##################################################### # # # Audit script by Alan Renouf - Virtu-Al # # Blog: http://teckinfo.blogspot.com/ # # # # Usage: Audit.ps1 'pathtolistofservers' # # # # The file is optional and needs to be a # # plain text list of computers to be audited # # one on each line. # # # ##################################################### param( [string] $auditlist) if ($auditlist -eq ""){ Write-Host "No list specified, using $env:computername" $targets = $env:computername } else { if ((Test-Path $auditlist) -eq $false) { Write-Host "Invalid audit path specified: $auditlist" exit } else { Write-Host "Using Audit list: $auditlist" $Targets = Get-Content $auditlist } } $Date = Get-Date Foreach ($Target in $Targets){ Write-Output "Collating Detail for $Target" $ComputerSystem = Get-WmiObject -computername $Target Win32_ComputerSystem switch ($ComputerSystem.DomainRole){ 0 { $ComputerRole = "Standalone Workstation" } 1 { $ComputerRole = "Member Workstation" } 2 { $ComputerRole = "Standalone Server" } 3 { $ComputerRole = "Member Server" } 4 { $ComputerRole = "Domain Controller" } 5 { $ComputerRole = "Domain Controller" } default { $ComputerRole = "Information not available" } } $OperatingSystems = Get-WmiObject -computername $Target Win32_OperatingSystem $TimeZone = Get-WmiObject -computername $Target Win32_Timezone $Keyboards = Get-WmiObject -computername $Target Win32_Keyboard $SchedTasks = Get-WmiObject -computername $Target Win32_ScheduledJob $BootINI = $OperatingSystems.SystemDrive + "boot.ini" $RecoveryOptions = Get-WmiObject -computername $Target Win32_OSRecoveryConfiguration switch ($ComputerRole){ "Member Workstation" { $CompType = "Computer Domain"; break } "Domain Controller" { $CompType = "Computer Domain"; break } "Member Server" { $CompType = "Computer Domain"; break } default { $CompType = "Computer Workgroup"; break } } $LBTime=$OperatingSystems.ConvertToDateTime($OperatingSystems.Lastbootuptime) Write-Output "..Hotfix Information" $colQuickFixes = Get-WmiObject Win32_QuickFixEngineering Write-Output "..Logical Disks" $colDisks = Get-WmiObject -ComputerName $Target Win32_LogicalDisk Write-Output "..Network Configuration" $NICCount = 0 $colAdapters = Get-WmiObject -ComputerName $Target Win32_NetworkAdapterConfiguration Write-Output "..Local Shares" $colShares = Get-wmiobject -ComputerName $Target Win32_Share Write-Output "..Printers" $colInstalledPrinters = Get-WmiObject -ComputerName $Target Win32_Printer Write-Output "..Services" $colListOfServices = Get-WmiObject -ComputerName $Target Win32_Service Write-Output "..Regional Options" $ObjKeyboards = Get-WmiObject -ComputerName $Target Win32_Keyboard $keyboardmap = @{ "00000402" = "BG" "00000404" = "CH" "00000405" = "CZ" "00000406" = "DK" "00000407" = "GR" "00000408" = "GK" "00000409" = "US" "0000040A" = "SP" "0000040B" = "SU" "0000040C" = "FR" "0000040E" = "HU" "0000040F" = "IS" "00000410" = "IT" "00000411" = "JP" "00000412" = "KO" "00000413" = "NL" "00000414" = "NO" "00000415" = "PL" "00000416" = "BR" "00000418" = "RO" "00000419" = "RU" "0000041A" = "YU" "0000041B" = "SL" "0000041C" = "US" "0000041D" = "SV" "0000041F" = "TR" "00000422" = "US" "00000423" = "US" "00000424" = "YU" "00000425" = "ET" "00000426" = "US" "00000427" = "US" "00000804" = "CH" "00000809" = "UK" "0000080A" = "LA" "0000080C" = "BE" "00000813" = "BE" "00000816" = "PO" "00000C0C" = "CF" "00000C1A" = "US" "00001009" = "US" "0000100C" = "SF" "00001809" = "US" "00010402" = "US" "00010405" = "CZ" "00010407" = "GR" "00010408" = "GK" "00010409" = "DV" "0001040A" = "SP" "0001040E" = "HU" "00010410" = "IT" "00010415" = "PL" "00010419" = "RU" "0001041B" = "SL" "0001041F" = "TR" "00010426" = "US" "00010C0C" = "CF" "00010C1A" = "US" "00020408" = "GK" "00020409" = "US" "00030409" = "USL" "00040409" = "USR" "00050408" = "GK" } $keyb = $keyboardmap.