#133728 - 2005-02-13 06:44 PM
Document local security policies
|
Cybex
Getting the hang of it
Registered: 2004-07-21
Posts: 81
Loc: Brandon, FL.
|
Hello all, long time no post.... I have been super busy at work and the birth of our first child as kept me busy at home. Anyway I find myself in need of a quick way to document the local security policies and certain other information on several systems (Win XP & Win2k3). They are not part of a domain, more of a workgroup setting. I know... talk to the engineers not me. Any I am trying to document as much information as I can about each system for a security review process. I have a collection of tools like PSINFO, PSLIST and FPORT to help me along. However if anyone knows a way to pull the info via WMI I would rather script it so I could customize the output. Basically I need to document all open ports, active protocols, currently running processes, and the information listed in the Local Computer Policy MMC snapin "Local Computer Policy\Computer Configuration\security\Windows Settings\Security Settings". If anyone knows hot to enumerate these (security policies) I would appreciate the help in building a script to list them out into a file I can use in final report. Also if there is an easier way or this has already been done please let me know, no since reinventing the wheel. The only thing is that it must be freeware or open source code. I know my company would buy a tool like Hyena, that would make too much sense.
Also if anyone knows anything else I missed that would be good to document for a security report on a system please let me know. I don't want to go overboard like complete file hashes or anything. But information that upon review would show that the proper steps have been taken to secure a box or that they have not been taken. I.e. unnecessary ports have been closed, unnecessary services stopped... You get the idea. Thanks
Cybex
_________________________
Common sense isn't so common.
|
|
Top
|
|
|
|
|
#133729 - 2005-02-13 08:03 PM
Re: Document local security policies
|
NTDOC
Administrator
Registered: 2000-07-28
Posts: 11631
Loc: CA
|
The best thing would to be locally on the box and run Microsoft Baseline Security Analyzer V1.2.1 however if that is not really feasible then at least get temporary admin rights on these systems and scan them remotely with the tool. It will tell and log a boat load of stuff about the systems.
Microsoft Baseline Security Analyzer V1.2.1
http://www.microsoft.com/technet/security/tools/mbsahome.mspx
If you get on the box locally you could also run my Helpdesk script http://www.kixhelp.com/Downloads/MyComputerInfo.zip
You could also mail them the script and have them run it and mail it back to you if wanted.
You could also use a tool like LANGuard Scanner to get back a ton of info about the systems.
Hyena will gather a lot of info as well.
http://www.systemtools.com/
|
|
Top
|
|
|
|
|
#133736 - 2005-02-14 08:58 AM
Re: Document local security policies
|
NTDOC
Administrator
Registered: 2000-07-28
Posts: 11631
Loc: CA
|
Well here is some code to get you started... or to at least give you an idea of one way to do it, there are other ways.
Break On
Dim $SO,$Pause
$SO=SetOption('Explicit','On')
$SO=SetOption('NoVarsInStrings','On')
$SO=SetOption('WrapAtEOL','On')
Dim $Results,$Entry
$Results = ArrayPack(Split(SubStr(Join(wshpipe(@ScriptDir+'\Fport.exe',1),@CRLF),184),@CRLF))
For Each $Entry In $Results
? $Entry
Next
Get $Pause
Function WshPipe($ShellCMD, OPTIONAL $NoEcho)
Dim $oExec, $Output
$oExec = CreateObject("WScript.Shell").Exec($ShellCMD)
If Not VarType($oExec)=9 $WshPipe="WScript.Shell Exec Unsupported" Exit 10 EndIf
$Output = $oExec.StdOut.ReadAll + $oExec.StdErr.ReadAll
If Not $NoEcho $Output Endif
$WshPipe=Split(Join(Split($Output,CHR(13)),CHR(32)),CHR(10))
Exit($oExec.ExitCode)
EndFunction
Function ArrayPack($array)
Dim $loop, $element
Dim $arrTemp[0]
If Not VarType($Array) & 8192 Exit 1 EndIf
$loop = -1
For Each $Element In $Array
If $Element > ' '
$Loop = $Loop + 1
ReDim PreServe $ArrTemp[$Loop]
$ArrTemp[$Loop] = $Element
EndIf
Next
If UBound($ArrTemp) = -1 Exit 2 Endif
$ArrayPack = $ArrTemp
EndFunction
|
|
|
Top
|
|
|
|
|
#133741 - 2005-02-14 09:43 PM
Re: Document local security policies
|
Anonymous
Anonymous
Unregistered
|
You are correct, I was using an older lab system that WSH had been removed from. I have corrected the issue and will attempt to try it again later today.
|
|
Top
|
|
|
|
Moderator: Jochen, Allen, Radimus, Glenn Barnas, ShaneEP, Ruud van Velsen, Arend_, Mart
|
1 registered
(Allen)
and 363 anonymous users online.
|
|
|
Babies are great, they just don't seem to care that you are right in the middle of something. 
