For example, you might want to capture security group membership changes. A quick web search may lead you to the 632 event.
|
|
- Amie Louise Haynes
- 8 years ago
- Views:
Transcription
1 Audtng Wndows & Actve Drectory Changes va Wndows Event Logs Ths document takes a lghtweght look at the steps and consderatons nvolved n settng up Wndows and/or Actve Drectory event log audtng. Settng up event log audtng s requred for mplementaton of any event management soluton that reles on Wndows event logs such as SIEMs (Securty Incdent and Event Management) and other log management systems. Ths document s not ntended to be a techncal reference or an otherwse complete analyss. It wll am to dentfy some of the consderatons and complexty related to Wndows event loggng. And, of course, pont out along the way where NetVson s approach gets better results. Generally speakng, event Log audtng can be confgured n four easy steps: 1. Determne Whch Events You Need 2. Enable Audtng on Desred Objects 3. Confgure Event Log Settngs 4. Confgure Event Management Soluton LOL! Step 1 Determne Whch Events You Need Understandng whch events you need to keep track of, and ther assocated event IDs s crtcal to capturng a full audt tral from the Wndows event log. For example, you mght want to capture securty group membershp changes. A quck web search may lead you to the 632 event. NetVson provdes a complete set of templates and tools to track the changes you need wthout the need to understand Event IDs or log lmtatons Securty Enabled Global Group Member Added But keep n mnd that 632 events don t tell the whole story. They only apply to Wndows Server 2003 (and pror) and there are a number of other events n Server 2003 also related to group membershp changes: Securty Enabled Global Group Created Securty Enabled Global Group Member Added Securty Enabled Global Group Member Removed Securty Enabled Global Group Deleted Securty Enabled Local Group Created Securty Enabled Local Group Member Added Securty Enabled Local Group Member Removed Securty Enabled Local Group Deleted NetVson
2 639 - Securty Enabled Local Group Changed Securty Enabled Global Group Changed Securty Enabled Unversal Group Created Securty Enabled Unversal Group Changed Securty Enabled Unversal Group Member Added Securty Enabled Unversal Group Member Removed Securty Enabled Unversal Group Deleted Group Type Changed NOTE: Each verson of Wndows has a slghtly dfferent set of events and event behavor. It s mportant to consult the documentaton for each verson represented n your envronment. Q U I Z? Whch attrbutes are tracked wth a group changed 639, 641, or 659 event? Hnt: samaccountname was added for Wndows 2003 As the admnstrator of a system collectng audt logs from Actve Drectory, you should be very comfortable wth the dfference between a Global, Local, and Unversal Groups. And you need to be aware that a report on all group membershp changes would need to nclude numerous event IDs. You ll need to fnd a good resource on whch attrbutes get pcked up by whch events. Many attrbute changes aren t audted at all by these events. If, for example, someone Wndows Server 2008 adds a changes the descrpton feld of a securty group to make the number of event IDs that group look more nnocuous, that change would not be logged would be requred for full by any of the precedng securty events. coverage of group changes n a mxed envronment. You may also see a number of events showng up n the logs assocated to Securty Dsabled groups. As a professonal AD admnstrator, you know these are smply dstrbuton groups, but f you have busness owners or audtors revewng log reports or provdng attestaton of changes and rghts, you ll need to dstngush between group types and the related securty mplcatons. In Wndows 2008, thngs change qute a bt as Mcrosoft ntroduced four-dgt event IDs and subcategores for the man audt categores. The good news about subcategores s that you get some basc control that you don t have n Server 2003 to control the flow of events comng through the event log. For example, computer account changes don t have to be treated the same as user account changes. The bad news s that t s not as smple as a few mouse clcks. And control s only granted at that very coarse level. You stll don t have the ablty to flter based on a subset of user accounts or groups, whch can be crtcal functonalty. NetVson makes flterng Easy! NetVson
3 Management of subcategores n Wndows Server 2008 s done through a command-lne tool (audtpol.exe) and any behavors that are set must be appled to each DC because the subcategores are not mplemented va GPOs. It s possble, though, to scrpt the audt changes and deploy to the DCs va a GPO deployment scrpt. Wat... what? Below are the Wndows 2008 Audt subcategory events that are most mportant for securty access-related event montorng. Wndows 2008 Audt Category: Account Management Subcategores User account management Computer account management Securty group management Dstrbuton group management Applcaton group management Other account management event Q U I Z? What s the precse lst of event IDs requred to capture Securty Group membershp changes across a mxed 2003 and 2008 envronment? Subcategory: Securty Group Management A securty-enabled global group was created A member was added to a securty-enabled global group A member was removed from a securty-enabled global group A securty-enabled global group was deleted A securty-enabled local group was created A member was added to a securty-enabled local group A member was removed from a securty-enabled local group A securty-enabled local group was deleted A securty-enabled local group was changed A securty-enabled global group was changed A securty-enabled unversal group was created A securty-enabled unversal group was changed A member was added to a securty-enabled unversal group A member was removed from a securty-enabled unversal group A securty-enabled unversal group was deleted A group s type was changed. Wrte these down... you may need them Subcategory: User Account Management A user account was created A user account was enabled An attempt was made to change an account's password An attempt was made to reset an account's password A user account was dsabled A user account was deleted NetVson
4 A user account was changed A user account was locked out SID Hstory was added to an account An attempt to add SID Hstory to an account faled A user account was unlocked The ACL was set on accounts whch are members of admnstrators groups The name of an account was changed: An attempt was made to set the Drectory Servces Restore Mode Credental Manager credentals were backed up Credental Manager credentals were restored from a backup. Wndows 2008 Audt Category: Drectory Servce Access Subcategores Drectory servce access Drectory servce changes Drectory servce replcaton Detaled drectory servce replcaton Q U I Z? If a user s added to a group, wll you see the change n a 4738 event? New for Server 2008, under the Drectory Servce Changes subcategory, Wndows can generate events whch capture before and after values related to drectory object changes. Note, however, that there are actually two events generated: one wth the prevous value and one wth the new value. Ths may complcate audt tral reportng and event response Modfy An attrbute for an exstng object has been modfed Create A new object has been created Undelete An object has been undeleted Move An object has been moved Ha ha - "may" complcate? Note that a 5136 event wll not capture create, delete, undelete or move events, even though those events may logcally be thought to be changes. So, set expectatons on reports accordngly. The delete event below s avalable only n Wndows Vsta Servce Pack 1 and n Wndows Server 2008 so be sure systems are up to date f you ntend to rely on the audt tral of delete events. NetVson captures full before & after values on ANY attrbute changes n a sngle event along wth WHO dd t for real-tme remedaton A drectory servce object was deleted NetVson
