#####################################################
# #
# Audit script by Alan Renouf - Virtu-Al #
# Blog: http://teckinfo.blogspot.com/ #
# #
# Usage: Audit.ps1 'pathtolistofservers' #
# #
# The file is optional and needs to be a #
# plain text list of computers to be audited #
# one on each line. #
# #
#####################################################
param( [string] $auditlist)
if ($auditlist -eq ""){
Write-Host "No list specified, using $env:computername"
$targets = $env:computername
}
else
{
if ((Test-Path $auditlist) -eq $false)
{
Write-Host "Invalid audit path specified: $auditlist"
exit
}
else
{
Write-Host "Using Audit list: $auditlist"
$Targets = Get-Content $auditlist
}
}
$Date = Get-Date
Foreach ($Target in $Targets){
Write-Output "Collating Detail for $Target"
$ComputerSystem = Get-WmiObject -computername $Target Win32_ComputerSystem
switch ($ComputerSystem.DomainRole){
0 { $ComputerRole = "Standalone Workstation" }
1 { $ComputerRole = "Member Workstation" }
2 { $ComputerRole = "Standalone Server" }
3 { $ComputerRole = "Member Server" }
4 { $ComputerRole = "Domain Controller" }
5 { $ComputerRole = "Domain Controller" }
default { $ComputerRole = "Information not available" }
}
$OperatingSystems = Get-WmiObject -computername $Target Win32_OperatingSystem
$TimeZone = Get-WmiObject -computername $Target Win32_Timezone
$Keyboards = Get-WmiObject -computername $Target Win32_Keyboard
$SchedTasks = Get-WmiObject -computername $Target Win32_ScheduledJob
$BootINI = $OperatingSystems.SystemDrive + "boot.ini"
$RecoveryOptions = Get-WmiObject -computername $Target Win32_OSRecoveryConfiguration
switch ($ComputerRole){
"Member Workstation" { $CompType = "Computer Domain"; break }
"Domain Controller" { $CompType = "Computer Domain"; break }
"Member Server" { $CompType = "Computer Domain"; break }
default { $CompType = "Computer Workgroup"; break }
}
$LBTime=$OperatingSystems.ConvertToDateTime($OperatingSystems.Lastbootuptime)
Write-Output "..Hotfix Information"
$colQuickFixes = Get-WmiObject Win32_QuickFixEngineering
Write-Output "..Logical Disks"
$colDisks = Get-WmiObject -ComputerName $Target Win32_LogicalDisk
Write-Output "..Network Configuration"
$NICCount = 0
$colAdapters = Get-WmiObject -ComputerName $Target Win32_NetworkAdapterConfiguration
Write-Output "..Local Shares"
$colShares = Get-wmiobject -ComputerName $Target Win32_Share
Write-Output "..Printers"
$colInstalledPrinters = Get-WmiObject -ComputerName $Target Win32_Printer
Write-Output "..Services"
$colListOfServices = Get-WmiObject -ComputerName $Target Win32_Service
Write-Output "..Regional Options"
$ObjKeyboards = Get-WmiObject -ComputerName $Target Win32_Keyboard
$keyboardmap = @{
"00000402" = "BG"
"00000404" = "CH"
"00000405" = "CZ"
"00000406" = "DK"
"00000407" = "GR"
"00000408" = "GK"
"00000409" = "US"
"0000040A" = "SP"
"0000040B" = "SU"
"0000040C" = "FR"
"0000040E" = "HU"
"0000040F" = "IS"
"00000410" = "IT"
"00000411" = "JP"
"00000412" = "KO"
"00000413" = "NL"
"00000414" = "NO"
"00000415" = "PL"
"00000416" = "BR"
"00000418" = "RO"
"00000419" = "RU"
"0000041A" = "YU"
"0000041B" = "SL"
"0000041C" = "US"
"0000041D" = "SV"
"0000041F" = "TR"
"00000422" = "US"
"00000423" = "US"
"00000424" = "YU"
"00000425" = "ET"
"00000426" = "US"
"00000427" = "US"
"00000804" = "CH"
"00000809" = "UK"
"0000080A" = "LA"
"0000080C" = "BE"
"00000813" = "BE"
"00000816" = "PO"
"00000C0C" = "CF"
"00000C1A" = "US"
"00001009" = "US"
"0000100C" = "SF"
"00001809" = "US"
"00010402" = "US"
"00010405" = "CZ"
"00010407" = "GR"
"00010408" = "GK"
"00010409" = "DV"
"0001040A" = "SP"
"0001040E" = "HU"
"00010410" = "IT"
"00010415" = "PL"
"00010419" = "RU"
"0001041B" = "SL"
"0001041F" = "TR"
"00010426" = "US"
"00010C0C" = "CF"
"00010C1A" = "US"
"00020408" = "GK"
"00020409" = "US"
"00030409" = "USL"
"00040409" = "USR"
"00050408" = "GK"
}
$keyb = $keyboardmap.$($ObjKeyboards.Layout)