$($ObjKeyboards.Layout) if (!$keyb) { $keyb = "Unknown" } Write-Output "..Event Log Settings" $colLogFiles = Get-WmiObject -ComputerName $Target Win32_NTEventLogFile Write-Output "..Event Log Errors" $WmidtQueryDT = [System.Management.ManagementDateTimeConverter]::ToDmtfDateTime([DateTime]::Now.AddDays(-14)) $colLoggedEvents = Get-WmiObject -computer $Target -query ("Select * from Win32_NTLogEvent Where Type='Error' and TimeWritten >='" + $WmidtQueryDT + "'") Write-Output "..Event Log Warnings" $WmidtQueryDT = [System.Management.ManagementDateTimeConverter]::ToDmtfDateTime([DateTime]::Now.AddDays(-14)) $colLoggedEvents = Get-WmiObject -computer $Target -query ("Select * from Win32_NTLogEvent Where Type='Warning' and TimeWritten >='" + $WmidtQueryDT + "'") $Filename = ".\" + $Target + "_" + $date.Hour + $date.Minute + "_" + $Date.Day + "-" + $Date.Month + "-" + $Date.Year + ".htm" $Report = @" Audit

$Target Audit


Version 1.1 by Alan Renouf (Virtu-Al)
Report generated on $Date

$target Details
General
Computer Name $($ComputerSystem.Name)
Computer Role $ComputerRole
$CompType $($ComputerSystem.Domain)
Operating System $($OperatingSystems.Caption)
Service Pack $($OperatingSystems.CSDVersion)
System Root $($OperatingSystems.SystemDrive)
Manufacturer $($ComputerSystem.Manufacturer)
Model $($ComputerSystem.Model)
Number of Processors $($ComputerSystem.NumberOfProcessors)
Memory $($ComputerSystem.TotalPhysicalMemory)
Registered User $($ComputerSystem.PrimaryOwnerName)
Registered Organisation $($OperatingSystems.Organization)
Last System Boot $LBTime
HotFixes
"@ ForEach ($objQuickFix in $colQuickFixes) { if ($objQuickFix.HotFixID -ne "File 1") { $Report+= " " $Report+= " " $Report+= " " $Report+= " " } } $Report+= @"
HotFix Number Description
$($objQuickFix.HotFixID)$($objQuickFix.Description)
Logical Disk Configuration
"@ Foreach ($objDisk in $colDisks) { if ($objDisk.DriveType -eq 3) { $Report+= " " $Report+= " " $Report+= " " $Report+= " " $disksize = [math]::round(($objDisk.size / 1048576)) $Report+= " " $freespace = [math]::round(($objDisk.FreeSpace / 1048576)) $Report+= " " $percFreespace=[math]::round(((($objDisk.FreeSpace / 1048576)/($objDisk.Size / 1048676)) * 100),0) $Report+= " " $Report+= " " } } $Report+= @"
Drive Letter Label File System Disk Size Disk Free Space % Free Space
$($objDisk.DeviceID)$($objDisk.VolumeName)$($objDisk.FileSystem)$disksize MB$Freespace MB$percFreespace%
NIC Configuration
"@ Foreach ($objAdapter in $colAdapters) { if ($objAdapter.IPEnabled -eq "True") { $NICCount = $NICCount + 1 If ($NICCount -gt 1) { $Report+= "
" $Report+= "
" $Report+= " " } $Report+= " " $Report+= " " $Report+= " " $Report+= " " $Report+= " " $Report+= " " $Report+= " " $Report+= " " If ($objAdapter.IPAddress -ne $Null) { $Report+= " " $Report+= " " $Report+= " " $Report+= " " $Report+= " " $Report+= " " $Report+= " " $Report+= " " $Report+= " " } $Report+= " " $Report+= " " If ($objAdapter.DHCPEnabled -eq "True") { $Report+= " " } Else { $Report+= " " } $Report+= " " $Report+= " " $Report+= " " $Report+= " " $Report+= " " $Report+= " " $Report+= " " $Report+= " " $Report+= " " $Report+= " " $Report+= " " $Report+= " " $NICCount = $NICCount + 1 } } $Report+= @"
Description$($objAdapter.Description)
Physical address$($objAdapter.MACaddress)
IP Address / Subnet Mask$($objAdapter.IPAddress)/$($objAdapter.IPSubnet)
Default Gateway$($objAdapter.DefaultIPGateway)
DHCP enabledYesNo
DNS Servers" If ($objAdapter.DNSServerSearchOrder -ne $Null) { $Report+= " $($objAdapter.DNSServerSearchOrder) " } $Report+= "
Primary WINS Server$($objAdapter.WINSPrimaryServer)
Secondary WINS Server$($objAdapter.WINSSecondaryServer)
