Where Are They Going?

Do you need a quick way to monitor the Internet sites your users access? GFI WebMonitor might be a good tool to try out. It monitors in real time all the current and recent HTTP and FTP connections that are active on Microsoft’s ISA Server. You’ll find the ISA server on our last month’s CD, and the GFIWebMonitor on this month’s CD. It’s a free tool, which once installed, can be accessed from any machine on your network using a Web browser. 

Install WebMonitor on a system running the ISA server in integrated mode. The ISA server can run as a proxy, a firewall, or both, which is called the integrated mode. WebMonitor’s installation is very easy with the installer just asking for permission to restart the Web proxy service of the ISA server. But, remember that restarting the Web proxy service may disconnect all current connections to the ISA server. So, it’s better to try this out on a test setup first.

After the installation, open ISA Server Management Console and go to Servers and Arrays. Select your server, go to Extensions, and then Web Filters. Open the GFI WebMonitor properties page and select the Configuration tab. Check ‘Allow access only to authentic users which are members of the administrators group’. This ensures that only members of the administrator group can access the WebMonitor, otherwise anyone from any machine can access it and see all the connections to the ISA server.

It’s also a good idea to authenticate all users on the ISA server. This will keep track of all the sites that are being accessed according to username.

To do this, right-click on the server and go to Properties. Here, under Outgoing Web requests, select ‘Ask unauthentic users for authentication’. This will ensure all users authenticate before using the ISA server.

If the ISA server is running in a Win 2000 domain then log on to the domain from any machine on the network and set your browser’s settings to the ISA server to be monitored. After this is done, fire your browser and in the Address bar, type http://monitor.isa. Voila, the browser shows all current and recent HTTP and FTP connections on the ISA server with the username, IP address, time and the URL accessed. If you are not already logged on to the domain or the ISA server is not running in a Win 2000 domain, you will be asked for a username and password before accessing the ISA server from the Web browser.

Anoop Mangla