Harness the power of the Win32 APIs to build a useful VB app without complex coding
VB Solutions is a new department in Windows NT
Magazine that shows you how to use Visual Basic (VB) to solve business
problems. In this space, we'll build a variety of solutions for specific
business problems ranging from network administration to integrating Microsoft
Office/BackOffice applications with Object Linking and Embedding (OLE).
This column doesn't teach you how to write VB--instead, it focuses on using
VB to provide quick and easy-to-implement solutions. Although a working
knowledge of VB is important to understand how the utilities in this column
work, you don't have to know VB to benefit from them. You can download the
source and executable code for all VB Solutions utilities from Windows NT
Magazine's Web site at www.winntmag.com.
Network Security Monitor
This month's solution is a network administration utility--Network Security
Monitor--that uses VB to collect and report security violations for your
networked Windows NT systems and lets you perform a quick security check on
those systems. Network Security Monitor warns you about attempted network
security violations by displaying all login failures for each networked NT
system. Repeated login failures are a telltale sign of unauthorized network
access attempts.
Requirements
You can use Network Security Monitor if you are running the NetBEUI protocol
or NetBIOS over TCP/IP on your network. User and password definitions must match
across all NT systems you want to monitor. For example, user MIKEO must have the
same password on all systems.
How It Works
Both NT Server and NT Workstation use an Event Log to track security-related
events and other system- and application-related events. If you aren't familiar
with NT's event logs, see "Windows NT Event Logs," page 153, for a
brief explanation of this NT feature. Mike Reilly shows you how to audit your NT
security in "Find Holes in Your NT Security," October 1996.
NT also has a built-in Event Viewer that lets you select and view event
logs for local and remote systems. However, Event Viewer lets you view only one
system at a time, so it's too cumbersome for checking several systems regularly.
Network Security Monitor solves this problem by reading event logs from multiple
networked NT systems. Screen 1 shows the Network Security Monitor
program's main window.
Using Network Security Monitor is easy. When the program starts, it
retrieves a list of networked NT systems and displays them in the main window's
left list box. You can monitor any or all systems in the list that appear in the
list box on the right. After choosing the systems, you simply click OK to begin
reading those systems' security event logs. The Network Security Monitor
highlights each system in the list box on the right as it begins reading that
system's log. The program displays a progress bar as it reads through the logs.
After Network Security Monitor finishes, the progress bar disappears and a View
Results button appears. Clicking View Results displays the Network
Security Monitor Results window, as shown in Screen 2.
The Network Security Monitor Results window displays a grid that contains
the server name, the user, the time stamp the Event Log generated, the event ID,
and a brief description of the event. Each system appears in the order you
selected it, and events appear chronologically (newest to oldest). Collecting
login security errors with Network Security Monitor is a snap.
Inside Network Security Monitor
Considering Network Security Monitor's functionality, you might think that
building it requires complicated communications coding and a knowledge of system
internals--but that's not the case. NT provides a rich set of more than 800
APIs, most of which you can call from VB. They let you access a variety of
system functions. Network Security Monitor takes advantage of a small set of NT
APIs to handle the trickiest parts of the program.
The first API Network Security Monitor uses, the Win32 NetBIOS API, lets
the program browse for the available networked NT systems. NT supplies this API
in the DLL netapi32.dll. It contains many functions; Network Security Monitor
uses one, netserverenum, that returns a list of networked systems.
To use NetBIOS or any API functions in VB, you must declare them. Listing 1
shows the VB declaration for function netserverenum.