Is it possible to block a process when it's started with specific commandline parameters? I'm looking at Applocker but it doesn't seem to have the ability.
Contrived example but suppose I don't mind anyone starting notepad.exe but I would like to block or get notified when someone starts with notepad.exe "C:\Users\profile\test.txt"
In trying to analyze a 3thparty application's throughput we have collected a WPR trace on two systems. One has Symantecs Intrusion Detection System enabled, the other one has not.
Many NDIS.SYS - ndisInterruptDpc function calls that take > 100µs.
Over a period of 10s: 1.966 fragments out of 17.273 took longer than 100µs.
Microsoft's recommendation for DPC is to not run longer than 100 microseconds.
The Microsoft-Windows-TCPIP provider shows everything is using TcpipSendSlowPath.
I tried reading up on slow/fast paths but not really any idea what to make of this. Everything I can find about it is about routers or dedicated hardware and I doubt ETW can get any data from them (unless it's passed back in the request/response somewhere?).
The Stacksview shows the packets going through IDSvia64.sys wich is Symantecs driver for packet inspection. There's a lot more allocating and freeing of Pool memory because of this.
psping tests for bandwith are a factor 10 slower.
With that being said: the perceived performance of the 3thparty application on both servers is comparable. The only tangible difference to date are the psping tests being much worse on the system with IDS. A conondrum to me... .
Edit
following the link provided by @Brian, this is how our DPC duration looks like on the system with IDS enabled (green) and on a system without IDS (blue)
I'm pretty convinced that IDS is responsible for the longer duration of DPC's.
If anyone can give some pointers on the second part of the question for the ammounts of TcpipSendSlowPath, there might be something worth investigating there too.
A note on the fact that the amount of DPC's on the system with IDS is much larger.
In our current workflow, we have to RDP to several servers just to know if a service is up-and-running. We do not have admin rights to those servers but are allowed to view, start and stop services.
We would like to use Powershell Remoting instead. Something like
(1..8)|%{gsv -c "server$($_" -n "*ourservice*"}
would be both easier and faster to do.
Am I correct that by adding our users to the WinRMRemoteWMIUsers group
Edit
Following extract taken from Secrects of Powershell Remoting seems to addres the security concerns
powershellorg · Secrets of PowerShell Remoting
Neither PowerShell nor Remoting are a "Back Door" for Malware
This is a major misconception. Keep in mind that, by default, PowerShell does not execute scripts. When it does so, it can only execute commands that the executing user has permission to run - it does not execute anything under a super-privileged account, and it bypasses neither existing permissions nor security.
and
Bottom line: Because of the way it works, PowerShell Remoting does not allow any user, authorized or not, to do anything that they could not do through a dozen other means
I'm using following psping command to measure the bandwith throughput for localhost on a physical server
psping -4 -b -l 8k -n 20000 localhost:1234
The throughput is around 150MB/s wich isn't all that bad but for an ipc over tcp problem we are having with an ODBMS running on the server, we decided to try the application on a standalone pc.
The performance on that standalone pc is far better than that of our server. It's throughput to localhost gets up to 800MB/s what I believe to account for most of the performance difference.
Does anyone know how to improve the localhost throughput on the server?
Server details
Standalone PC