5 An mportant note on use of the Server 2008 event subcategores: To set any subcategory event behavor to dffer from the man audt category settngs, a command lne tool called audtpol.exe must be used. Thngs to consder before usng audtpol.exe to set subcategory audt settngs From: The procedure assumes that: o You are famlar wth the followng technologes and tools: Group Polcy startup scrpts Group Polcy Management Console The Audtpol.exe command-lne tool o You have a basc understandng of batch fle processng. Ouch! ths s a lot o You are famlar wth the scrpts that the procedure uses work to overrde legacy doman-based audt polcy settngs wth the detaled audt polcy settngs that are avalable n Wndows Vsta. If you do not want to confgure the detaled audt polcy settngs that are avalable n Wndows Vsta, do not use the procedure that ths artcle dscusses. A legacy polcy overwrtes the audtpol settngs only f the audtpol settngs are defned explctly n the legacy polcy. Ths behavor s by desgn. Addtonally, f the audtpol settngs are specfed as No audtng or as not defned, the audtpol settngs have precedence and are not overwrtten by the legacy polcy. NOTE: If you encounter an ssue where the command lne nstructons you sent are no longer appled after a reboot, please refer to KB for nstructons on applyng the Hotfx to each of the servers that you ntend to audt. In some cases, Account Name, Account Doman, and Securty ID felds are not populated n event ID 5136 for "Drectory Servce Changes" on a computer that s runnng Wndows Server A hotfx s avalable. See: Please keep n mnd that events wll only be generated for AD objects f the object's audt polcy has audtng enabled for the propertes or actons nvolved and for the user performng the acton or a group to whch the user belongs. (See next secton for detals.) A L E R T! Wndows event logs may generate numerous log events for a sngle realworld acton. So, event IDs, patches, audt polces, command lne tools... ths s gettng complcated! NetVson
6 Step 2 Enable Audtng on Desred Objects Once you have selected the event types that apply to your organzaton, you need to also ensure that the objects whch you want to montor are confgured correctly for audtng. Just as selectng event IDs s complcated, understandng and confgurng objects for audt s also complcated and dffcult to mantan over tme. Typcally, enablng audt on drectory objects s as smple as enablng Audt Account Management n the approprate GPO. Keep n mnd, though, that audt settngs dffer slghtly n varous versons of Wndows, so f you have a mxed envronment, be sure to consult each versons documentaton for approprate audt settngs. And be sure that the GPO s confgured approprately on each Actve Drectory Doman Controller. NetVson s approach elmnates the need to manage audt settngs across both drectory and fle system objects. In stuatons where you re lookng for a more refned soluton perhaps flterng out computer account changes, refer to the above dscusson of Server 2008 subcategores. Addtonally, you can utlze ADSIEdt to apply a don t audt flag on attrbutes that you d lke to have fltered out of audtng. Note that ths removes ALL audtng of that attrbute for ALL objects. You cannot dstngush, for example, between hgh-rsk user accounts and other accounts. To enable audtng of Actve Drectory objects n Server 2003: From: Confgure an audt polcy settng for a doman controller. When you confgure an audt polcy settng, you can audt objects but you cannot specfy the object you want to audt. Confgure audtng for specfc Actve Drectory objects. After you specfy the events to audt for fles, folders, prnters, and Actve Drectory objects, Wndows Server 2003 tracks and logs these events. You must grant the Manage Audtng and Securty Log user rght to the computer where you want to ether confgure an audt polcy settng or revew an audt log. By default, Wndows Server 2003 grants these rghts to the Admnstrators group. The sze of the Securty log s lmted. Because of ths, Mcrosoft recommends that you carefully select the fles and the folders that you want audt. Also consder the amount of dsk space that you want to devote to the Securty log. The maxmum sze s defned n Event Vewer NetVson
7 There are many artcles that dscuss the ntrcaces of enablng audtng on Wndows objects. Ths one helps you determne the effectve audt polcy n Wndows 2008 based on all the varous ways to apply audt settngs: The author makes the pont that you should not trust any of the Group Polcy reportng tools when t comes to audt settngs. That does'nt make me feel good Step 3 Confgure Event Log Settngs Once you have your events selected and audtng s enabled on all n-scope objects, the next step s to confgure settngs on the event logs themselves to support the expected behavor. Some of the confguraton optons that you ll need to consder and confgure nclude: Log Fle Path Enables you to select a locaton to whch the event logs wll be wrtten. If you re plannng to ntegrate wth a log collectng soluton, you may need or want to set the log fle path for logs on each n-scope server. NetVson requres no audt polcy confguraton, attrbute changes, command lne programmng, or event log confguraton. And gets more relable event data. Securty on Event Logs Be sure to consder event log securty so that advanced users lookng to cover ther tracks cannot clear logs whch may hold vtal evdence. If the log securty polcy s not enabled, all authentcated users would have access to wrte & clear applcaton logs. System and Securty logs can, by default, be cleared by system software or system admnstrators. Maxmum Log Sze, Retan Old Events, and Backup Log Automatcally When Full These settngs enable you to control how large the log fles wll grow and what happens when they reach ther maxmum. Ths s crtcal because logs need to be effcently handled by log collecton systems. A 2TB log fle wll be dffcult to manage. However, you also don t want logs to roll over too quckly f you mght lose some event data as a result. Be sure to consder dsk space, bandwdth, schedulng of event collecton, CPU performance, memory, etc. when applyng these settngs. Some thngs to consder relevant to event log confguraton From: NetVson
