>> - Log security events in a meaningful way.
>>
>> Do you know what
>>
>>   Object Access Attempt:
>>   Object Server:Security
>>   Handle ID:144
>>   Object Type:File
>>   Process ID:3156
>>   Image File Name:C:\WINDOWS\system32\notepad.exe
>>   Accesses:WriteData
>>   Access Mask:0x6
>>
>> means? I certainly don't.
> 
> Looks like someone was trying to overwrite notepad. I'd be suspicious. 
> Most people don't overwrite notepad. Wonder what process 3156 was..

I think it means that process 3156 *was* NOTEPAD.EXE  - but I have no 
idea what it was trying to overwrite...

>> - The ability to monitor CPU, HD and NIC activity from the 
>> notification area would be useful.
> 
> I think sysinternals has a utility like this..
> 
> http://technet.microsoft.com/en-us/sysinternals/bb896646.aspx
> 
> Just open task manager for a CPU monitor. NIC, I dunno.

SysInternals has Process Explorer, which gives you a nice scrolling CPU 
graph (and now also I/O). Task Manager gives you current CPU usage, but 
PE gives you a scrolling graph, and seperates user-time and kernel-time 
with colours. Unfortunately, the I/O graph is wildly inaccurate (as in, 
it doesn't appear strongly correlated with the HD activity light on the 
front of the PC).

Windows XP (and later?) have a feature where you can put a little NIC 
icon in the tray, and it flashes when you access the network. Not 
terribly accurate though. Task Manager shows you a better graph, but 
only when you have it open on that page. There's nothing in the tray.

Post a reply to this message