==============================================
SofTrack Local Workstation Agent for:

Windows NT/2000/2003 and XP desktops as well as Thin Client (Terminal Service) Servers
==============================================

Updated: February 15, 2006

==========================
New option:

In the registry, under the 

HKLM\System\CurrentControlSet\Services\SofTrackLocalAgentService

key, add a new DWORD value:

AlwaysDenyRenames

and set its value to 1

When you do this and the SofTrack Server Agent will block renaming, creation and modification of .EXE and .COM files.  This option will override the SofTrack Server Agent settings.

If you combine this option with the "WaitForever" option below you will receive protection from EXE/COM file renaming, creation and modification at all times, even on laptops that are not connected to the SofTrack Server Agent.

To unset this option, remove the "AlwaysDenyRenames" value from the registry.

This option can be also be set by running:

STLWA_NT -AlwaysBlockNewEXE

or unset by running

STLWA_NT -AlwaysAllowNewEXE

Any changes to this option require the local agent to be restarted before being recognized.

==========================
New option:

In the registry, under the 

HKLM\System\CurrentControlSet\Services\SofTrackLocalAgentService

key, add a new DWORD value:

WaitForever

and set its value to 1

When you do this and the SofTrack Server Agent is set to wait forever for a connection to the SofTrack Server Agent when the Local Agent is first loaded.

To unset it, remove the "WaitForever" value from the registry.

This option can be also be set by running:

STLWA_NT -WaitForever

or unset by running

STLWA_NT -Wait5

The default is to wait 5 minutes from the time the Local Agent is loaded.  If no connection to the SofTrack Server Agent is obtained in that time the Local Agent will automatically unload.  Please note, there is not option of "-Wait6" or "-Wait10", the only options are "-WaitForever" or "-Wait5".

Any changes to this option require the local agent to be restarted before being recognized.

==========================
New option:

In the registry, under the 

HKLM\System\CurrentControlSet\Services\SofTrackLocalAgentService

key, add a new DWORD value:

AuditRemoteOpenCreateOnly

and set its value to 1

When you do this and the SofTrack Server Agent is set to Audit Open and Create File Events, only those events occurring on remote devices will be delivered by the local agent to the server agent for recording.   These Server Options are set in SOFTRACK.EXE under the Administration menu item, SofTrack Server Agent Options.

Please note, this option does not affect auditing of application launches.  If being audited, all application launches, local or remote will always be audited.

If its value does not exist or if you set its value to 0 all file open and create events will be delivered by the local agent to the server agent for recording, again, if the server agent is set to Audit such events.

This option can be also be set by running:

STLWA_NT -AuditRemoteOpenCreateOnly

or unset by running

STLWA_NT -AuditAllOpenCreate

Any changes to this option require the local agent to be restarted before being recognized.

==========================
New option:

In the registry, under the 

HKLM\System\CurrentControlSet\Services\SofTrackLocalAgentService

key, add a new DWORD value:

AuditUseNDSName

and set its value to 1

When you do this and the SofTrack Server Agent is running on a NetWare server and is set to Audit any event (file open, create, launch, browse request), the username shown in the audit records will be the NDS/eDirectory login name for that workstation's user on the server hosting the SofTrack Server Agent.  Normally the name shown is the user's local windows login name.

The Server Options for Auditing are set in SOFTRACK.EXE under the Administration menu item, SofTrack Server Agent Options.

If its value does not exist or if you set its value to 0 all audit events will be delivered will display the local windows login name.

This option can be also be set by running:

STLWA_NT -AuditWithNDSName

or unset by running

STLWA_NT -AuditWithLocalName

Please note, when setting this option to LocalName, application launch audit records will still contain the NDS/eDirectory login name.

Any changes to this option require the local agent to be restarted before being recognized.

==========================
Option [ sparsely documented on purpose ]:

In the registry, under the 

HKLM\System\CurrentControlSet\Services\SofTrackLocalAgentService

key, add a new DWORD value:

AlwaysAllowRenames

and set its value to 1

When you do this your workstation will be allowed to rename and create executable files regardless of the settings imposed by the SofTrack Server Agent's Server Options.

These Server Options are set in SOFTRACK.EXE under the Administration menu item, SofTrack Server Agent Options.

Any changes to this option require the local agent to be restarted before being recognized.
===========================
Option [ sparsely documented on purpose ]:

In the registry, under the 

HKLM\System\CurrentControlSet\Services\SofTrackLocalAgentService

key, add a new DWORD value:

IfSetTrackAllOpens

and set its value to 1

When you do this, and your workstation has the SofTrack Local Workstation Agent in use and the Server Option to Track all File Opens and Creates has been set,  all file Opens and Creates will be sent to the server for all users.