8 By default, when event logs fll to capacty, the computer overwrtes the oldest entres wth the most recent ones. To mtgate the rsk of loss of older data, you can confgure the computer to automatcally back up the log when t s full. If you sgnfcantly ncrease the number of objects to audt n your organzaton and f you enabled the Audt: Shut down system mmedately f unable to log securty audts settng, there s a rsk that the Securty log wll reach ts capacty and force the computer to shut down. Retanng old events ntroduces a greater rsk of both a DoS attack by fllng up the event log and an evdence obfuscaton method by preventng crtcal nformaton about an attack from beng logged due to lack of space. Users, both legtmate and llegtmate, who are attemptng to hde evdence of prohbted actvtes, could clear the event logs that could be used aganst them. NetVson collects event nformaton ndependently from the event logs,thereby elmnatng a number of rsks such as event clearng and rollover. Q U I Z? How many events are collected before your event logs roll over and begn deletng old events? Step 4 Confgure Event Management Soluton Ths step wll dffer for each soluton and we re not gong to attempt to dentfy every step for every soluton. In general, here are a few of the consderatons: Regster for approprate Events We dscussed Event IDs earler. Be sure all relevant events are confgured n the event management soluton. And, when possble, that unwanted events are fltered out. Event Response Ideally, you ll have complete control over event response based on Who, What, When, and Where wth the ablty to select whether the system wll generate alerts, remedaton tasks, open help desk tckets, or other responses. NetVson provdes ndustryleadng event selecton & flterng puttng you n full control over whch responses wll be generated for whch events. Event Correlaton Snce many actons generate multple log events, t s mportant n many solutons to confgure correlaton rules so that you don t get too many events reported or lose crtcal nformaton by not correlatng mportant events such as before and after values of a change. You must also accommodate for the lmted subset of object/attrbute changes and actons that are wrtten to the event log NetVson
9 Fnal Thoughts Do I need an Event Management soluton at all? You, of course, have the opton to refran from mplementng any soluton to assst wth event montorng, but logs are lmted n sze and manageablty. If access to hstorcal event data or even recent actvty audt trals s mportant, you ll almost certanly need to centrally collect and manage events, makng t possble to report across numerous servers and allowng for centralzed control of event response. Mnmzng Event Nose (a real problem) to say the least! FROM: Object access audt s generated when the system access control lst (SACL) on the object matches the access that was performed on ALL of the followng condtons: 1. Object - the object that was accessed must have ether an explct or nherted SACL. The access performed s compared aganst the ACEs n that SACL. 2. Success or falure of actvty - every audt access control entry (ACE) n a SACL wll be ether of type AUDIT_SUCCESS or AUDIT_FAILURE. The access performed must match the access type of the ACE for the rest of the ACE to be consdered. 3. User account - the accessng user's token s compared aganst each ACE matchng the access type. If the user, or a group the user belongs to, matches the SID n the ACE, then an audt mght be generated. 4. Access - the access beng performed must match the audted accesses n the access mask n an otherwse matchng ACE. Audt only the objects that you care about. User accounts and groups already are well-audted wth "Account Management" audtng, so don't audt them wth DS access. Perhaps audt OUs, or other DS objects. Use the Object Type and attrbute type restrctons that you have n DS Access audtng. Also, n Wndows Server 2008, you can affect audtng on a per-object bass by adjustng the SearchFlags attrbute n the AD schema for the object. SACLs are more easly reversed so are probably a more acceptable method of controllng audt for most organzatons. Audt only the accesses that you care about. Specfcally, read accesses occur much more often (n my experence, a conservatve estmate s about a 100:1 rato) than wrte accesses. If you restrct your audtng to "wrte" type accesses (ncludng change, delete, change permssons, create, etc.) then you wll end up generatng far fewer events. Audtng for read access s very nosy. If you must audt for reads, consder audtng fewer objects, perhaps only audtng reads on the contaner object nstead of the objects n the contaner, or on one "nterestng" object n any gven contaner as a "canary" NetVson
10 How are Object Access Events Generated? Ths artcle descrbes the complexty of how object events are generated and the dfferences between results from dfferent applcatons: w-are-object-access-events-generated.aspx Understandng the dfferences wll be an mportant part of evaluatng the event nformaton you collect. A L E R T! You may see dfferent event log event behavor for the same set of actons f a dfferent applcaton s beng used. Concluson At the end of the day, there s sgnfcant ntal and on-gong effort requred just to start generatng the rght events n your Wndows Event Log. You may fnd that multple events for a gven acton cause confuson when tryng to fgure out what actually happened. You have lmted data snce not all events show up n the logs, nablty to flter wthout extensve (typcally prohbtvely so) manual confguraton, nablty to respond based on what changed, who dd t, where somethng happened, etc. And there s a sgnfcant on-gong effort, educaton, and nfrastructure requrements to keep the logs accurate and complete over tme. Hopefully, f you go through all of that effort and mplement the rght event management soluton, you ll have a way to generate the reports you need wthout just spttng out the event log data n ts raw format, whch s clearly not optmzed for human consumpton. An Alternatve Approach Now that's an understatement! NetVson s approach to event management and response elmnates the need to worry about Wndows event logs. NetVson event collecton happens at the source, gettng better nformaton, more complete data, n a more relable and easer to manage approach. Ths advanced, patented event collecton, coupled wth ndustry leadng event flterng and event response makes NetVson the obvous soluton. But the best part s that the ownershp effort s near zero. And NetVson ntegrates wth SIEM/log management solutons so that you can ncorporate NetVson s clean, complete event nformaton nto your exstng enterprse soluton. Fnd out more: Fnally, some good news!...musc to my ears NetVson
Vembu StoreGrid Windows Client Installation Guide
Ser v cepr ov dered t on Cl enti nst al l at ongu de W ndows Vembu StoreGrd Wndows Clent Installaton Gude Download the Wndows nstaller, VembuStoreGrd_4_2_0_SP_Clent_Only.exe To nstall StoreGrd clent on
More informationCanon NTSC Help Desk Documentation
Canon NTSC Help Desk Documentaton READ THIS BEFORE PROCEEDING Before revewng ths documentaton, Canon Busness Solutons, Inc. ( CBS ) hereby refers you, the customer or customer s representatve or agent
More informationCONTENTS Introduction... 3
Cuty ourm c r os of t Ex c hangeser v er s t or agec os t sbyupt o85% Howema lar c h v ngs ol ut onsex pand y ournat v eema lappl c at on' sc apab l t es CONTENTS Introducton... 3 Emal Storage Management...
More informationAn Alternative Way to Measure Private Equity Performance
An Alternatve Way to Measure Prvate Equty Performance Peter Todd Parlux Investment Technology LLC Summary Internal Rate of Return (IRR) s probably the most common way to measure the performance of prvate
More information1.1 The University may award Higher Doctorate degrees as specified from time-to-time in UPR AS11 1.