if (!$keyb)
{ $keyb = "Unknown"
}
Write-Output "..Event Log Settings"
$colLogFiles = Get-WmiObject -ComputerName $Target Win32_NTEventLogFile
Write-Output "..Event Log Errors"
$WmidtQueryDT = [System.Management.ManagementDateTimeConverter]::ToDmtfDateTime([DateTime]::Now.AddDays(-14))
$colLoggedEvents = Get-WmiObject -computer $Target -query ("Select * from Win32_NTLogEvent Where Type='Error' and TimeWritten >='" + $WmidtQueryDT + "'")
Write-Output "..Event Log Warnings"
$WmidtQueryDT = [System.Management.ManagementDateTimeConverter]::ToDmtfDateTime([DateTime]::Now.AddDays(-14))
$colLoggedEvents = Get-WmiObject -computer $Target -query ("Select * from Win32_NTLogEvent Where Type='Warning' and TimeWritten >='" + $WmidtQueryDT + "'")
$Filename = ".\" + $Target + "_" + $date.Hour + $date.Minute + "_" + $Date.Day + "-" + $Date.Month + "-" + $Date.Year + ".htm"
$Report = @"
Audit
$Target Audit
Version 1.1 by Alan Renouf (Virtu-Al)
Report generated on $Date
| Computer Name |
$($ComputerSystem.Name) |
| Computer Role |
$ComputerRole |
| $CompType |
$($ComputerSystem.Domain) |
| Operating System |
$($OperatingSystems.Caption) |
| Service Pack |
$($OperatingSystems.CSDVersion) |
| System Root |
$($OperatingSystems.SystemDrive) |
| Manufacturer |
$($ComputerSystem.Manufacturer) |
| Model |
$($ComputerSystem.Model) |
| Number of Processors |
$($ComputerSystem.NumberOfProcessors) |
| Memory |
$($ComputerSystem.TotalPhysicalMemory) |
| Registered User |
$($ComputerSystem.PrimaryOwnerName) |
| Registered Organisation |
$($OperatingSystems.Organization) |
| Last System Boot |
$LBTime |
| HotFix Number |
Description |
"@
ForEach ($objQuickFix in $colQuickFixes)
{
if ($objQuickFix.HotFixID -ne "File 1")
{
$Report+= " "
$Report+= " | $($objQuickFix.HotFixID) | "
$Report+= " $($objQuickFix.Description) | "
$Report+= "
"
}
}
$Report+= @"
Logical Disk Configuration
| Drive Letter |
Label |
File System |
Disk Size |
Disk Free Space |
% Free Space |
"@
Foreach ($objDisk in $colDisks)
{
if ($objDisk.DriveType -eq 3)
{
$Report+= " "
$Report+= " | $($objDisk.DeviceID) | "
$Report+= " $($objDisk.VolumeName) | "
$Report+= " $($objDisk.FileSystem) | "
$disksize = [math]::round(($objDisk.size / 1048576))
$Report+= " $disksize MB | "
$freespace = [math]::round(($objDisk.FreeSpace / 1048576))
$Report+= " $Freespace MB | "
$percFreespace=[math]::round(((($objDisk.FreeSpace / 1048576)/($objDisk.Size / 1048676)) * 100),0)
$Report+= " $percFreespace% | "
$Report+= "
"
}
}
$Report+= @"
"@
Foreach ($objAdapter in $colAdapters)
{
if ($objAdapter.IPEnabled -eq "True")
{
$NICCount = $NICCount + 1
If ($NICCount -gt 1)
{
$Report+= "
"
$Report+= "
"
$Report+= "
"
}
$Report+= " "
$Report+= " | Description | "
$Report+= " $($objAdapter.Description) | "
$Report+= "
"
$Report+= " "
$Report+= " | Physical address | "
$Report+= " $($objAdapter.MACaddress) | "
$Report+= "
"
If ($objAdapter.IPAddress -ne $Null)
{
$Report+= " "
$Report+= " | IP Address / Subnet Mask | "
$Report+= " $($objAdapter.IPAddress)/$($objAdapter.IPSubnet) | "
$Report+= "
"
$Report+= " "
$Report+= " "
$Report+= " | Default Gateway | "
$Report+= " $($objAdapter.DefaultIPGateway) | "
$Report+= "
"
}
$Report+= " "
$Report+= " | DHCP enabled | "
If ($objAdapter.DHCPEnabled -eq "True")
{
$Report+= " Yes | "
}
Else
{
$Report+= " No | "
}
$Report+= "
"
$Report+= " "
$Report+= " | DNS Servers | "
$Report+= " "
If ($objAdapter.DNSServerSearchOrder -ne $Null)
{
$Report+= " $($objAdapter.DNSServerSearchOrder) "
}
$Report+= " |
"
$Report+= " "
$Report+= " | Primary WINS Server | "
$Report+= " $($objAdapter.WINSPrimaryServer) | "
$Report+= "
"
$Report+= " "
$Report+= " | Secondary WINS Server | "
$Report+= " $($objAdapter.WINSSecondaryServer) | "
$Report+= "
"
$NICCount = $NICCount + 1
}
}
$Report+= @"
"@
if ((get-wmiobject -namespace "root/cimv2" -list) | ? {$_.name -match "Win32_Product"})
