Policy Commander ably secures Windows systems

Over time, Windows or application updates can change a PC’s security posture by adding or removing components not originally part of the approved PC. Factor in regulatory compliance criteria, such as Sarbanes-Oxley and HIPAA, and this security drift can become more than just a nuisance; it can get IT into real trouble.

Fortunately, a number of tools are available to ease the task of auditing and enforcing security policies. One such tool is Policy Commander 1.5 from New Boundary Technologies. Based on Windows server technologies, and only available for Windows systems, Policy Commander is easy to use, with an entry price that makes it available to even small companies.

Unlike other policy enforcement products, such as Elemental Compliance System, Policy Commander does not provide packet filtering or firewall capabilities. However, the system does work with Cisco’s NAC and Microsoft’s NAP initiatives to enforce security policies as maintained by those platforms.

Policy Commander uses a small-footprint software agent, 200KB in size, on each monitored PC and server to enforce policy and report back to the console. Installation of the agent requires local administrative rights to complete, as does stopping the agent as it runs in the Windows system tray.

The agents poll the Policy Commander server to check for policy updates or changes. The polling interval and port number are configurable to meet existing infrastructure requirements. A single Policy Commander server can scale to approximately 6,000 managed systems.

Installation on my HP DL360 running Windows 2003 Server was nicely uneventful, with the setup wizard doing all of the heavy lifting. Once it was installed, I added computers to the system by running the agent installation program. Each client promptly showed up in the various summary displays, at which point I was able to begin deploying policies.

The browser-based administrative console is easy to navigate and not overly cluttered. I liked that I could quickly check the compliancy status of my PCs from the console, filtered by policy or computer. By clicking on each non-compliant PC, I could see which policies had failed, and with one click, I could choose to enforce the policy or dig deeper for more information.

Quite a few predefined policy templates are included in the system to help get things going. There are OS-specific security policies that range from disabling Windows’ wireless networking services to enforcing “best practice” policies based on recommendations from the National Institute of Standards and Technology, the National Security Agency, and Microsoft. Security templates are available for Windows 2000 and newer OSes; Linux and Mac computers must fend for themselves.

New policies are available for download directly from New Boundary’s Web site from within Policy Commander. Alternatively, admins can create custom ones using the included policy editor. This tool guides you through the process of defining the various aspects of a policy. I created a handful of custom policies during my evaluation and found that the editor was not very intuitive. It did prove flexible, though, allowing me to create rules using a wide variety of criteria, such as MAC address, CPU family, and domain name.

Policy Commander is a good choice for SMBs that need a cost-effective way to monitor and maintain their Windows security policies proactively. The management console and policy editor provide the necessary tools to create and implement security postures, but don’t look to Policy Commander to enforce network access policies.