HIGHER DOCTORATE DEGREES SUMMARY OF PRINCIPAL CHANGES General changes None Secton 3.2 Refer to text (Amendments to verson 03.0, UPR AS02 are shown n talcs.) 1 INTRODUCTION 1.1 The Unversty may award Hgher
More informationUpdating the E5810B firmware
Updatng the E5810B frmware NOTE Do not update your E5810B frmware unless you have a specfc need to do so, such as defect repar or nstrument enhancements. If the frmware update fals, the E5810B wll revert
More informationGENESYS BUSINESS MANAGER
GENESYS BUSINESS MANAGER e-manager Onlne Conference User Account Admnstraton User Gude Ths User Gude contans the followng sectons: Mnmum Requrements...3 Gettng Started...4 Sgnng On to Genesys Busness Manager...7
More informationIntroduction CONTENT. - Whitepaper -
OneCl oud ForAl l YourCr t c al Bus nes sappl c at ons Bl uew r esol ut ons www. bl uew r e. c o. uk Introducton Bluewre Cloud s a fully customsable IaaS cloud platform desgned for organsatons who want
More informationiavenue iavenue i i i iavenue iavenue iavenue
Saratoga Systems' enterprse-wde Avenue CRM system s a comprehensve web-enabled software soluton. Ths next generaton system enables you to effectvely manage and enhance your customer relatonshps n both
More informationThe Development of Web Log Mining Based on Improve-K-Means Clustering Analysis
The Development of Web Log Mnng Based on Improve-K-Means Clusterng Analyss TngZhong Wang * College of Informaton Technology, Luoyang Normal Unversty, Luoyang, 471022, Chna wangtngzhong2@sna.cn Abstract.
More informationOne Click.. Ȯne Location.. Ȯne Portal...
New Addton to your NJ-HITEC Membershp! Member Portal Detals & Features Insde! One Clck.. Ȯne Locaton.. Ȯne Portal... Connect...Share...Smplfy Health IT Member Portal Benefts Trusted Advsor - NJ-HITEC s
More informationThe OC Curve of Attribute Acceptance Plans
The OC Curve of Attrbute Acceptance Plans The Operatng Characterstc (OC) curve descrbes the probablty of acceptng a lot as a functon of the lot s qualty. Fgure 1 shows a typcal OC Curve. 10 8 6 4 1 3 4
More informationDEFINING %COMPLETE IN MICROSOFT PROJECT
CelersSystems DEFINING %COMPLETE IN MICROSOFT PROJECT PREPARED BY James E Aksel, PMP, PMI-SP, MVP For Addtonal Informaton about Earned Value Management Systems and reportng, please contact: CelersSystems,
More informationProject Networks With Mixed-Time Constraints
Project Networs Wth Mxed-Tme Constrants L Caccetta and B Wattananon Western Australan Centre of Excellence n Industral Optmsaton (WACEIO) Curtn Unversty of Technology GPO Box U1987 Perth Western Australa
More informationTo manage leave, meeting institutional requirements and treating individual staff members fairly and consistently.
Corporate Polces & Procedures Human Resources - Document CPP216 Leave Management Frst Produced: Current Verson: Past Revsons: Revew Cycle: Apples From: 09/09/09 26/10/12 09/09/09 3 years Immedately Authorsaton:
More informationbenefit is 2, paid if the policyholder dies within the year, and probability of death within the year is ).
REVIEW OF RISK MANAGEMENT CONCEPTS LOSS DISTRIBUTIONS AND INSURANCE Loss and nsurance: When someone s subject to the rsk of ncurrng a fnancal loss, the loss s generally modeled usng a random varable or
More informationVRT012 User s guide V0.1. Address: Žirmūnų g. 27, Vilnius LT-09105, Phone: (370-5) 2127472, Fax: (370-5) 276 1380, Email: info@teltonika.
VRT012 User s gude V0.1 Thank you for purchasng our product. We hope ths user-frendly devce wll be helpful n realsng your deas and brngng comfort to your lfe. Please take few mnutes to read ths manual
More informationANALYZING THE RELATIONSHIPS BETWEEN QUALITY, TIME, AND COST IN PROJECT MANAGEMENT DECISION MAKING
ANALYZING THE RELATIONSHIPS BETWEEN QUALITY, TIME, AND COST IN PROJECT MANAGEMENT DECISION MAKING Matthew J. Lberatore, Department of Management and Operatons, Vllanova Unversty, Vllanova, PA 19085, 610-519-4390,
More informationHP Mission-Critical Services
HP Msson-Crtcal Servces Delverng busness value to IT Jelena Bratc Zarko Subotc TS Support tm Mart 2012, Podgorca 2010 Hewlett-Packard Development Company, L.P. The nformaton contaned heren s subject to
More informationWhat is Candidate Sampling
What s Canddate Samplng Say we have a multclass or mult label problem where each tranng example ( x, T ) conssts of a context x a small (mult)set of target classes T out of a large unverse L of possble
More informationIT09 - Identity Management Policy
IT09 - Identty Management Polcy Introducton 1 The Unersty needs to manage dentty accounts for all users of the Unersty s electronc systems and ensure that users hae an approprate leel of access to these
More informationRequIn, a tool for fast web traffic inference
RequIn, a tool for fast web traffc nference Olver aul, Jean Etenne Kba GET/INT, LOR Department 9 rue Charles Fourer 90 Evry, France Olver.aul@nt-evry.fr, Jean-Etenne.Kba@nt-evry.fr Abstract As networked
More informationFeature selection for intrusion detection. Slobodan Petrović NISlab, Gjøvik University College
Feature selecton for ntruson detecton Slobodan Petrovć NISlab, Gjøvk Unversty College Contents The feature selecton problem Intruson detecton Traffc features relevant for IDS The CFS measure The mrmr measure
More informationCISCO SPA500G SERIES REFERENCE GUIDE
CISCO SPA500G SERIES REFERENCE GUIDE Part of the Csco Small Busness Pro Seres, the SIP based Csco SPA504G 4-Lne IP phone wth 2-port swtch has been tested to ensure comprehensve nteroperablty wth equpment
More informationA Secure Password-Authenticated Key Agreement Using Smart Cards
A Secure Password-Authentcated Key Agreement Usng Smart Cards Ka Chan 1, Wen-Chung Kuo 2 and Jn-Chou Cheng 3 1 Department of Computer and Informaton Scence, R.O.C. Mltary Academy, Kaohsung 83059, Tawan,
More informationCloud Auto-Scaling with Deadline and Budget Constraints
Prelmnary verson. Fnal verson appears In Proceedngs of 11th ACM/IEEE Internatonal Conference on Grd Computng (Grd 21). Oct 25-28, 21. Brussels, Belgum. Cloud Auto-Scalng wth Deadlne and Budget Constrants
More informationHollinger Canadian Publishing Holdings Co. ( HCPH ) proceeding under the Companies Creditors Arrangement Act ( CCAA )
February 17, 2011 Andrew J. Hatnay ahatnay@kmlaw.ca Dear Sr/Madam: Re: Re: Hollnger Canadan Publshng Holdngs Co. ( HCPH ) proceedng under the Companes Credtors Arrangement Act ( CCAA ) Update on CCAA Proceedngs
More informationCan Auto Liability Insurance Purchases Signal Risk Attitude?
