Leave a comment

Securing Cd/Dvds with secRMM


secRMM secures when end-users write files to Cd/Dvds (we will just call it a disc in this article) just the same as when they use a flash drive or mobile device. The Windows operating system offers two different ways to write to discs. You can read a Microsoft description at http://windows.microsoft.com/en-us/windows/which-cd-dvd-format#1TC=windows-7. When you insert a blank disc, Windows will display a dialog asking how you want to use the disc (see screen shot). secRMM will apply security rules to either method chosen. It is up to the security or IT administrator how the security will work on disc.

There are two secRMM properties (rules) that apply to discs. The first one is set to on by default and is called “MonitorCDROMAndDVD”. As its name implies, it tells secRMM whether to monitor the disc while it is insCD/DVD secRMM Propertyerted into the Windows computer (the property is set to on) or not to monitor the disc while it is inserted into the Windows computer (the property is not set). When “MonitorCDROMAndDVD” is on, secRMM records the ONLINE/OFFLINE events, the WRITE events and any AUTHORIZATION failure events that might occur. This is exactly how secRMM handles any removable storage such as flash drives, external hard drives and all mobile devices.

The second secRMM property related to discs is the “BlockCDROMAndDVDWrites” property. As its name implies, writing to any disc will be blocked (i.e. not allowed). The benefit of using the “BlockCDROMAndDVDWrites” property

CD2 as opposed to disallowing discs via Active Directory Group Policy is that secRMM will log the write violation which tells you who the violator was (userid), what file they were trying to copy (the source file), where they were trying to copy it to (the target file which will be somewhere on the disc), what program they were using (explorer in this case), the time they attempted the write, and what computer the user was logged into. All of this information is logged into the security event log and the secRMM event log.

If you are not interested in recording disc write violations but just want to prevent users from mounting writable discs, you can also enable the “Enforce when device is plugged in.” setting. When “Enforce when device is plugged in.” is on, as soon as the end-user inserts the disc into the drive, Windows will eject the disc. secRMM will log an ONLINE error which indicates the disc was forcibly un-mounted (see screen shot).


secRMM is all about enabling productivity by allowing end-users to use removable storage while still protecting and securing the corporations data assets. As you can see, this applies to Cd/Dvds as well.

You can see a YouTube video on this subject at https://www.youtube.com/watch?v=7Ec3MD47-ws.

Leave a comment

Using Powershell to copy data from your apple iPad/iPhone

With the recent release of secRMM 5.7, you can use the secRMM SDK/API to copy data to and from mobile devices.  This includes apple mobile devices.  For an overview of the apple functionality provided by secRMM, please read this blog.

secRMM provides an out-of-the-box “Windows explorer like GUI” program called SafeCopy which allows you to do file copies interactively.

Today, though, we will show IT admins how to do this programmatically using Microsoft Powershell.

Here is the code.  Hopefully to the Powershell enthusiast, it is self explanatory.

#To run this batch, from a DOS command window, type:
#powershell “& ‘C:\BlogPost\CopyFromDevice.ps1′”

#Create the secRMM mobile device object
$l_objSecRMM = New-Object -COM secRMMWPDApiCOM;

#Lets set the device, source file and target file
$l_strMobileDevice = “My iPad
$l_strAppleSource = “com.myCompany.mobileApp1/Documents/TodaysSales.docx“;
$l_strWindowsTarget = “C:\Users\Angela\SalesFor08092014.docx“;

#Lets execute the file copy operation
$l_strReturnCode =

if ($l_strReturnCode -eq “1”)
Write-Host $l_strAppleSource “copied to” $l_strWindowsTarget;
Write-Host $l_strAppleSource “NOT copied to” $l_strWindowsTarget “:” $l_strReturnCode;

For more details, please see https://www.youtube.com/watch?v=EYVn6pfk6lw

Happy scripting!

P.S. Yes, you can do the exact same in VBScript and JScript or in your favorite .Net language.  Native C++ coders, there is a tlb for you to #import as well!

Leave a comment

Apple mobile devices in the enterprise

Apple is moving towards better integrating their mobile solutions into the enterprise environment (see https://www.apple.com/ios/ios8/enterprise/). Many businesses use Windows workstations as the primary endpoint computer; meaning, the computer used by the worker.

