Previous Topic: Prevent Unauthorized Changes to the Internet Explorer Add-on ListNext Topic: General Hardening Recommendations


Prevent Unauthorized Changes to CA DataMinder Services

The Windows Task Manager displays only one CA DataMinder service on a client workstation, namely WgnInfra (CA DataMinder infrastructure service). If the user is not logged on as an Administrator, the Task Manager does not permit the user to stop or shut down the service. Therefore, the presence of the WgnInfra entry in the Task Manager does not jeopardize the integrity of CA DataMinder.

An administrator can use the Services pane in the Microsoft Management Console and the NET STOP console command to start and stop services. However, by default, a user who does not have local administrator privileges cannot stop WgnInfra.

The Windows Task Manager displays a further process, WgnCM, which is a regular executable. Although it can be shut down using the Task Manager, doing so has little or no effect on the operation of CA DataMinder: The process is restarted automatically as soon as one of the CA DataMinder endpoint agent plug-ins encounters an event that requires processing. Once WgnCM has restarted, CA DataMinder continues to function normally.