Welcome to Omniquad Desktop Surveillance

Omniquad Desktop Surveillance offers a unique approach to the problem of access control, prevention of, or investigation into, use/misuse of computer equipment and software.  Instead of merely obstructing the user's actions, one of the oldest prevention methods known - the prospect of being watched and 'found out' - is applied.

The program is the software equivalent of a surveillance camera and works by recording desktop activity.  Yet it may operate in two modes; either by displaying warning signs in order to discourage misuse, or by secretly monitoring activity.  While the application can store days of recordings, the settings can be tailored virtually for any situation.  For example, recording can be activated at certain chosen times only, when running specified applications or on log-on to the Internet.

This application is the only tool available to address not only the issues of web browsing but also newsgroups and IRC at the same time.  The program recording can be activated as soon as you visit certain WWW sites or specific IRC channels.  Desktop Surveillance can also be remotely controlled, either via local network or the Internet, and in both cases it is possible to remotely observe activity on the local desktop in real time.  The program can be applied in a manifold of situations - for example to discourage employees in your office from visiting specified WWW sites or performing certain tasks, or maybe to secretly find out what your PC is being used for in your absence.  Unlimited number of users can be added, each with an individual surveillance profile.


Step-by-step instructions

Please see the setup.doc document for step-by-step deployment and configuration instructions.


User Profiles

When Omniquad Desktop Surveillance agent loads, it will try to load settings for the currently logged on user.  If a profile that corresponds to the current user name cannot be found, the agent will load the DEFAULT user profile (DEFAULT.CFG).  In this way, each user on the network allows each user to have a unique profile.

Central server installation ensures that a correct profile will be loaded for each user, regardless from on which workstation they log on.


General

Enable Desktop Surveillance in this profile

When disabled, Omniquad Desktop Surveillance will automatically unload itself from memory and exit.  Use this setting to determine which users are monitored and which are not.

Remove application entry from Windows 95/98 task list

When this setting is enabled, it is difficult for any user to determine whether Omniquad Desktop Surveillance is active or terminate it.  On Windows NT, the application name will not appear in the task list by default.

Display icon in task tray area

Displays ‘eye’ icon which indicates to the user that Omniquad Desktop Surveillance is active.

Display message

Use this option to communicate a start-up message related to usage policy on your network, for example ‘Any activity on this workstation may be monitored’ etc.


Storage

Store records on disk

Leaves Virtual Video records to disk.  If this setting is disabled, Virtual Video records are deleted after they are forwarded away by SMTP or FTP

Forward by Email to …

Forwards Virtual Video records to another email recipient. Omniquad Desktop Surveillance agent will try to send records as soon as connection to the specified SMTP is made.  This process takes place in the background.

Please see the Maximizing Security section for information about risks associated with Email Forwarding

Forward to FTP sever

Forwards Virtual Video records to remote FTP sever. Omniquad Desktop Surveillance agent will try to send records as soon as connection to the specified SMTP sever is made.  This process takes place in the background.

The agent will try to store Virtual Video data in the initial server directory (user ftp root), so FTP account used by the agent should have the necessary permission to create and store files.


Logs

Activity logs store information about dates and times of any applications, files, documents, network resources or web sites accessed by users.  Only the foreground tasks are logged, so a realistic record of usage patterns is made.

Enable activity logs

When enabled, activity log information is stored in file odsact.log in the specified network paths

Idle activity time-out

Assumes that user is away and terminates the log input after a specified number of minutes.

Capture Keystrokes

Stores captured keystrokes in file key.log in the specified folder. This function is not guaranteed to work with all applications and may be not compatible with some keystroke monitoring tools.


Virtual Video

Enable Virtual Video

Creates visual records of computer usage.  Ensure that ‘save records to disk’ option is enabled if the records are supposed to be stored permanently

Record Always Option

Ensures that Virtual Video records are always created, regardless of what the user does

Record Only on Window or Keystroke triggers

Please read Window and Keystroke triggers sections for more information on this option

Save new frame every …

Specifies Virtual Video frame interval, the recommended setting is 60 seconds.

Enable Secondary Virtual Video timer

The secondary timer allows you to effectively have 2 recording speeds and should be enabled only with ‘recording on triggers only’ option.