Squadra Technologies’ new release, version is 5.7 of “Security Removable Media Manager” (secRMM), supports apples direction of moving into the enterprise (see https://www.youtube.com/watch?v=EYVn6pfk6lw).  secRMM provides a security layer for apple mobile devices attached to a Windows computer using a USB cable.

secRMM is a security product that records all files written to any storage device attached to a Windows computer by a USB connection.  It also allows you to specify simple rules to prevent using removable media.  In addition to Android, BlackBerry and Windows mobile devices, secRMM 5.7 includes apple mobile devices.  In general, any device that Windows identifies as a storage object will be protected by secRMM.

Additionally, secRMM provides a mobile device app for Android, apple and BlackBerry that adds an extra layer of security.  Using their Windows credentials, the user must login using the secRMM mobile device app before allowing the device to become mounted to the Windows computer.  A YouTube video about the secRMM mobile device app is at http://www.youtube.com/watch?v=F9tO428gTV4.

For enterprises preferring not to offer iTunes to their end-users, secRMM has an end-user tool called SafeCopy.  SafeCopy is a “Windows explorer” like tool that allows copying files to and from the apple mobile device and the Windows computer.  You still need to install iTunes so secRMM can interact with the mobile device via the “apple mobile device service”, however, you can simply rename or delete the iTunes.exe file to prevent your end-users from accessing it.

secRMM 5.7 also ships a collection of apple command-line utilities that perform many tasks necessary to use the mobile device as a tool within the enterprise.  This includes such tasks as:
1. Listing what apps and their version are installed on the device
2. Install and uninstall apps
3. List, install and backup provisioning profiles
4. Backup the device
5. Copying data to and from the device

While secRMM provides SafeCopy so you can move files to and from the mobile devices, it also ships with a Software Development Kit (SDK) to allow businesses to build their own solutions to integrate the apple device, or any other mobile device, into their environment.  The SDK is comprised of a COM type library (tlb) and .Net COM-Interop dlls for:
1. 32 bit and 64 bit systems
2. .Net pre-40 and .Net 4.0 and greater

The release of secRMM 5.7 is timed perfectly with apples new enterprise direction.

We hope you consider secRMM 5.7 as a necessary tool to keep your sensitive data safe.


For more information, please visit the Squadra Technologies web site.

To see how to copy a file from an apple device using Powershell, please read this blog.

Leave a comment

SCCM Endpoint Protection supports Removable Media (DLP)

Abstract overview

Microsoft System Center Configuration Manager (SCCM) contains a component called Endpoint Protection.  Endpoint Protection here means protecting the organization assets.  Assets mean data, software and hardware (Windows workstations and servers) in your environment.  Out of the box, SCCM provides 2 features under Endpoint Protection:

1. Antimalware
2. Firewall


Antimalware is protecting the Endpoint by not allowing programs on the Windows Operating System from performing destructive operations.  The operations I want to call out here is a malware piece of software that takes sensitive data and sends it outside of the network to someone who should not have that data.

Firewall is protecting the Endpoint by not allowing unauthorized data packets from coming into or out of the network.  The Firewall deals with the data coming to/from the network.  For the scenario where data is being taken from the network to outside of the network, Antimalware and Firewall are working together, each covering a different scenario.

There is another security hole that is now covered by SCCM Endpoint Protection: Removable Media devices.  Removable Media devices are hardware devices that connect to the Windows computer with a Universal Serial Bus (USB) cable or a Bluetooth connection.  Removable Media devices contain file-system storage.  With file-system storage, data (files) can be read from and written to Removable Media devices.  Antimalware protects the organization from data being read from Removable Media devices.

What about data being written to Removable Media devices?  SCCM Endpoint Protection needs a feature that will protect sensitive data from leaving the organization.  Squadra Technologies Security Removable Media Manager (secRMM) is Windows security software that focuses on data being written to Removable Media devices (smart phones, tablets, usb drives/sticks, SD-Cards, CD/DVD, etc.).  secRMM lets you define authorization rules to prevent writing and also has the best monitoring (i.e. logging each write event) solution on the market today.  secRMM integrates into SCCM Endpoint Protection and provides this critical functionality.  In addition to protecting the organization from sensitive data leaving (stolen or mistakenly taken), any piece of data that does leave the organization is accounted for by secRMM.  This allows organizations to adhere to strict data regulations that are being required today (i.e. medical, legal, financial, etc.).


