool with the necessary credentials and a "seed" IP address, such as your switch or DHCP server. The tool scans the address range you specify and discovers all the devices in the network segment.

With its modular, easy-to-configure web interface, WhatsUp Gold allows administrators to check the status of devices and monitor the health of their network in real time.

The latest version of WUG also supports Layer 2 Topology Discovery, so as well as a list of devices you also get a map of your network showing the relationships between different devices. To this you can add dependencies, which can be done with just two clicks from the context menu. These help make clear how devices are connected and, more importantly, help to minimise network traffic. You could, for instance, use dependences to tell WUG not to poll devices unless the switch they're attached to is working no point polling devices that are unreachable.

Once your devices have been discovered, you can assign a device type to them. WUG actually does this automatically during the discovery process but doesn't always get it right. Although not as important as in previous editions they're no longer used to determine which monitors should be used with a device (more on this below) it's still good to make sure that your device types are what they should be. Later on it makes finding the information you need easier. Fortunately, changing device type is easy, simply right click on the device in the WUG admin console, choose properties and then, on the General tab, pick the appropriate device type.

User accounts can be created natively within the program or imported from Microsoft Active Directory (AD). As well as importing security groups from AD, you can now also create security groups within WUG itself. So users whose networks aren't AD-based can easily apply access rights to many users at once, saving time and cutting hassle.

You can configure WhatsUp Gold to warn you when an important device goes down. Wherever you log in to the web interface, a pop-up appears accompanied, if desired, by an attention-grabbing klaxon sound.

The program allows you to apply three types of monitor to a device: active, passive and performance. Active monitors are those which poll devices at regular intervals. SNMP is the default for this, but there are also plenty of other options. These include queries for web and FTP services, IMAP and so on. Passive monitors, on the other hand, are triggered by certain device events -a device or link going down for a certain length of time for example. When this happens, it triggers an alarm, alerting administrators to the problem. The last type of monitor is performance monitors. On SNMP-enabled devices, the software can track a range of indicators, including CPU and disk utilisation, memory usage and so on. As well as the default alerts, you can also add monitors for printer performance, SNMP performance and a range of other variables.

The Flow Monitor has also been improved in version 15. Thanks to a new configuration wizard it's easier to set up. It now automatically detects packets of the relevant protocols (NetFlow, sFlow, J-Flow and IPFIX). The sending devices are logged as sources and their output monitored and logged. The software then feeds the data gathered into a number of reports and graphs.

Frustratingly, though, we found some of the reports difficult to view in the browser.

Other reports can be accessed directly from the main dashboard. Simply add the desired report to the dashboard and use the "Configuration" option from the report's menu to specify exactly what variables you want it to log. Pre-defined reports include CPU utilisation, disk utilisation and so on, either for specific devices or groups of the devices as well as a wide range of other templates. You can also monitor clients in real time, using the Web Task Manager and Web Performance Monitor, among other tools.

Frustratingly, though, we found some of the reports difficult to view in the browser with pop-ups appearing in oddly sized windows that were difficult to work with. It's a small thing, but irksome. Customising the SNMP counters that the performance monitor follows can also be a time-consuming task, as it involves browsing to the objects in the MIB database. It would have been handy if there had been some more graphical, intuitive way of customising the tool. Adding WMI monitors was much easier.

WUG's web interface has had a makeover. Modular and easily configurable, it now comes with a handy mouse-over pop-up for each device. This tells you the current status of the device in question and summarizes the results of the relevant performance monitors. So it's easy to see, quickly and at a glance, exactly what the device's status is. To view the results of the monitoring, simply select a device in the web interface and either hover your mouse cursor over it or, for a fuller report, double-click it.

So what's our verdict?

Verdict

WhatsUp Gold is comprehensive, has a slick new interface on the web console and is generally easy to use. At times the web interface can be a bit flaky, but otherwise we like it.