Internatonal Journal of Busness and Economcs, 2011, Vol. 10, No. 2, 159-164 Can Auto Lablty Insurance Purchases Sgnal Rsk Atttude? Chu-Shu L Department of Internatonal Busness, Asa Unversty, Tawan Sheng-Chang
More informationIMPACT ANALYSIS OF A CELLULAR PHONE
4 th ASA & μeta Internatonal Conference IMPACT AALYSIS OF A CELLULAR PHOE We Lu, 2 Hongy L Bejng FEAonlne Engneerng Co.,Ltd. Bejng, Chna ABSTRACT Drop test smulaton plays an mportant role n nvestgatng
More informationMultiple-Period Attribution: Residuals and Compounding
Multple-Perod Attrbuton: Resduals and Compoundng Our revewer gave these authors full marks for dealng wth an ssue that performance measurers and vendors often regard as propretary nformaton. In 1994, Dens
More informationA Replication-Based and Fault Tolerant Allocation Algorithm for Cloud Computing
A Replcaton-Based and Fault Tolerant Allocaton Algorthm for Cloud Computng Tork Altameem Dept of Computer Scence, RCC, Kng Saud Unversty, PO Box: 28095 11437 Ryadh-Saud Araba Abstract The very large nfrastructure
More informationPolitecnico di Torino. Porto Institutional Repository
Poltecnco d Torno Porto Insttutonal Repostory [Artcle] A cost-effectve cloud computng framework for acceleratng multmeda communcaton smulatons Orgnal Ctaton: D. Angel, E. Masala (2012). A cost-effectve
More informationMultitone Electronics Plc. delivering certainty
Multtone Electroncs Plc Multtone Electroncs Plc, Multtone House, Shortwood Copse Lane, Basngstoke, Hampshre, RG23 7NL Tel: +44 (0)1256 320292 Fax: +44 (0)1256 462 643 Emal: nfo@multtone.com Web: www.multtone.com
More informationELM for Exchange version 5.5 Exchange Server Migration
ELM for Exchange verson 5.5 Exchange Server Mgraton Copyrght 06 Lexmark. All rghts reserved. Lexmark s a trademark of Lexmark Internatonal, Inc., regstered n the U.S. and/or other countres. All other trademarks
More informationCalculation of Sampling Weights
Perre Foy Statstcs Canada 4 Calculaton of Samplng Weghts 4.1 OVERVIEW The basc sample desgn used n TIMSS Populatons 1 and 2 was a two-stage stratfed cluster desgn. 1 The frst stage conssted of a sample
More informationVision Mouse. Saurabh Sarkar a* University of Cincinnati, Cincinnati, USA ABSTRACT 1. INTRODUCTION
Vson Mouse Saurabh Sarkar a* a Unversty of Cncnnat, Cncnnat, USA ABSTRACT The report dscusses a vson based approach towards trackng of eyes and fngers. The report descrbes the process of locatng the possble
More informationHow To Get A Tax Refund On A Retirement Account
CED0105200808 Amerprse Fnancal Servces, Inc. 70400 Amerprse Fnancal Center Mnneapols, MN 55474 Incomng Account Transfer/Exchange/ Drect Rollover (Qualfed Plans Only) for Amerprse certfcates, Columba mutual
More informationVIP X1600 M4S Encoder module. Installation and Operating Manual
VIP X1600 M4S Encoder module en Installaton and Operatng Manual VIP X1600 XFM4 VIP X1600 Table of Contents en 3 Table of Contents 1 Preface 7 1.1 About ths Manual 7 1.2 Conventons n ths Manual 7 1.3 Intended
More informationEnterprise Master Patient Index
Enterprse Master Patent Index Healthcare data are captured n many dfferent settngs such as hosptals, clncs, labs, and physcan offces. Accordng to a report by the CDC, patents n the Unted States made an
More informationEfficient Project Portfolio as a tool for Enterprise Risk Management
Effcent Proect Portfolo as a tool for Enterprse Rsk Management Valentn O. Nkonov Ural State Techncal Unversty Growth Traectory Consultng Company January 5, 27 Effcent Proect Portfolo as a tool for Enterprse
More informationLIFETIME INCOME OPTIONS
LIFETIME INCOME OPTIONS May 2011 by: Marca S. Wagner, Esq. The Wagner Law Group A Professonal Corporaton 99 Summer Street, 13 th Floor Boston, MA 02110 Tel: (617) 357-5200 Fax: (617) 357-5250 www.ersa-lawyers.com
More informationIWFMS: An Internal Workflow Management System/Optimizer for Hadoop
IWFMS: An Internal Workflow Management System/Optmzer for Hadoop Lan Lu, Yao Shen Department of Computer Scence and Engneerng Shangha JaoTong Unversty Shangha, Chna lustrve@gmal.com, yshen@cs.sjtu.edu.cn
More informationCourse outline. Financial Time Series Analysis. Overview. Data analysis. Predictive signal. Trading strategy
Fnancal Tme Seres Analyss Patrck McSharry patrck@mcsharry.net www.mcsharry.net Trnty Term 2014 Mathematcal Insttute Unversty of Oxford Course outlne 1. Data analyss, probablty, correlatons, vsualsaton
More informationSmall pots lump sum payment instruction
For customers Small pots lump sum payment nstructon Please read these notes before completng ths nstructon About ths nstructon Use ths nstructon f you re an ndvdual wth Aegon Retrement Choces Self Invested
More informationOn the Optimal Control of a Cascade of Hydro-Electric Power Stations
On the Optmal Control of a Cascade of Hydro-Electrc Power Statons M.C.M. Guedes a, A.F. Rbero a, G.V. Smrnov b and S. Vlela c a Department of Mathematcs, School of Scences, Unversty of Porto, Portugal;
More informationHow To Understand The Results Of The German Meris Cloud And Water Vapour Product
Ttel: Project: Doc. No.: MERIS level 3 cloud and water vapour products MAPP MAPP-ATBD-ClWVL3 Issue: 1 Revson: 0 Date: 9.12.1998 Functon Name Organsaton Sgnature Date Author: Bennartz FUB Preusker FUB Schüller
More informationTrivial lump sum R5.0
Optons form Once you have flled n ths form, please return t wth your orgnal brth certfcate to: Premer PO Box 2067 Croydon CR90 9ND. Fll n ths form usng BLOCK CAPITALS and black nk. Mark all answers wth
More informationwww.olr.ccli.com Introducing Online Reporting Your step-by-step guide to the new online copy report Online Reporting
Onlne Reportng Introducng Onlne Reportng www.olr.ccl.com Your step-by-step gude to the new onlne copy report Important nformaton for all lcence holders No more software to download Reportng as you go...
