Avecto Leverages Microsoft Event Forwarding for Least Privilege Compliance Reporting

Avecto Ltd, the leader in Windows privilege management, announced its support for Microsoft Event Forwarding to provide centralized auditing of Windows desktops for least privilege compliance. By leveraging Windows Remote Management (WinRM) protocol Avecto Privilege Guard can now document compliance-relevant events at desktops across the enterprise and generate detailed reports to demonstrate compliance with industry regulations.

"A growing number of organizations are looking to adopt a least privilege approach, as it provides a number of benefits, including increased desktop security and reduced operational costs," said Mark Austin, CTO at Avecto. "The requirement to remove administrative rights from users is frequently driven by external or internal compliance initiatives, and in these situations the auditing of privileged operations is very important. With the addition of new WinRM support, Avecto is dramatically simplifying desktop compliance for enterprises across industries."

A number of compliance regulations demand the implementation of least privilege, including Federal Desktop Core Configuration (FDCC), Government Connect and Payment Card Industry Data Security Standard (PCI DSS). Least privilege is also recommended by other regulations, such as Sarbanes Oxley (SOX) and Health Insurance Portability and Accountability Act (HIPAA).

The Avecto Privilege Guard solution enables companies to adopt the principle of least privilege, by removing admin rights from users and assigning privileges directly to applications, based on policy settings, which are centrally managed through Active Directory Group Policy. All privileged applications are audited to the Windows event log, providing detailed information on the application and the policy where it was defined. By leveraging Microsoft WinRM, important events may be forwarded to a centralized server, allowing compliance reports to be generated. For more advanced reporting the forwarded events may be further consolidated with Microsoft System Center Operations Manager (SCOM) or a SQL Server database.

WinRM is Microsoft's implementation of WS-Management Protocol, a SOAP based, firewall-friendly protocol, which provides a common way for systems to access and exchange management information across an IT infrastructure. WinRM is a standard component of Windows 7, as it was introduced in Windows Vista, and it may also be installed on Windows XP desktops.

A free solution guide is available from Avecto on setting up and configuring WinRM for event forwarding at /resources.