Processor: dual-core RAM: 2GB Operating system: Microsoft Windows 7 Ultimate, Windows Vista Ultimate/Business, Windows Server 2008/2008 R2, IIS6 or IIS7, Microsoft .Net Frameworks 2, 3 & 4

Promise has launched a two-bay network attached storage (NAS) device that costs just 145 ex VAT.

The SmartStor NS2600 has two hard disk bays so supports both RAID 0 and RAID 1. It is then up to the user if it is deployed for either maximum performance or greater data redundancy.

Promise claimed the NS2600 used just 7W of power when it sleep mode, so it's environmentally friendly too.

As well as several consumer-oriented features, such as a UPnP media server and a download manager, the NS2600 also has several business-focused features. These included the ability to act as a print server, potentially saving the cost of a dedicated network printer, and the ability to act as a repository for IP security camera footage.

It supports Microsoft Active Directory and can even be used as a web or SQL server which will be attractive to smaller businesses with tight IT budgets.

We suspect the NS2600 is the two-bay version the larger and more expensive NS4600, which was favourably reviewed by our colleagues at Expert Reviews.

However, Promise isn't as well known as rival NAS manufacturers Synology and Thecus, who make NAS devices with the benefit of broader support amongst third party plug-in developers. It may, therefore, struggle to attract customers not motivated purely by price.

The SmartStore NS2600 will be available shortly and is backed by a two-year limited warranty.

Keeping a small business network running is a demanding job. Unless you remember to check all the event logs regularly, it's easy to let something important slip. What's required is one place where you can see everything you need to know about your network, and make any necessary changes to its configuration.

Spiceworks is a free browser-based network management and administration program. It provides the user with a single dashboard from which he or she can inventory, monitor and troubleshoot the network.

When you first install it, Spiceworks scans your network. It checks Active Directory, does a NetBIOS scan and pings the addresses in your specified IP range. It took us a fair bit of fiddling with the firewall to get all the devices on our network inventoried, and even then our locally attached printer wasn't found. This was a bit odd, given that it was attached to the PC Spiceworks was installed on.

Once it has its inventory, though, Spiceworks is refreshingly intelligent in the way it uses your information. For instance, wherever it can it will identify a client PC's make and model. It will then automatically link that PC's entry to the driver download page on its manufacturer's website. It will also show you the machine's spec, the programs that are installed on it, the amount of disk space free and so on.

Building and updating an inventory, though, is really only the beginning. Spiceworks monitors the network and warns you when alerts come in. So when there's a security alert, a PC is behind on its updates or even when a printer runs low on toner, you'll know about it. And when a problem does arise, you can troubleshoot it from within Spiceworks too.

The software has a built-in, and fairly sophisticated, help desk feature. With this you can create a helpdesk portal and then link that portal to your IT support email address. Each time someone sends support an email, Spiceworks automatically creates a support ticket. The ticket tells you who submitted the request (Spiceworks scans Active Directory on setup, so it knows who your users are), the text of their mail, and when the request was submitted. You can then assign the ticket to a tech support worker, attach it to the relevant device in your inventory, track its progress and close it when it's resolved.

Spiceworks installs locally and doesn't share your information with the eponymous developers. However, the reason it's free is that it's ad-supported. So, when you install you have to register for an account at spiceworks.com. The company will then push targeted ads to appear in relevant places in the Spiceworks interface. For instance, if no Exchange server is detected you'll be shown an ad for hosted email.

The adverts really aren't obtrusive. What's more, your Spiceworks account also gets you access to user forums, training videos and useful repositories of white papers and other tech resources on lots of interesting topics.

Spiceworks has an enormous amount of useful features for absolutely nothing. Having your inventory in one place and being able to easily see network events in real time was incredibly useful. And the free helpdesk and ticketing system will greatly simplify support for small businesses who couldn't otherwise afford such a thing.

Verdict

As long as you don’t mind the occasional advert and are prepared to put some effort into setup, Spiceworks is a great program that makes life a lot easier for small business IT support teams.

SYSTEM REQUIREMENTS Operating system: Windows XP (SP2), Vista, 7, Server 2003 or Server 2008 Processor: 1.5GHz or faster RAM: 1GB