More informationThe Greedy Method. Introduction. 0/1 Knapsack Problem
The Greedy Method Introducton We have completed data structures. We now are gong to look at algorthm desgn methods. Often we are lookng at optmzaton problems whose performance s exponental. For an optmzaton
More informationWEBSENSE WEB SECURITY SUITE QUICK START GUIDE
WEBSENSE WEB SECURITY SUITE QUICK START GUIDE Websense Web Securty Sute Websense Web Securty Sute Corporate Edton Websense Web Securty Sute Lockdown Edton Websense Web Securty Sute Lockdown Corporate Edton
More informationInstructions for Analyzing Data from CAHPS Surveys:
Instructons for Analyzng Data from CAHPS Surveys: Usng the CAHPS Analyss Program Verson 4.1 Purpose of ths Document...1 The CAHPS Analyss Program...1 Computng Requrements...1 Pre-Analyss Decsons...2 What
More informationFrequency Selective IQ Phase and IQ Amplitude Imbalance Adjustments for OFDM Direct Conversion Transmitters
Frequency Selectve IQ Phase and IQ Ampltude Imbalance Adjustments for OFDM Drect Converson ransmtters Edmund Coersmeer, Ernst Zelnsk Noka, Meesmannstrasse 103, 44807 Bochum, Germany edmund.coersmeer@noka.com,
More informationRobust Design of Public Storage Warehouses. Yeming (Yale) Gong EMLYON Business School
Robust Desgn of Publc Storage Warehouses Yemng (Yale) Gong EMLYON Busness School Rene de Koster Rotterdam school of management, Erasmus Unversty Abstract We apply robust optmzaton and revenue management
More informationWhitePaper: Security "Point" Solutions are Not a 4 Letter Word:
Securty "Pont" Solutons are Not a 4 Letter Word: Why Purpose-Bult Solutons for Patch and Confguraton Management Contnue to be a Good Thng Securty "Pont" Solutons are Not a 4 Letter Word: In recent years
More informationEE31 Series. Manual. Logger & Visualisation Software. BA_EE31_VisuLoggerSW_01_eng // Technical data are subject to change V1.0
EE31 Seres Manual Logger & Vsualsaton Software BA_EE31_VsuLoggerSW_01_eng // Techncal data are subject to change V1.0 Logger & Vsualsaton Software - EE31 Seres GENERAL Ths software has been developed by
More informationTraffic State Estimation in the Traffic Management Center of Berlin
Traffc State Estmaton n the Traffc Management Center of Berln Authors: Peter Vortsch, PTV AG, Stumpfstrasse, D-763 Karlsruhe, Germany phone ++49/72/965/35, emal peter.vortsch@ptv.de Peter Möhl, PTV AG,
More informationA DYNAMIC CRASHING METHOD FOR PROJECT MANAGEMENT USING SIMULATION-BASED OPTIMIZATION. Michael E. Kuhl Radhamés A. Tolentino-Peña
Proceedngs of the 2008 Wnter Smulaton Conference S. J. Mason, R. R. Hll, L. Mönch, O. Rose, T. Jefferson, J. W. Fowler eds. A DYNAMIC CRASHING METHOD FOR PROJECT MANAGEMENT USING SIMULATION-BASED OPTIMIZATION
More informationAssurant Employee Benefits City of Frisco Dental DHMO & Dental PPO
Assurant Employee Benefts Cty of Frsco Dental DHMO & Dental PPO Dental Health Goes Beyond Your Teeth Bad dental health mpacts overall health and ncreases the rsk for dabetes, heart dsease, and poor brth
More informationA Performance Analysis of View Maintenance Techniques for Data Warehouses
A Performance Analyss of Vew Mantenance Technques for Data Warehouses Xng Wang Dell Computer Corporaton Round Roc, Texas Le Gruenwald The nversty of Olahoma School of Computer Scence orman, OK 739 Guangtao
More informationForecasting the Direction and Strength of Stock Market Movement
Forecastng the Drecton and Strength of Stock Market Movement Jngwe Chen Mng Chen Nan Ye cjngwe@stanford.edu mchen5@stanford.edu nanye@stanford.edu Abstract - Stock market s one of the most complcated systems
More informationUsing Series to Analyze Financial Situations: Present Value
2.8 Usng Seres to Analyze Fnancal Stuatons: Present Value In the prevous secton, you learned how to calculate the amount, or future value, of an ordnary smple annuty. The amount s the sum of the accumulated
More informationSection 5.4 Annuities, Present Value, and Amortization
Secton 5.4 Annutes, Present Value, and Amortzaton Present Value In Secton 5.2, we saw that the present value of A dollars at nterest rate per perod for n perods s the amount that must be deposted today
More informationMission Oriented Business Integration Services (MOBIS) FSC Group: 874 Class: R499
General Servces Admnstraton Federal Supply Servce Authorzed Federal Supply Schedule Prce Lst Msson Orented Busness Integraton Servces (MOBIS) FSC Group: 874 Class: R499 On-lne access to contract orderng
More informationModule 2 LOSSLESS IMAGE COMPRESSION SYSTEMS. Version 2 ECE IIT, Kharagpur
Module LOSSLESS IMAGE COMPRESSION SYSTEMS Lesson 3 Lossless Compresson: Huffman Codng Instructonal Objectves At the end of ths lesson, the students should be able to:. Defne and measure source entropy..
