Monitoring workstations

[Scheffie]

L.S.

I'm wondering why some administrators monitor their workstations, what's their reason for monitoring each pc is and witch items/triggers they use?

A lot of questions in one sentence but I'm very curious!

Grtzz
Scheffie

[RohrbaGe]

Well,

we have about 500 PC's, > 30 Servers, > 150IP Phones,
some WAN connections and several switches and routers.

To monitor the 500 PC's is not really an issue, as this
are not really the important system.

In smaller environments it is possible, but what is the point to monitor
it. This machines will not run 24*7.

Ro

[QuakENT]

Why monitoring workstations? Its simple...just for knowing whats going on in your environment. I need know, if all require services as antivir, win update, remote control etc. running, or danger services not running..., whats the load of WS, because if we will upgrade users WS, that I simple look at graph and see who should have priority..., I need immediate information if someone try connect to WS, no matter if thru remote control or on local to local admin account..., I want info for kicking butt of lazy users who cant remember, that WS should be powering off, when they finish work and going home(bill for electricity isnt for weakly persons in this days)...etc...
As you can see there is few reasons, mostly for security and for knowing about you WS. For example...after I begun monitor WS in my testing env., I find that someone services on WS(windows) not working as they should. In this example case I can mention our symantec antivir, which is installed same way thru domain politics as other WS(same HW, same SW and same conf) and if everything looks good in symantec console, I find out thru monitoring of symantec windows services, that this SW not working on few WS. So I get info and I can react on that situation. If you dont have info, you cant react...and after few weeks or months(base on size of your env.) you get in very serious trable, when you find out, that half of your WS havent functional antivir. Yes you can blame symantec on their hotline for their lame SW and try to explain situation to your boss, but Im afraid that should by a little late after half of your WS will have deleted mbr...
So proper and fresh informations are a basic element for keeping you work safe and your butt unhurt.