Technology overview

Integrating secRMM into SCCM did not require new technology.  SCCM has a feature called “Compliance Settings” (previously named Desired Configuration Management).  “Compliance Settings” allows you to specify values for software running within the organization.  The values you specify are the appropriate values for work to be performed within the organization.  Should the value(s) change, either by a person or programmatically, it will have an adverse impact to the organization.  When a value is set to the wrong value, it is said to be “out of compliance”.  Security settings within the organization typically protect the values from being changed.  For example, the file system (i.e. NTFS) and registry permissions can protect a majority of the values.  However, there are permissions assigned to personnel and programs that give update access to the values.  Given that the values do get changed either intentionally or not, an automated feature that checks the values and reports if they are “out of compliance” is needed to prevent improper values from causing adverse impacts.  This is exactly what SCCM “Compliance Settings” does.  It also includes a feature called remediation.  Remediation will set the value back to the correct value if it is found to be “out of compliance”.

The “Removable Media Policies” under SCCM “Endpoint Protection” makes it very easy to create SCCM “Compliance Settings” specifically for protecting sensitive data being written to Removable Media devices.  Within a large organization, you might want to define more than one “Removable Media Policy”.  SCCM allows you to do this.  Then, for each policy, you assign it to a collection of computers.

Technology specifics

The secRMM integration into SCCM Endpoint Protection is implemented as an SCCM Console Extension.  Each “Removable Media Policy” generates a collection of SCCM “Compliance Settings” “Configuration Items” (CI).  There is always one parent CI and one or more child CIs.  The parent CI performs the secRMM discovery and each child CI is responsible for a specific secRMM property (i.e. AllowedDirectories, AllowedSerialNumbers, AllowedUsers, etc.).  In addition to the CI collection, a single SCCM “Compliance Settings” “Configuration Baseline” (CB) is created and associated with the CI collection.  Both the CIs and CB reside in a console subfolder under the appropriate parent folder (i.e. CI or CB).  This makes the folder structure within the SCCM console very organized and easy to manage.  All management of the CIs and CBs can be performed with the “secRMM SCCM Console Extension” thereby abstracting the “Compliance Setting” user interface that comes with SCCM.  The SCCM Administrator is free to use either user interface though.  The “secRMM SCCM Console Extension” support SCCM “Compliance Settings” remediation.


Combining the powerful features of SCCM “Compliance Settings” (i.e. compliance monitoring, remediation, alerting and reporting) with secRMM is a very powerful solution for protecting an organizations data.  secRMM is deeply integrated into the Microsoft System Center suite and also has:

  1. Operations Manager Management Pack (alerts, tasks)
  2. Operations Manager Data-warehouse reports
  3. Security Audit and Collection Services (ACS) reports
  4. Orchestrator extension
Leave a comment

Preventing the NSA Security Breach


By now everyone has heard the news about the security data breach at the National Security Agency.

So frustrating right?!

If only the NSA were using secRMM’s “Enforceable two man policy”, Snowden would have not been able to copy data without another human involved.

Below is a hyperlink to an article discussing the security breach.  Below the hyperlink, we extracted key excerpts from the article.  Each comment could have been addressed by secRMM.


As a system administrator, Snowden was allowed to look at any file he wanted, and his actions were largely unaudited. “At certain levels, you are the audit,” said an intelligence official.

He was also able to access NSAnet, the agency’s intranet, without leaving any signature, said a person briefed on the postmortem of Snowden’s theft. He was essentially a “ghost user,” said the source, making it difficult to trace when he signed on or what files he accessed.

The “thin client” system and system administrator job description also provided Snowden with a possible cover for using thumb drives.

Finally, Snowden’s physical location worked to his advantage. In a contractor’s office 5,000 miles and six time zones from headquarters, he was free from prying eyes. Much of his workday occurred after the masses at Ft. Meade had already gone home for dinner. Had he been in Maryland, someone who couldn’t audit his activities electronically still might have noticed his use of thumb drives.

Leave a comment

Microsoft BitLocker Monitoring Extension


Microsoft BitLocker is a software disk drive encryption technology.  This means that the end-user who plugs the device in needs to authenticate with Windows before the disk is accessible to them.  Authentication is usually performed by specifying a password but can also be performed with a physical security card.

Microsoft makes it very easy to administer BitLocker  in the enterprise with a tool called “Microsoft BitLocker Administration and Monitoring (MBAM)”.  Furthermore, Microsoft distinguishes between encryption on non-removable hard drives and removable hard drives.  For removable hard drives, they coin BitLocker as “BitLocker to Go”.  The “to Go” part meaning the storage drive can be moved from one Windows computer system to another Windows computer system.

