skrypt audytujący

zadanie – jak zaudytować komputery poza domeną tak, aby stwierdzić jakie są na nich aplikacje i jakie licencje? prostym zapytaniem WMI można dowiedzieć się, że wersja systemu to np. WinXP pro – ale OEM czy VLK?

nie udało mi się dotrzeć do samych linków na MSDN ale udało mi się zebrać te informacje. kilka ogólnych:

• MAP toola nie da się użyć często ze względu na niedostępność komputerów a czasem credentiali. niestety takie środowiska są i to wcale nie tak rzadkie jakby się mogło wydawać…
• wersję licencji OEM/VLK/MAK można wyciągnąć np. przy pomocy slmgr.vbs … ale tego nie ma na XP. poza tym lepiej mieć to we własnym skrypcie. kluczem jest „HKLM\SYSTEM\Setup\Pid”. w skrypcie poniżej pokazuję konkretne wartości.
• można nawet dowiedzieć się jaka to wersja na podstawie innego klucza – ale pełnej listy nie mam.
• korzystanie z metody Win32_product nie jest wskazane ponieważ każde takie odpytanie automatycznie uruchamia proces weryfikacji. trwa długo i może doprowadzić do dziwnych komunikatów – ogólnie wysypać się. dodatkowo – klasa PRODUCT nie jest standardowo instalowana na wersji XP /: trzeba ją oddzielnie dodać. lepiej skorzystać z zapytania do rejestru.
• odpytując rejestr na 64 bitowej maszynie musimy zrobić dwa zapytania, zmieniając providera – inaczej dostaniemy tylko małą część aplikacji zainstalowanych.
• do bardziej skomplikowanych operacji oraz bardziej wymyślny skrypt -> open audit

a poniżej kod. oczywiście w VBS ponieważ to jedyny 'standard’ który zadziała na każdej wersji od w2k aż po dzisiejsze w8.1

ON ERROR RESUME NEXT

Sub GetApps
  ' Use ExecMethod to call the GetStringValue method
  Set Inparams = objStdRegProv.Methods_("EnumKey").Inparameters
  Inparams.Hdefkey = HKLM
  Inparams.Ssubkeyname = "Software\Microsoft\Windows\CurrentVersion\Uninstall\"

  set Outparams = objStdRegProv.ExecMethod_("EnumKey", Inparams,,objCtx)

  For Each strSubKey In Outparams.snames

    Set Inparams = objStdRegProv.Methods_("GetStringValue").Inparameters
    Inparams.Hdefkey = HKLM
    Inparams.Ssubkeyname = strKey & strSubKey

    Inparams.Svaluename = "DisplayName"
    rkDisplayName=""
    set Outparams = objStdRegProv.ExecMethod_("GetStringValue", Inparams,,objCtx)
    if ("" & Outparams.sValue) <> "" then
      rkDisplayName=Outparams.SValue
    End iF

    Inparams.Svaluename = "Publisher"
    rkPublisher=""
    set Outparams = objStdRegProv.ExecMethod_("GetStringValue", Inparams,,objCtx)
    if ("" & Outparams.sValue) <> "" then
      rkPublisher=Outparams.SValue
    End iF

    'Set Inparams = objStdRegProv.Methods_("GetDWORDValue").Inparameters
    Inparams.Svaluename = "VersionMajor"
    rkVersionMajor=""
    set Outparams = objStdRegProv.ExecMethod_("GetDWORDValue", Inparams,,objCtx)
    if ("" & Outparams.uValue) <> "" then
      rkVersionMajor=Outparams.uValue
    End iF

    Inparams.Svaluename = "VersionMinor"
    rkVersionMinor=""
    set Outparams = objStdRegProv.ExecMethod_("GetDWORDValue", Inparams,,objCtx)
    if ("" & Outparams.uValue) <> "" then
      rkVersionMinor=Outparams.uValue
    End iF

    if rkDisplayName<>"" and inStr(lcase(rkDisplayName),"update")=0 and inStr(lcase(rkDisplayName),"hotfix")=0 then
      logFile.writeLine rkDisplayName&";"&rkPublisher&";"&rkVersionMajor&"."&rkVersionMinor
    end if

