Hi Darwin,
I suppose it is a type cause you mix SNMP and SMTP - while SMTP is on that list as well - but that's a different story. Pretty sure you meant SNMP instead of SMTP.
Please be aware - I am not a Paessler employee nor associated somehow, just for the record and full disclosure of course :-).
What I stated about SNMP being a risky protocol is true - as long you don't put appropriate security measures in place, like named communities (other then private/public), IP restrictions, authentication mechanisms.
The protocol is risky cause it is standardized, well documented, actually pretty old and not the most secure, thought they change it from v1 to v2 to v3 over the years - while I even today find brand new devices that only understand v1 or v2 - what is quite amazing. Often the protocol is even enabled by default and using private/public community strings (e.g. printers!) - so yes - it is an actually security issue.
If you monitored all your windows clients via SNMP - I assume you configured it as secure as possible - otherwise any system that is able to send SNMP requests to your client would be able to gather very confidential information and possibly be able to determine due to this information the best way to intrude and overtake the target system.
WMI is a bit more secure - you can configure firewall ports per GPO and change the sensors possibly even per auto-discover. You have months if now more to slowly transition - while Microsoft started this possibly in or around 2012 - it now is more then 5 years later and they barely start to make it harder to find it / activate it.
It is not totally clear if updates to Windows 10 respective server 2016 / 2019 will remove the feature completely, so far this did not happen, but any older operating system will still have the feature. This also means the amount of affected clients possibly is less then it seems. A smooth transition over a likely long enough time window should be possible.
As of now, there is no clear statement when the feature will finally vanish from Windows nor how this might affect systems like Windows 10 that have it installed and getting the new build - what likely might cause a removal once this will happen.
I see it this way - to monitor Windows systems I do not prefer SNMP - but no one said that you can't monitor your printers, switches, routers, Linux systems and other network components via SNMP. Nor will this have an effect on older Windows versions - possible legacy systems.
As for Paessler, well - Microsoft mentioned this in a tech article, this might have been known by them or not - but in any case the feature is still here and all Paessler says is that you can use SNMP to monitor Windows systems - nothing wrong with that - it might be time to update the article and mention that it might be wise to use e.g. WMI instead for Windows systems, but that's a different story.
Personally, I think it is great that you discovered this and actually brought it up here in an open conversation so that others will be aware of it as well - you even caused me to write a whole blog entry about it cause I think it is quite interesting.
Finally - your question was originally how to monitor your Windows systems now - well - e.g. WMI or install remote probes etc.. I am sorry that I can't give you any other advice, I hope you find this whole posting not offensive, I only try to help out in the PRTG community, I do not get compensated for it and do this only because I think the product is great and I try to share my experience with other end users, while only being a end user - and as you sure know - end-user to end-user opinion, experience and knowledge sharing is often a bit different ;-)
Regards
Florian Rossmark
www.it-admins.com
Add comment