Squadra Technologies Security for Removable Media Manager (secRMM) compliments the “BitLocker to Go” experience by tracking how the end-user is using the encrypted removable media device.  secRMM compliments Microsofts MBAM because MBAM is focused more on managing and deploying the devices whereas secRMM is focused on how the device is being used by the end-user.

The secRMM events tell you that the device is configured for BitLocker when the device is plugged into the Windows computer.  Specifically, you will get two events when the “BitLock to Go” device is plugged in.  The first secRMM ONLINE event will tell you that a device has been plugged in and that it is configured for BitLocker encryption.  This event also tells you that the end-user has not yet authenticated with Windows so that he/she cannot yet actually use the device.  From a security standpoint though, it is important to know that someone has plugged the device in.  Once the end-user authenticates successfully, another secRMM ONLINE event is logged indicating the device is ready for use.

secRMM logs all removable media (smartphones, tablets, usb drives, SDCards, CDRoms, etc.) events into the Windows security event log and also into a Windows event log named secRMM (that is only accessible to Administrators).  secRMM has an Excel 2010+ AddIn that lets you look at the event log data in a tabular format.  If you use Microsoft System Center, secRMM is integrated into SCCM, SCOM and Orchestrator (with Service Manager coming soon).  We used the secRMM Excel AddIn for the screen shots below.

When the “BitLocker to Go” device is first plugged in, you will get an event that looks like the screen shot below.  Notice the very last line.


Once the end-user authenticates to Windows, you will see an event that looks like the screen shot below.  Notice the Serial Number from screen shot 1 to screen shot 2.


Then, whenever a file is written to the device, you will get an event that looks like the screen shot below. Notice that the source file (i.e. the file the end-user copied to the removable media device) is captured.


Finally, when the “BitLocker to Go” device is removed from the Windows computer, you will get an event that looks like the screen shot below.


In conclusion, Microsoft BitLocker is a very good software encryption technology.

For more information on secRMM, please visit http://www.squadratechnologies.com.

For more details on “BitLocker to Go”, you might also want to read this blog.
For more details on “Microsoft BitLocker Administration and Monitoring”, you might also want to read this blog.

Leave a comment

Windows Powershell/VBScript to un-mount a smart phone or tablet

Thanks for reading the squadra technologies blog!

The one line of Power-shell script below un-mounts a USB cable attached Windows Portable Device (WPD) from the Windows Operating System (XP thru W8/2012):

Invoke-WMIMethod -path Win32ext_WPD -name EjectDevice -argumentList (Get-WmiObject -Class Win32ext_WPD -Namespace root/cimv2 -ComputerName . -Filter “strFriendlyName = ‘SAMSUNG-SGH-I747′”).strId

*** change ‘SAMSUNG-SGH-I747′ to the phone/tablet name you see in Windows Explorer

To have this functionality, just download and install the squadra technologies Security Removable Media Manager. (secRMM).   The WMI WPD provider that comes with the secRMM install does not need a license so you can have this functionality free of charge!

Even better yet, the device will still take a battery charge from the PC you have it attached to so your end-user can still charge their device yet cannot copy data to it.

Of course, the secRMM product does the above line with a simple checkbox and has many more powerful security features such as locking a device to a particular userId.  For a complete list of the secRMM features, you can read the introduction chapter in the secRMM Administrator Guide (online PDF).

And just in case you have not yet started playing with Powershell, here is the equivalent VBScript:

Set objWMIService = GetObject (“winmgmts:\\.\root\cimv2″)
Set colItems = objWMIService.ExecQuery (“Select * from Win32ext_WPD Where strFriendlyName = ‘SAMSUNG-SGH-I747′”)
For Each objItem in colItems
Set objWMIWPDStatic = objWMIService.Get(“Win32ext_WPD”)
Set objInParam = objWMIWPDStatic.Methods_(“EjectDevice”).inParameters.SpawnInstance_()
objInParam.Properties_.Item(“strObjectDeviceId”) =  objItem.strId
Set objOutParams = objWMIService.ExecMethod(“Win32ext_WPD”, “EjectDevice”, objInParam)
Exit For

I hope this is helpful to someone out there.  Happy scripting!
If you have any question about the script, please feel free to contact me and we can talk over a best approach.


Get every new post delivered to your Inbox.