Martinet

User Tools

Site Tools

download_installation

Download & Installation

A proper signed downloadable package which can be installed by double-clicking the file is being developed. For now, contact Martinet support for a copy of Martinet (or download) and for help with installation & configuration.

Installation requirements

  • A currently-supported Microsoft Windows installation (Windows Server preferred).
    • PowerShell v5.1 or later (production releases only; pre-release, beta, or other advance releases are not included in this). This should come with the Windows install but if you installed Windows without PowerShell, you'll need to install PowerShell.
  • The Windows system should always be on so that you can run Martinet (via the Task Scheduler) at any time and as frequently as you need.
  • Administrative access to that Windows system.
  • A clear idea of what you want Martinet to review and report. Your knowledge as a unit IT pro should include:
    • how your unit's resources ought to be configured,
    • how AD objects ought to be organized and named,
    • how fileshare folders ought to be organized & how fileshare permissions ought to be set up, etc.

The more you know about your unit's resources and how those resources should be organized, the more Martinet can help you vet such resources.

Installation

You will need

  • AD access to write in the unit's OU.
  • SMB fileshare full access to edit an ACE inherited by every share in which you'll monitor/vet the setup.
  • To install the RSAT-AD-PowerShell Windows feature because it's likely that you'll want Martinet to vet AD objects.
  • A mail-enabled service account which will run Martinet (you also need to grant this account read-only access to things you want Martinet to review).
  • A Microsoft Windows system on which to run Martinet. This system should be always-on and domain-bound. You need administrative access to this system.
  1. Create a new service account or select an extant service account for Martinet to use. This service account should be appropriately named (perhaps something with “martinet” in the username to easily identify it).

    Do not run Martinet as an Administrative user!

    It is highly recommended to run Martinet with the least powerful privileges—read-only permissions—on any system being vetted or monitored so that Martinet has no power to alter or delete anything. There is no code in Martinet to write or delete any resource; Martinet is designed to only read how something is set up and warn about non-conformancy.

    Running Martinet from a service account with minimal permissions and only on resources where such access is needed is a valuable bit of insurance against accidental modification. This is also a time-honored best practice for how any service should be set up.

  2. Mail-enable the service account: add two universal groups named after the service account plus "-FA" (full access) and "-SA" (send as). Add the account and your unit IT pro group membership in each of these groups. Mail-enable the groups (hide the groups from the GAL because there's no need for others to easily find and mail these groups), and then get the service account mail-enabled and specify these groups are set as the full access and send-as control groups, respectively.
  3. Login to the Windows system from which Martinet will run with an administrative account. On that system:
    • Grant Martinet the permission to log on as a batch user:
      1. Run secpol.msc to launch the local Security Policy editor.
      2. Open the Security Settings → Local Policies → User Rights Assignment node.
      3. Open the “Log on as a batch user” task and add either the Martinet service user set up above or the group in which the Martinet service user is a member.
      4. Save the settings and close the Local Security Policy panel.
    • Install “WindowsFeature RSAT-AD-PowerShell” to add the PowerShell Active Directory module.
      1. Open an Administrative PowerShell.
      2. In that admin PowerShell run Install-WindowsFeature RSAT-AD-PowerShell and wait for the next prompt. If asked, confirm the installation.
    • Place Martinet somewhere local on the system.
      Martinet should run from the local system, not a fileshare (in order to avoid additional complexity with running unsigned scripts from a fileshare). Place a copy of the Martinet file somewhere on the local system in accordance with local preferences. The location isn't critical so long as you know where the Martinet program is and the file won't be deleted by uninstalling something else, removing user accounts, or other administrative changes.
  4. Configure & test Martinet:
    1. Add or copy in a Martinet configuration file: The configuration file should be a UTF-8 text file with CR or CRLF line endings. Editing this file from Notepad (or your preferred modern text editor) will suffice. The configuration file must be readable to the service account configured above. Unless you add something sensitive, there will be nothing sensitive in this file, so widespread read-only access is acceptable.
    2. Edit the Martinet file to reference the path to the configuration file—in the Martinet file, jump to the end where the configuration file is referenced. Edit that path to point to the full path to your configuration file.
    3. Test run Martinet from Powershell—open PowerShell and supply the path to the Martinet file. You should get an email report. If you don't get the email, make sure that you're in the group being emailed and if the account is hosted on the University Exchange system make sure that the account does not require sender authentication.
    4. (Optional) Run Martinet regularly from Windows Task Scheduler
      1. Launch Windows Task Scheduler (taskschd.msc) or connect to the remote Windows system from another instance of Task Scheduler by right-clicking on “Task Scheduler (Local)” and selecting “Connect to Another Computer…”.
      2. In Task Scheduler, right-click on “Task Scheduler” in the upper-left and select “Create Task…”
      3. In the General tab: give the task a name, description, and change the user to the service account (be prepared to later specify the service account's credentials).
      4. In the Triggers tab: add a new trigger indicating when you want Martinet to run. It's likely you'll pick “On a schedule” and specify when to first run Martinet and select “Repeat task every” 1 or 2 hours, and “Stop task if it runs longer than” 1 hour (be mindful of your relaunch cadence).
      5. In the Actions tab: add a new action with “Action: Start a program”; Program/script of “powershell.exe” (without the quotes), and Add arguments (optional): “-NoProfile -NoLogo -NonInteractive -ExecutionPolicy Bypass -File ” followed by the path to your copy of Martinet.ps1 in double-quotes.
      6. Set the conditions tab settings as desired. In the Settings tab, you likely want “Allow task to be run on demand” to be enabled, “If task fails, restart every” 5 minutes and “Attempt to run up to” 3 times. You likely want “Stop the task if it runs longer than” 1 hour and “If the running task does not end when requested, force it to stop” should be enabled, and finally “If the task is already running, then the following rule applies” to be set to “Do not start a new instance”. Other settings can be set as you prefer.
download_installation.txt · Last modified: by 127.0.0.1
Donate Powered by PHP Valid HTML5 Valid CSS Driven by DokuWiki