More informationThe Use of Analytics for Claim Fraud Detection Roosevelt C. Mosley, Jr., FCAS, MAAA Nick Kucera Pinnacle Actuarial Resources Inc.
Paper 1837-2014 The Use of Analytcs for Clam Fraud Detecton Roosevelt C. Mosley, Jr., FCAS, MAAA Nck Kucera Pnnacle Actuaral Resources Inc., Bloomngton, IL ABSTRACT As t has been wdely reported n the nsurance
More informationAn Empirical Study of Search Engine Advertising Effectiveness
An Emprcal Study of Search Engne Advertsng Effectveness Sanjog Msra, Smon School of Busness Unversty of Rochester Edeal Pnker, Smon School of Busness Unversty of Rochester Alan Rmm-Kaufman, Rmm-Kaufman
More informationDesign and Development of a Security Evaluation Platform Based on International Standards
Internatonal Journal of Informatcs Socety, VOL.5, NO.2 (203) 7-80 7 Desgn and Development of a Securty Evaluaton Platform Based on Internatonal Standards Yuj Takahash and Yoshm Teshgawara Graduate School
More informationAN APPOINTMENT ORDER OUTPATIENT SCHEDULING SYSTEM THAT IMPROVES OUTPATIENT EXPERIENCE
AN APPOINTMENT ORDER OUTPATIENT SCHEDULING SYSTEM THAT IMPROVES OUTPATIENT EXPERIENCE Yu-L Huang Industral Engneerng Department New Mexco State Unversty Las Cruces, New Mexco 88003, U.S.A. Abstract Patent
More informationRecurrence. 1 Definitions and main statements
Recurrence 1 Defntons and man statements Let X n, n = 0, 1, 2,... be a MC wth the state space S = (1, 2,...), transton probabltes p j = P {X n+1 = j X n = }, and the transton matrx P = (p j ),j S def.
More informationMethodology to Determine Relationships between Performance Factors in Hadoop Cloud Computing Applications
Methodology to Determne Relatonshps between Performance Factors n Hadoop Cloud Computng Applcatons Lus Eduardo Bautsta Vllalpando 1,2, Alan Aprl 1 and Alan Abran 1 1 Department of Software Engneerng and
More informationDamage detection in composite laminates using coin-tap method
Damage detecton n composte lamnates usng con-tap method S.J. Km Korea Aerospace Research Insttute, 45 Eoeun-Dong, Youseong-Gu, 35-333 Daejeon, Republc of Korea yaeln@kar.re.kr 45 The con-tap test has the
More informationNordea G10 Alpha Carry Index
Nordea G10 Alpha Carry Index Index Rules v1.1 Verson as of 10/10/2013 1 (6) Page 1 Index Descrpton The G10 Alpha Carry Index, the Index, follows the development of a rule based strategy whch nvests and
More information"Research Note" APPLICATION OF CHARGE SIMULATION METHOD TO ELECTRIC FIELD CALCULATION IN THE POWER CABLES *
Iranan Journal of Scence & Technology, Transacton B, Engneerng, ol. 30, No. B6, 789-794 rnted n The Islamc Republc of Iran, 006 Shraz Unversty "Research Note" ALICATION OF CHARGE SIMULATION METHOD TO ELECTRIC
More informationDynamic Fleet Management for Cybercars
Proceedngs of the IEEE ITSC 2006 2006 IEEE Intellgent Transportaton Systems Conference Toronto, Canada, September 17-20, 2006 TC7.5 Dynamc Fleet Management for Cybercars Fenghu. Wang, Mng. Yang, Ruqng.
More information= (2) T a,2 a,2. T a,3 a,3. T a,1 a,1
A set of tools for buldng PostgreSQL dstrbuted databases n bomedcal envronment. M. Cavaller, R. Prudentno, U. Pozzol, G. Ren IRCCS E. Medea, Bosso Parn (LC), Italy. E-mal: gren@bp.lnf.t Abstract PostgreSQL
More information2008/8. An integrated model for warehouse and inventory planning. Géraldine Strack and Yves Pochet
2008/8 An ntegrated model for warehouse and nventory plannng Géraldne Strack and Yves Pochet CORE Voe du Roman Pays 34 B-1348 Louvan-la-Neuve, Belgum. Tel (32 10) 47 43 04 Fax (32 10) 47 43 01 E-mal: corestat-lbrary@uclouvan.be
More informationElectronic Document Management
tem no 14- THE CTY OF EDNBURGH COUNCL Electronc Document Management Executve of the Councl 7th October 2003 y. 1 1. 2 2.1 2.2 2.3 2.4 2.5 Purpose of report To approve a preferred suppler and proposed way
More informationAPPLICATION OF PROBE DATA COLLECTED VIA INFRARED BEACONS TO TRAFFIC MANEGEMENT
APPLICATION OF PROBE DATA COLLECTED VIA INFRARED BEACONS TO TRAFFIC MANEGEMENT Toshhko Oda (1), Kochro Iwaoka (2) (1), (2) Infrastructure Systems Busness Unt, Panasonc System Networks Co., Ltd. Saedo-cho
More informationPRO-CRIMPER* III Hand Crimping Tool Assembly 90800-1 with Die Assembly 90800-2
PRO-CRIMPER* III Hand Crmpng Tool Assembly 90800-1 wth Assembly 90800-2 Instructon Sheet 408-4007 19 APR 11 PROPER USE GUIDELINES Cumulatve Trauma Dsorders can result from the prolonged use of manually
More informationThe purpose of this benchmark was to compare the performance of
Ruby on Rals Database Benchmark: Clustrx and MySQL by Clayton Cole and Nel Harkns The purpose of ths benchmark was to compare the performance of Ruby on Rals usng MySQL, an open-source database commonly
More informationSQUARE Project: Cost/Benefit Analysis Framework for Information Security Improvement Projects in Small Companies
SQUARE Project: Cost/Beneft Analyss Framework for Informaton Securty Improvement Projects n Small Companes System Qualty Requrements Engneerng (SQUARE) Team Nck (Nng) Xe Nancy R. Mead, Advsor Contrbutors:
More informationPre-entry Review. Industry Applications. NESUG '96 Proceedings 330
ndustry Applcatons THE ROLE OF SAS PROGRAMMERS N CLNCAL TRAL DATA ANALYSS Mng Wang ndependent SAS Consultant Abstract Ths artcle shows n-depth the role of SAS programmers n clncal tral data analyss. t