The secondary timer can be compared to recording all TV programs all day in low-quality ‘Long Play’ mode but recording favorite programs in high-quality ‘Single Play’ mode.  For example Virtual Video frames can be taken most of the time every 5 minutes (though the secondary timer), but every 30 seconds when user goes on-line.

Delete Oldest Virtual Video when disk usage …

Use to this option to maintain a disk space limit for each user profile.  Once the limit is reached, the oldest records will be deleted.

The maximum disk space which taken by Omniquad Desktop Surveillance video records may take more space than the total sum of disk space limits for each possible user on the network.  This is because disk space usage is verified on logon only and allows for the limit to be exceeded during the actual login session – in this way, Omniquad Desktop Surveillance can delete the optimum (minimal) number of records and have no impact on system or network performance.

Virtual Video window triggers

When Virtual Video is in trigger mode, new frames will be taken only when

Trigger on list match – the caption of the foreground window with user input can be matched on the trigger list.

Trigger when no match – the caption of the foreground window with user input cannot be matched on the trigger list.

Trigger when no match (WWW only)– the caption of the foreground window with user input cannot be matched on the trigger list and Internet browser (Internet Explorer or Netscape Navigator) is the foreground application

If the trigger criteria cannot be satisfied, Virtual Video will pause and resume once they are.

Virtual Video keystroke triggers

Once user types on the keyboard any of the specified keystroke triggers, Virtual Video will be turned permanently on until the user logs off.


Executable window triggers

Starts item specified in Filename text box if the caption of the foreground window can be matched with any item in the trigger list.  If the item is a document or a web site, it will be opened with it’s default associated application.

Window triggers are disabled once the first item is triggered

Executable keystroke triggers

Starts item specified in Filename text box words typed by user can be matched with any item in the trigger list.  If the item is a document or a web site, it will be opened with it’s default ssociated

application.  They keystroke event will be triggered every time the words are matched.


Blocking

Blocking allows you to deny access to any application, web site or network resource.

Block List

When blocking is enabled, captions of top level windows are scanned and when the block keyword is matched, the relevant window will be automatically closed.

Example 1)

To stop user from changing the display properties, add text DISPLAY PROPERTIES to the block list.  When the user logs on next time and tries to open the display properties, that window will be automatically closed (because text ‘Display Properties’ appears as a caption in that window)

Almost any activity can be blocked in this way, since in most cases the caption of the top level window is relevant to that window’s content (you may have to display the window first so that you can find out exactly what keywords to add in the blocking list)

Reverse Block List

This option can be used instead of the standard block list.  Use it to specify only the applications or documents the user is allowed to access – everything else will be automatically closed.  The reverse block list can be used to create and enforce very strict policies.

Example 2)

To allow the user only access to excel and no other applications, enable reverse block list and enter word EXCEL into the reverse block list.  When the user logs on next time, they will be able to use only Excel, all other activities will be blocked.

Reverse Block List (WWW only)

Use to specify a list of internally approved web sites – any other web site will be blocked.  For example to allow users to browse only the Omniquad web site, enter OMNIQUAD to the reverse block list.  Since text ‘Welcome to Omniquad’ appears on every page of Omniquad web site, the users will be allowed to browse freely only within Omniquad web site. If the user tries to load other site, the web browser window will be automatically closed.  This list applies to web sites only, so it can be used at the same time as the standard block list.


Lockdown

Shut down window triggers

Shuts the system down if the caption of the foreground window can be matched with any item in the trigger list

Shut down keystroke triggers

Shuts the system down if user types any words that can be matched with items in the trigger list


Maximizing Security

The nature of Omniquad Desktop Surveillance may demand applying all possible security features

-	Change startup registry entry label from ‘odsload’ to one of your choice.

-	Rename agent executable from ODSHOST.EXE to one of your choice.  This may prove especially helpful on Windows NT in order to make Omniquad Desktop Surveillance less apparent in the process list.

-	When records need to be forwarded to remote location try using FTP rather than SMTP.  Omniquad Desktop Surveillance uses it’s own email engine which bypasses user’s email own email software, but SMTP email can be routed back to the user if there is a network routing failure.