  next
end sub

function getPID
  set licTypes=CreateObject("Scripting.Dictionary")
  licTypes.add "007","retail"
  licTypes.add "011","upgrade"
  licTypes.add "OEM","OEM"
  licTypes.add "270","Volume License"
  licTypes.add "335","Retail"
  licTypes.add "640","Volume License"
  licTypes.add "648","Academic"
  set productIDs=CreateObject("Scripting.Dictionary")
  productIDs.add "007","VLK MAK"
  productIDs.add "033","Retail Windows 7 Home Premium"
  productIDs.add "049","VLK MAK"
  productIDs.add "050","Technet Plus Enterprise MAK"
  productIDs.add "065","Technet/MSDN/Bizspark Windows 7 Ultimate"
  productIDs.add "066","Technet/MSDN/Bizspark Windows 7 Ultimate"
  productIDs.add "067","Technet/MSDN/Bizspark Windows 7 Ultimate"
  productIDs.add "074","Retail Windows 7 Ultimate"
  productIDs.add "112","Retail Windows 7 Home Premium (conflicting info says MSDN)"
  productIDs.add "177","Retail Windows 7 Professional"
  productIDs.add "220","Technet/MSDN/Bizspark Windows 7 Professional"
  productIDs.add "230","Technet/MSDN/Bizspark Windows 7 Home Premium"
  productIDs.add "231","Technet/MSDN/Bizspark Windows 7 Home Premium"
  productIDs.add "292","Retail Windows 7 Ultimate?"
  productIDs.add "293","Retail Windows 7 Ultimate? (maybe Academic)"
  productIDs.add "339","Retail Windows 7 Home Basic"
  productIDs.add "838","Technet/MSDN/Bizspark Windows 7 Professional"
  productIDs.add "896","Retail Windows 7 Home Basic N"
  productIDs.add "929","Retail Windows 7 Home Basic E"
  productIDs.add "956","Retail Windows 7 Ultimate"

  Set Inparams = objStdRegProv.Methods_("GetStringValue").Inparameters
  Inparams.Ssubkeyname = "SYSTEM\Setup\Pid\"
  Inparams.Hdefkey = HKLM
  Inparams.Svaluename = "Pid"
  set Outparams = objStdRegProv.ExecMethod_("GetStringValue", Inparams,,objCtx)
  if ("" & Outparams.sValue) <> "" then
    rkPID=Outparams.SValue
  else
    rkPID="ERROR GETTING LICENCE TYPE"
  End iF
  for each lt in licTypes
    if strcomp(right(rkPID,3),lt)=0 then
      rkPID=rkPID&" "&licTypes.item(lt)
    end if
  next
  getPID=rkPID
end Function

sub runAddonScript
  logFile.writeLine vBCRLF&"RUNNING ADD-ON scripts.vbs"
  logFile.Close
  INV_SCRIPT = tpath&"\inw.cmd"
  set invScript=fso.CreateTextFile(INV_SCRIPT)

  if not isNull(runVBS) then invScript.writeLine runVBS
  if not isNull(runOffice) then invScript.writeLine runOffice

  invScript.close
  oShell.run INV_SCRIPT,7,true
  fso.DeleteFile INV_SCRIPT
end sub

Const HKLM = &H80000002 'HKEY_LOCAL_MACHINE
strComputer = "."
strKey = "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\"

set fso=CreateObject("Scripting.FileSystemObject")
set oShell=CreateObject("WScript.Shell")
set oEnv=oShell.environment("process")
set oNet=WScript.CreateObject("WScript.Network")
set computerInfo=CreateObject("Scripting.Dictionary")
set softwareInfo=CreateObject("Scripting.Dictionary")

'LOG FILE'
tpath=oEnv.item("userprofile")
LOGFILE_NAME = tpath&"\"&oNet.computerName&"-inventory.log"
set logFile=fso.CreateTextFile(LOGFILE_NAME)

logfile.writeLine "USER INFO"
logFile.writeLine oNet.userdomain&";"&oNet.username&vbCrLf

'INVENTARYZACJA hardware'
logFile.writeLine "HARDWARE INFO"&vbCrLf
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
if err.number<>0 then
  logFile.writeLine "error opening WMI "&cstr(hex(err.number))
  finish
end if

