Employee PC Monitoring.

[badwhitevision]

I'm hoping at least a few members of this forum are sysadmins or have had experience in this field and can help me with this.

Before going forward, I am not a sys-admin. I don't even have a college education in computer science. Everything I have learnt is by experience and the internet, so I may well be wrong. This is not my profession. I'm doing this simply out of interest and passion.

I have a relative who has a business and as a part of this business, issues office owned laptops to employees. I would like to incorporate/harden security for these laptops and also monitor their network traffic/installed applications, any changes to system configuration etc.

Most of these are home use laptops that are repurposed for office usage (so Windows 10/11 Home) and aren't specifically meant for corporate usage (think like a ThinkPad).

I can install a fresh Windows Enterprise edition, should that give me better features.

I have divided this into a few sections. Please give me your inputs on how stupid I am.

1. BIOS -

Employ an admin password. If the BIOS supports it, something like Computrace or Absolute. (Highly doubtful, since these were never intended for Business usage)

Why? - A few tech-savvy employees mess up the BIOS and then handing in their laptops stating something is wrong. I am all for learning by experimenting, but would prefer if they did it on their own equipment instead of the office equipment.

2. Network Monitoring -

Currently, I use a PiHole with certain sites blocked out. By virtue of the PiHole, I am able to see which devices access which sites. I am looking to make this more easier/simpler/better/more invasive.

The fallacy here is that I cannot control applications which use inbuilt DNS.

For remote monitoring, I use Tailscale to pass all DNS queries to the PiHole. This also allows remote access of the SMB File share that contains documents.

Should I consider invasive monitoring like DPI (Deep Packet Inspection) or are there easier methods available? If DPI, how do I go about it? Any leads would be appreciated.

There is also another fallacy that Tailscale has a quick access button that allows you to stop using the VPN. I would prefer that the VPN remained always on.

I have read about Nagios and LibreNMS, but have never deployed them in my homelab because there was never a need to, so I don't know much about these softwares. I have also read about SNMP monitoring, but again no idea how useful these will be.

Why? - Access to social media is fine. (I am not going ballistic over someone using Snapchat/Instagram) But a few decide to use the office equipment and network for NSFW activities, or even worse, download games to play.

3. Device Monitoring -

This is for device stats, such as disk space, CPU/RAM temperatures/usage, SMART status, WiFi/LAN connectivity.

In my current HomeLab setup, I use Telegraf with InfluxDB and Grafana for the UI. I'm planning to scale this setup and implement as-is.

Why? - Very often, any issue that arises is attributed to the laptop being old and very slow. However, I do not have enough data to counteract these claims, despite knowing that they are utterly rubbish. Also would help in pre emptive maintenance.

4. Software Install/ Lock configuration -

This is where I am blank and unable to draw any ideas and this is important.

Some kind of admin password needs to be provided before attempting to install any application or change any significant configuration.

This also applies when attempting to uninstall an application.

One way I can think of is to use 2 accounts, an admin and a limited user and require admin access for the above. Is this feasible?

A nice to have feature would be a notification such an event has occured.

Why?

Prevent unauthorised installs. Most of the employees are proficient in internet usage, but end up downloading bloatware/spyware and then complain that the system is slow. Half of my troubles would be stopped if only they stuck to the software that has already been installed. Even when downloading required software, they tend to use non official sites and I am dreading the day they decide to install a RAT along with the software.

Configuration changes - Stop the above mentioned tech-savvy employees from messing up the Windows install.

-----Edit------

Adding the following 2 points based on post #3 below. Thank you for pointing these out @calvin1719
​

5. Dealing with updates -

Access via TeamViewer/anydesk. But if the employee only has access to limited user actions, how can I perform admin actions?

6. Recovery plan -

All projects undergo failures during implementation and a robust recovery plan is a requirement.

My current and only idea is to have a few extra SSDs with fresh windows installs and the required software and when any major issue arises, replace the SSDs. Obviously, this does not cover issues arising when the employee is at a remote location.

------End of Edit-----​

I have seen friends who work in larger organisations (proper corporates) who have laptops that are restricted from even using USB sticks (I guess this is a BIOS lock?). I suspect they do use some kind of software too, but I have no idea what that is.


I am trying to use FOSS for all this, but am open to considering paid enterprise versions if they are worth it. As every other middle-class Indian, I'm trying to keep this as cheap as possible, but I do understand that sometimes only a paid solution will work.

A reason for preferring FOSS is the hands on work it brings with it. Like I said, I am doing this out of passion and sitting and breaking my head over something that doesn't work, gives me a sense of satisfaction. (I'm weird, I know)


Thank you for reading through this wall of text and for your suggestions.