More informationCHOLESTEROL REFERENCE METHOD LABORATORY NETWORK. Sample Stability Protocol
CHOLESTEROL REFERENCE METHOD LABORATORY NETWORK Sample Stablty Protocol Background The Cholesterol Reference Method Laboratory Network (CRMLN) developed certfcaton protocols for total cholesterol, HDL
More informationHosted Voice Self Service Installation Guide
Hosted Voce Self Servce Installaton Gude Contact us at 1-877-355-1501 learnmore@elnk.com www.earthlnk.com 2015 EarthLnk. Trademarks are property of ther respectve owners. All rghts reserved. 1071-07629
More informationFault tolerance in cloud technologies presented as a service
Internatonal Scentfc Conference Computer Scence 2015 Pavel Dzhunev, PhD student Fault tolerance n cloud technologes presented as a servce INTRODUCTION Improvements n technques for vrtualzaton and performance
More informationTypes of Injuries. (20 minutes) LEARNING OBJECTIVES MATERIALS NEEDED
U N I T 3 Types of Injures (20 mnutes) PURPOSE: To help coaches learn how to recognze the man types of acute and chronc njures. LEARNING OBJECTIVES In ths unt, coaches wll learn how most njures occur,
More informationEnterprise Content Management
Enterprse Content Management for the Laboratory Jm Mller Drector of Informatcs and Software Aglent Technologes Branden Humphrey Global Data Archve Program Manager Pfzer Global Research The content exploson
More informationEffective Network Defense Strategies against Malicious Attacks with Various Defense Mechanisms under Quality of Service Constraints
Effectve Network Defense Strateges aganst Malcous Attacks wth Varous Defense Mechansms under Qualty of Servce Constrants Frank Yeong-Sung Ln Department of Informaton Natonal Tawan Unversty Tape, Tawan,
More informationHow To Detect An 802.11 Traffc From A Network With A Network Onlne Onlnet
IEEE TRANSACTIONS ON MOBILE COMPUTING, VOL. X, NO. X, XXX 2008 1 Passve Onlne Detecton of 802.11 Traffc Usng Sequental Hypothess Testng wth TCP ACK-Pars We We, Member, IEEE, Kyoungwon Suh, Member, IEEE,
More informationBUSINESS PROCESS PERFORMANCE MANAGEMENT USING BAYESIAN BELIEF NETWORK. 0688, dskim@ssu.ac.kr
Proceedngs of the 41st Internatonal Conference on Computers & Industral Engneerng BUSINESS PROCESS PERFORMANCE MANAGEMENT USING BAYESIAN BELIEF NETWORK Yeong-bn Mn 1, Yongwoo Shn 2, Km Jeehong 1, Dongsoo
More informationLuby s Alg. for Maximal Independent Sets using Pairwise Independence
Lecture Notes for Randomzed Algorthms Luby s Alg. for Maxmal Independent Sets usng Parwse Independence Last Updated by Erc Vgoda on February, 006 8. Maxmal Independent Sets For a graph G = (V, E), an ndependent
More informationHow Sets of Coherent Probabilities May Serve as Models for Degrees of Incoherence
1 st Internatonal Symposum on Imprecse Probabltes and Ther Applcatons, Ghent, Belgum, 29 June 2 July 1999 How Sets of Coherent Probabltes May Serve as Models for Degrees of Incoherence Mar J. Schervsh
More informationOverview of monitoring and evaluation
540 Toolkt to Combat Traffckng n Persons Tool 10.1 Overvew of montorng and evaluaton Overvew Ths tool brefly descrbes both montorng and evaluaton, and the dstncton between the two. What s montorng? Montorng
More informationA system for real-time calculation and monitoring of energy performance and carbon emissions of RET systems and buildings
A system for real-tme calculaton and montorng of energy performance and carbon emssons of RET systems and buldngs Dr PAAIOTIS PHILIMIS Dr ALESSADRO GIUSTI Dr STEPHE GARVI CE Technology Center Democratas
More informationMETHODOLOGY TO DETERMINE RELATIONSHIPS BETWEEN PERFORMANCE FACTORS IN HADOOP CLOUD COMPUTING APPLICATIONS
METHODOLOGY TO DETERMINE RELATIONSHIPS BETWEEN PERFORMANCE FACTORS IN HADOOP CLOUD COMPUTING APPLICATIONS Lus Eduardo Bautsta Vllalpando 1,2, Alan Aprl 1 and Alan Abran 1 1 Department of Software Engneerng
More informationFinancial Mathemetics
Fnancal Mathemetcs 15 Mathematcs Grade 12 Teacher Gude Fnancal Maths Seres Overvew In ths seres we am to show how Mathematcs can be used to support personal fnancal decsons. In ths seres we jon Tebogo,
More informationLecture 2: Single Layer Perceptrons Kevin Swingler
Lecture 2: Sngle Layer Perceptrons Kevn Sngler kms@cs.str.ac.uk Recap: McCulloch-Ptts Neuron Ths vastly smplfed model of real neurons s also knon as a Threshold Logc Unt: W 2 A Y 3 n W n. A set of synapses
More informationActivity Scheduling for Cost-Time Investment Optimization in Project Management
PROJECT MANAGEMENT 4 th Internatonal Conference on Industral Engneerng and Industral Management XIV Congreso de Ingenería de Organzacón Donosta- San Sebastán, September 8 th -10 th 010 Actvty Schedulng
More informationTraffic-light a stress test for life insurance provisions
MEMORANDUM Date 006-09-7 Authors Bengt von Bahr, Göran Ronge Traffc-lght a stress test for lfe nsurance provsons Fnansnspetonen P.O. Box 6750 SE-113 85 Stocholm [Sveavägen 167] Tel +46 8 787 80 00 Fax
More informationAn MILP model for planning of batch plants operating in a campaign-mode
An MILP model for plannng of batch plants operatng n a campagn-mode Yanna Fumero Insttuto de Desarrollo y Dseño CONICET UTN yfumero@santafe-concet.gov.ar Gabrela Corsano Insttuto de Desarrollo y Dseño
More information