'get processor architecture
vArch=oEnv("PROCESSOR_ARCHITECTURE")
logFile.writeLine "Architecture;"&vArch
Set colItems = objWMIService.ExecQuery("Select caption, domain, manufacturer, model, name, numberofprocessors, roles, totalphysicalmemory from Win32_ComputerSystem",,48)
For Each objItem in colItems
    computerInfo.add "name", objItem.Name
    computerInfo.add "domain",objItem.Domain
    computerInfo.add "manufacturer",objItem.Manufacturer
    computerInfo.add "model",objItem.Model
    computerInfo.add "numberOfProcessors",objItem.NumberOfProcessors
    computerInfo.add "roles", join(objItem.roles,", ")
    computerInfo.add "totalPhysicalMemory",cstr( formatnumber( cdbl(objItem.TotalPhysicalMemory)/1024/1024,0) )&" MB"
Next
set colItems = objWMIService.ExecQuery("select SerialNumber from Win32_SystemEnclosure")
For Each objItem in colItems
  computerInfo.add "SerialNumber",objItem.SerialNumber
next
Set colItems = objWMIService.ExecQuery("select otherTypeDescription, buildnumber, caption, csdversion, systemdirectory, systemdrive from Win32_OperatingSystem")
For Each objItem in colItems
  computerInfo.add "caption",objItem.caption&" "&objItem.otherTypeDescription&" "&objItem.CSDVersion
  computerInfo.add "buildnumber",objItem.buildNumber
  computerInfo.add "SystemDrive",objItem.SystemDrive
  computerInfo.add "SystemDirectory",objItem.SystemDirectory
next

for each ci in computerInfo
  logFile.writeLine ci & ";" & computerInfo.item(ci)
next
logFile.writeLine

'INVENTARYZAJCA SOFTWARE'

logFile.writeline "Installed Applications" & VbCrLf
logFile.writeLine "Display Name;Publisher;Version"
err.clear
Set objCtx = CreateObject("WbemScripting.SWbemNamedValueSet")
objCtx.Add "__ProviderArchitecture", 32
objCtx.Add "__RequiredArchitecture", TRUE
Set objLocator = CreateObject("Wbemscripting.SWbemLocator")
Set objServices = objLocator.ConnectServer("","root\default","","",,,,objCtx)
Set objStdRegProv = objServices.Get("StdRegProv")
if err.number<>0 then
  logFile.writeLine "error getting registry "&cstr(hex(err.number))
  finish
end if

getApps

if instr(vArch,"64")>1 then
  objCtx.Add "__ProviderArchitecture", 64
  objCtx.Add "__RequiredArchitecture", TRUE
  Set objLocator = CreateObject("Wbemscripting.SWbemLocator")
  Set objServices = objLocator.ConnectServer("","root\default","","",,,,objCtx)
  Set objStdRegProv = objServices.Get("StdRegProv")
  getApps
end if

logFile.writeLine "WINDOWS LICENCE TYPE: "&getPID

'prepare to launch slmgr'
runOffice=null
runVBS=null
if fso.FileExists("C:\Windows\system32\slmgr.vbs") then runVBS="cscript C:\Windows\system32\slmgr.vbs /dlv >>"&LOGFILE_NAME

voffice="C:\Program Files (x86)\Microsoft Office\Office15\ospp.vbs"
if fso.FileExists(voffice) then
   runOffice= """"&voffice&""" /dstatus >>"&LOGFILE_NAME
end if
voffice="C:\Program Files\Microsoft Office\Office15\ospp.vbs"
if fso.FileExists(voffice) then
   runOffice= """"&voffice&""" /dstatus >>"&LOGFILE_NAME
end if
voffice="C:\Program Files (x86)\Microsoft Office\Office14\ospp.vbs"
if fso.FileExists(voffice) then
   runOffice= """"&voffice&""" /dstatus >>"&LOGFILE_NAME
end if
voffice="C:\Program Files\Microsoft Office\Office14\ospp.vbs"
if fso.FileExists(voffice) then
   runOffice= "cscript """&voffice&""" /dstatus >>"&LOGFILE_NAME
end if

if not isNull(runVBS) or not isNull(runOffice) then
  runAddonScript
end if

eN.