 

[JustSKY]

Windows GPO are going to be your best friend in this. It can do alot of things.
You can restrict software installs using Applocker.
Would suggest you figure out a way to centrally manage the devices first, like linking them to Active directory.

If the devices are only going to be used for work moving on, you can enforce Bitlocker encryption on them.

Look into Wazuh (XDR + SIEM), it can solve a lot of what you want to do, and it's free & open source but will require a lot of setup.

 

[calvin1719]

While that passion is admirable and understandable, I have deep reservations about using your relative's business to scratch the itch.

Like I said, I am doing this out of passion and sitting and breaking my head over something that doesn't work, gives me a sense of satisfaction. (I'm weird, I know)

This is a great way to learn, but I wouldn't want to do it when the cost of messing up is someone else's livelihood or business. Downtime in terms of things going wrong etc. might have extremely serious consequences for your relative. If you do decide to go ahead with it, have a process in place for how you're going to implement on test machines, actually carry out tests and ensure everything works as expected, then update employees' machines (because it's not a 1 time thing, you might want to change stuff after you distribute machines), and what to do in case something goes wrong/a recovery plan.

 

[badwhitevision]

Thank you @calvin1719 . Those are fair points.

Since this is going to be a new implementation, I do not have to worry about disrupting production, causing downtime.

I intend to fully setup a test system on my home network and test it to my heart's content, before I deploy it in the office wherein I plan on asking a few senior staff to use these for their daily tasks, while still having their regular machines as redundancies. And should they face any problem, document it and pass the information on.

I have no doubts that the project will face deployment issues. My recovery plan was to have 2 or 3 SSDs with fresh installs and the usual software required for their regular operation and swap it out when any issue arises. It can definitely be made more robust.

As for updates, this is something I need to consider.

For now, a quick hack would be remote access via applications like TeamViewer.

I initially thought of leaving everything as is (and not update regularly), but quickly shot it down, since a CVE can easily disrupt all plans and open up unintended attack vectors.

Since the nature of the business only requires a centralized server, there are seldom any files of importance on the employee machines.

I have edited my original post to also include my recovery plan and update process.

Thank you for the insight.

 

[enthusiast29]

Keep it simple at first.

1. Add domain joined accounts with policies to change password every 3 months at least.
2. No user accounts should have Admin privileges unless absolutely needed.
3. If anyone needs Admin privilege, temporary credentials should be created and expired as needed.
4. Use a secure hosted VPN with MFA to connect to office infrastructure.
5. Install a good paid Endpoint protection solution such as Symantec Endpoint or VMware Carbon black.
6. Install a web application firewall application such as Zscaler/Cloudflare/Forticlient etc.
7. Harden device security by disabling removable storage devices using the endpoint protection solution.

That's all I guess.

If managing the hardware devices is a task then I'd prefer VDIs instead. Just deploy a few high end Xeons with plenty RAM and storage and create VMs. You'll have snapshot feature, scalability and protection.

 

[JustSKY]

Windows GPO are going to be your best friend in this. It can do alot of things.
You can restrict software installs using Applocker.
Would suggest you figure out a way to centrally manage the devices first, like linking them to Active directory.

If the devices are only going to be used for work moving on, you can enforce Bitlocker encryption on them.

Look into Wazuh (XDR + SIEM), it can solve a lot of what you want to do, and it's free & open source but will require a lot of setup.

Look into Cloudflare zero trust, it can do both DNS security and secure access to internal stuff

 

[rsaeon]

The fallacy here is that I cannot control applications which use inbuilt DNS.

Use firewall rules to redirect all external DNS queries not originating from pihole, to pihole.

 

[badwhitevision]

Thank you all for the replies and insights.

@JustSKY I Shall look into wazuh and windows GPO/AD.

@enthusiast29 that is very detailed. I don't think the business will be ready to spring for high end Xeons for VMs. However, I shall incorporate the other points. I was searching for the term "endpoint protection". Have found openEDR with a quick search. Will read more now that I know the term to search for.

@rsaeon that is very simple and efficient. Thank you.

 

[nRiTeCh]

1. BIOS -

Employ an admin password.

Yes

If the BIOS supports it, something like Computrace or Absolute. (Highly doubtful, since these were never intended for Business usage)

Dont play with Computrace its a pain to getting rid off it.

Why? - A few tech-savvy employees mess up the BIOS and then handing in their laptops stating something is wrong. I am all for learning by experimenting, but would prefer if they did it on their own equipment instead of the office equipment.

Usually the default optimized settings are designed such that they are more than sufficient for the operation of any given system (laptop/desktop/servers) so its best to leave them untouched unless you want to troubleshoot some issue. An admin password will work.

2. Network Monitoring -

Currently, I use a PiHole with certain sites blocked out. By virtue of the PiHole, I am able to see which devices access which sites. I am looking to make this more easier/simpler/better/more invasive.