Normally, file open requests for the SYSTEM account will not be included in the audit log file.  The main purpose of the audit log file is to watch user directed activity and the SYSTEM account operates independently of the user's requests (sometimes in response to the user but it is it own master).

Any changes to this option require the local agent to be restarted before being recognized.
===========================
Option [ sparsely documented on purpose ]:

In the registry, under the 

HKLM\System\CurrentControlSet\Services\SofTrackLocalAgentService

key, add a new STRING value:

CreateEXEList

and set its value as such:

fileone.exe,filetwo.exe,filethree.exe

Very important: DO NOT INSERT SPACES (fileone.exe, filetwo.exe) into the list, they will be counted as part of the filename and unless the spaces are part of the filename they will not be recognized.

The filenames you put into this list are those of the processes that will be allowed to create EXE files.  One example application is that of a university environment where students are compiling programs, that is, creating EXE files.  But you need to prevent the students from installing executable files such as the latest MP3 player.  The solution to to Deny Renames (with SOFTRACK.EXE under Administration, SofTrack Server Agent Options) and Creations of EXE files and at each workstation create this registry key (CreateEXEList) and add the names of the processes that are OK to create EXE files.  How will you know the name of the processes?  Simple, first use SofTrack without denying renames/creates on EXE files but do Track File Opens.  Next, at a workstation where the Local Agent is installed, run the compiler and create a new EXE file.  Next, check the SofTrack Audit Report for Files Opens and Creates and see what process created the EXE file.  For most Microsoft compilers the process filename is LINK.EXE.

When you do this the NAMED PROCESSES you define by filename (i.e. fileone.exe,filetwo.exe) will be allowed to create and rename and copy executable files regardless of the settings imposed by the SofTrack Server Agent's Server Options.  Any process not defiend in the list that attempts such actions will have its request denied (or as you have defined in the Server Options).

Any changes to this option require the local agent to be restarted before being recognized.
=============================
Option [ sparsely documented on purpose ]:

In the registry, under the 

HKLM\System\CurrentControlSet\Services\SofTrackLocalAgentService

key, add a new DWORD value:

AllowIEAccess

           If set to 1, this option tells the local agent to always allow the browsing
           of the internet regardless of the server option setting.

           If set to 0, this option tells the local agent to always block browsing
           of the internet regardless of the server option setting.

           When set to 0, the following "local" addresses are browsable:

           http://127.0.0.1

           https://127.0.0.1

           file://

           res://

           javascript:

           sysimage:

           And the following nonroutable IP addresses are also allowed:

           http://10.

           https://10.

           http://172.16.0.0 through 172.31.255.255

           https://172.16.0.0. through 172.31.255.255

           http://192.168.
 
           https://192.168.

Any changes to this option require the local agent to be restarted before being recognized.
==========================
Option:

In the registry, under the 

HKLM\System\CurrentControlSet\Services\SofTrackLocalAgentService

key, add a new DWORD value:

DoNotShowBuildError

and set its value to 1

When you do this your workstation will be not display the load time error that occurs if the SofTrack Server Agent is not available - this generally occurs on notebook or laptop workstations that are disconnected from your network.

If its value does not exist or if you set its value to 0 the error message will be displayed.

This option can be also be set by running:

STLWA_NT -hidebuilderror

or unset by running

STLWA_NT -showbuilderror

Any changes to this option require the local agent to be restarted before being recognized.
==============================
Option [ sparsely documented on purpose ]:

In the registry, under the 

HKLM\System\CurrentControlSet\Services\SofTrackLocalAgentService

key, add a new STRING value:

DoNotTrackEXEList

and set its value as such:

fileone.exe,filetwo.exe,filethree.exe

Very important: DO NOT INSERT SPACES (fileone.exe, filetwo.exe) into the list, they will be counted as part of the filename and unless the spaces are part of the filename they will not be recognized.

The filenames you put into this list are those of the processes that you do not want to track file open/create activity.

One example application is that of a backup program such as backup exec, the BEREMOTE.EXE process opens files during backup - SofTrack's auditing of this backup process can slow the backup process down due to the high volume of file activity generated by the backup.

When you do this the NAMED PROCESSES you define by filename (i.e. fileone.exe,filetwo.exe) will not have file open/create activity tracked.

\Any changes to this option require the local agent to be restarted before being recognized.
=============================
END
===========================