"@ if ((get-wmiobject -namespace "root/cimv2" -list) | ? {$_.name -match "Win32_Product"}) { Write-Output "..Installed Software" $colShares = get-wmiobject -ComputerName $Target Win32_Product | select Name,Version,Vendor,InstallDate $Report+= @"
Software
"@ Foreach ($objShare in $colShares) { $Report+= " " $Report+= " " $Report+= " " $Report+= " " $Report+= " " $Report+= " " } $Report+= "
Name Version Vendor Install Date
$($objShare.Name)$($objShare.Version)$($objShare.Vendor)$($objShare.InstallDate)
" $Report+= "
" $Report+= "
" $Report+= "
" $Report+= "
" } $Report+= @"
Local Shares
"@ Foreach ($objShare in $colShares) { $Report+= " " $Report+= " " $Report+= " " $Report+= " " $Report+= " " } $Report+= @"
Share Path Comment
$($objShare.Name)$($objShare.Path)$($objShare.Caption)
Printers
"@ Foreach ($objPrinter in $colInstalledPrinters) { If ($objPrinter.Name -eq "") { $Report+= " " $Report+= " " } Else { $Report+= " " $Report+= " " $Report+= " " if ($objPrinter.Default -eq "True") { $Report+= " " } Else { $Report+= " " } $Report+= " " } $Report+= " " } $Report+= @"
Printer Location Default Printer Portname
No Printers Installed
$($objPrinter.Name)$($objPrinter.Location)YesNo$($objPrinter.Portname)
Services
"@ Foreach ($objService in $colListOfServices) { $Report+= " " $Report+= " " $Report+= " " $Report+= " " If ($objService.StartMode -eq "Auto") { if ($objService.State -eq "Stopped") { $Report+= " " $Report+= " " } } If ($objService.StartMode -eq "Auto") { if ($objService.State -eq "Running") { $Report+= " " $Report+= " " } } If ($objService.StartMode -eq "Disabled") { If ($objService.State -eq "Running") { $Report+= " " $Report+= " " } } If ($objService.StartMode -eq "Disabled") { if ($objService.State -eq "Stopped") { $Report+= " " $Report+= " " } } If ($objService.StartMode -eq "Manual") { $Report+= " " $Report+= " " } If ($objService.State -eq "Paused") { $Report+= " " $Report+= " " } $Report+= " " } $Report+= @"
Name Account Start Mode State Expected State
$($objService.Caption)$($objService.Startname)$($objService.StartMode)$($objService.State)û$($objService.State)ü$($objService.State)û$($objService.State)ü$($objService.State)ü$($objService.State)ü
Regional Settings
Time Zone $($TimeZone.Description)
Country Code $($OperatingSystems.Countrycode)
Locale $($OperatingSystems.Locale)
Operating System Language $($OperatingSystems.OSLanguage)
Keyboard Layout $keyb
Event Logs
Event Log Settings
"@ ForEach ($objLogFile in $colLogfiles) { $Report+= " " $Report+= " " If ($objLogfile.OverWriteOutdated -lt 0) { $Report+= " " } if ($objLogFile.OverWriteOutdated -eq 0) { $Report+= " " } Else { $Report+= " " } $MaxFileSize = ($objLogfile.MaxFileSize) / 1024 $FileSize = ($objLogfile.FileSize) / 1024 $Report+= " " $Report+= " " $Report+= " " } $Report+= @"
Log Name Overwrite Outdated Records Maximum Size Current Size
$($objLogFile.LogFileName)NeverAs neededAfter $($objLogFile.OverWriteOutdated) days$MaxFileSize KB$FileSize KB
ERROR Entries
"@ ForEach ($objEvent in $colLoggedEvents) { $dtmEventDate = $ObjEvent.ConvertToDateTime($objEvent.TimeWritten) $Report+= " " $Report+= " " $Report+= " " $Report+= " " $Report+= " " $Report+= " " $Report+= " " } $Report+= @"
Event Code Source Name Time Log Message
$($objEvent.EventCode)$($objEvent.SourceName)$dtmEventDate$($objEvent.LogFile)$($objEvent.Message)
WARNING Entries
"@ ForEach ($objEvent in $colLoggedEvents) { $StrWMIDate = $ObjEvent.ConvertToDateTime($objEvent.TimeWritten) $Report+= " " $Report+= " " $Report+= " " $Report+= " " $Report+= " " $Report+= " " $Report+= " " } $Report+= @"
Event Code Source Name Time Log Message
$($objEvent.EventCode)$($objEvent.SourceName)$($dtmEventDate)$($objEvent.LogFile)$($objEvent.Message)
"@ $Report | out-file -encoding ASCII -filepath $Filename }