The fallacy here is that I cannot control applications which use inbuilt DNS.

For remote monitoring, I use Tailscale to pass all DNS queries to the PiHole. This also allows remote access of the SMB File share that contains documents.

Should I consider invasive monitoring like DPI (Deep Packet Inspection) or are there easier methods available? If DPI, how do I go about it? Any leads would be appreciated.

There is also another fallacy that Tailscale has a quick access button that allows you to stop using the VPN. I would prefer that the VPN remained always on.

I have read about Nagios and LibreNMS, but have never deployed them in my homelab because there was never a need to, so I don't know much about these softwares. I have also read about SNMP monitoring, but again no idea how useful these will be.

Why? - Access to social media is fine. (I am not going ballistic over someone using Snapchat/Instagram) But a few decide to use the office equipment and network for NSFW activities, or even worse, download games to play.

I have used Nagios and its free for most of the part but most good plugins come paid. have worked on similar enterprise grade tools but buying them itself is going to cost a bomb and I dont think its required at your levels-use-case-. There are many networking tools you can google for.

3. Device Monitoring -

This is for device stats, such as disk space, CPU/RAM temperatures/usage, SMART status, WiFi/LAN connectivity.

In my current HomeLab setup, I use Telegraf with InfluxDB and Grafana for the UI. I'm planning to scale this setup and implement as-is.

Why? - Very often, any issue that arises is attributed to the laptop being old and very slow. However, I do not have enough data to counteract these claims, despite knowing that they are utterly rubbish. Also would help in pre emptive maintenance.

You can deploy PRTG tool, its free and you can configure sensors for almost everything- cpu/ram/disk/processes/threads etc. I had deployed it in one of my past company. It triggers alerts base on the threshold set and thus you will receive such alerts and take actions.
It even sends you usage reports as scheduled or you can pull them as and when required.

4. Software Install/ Lock configuration -

This is where I am blank and unable to draw any ideas and this is important.

Some kind of admin password needs to be provided before attempting to install any application or change any significant configuration.

This also applies when attempting to uninstall an application.

One way I can think of is to use 2 accounts, an admin and a limited user and require admin access for the above. Is this feasible?

A nice to have feature would be a notification such an event has occured.

Why?

Prevent unauthorised installs. Most of the employees are proficient in internet usage, but end up downloading bloatware/spyware and then complain that the system is slow. Half of my troubles would be stopped if only they stuck to the software that has already been installed. Even when downloading required software, they tend to use non official sites and I am dreading the day they decide to install a RAT along with the software.

Configuration changes - Stop the above mentioned tech-savvy employees from messing up the Windows install.

For software installs etc. you can deploy Ivanti or sccm but sccm requires a license will take care of all your software needs while ivanti is free for ltd. period afaik but for enterprise it does require proper license.

You can deploy AD in the infra and easily configure and set group policies to block almost everything within windows- settings, updates, installations etc.

-----Edit------

Adding the following 2 points based on post #3 below. Thank you for pointing these out @calvin1719
​

5. Dealing with updates -

Access via TeamViewer/anydesk. But if the employee only has access to limited user actions, how can I perform admin actions?

Remotely.. Ivanti/Sccm you can push/rollback updates. And for remote support you already have those options.

6. Recovery plan -

All projects undergo failures during implementation and a robust recovery plan is a requirement.

My current and only idea is to have a few extra SSDs with fresh windows installs and the required software and when any major issue arises, replace the SSDs. Obviously, this does not cover issues arising when the employee is at a remote location.

Thats not an recovery plan but backup inventory stock.

------End of Edit-----​

I have seen friends who work in larger organisations (proper corporates) who have laptops that are restricted from even using USB sticks (I guess this is a BIOS lock?). I suspect they do use some kind of software too, but I have no idea what that is.

GPO in AD..its your key for all such restrictions. No need to pay for individual tools outside.

I am trying to use FOSS for all this, but am open to considering paid enterprise versions if they are worth it. As every other middle-class Indian, I'm trying to keep this as cheap as possible, but I do understand that sometimes only a paid solution will work.

A reason for preferring FOSS is the hands on work it brings with it. Like I said, I am doing this out of passion and sitting and breaking my head over something that doesn't work, gives me a sense of satisfaction. (I'm weird, I know)


Thank you for reading through this wall of text and for your suggestions.

I have listed down mostly freeware solutions. But freeware always come with certain limitations, restrictions and complexities in configurations awhile paid stuff is straightway with proper customer support.

Last but the most important- Just ensure you don't use those stupid kiddish passwords like@dm!n!$tr@t0r etc types. That era has long gone. Get creative and come up with your own idea.