{
Write-Output "..Installed Software"
$colShares = get-wmiobject -ComputerName $Target Win32_Product | select Name,Version,Vendor,InstallDate
$Report+= @"
| Name |
Version |
Vendor |
Install Date |
"@
Foreach ($objShare in $colShares)
{
$Report+= " "
$Report+= " | $($objShare.Name) | "
$Report+= " $($objShare.Version) | "
$Report+= " $($objShare.Vendor) | "
$Report+= " $($objShare.InstallDate) | "
$Report+= "
"
}
$Report+= "
"
$Report+= "
"
$Report+= "
"
$Report+= "
"
$Report+= "
"
}
$Report+= @"
| Share |
Path |
Comment |
"@
Foreach ($objShare in $colShares)
{
$Report+= " "
$Report+= " | $($objShare.Name) | "
$Report+= " $($objShare.Path) | "
$Report+= " $($objShare.Caption) | "
$Report+= "
"
}
$Report+= @"
| Printer |
Location |
Default Printer |
Portname |
"@
Foreach ($objPrinter in $colInstalledPrinters)
{
If ($objPrinter.Name -eq "")
{
$Report+= " "
$Report+= " | No Printers Installed | "
}
Else
{
$Report+= "
"
$Report+= " | $($objPrinter.Name) | "
$Report+= " $($objPrinter.Location) | "
if ($objPrinter.Default -eq "True")
{
$Report+= " Yes | "
}
Else
{
$Report+= " No | "
}
$Report+= " $($objPrinter.Portname) | "
}
$Report+= "
"
}
$Report+= @"
| Name |
Account |
Start Mode |
State |
Expected State |
"@
Foreach ($objService in $colListOfServices)
{
$Report+= " "
$Report+= " | $($objService.Caption) | "
$Report+= " $($objService.Startname) | "
$Report+= " $($objService.StartMode) | "
If ($objService.StartMode -eq "Auto")
{
if ($objService.State -eq "Stopped")
{
$Report+= " $($objService.State) | "
$Report+= " û | "
}
}
If ($objService.StartMode -eq "Auto")
{
if ($objService.State -eq "Running")
{
$Report+= " $($objService.State) | "
$Report+= " ü | "
}
}
If ($objService.StartMode -eq "Disabled")
{
If ($objService.State -eq "Running")
{
$Report+= " $($objService.State) | "
$Report+= " û | "
}
}
If ($objService.StartMode -eq "Disabled")
{
if ($objService.State -eq "Stopped")
{
$Report+= " $($objService.State) | "
$Report+= " ü | "
}
}
If ($objService.StartMode -eq "Manual")
{
$Report+= " $($objService.State) | "
$Report+= " ü | "
}
If ($objService.State -eq "Paused")
{
$Report+= " $($objService.State) | "
$Report+= " ü | "
}
$Report+= "
"
}
$Report+= @"
| Time Zone |
$($TimeZone.Description) |
| Country Code |
$($OperatingSystems.Countrycode) |
| Locale |
$($OperatingSystems.Locale) |
| Operating System Language |
$($OperatingSystems.OSLanguage) |
| Keyboard Layout |
$keyb |
| Log Name |
Overwrite Outdated Records |
Maximum Size |
Current Size |
"@
ForEach ($objLogFile in $colLogfiles)
{
$Report+= " "
$Report+= " | $($objLogFile.LogFileName) | "
If ($objLogfile.OverWriteOutdated -lt 0)
{
$Report+= " Never | "
}
if ($objLogFile.OverWriteOutdated -eq 0)
{
$Report+= " As needed | "
}
Else
{
$Report+= " After $($objLogFile.OverWriteOutdated) days | "
}
$MaxFileSize = ($objLogfile.MaxFileSize) / 1024
$FileSize = ($objLogfile.FileSize) / 1024
$Report+= " $MaxFileSize KB | "
$Report+= " $FileSize KB | "
$Report+= "
"
}
$Report+= @"
| Event Code |
Source Name |
Time |
Log |
Message |
"@
ForEach ($objEvent in $colLoggedEvents)
{
$dtmEventDate = $ObjEvent.ConvertToDateTime($objEvent.TimeWritten)
$Report+= " "
$Report+= " | $($objEvent.EventCode) | "
$Report+= " $($objEvent.SourceName) | "
$Report+= " $dtmEventDate | "
$Report+= " $($objEvent.LogFile) | "
$Report+= " $($objEvent.Message) | "
$Report+= "
"
}
$Report+= @"
| Event Code |
Source Name |
Time |
Log |
Message |
"@
ForEach ($objEvent in $colLoggedEvents)
{
$StrWMIDate = $ObjEvent.ConvertToDateTime($objEvent.TimeWritten)
$Report+= " "
$Report+= " | $($objEvent.EventCode) | "
$Report+= " $($objEvent.SourceName) | "
$Report+= " $($dtmEventDate) | "
$Report+= " $($objEvent.LogFile) | "
$Report+= " $($objEvent.Message) | "
$Report+= "
"
}
$Report+= @"
"@
$Report | out-file -encoding ASCII -filepath $Filename
}