Innovation_Dan

Actually, now that I think about it I don't know that using DG to point at the websense server would work unless you did some kind of routing along side it. In the Cisco PIX setups we use at our sites, the PIX actually knows to pass the info to Websense and then get a response.

Yes, websense simply applies a default policy to all users and computers unless otherwise configured. You do need to have something passing the info to the server. Default gateway is probably fine for that. If they know how to get around a DHCP default gateway then you're probably going to need more complex protection anyhow.

Here's what we use in production environments... ESXi server, free download from Vmware. A little picky on hardware tho, so make sure your test server can run it. Also, get as much RAM as you can in it. Install VMWare Converter (also free) on the computers you want to clone to virtual, and in a local console on that machine convert it over to the ESXi server. Configure the ESXi server's networking with a virtual switch that is not attached to a physical NIC. (Host only networking, in other words). Or, you could let the virtual computers talk to a NIC but keep it off the network, just so you could get RDP into your little virtual network. The VI client is a little slow. ESXi is great, super fast and stable. We've really been enjoying it a lot. We were trying to run Vmware Server on a linux platform before, but it was dog slow and prone to weird crashes and time sync errors. Since we converted over to ESXi it's just been a dream.

AFAIK you would only actually *need* to use ISA server if you're trying to use actual filtering policies on users or groups, and your users are using terminal services. ISA is used to pass authentication information from the TS to the Websense agents. If you're not using TS, then you shouldn't need ISA at all, and in fact ISA just complicates the whole thing tenfold. As for transparent filtering, it depends on how deep you're asking. If you're just asking in general, then there's plenty of responses here already. If you're asking "How do I configure websense for transparent filtering?" then that's a different matter. Websense first has to be set up in your network infrastructure as a mandatory sort of gateway. It can obviously only filter traffic that goes through it. Configuration is going to vary by hardware, but if you're using Cisco routers they can be configured for filtering directly to Websense. Within websense, you'll use various agent services to authenticate users, either the Network Agent or the Logon Agent if I remember correctly. These work to pass authentication info to Websense, and it should be transparent if you're on a domain setup and have set Websense to talk to your LDAP server. If you don't want to actually filter based on specific policies or groups, then you can set up the default filtering service to just apply to everyone. You can tell Websense to use the default policy if it can't authenticate the individual user or computer. As for Proxies and HTTPS filtering, that's a lot harder to set up. You basically need a switch that can mirror a port, and you have to set up a 2nd nic on the Websense server to watch the HTTPS traffic. Notes: 1. I despise Websense. It's a house of cards to get running and keep up. Admittedly when it runs it's really powerful and hard to get around, but it seems like if you so much as look at the SQL server or ODBC connections you'll break the whole thing. It takes like 7 different services that are all interdependent. 2. I've only really worked with Websense Enterprise, to YMMV.

Agreed. The "Backup Operators" builtin security group should give permissions to run the backup on any folder, regardless of owner or permissions. If you really need to take ownership tho, you might want to download Microsoft's Subinacls program which allows you to do batch ownership changes on folders. We had to do this on one of our sites because the local admin moved the redirection location, but killed off the folders on the old location and the redirects kept failing until we recreated the directory structure.

I think I would immediately run a full virus scan on all DNS servers. Sounds like a pretty standard practice for some of these fake AV viruses. (Is it possible for these viruses to send a fake update to the DNS server?)

Well, the first place to look is your event viewer logs on the computer you're working with, as well as running GPresult from a command line. I would imagine the GPresult will show that the GPO policy is applied. In my experience, when an app fails to apply via GP, it's either a permissions issue on the source location, the source for the package was set to local drives instead of UNC (i.e. d:\shared\apps instead of \\server\shared\apps), or a problem with the Windows Installer service. The Eventviewer should tell you something useful though. Check in Applications. GL!