#137286 - 2005-04-06 08:44 PM
cheking System rights (revisited)
|
burnsc
Starting to like KiXtart
Registered: 2004-04-14
Posts: 171
|
I still need a way to check the system rights via script (seInteractiveLogon) etc..
I tried placeing something up on this last year, but never really got anywhere on it. Anyone have any ideas?
At its best this script needs to walk all machines in an OU and read the rights from it. And dump them to a flat file so that I can review the rights.
It gets tedious to Audit 400+ machines by hand. 
|
|
Top
|
|
|
|
|
#137287 - 2005-04-06 08:54 PM
Re: cheking System rights (revisited)
|
Howard Bullock
KiX Supporter
Registered: 2000-09-15
Posts: 5809
Loc: Harrisburg, PA USA
|
To make life easier, i could look into adding the following functions into my Win32Admin.DLL ( http://home.comcast.net/~habullock/kix_solutions.htm ) to assist you.
LsaEnumerateAccountsWithUserRight($server, $privilege, \@sids)
Enums all accounts granted the SeNetworkLogonRight privilege on server \\testserver.
LsaEnumerateAccountRights($server, $sid, \@privileges)
Enumerates all privileges granted to the account testuser on server \\testserver.
|
|
Top
|
|
|
|
|
#137288 - 2005-04-06 08:55 PM
Re: cheking System rights (revisited)
|
NTDOC
Administrator
Registered: 2000-07-28
Posts: 11634
Loc: Space
|
Maybe use DUMPSEC from here
http://www.somarsoft.com/somarsoft_main.htm
along with some other UDFs as required/needed.
Without more specific details it's rather difficult to assist you further.
Maybe used in conjuntion with scheduled tasks or remoteexec
http://www.kixtart.org/ubbthreads/showflat.php?Cat=&Number=83206
NET VIEW to get a list of computers in the domain or an ADSI query against a specific OU then maybe ping them to make sure there online, then run remote scripts against them.
|
|
Top
|
|
|
|
|
#137289 - 2005-04-06 08:59 PM
Re: cheking System rights (revisited)
|
Howard Bullock
KiX Supporter
Registered: 2000-09-15
Posts: 5809
Loc: Harrisburg, PA USA
|
|
|
Top
|
|
|
|
#137290 - 2005-04-06 09:19 PM
Re: cheking System rights (revisited)
|
burnsc
Starting to like KiXtart
Registered: 2004-04-14
Posts: 171
|
The biggest thing I need to do is Audit complience with a standard. I can theoretically check it against our standard in the code and report just non-compliance, but I need documentation that it is complient as well. So I will most likely report it out saying the string that is returned as well as a field saying 'complient' as 'yes/no'.
So basicly I will be:
1) getting a list of machines on the domain
2) enterateing through that list to check each right on each machine.
3) compare that right to a 'standard' (this step MAY involve resolving SIDs). Set the variable reporting complience.
4) Save the report out. Dont know what format I am going to prefer here yet, excel or flat-text.
I must admit that I am not as brushed up on my ADSI as I should be. Could you give me an example of an ADSI Query that would return the machines in a specific OU (my OU is 4 layers from the root).
I would rather the script remotely get the information if possible. If I cant then I will most likely launch it using a schedule and 'last ran' indicator in the machines registry as I do this quarterly.
|
|
Top
|
|
|
|
|
#137291 - 2005-04-06 09:25 PM
Re: cheking System rights (revisited)
|
Howard Bullock
KiX Supporter
Registered: 2000-09-15
Posts: 5809
Loc: Harrisburg, PA USA
|
|
|
Top
|
|
|
|
|
#137292 - 2005-04-06 10:53 PM
Re: cheking System rights (revisited)
|
burnsc
Starting to like KiXtart
Registered: 2004-04-14
Posts: 171
|
OK ... stupid question ... I cant get my mind in gear here
tree
|-OU1
| |-OU2
| |-OU 3
how would this be written in LDAP?
I placed a shot at LDAP://tree/DC=OU1/DC=OU2/DC=OU 3, DC=timken, DC=com. This gave me nothing. Where am I wrong.
|
|
Top
|
|
|
|
|
#137293 - 2005-04-06 11:07 PM
Re: cheking System rights (revisited)
|
Howard Bullock
KiX Supporter
Registered: 2000-09-15
Posts: 5809
Loc: Harrisburg, PA USA
|
$LDAPstring = "LDAP://domainname/OU=OU1,DC=timken,DC=com"
enumerates everything in the OU1 OU
$LDAPstring = "LDAP://domainname/OU=OU2,OU=OU1,DC=timken,DC=com"
enumerates everything in the OU2 OU.
should be right.
|
|
Top
|
|
|
|
|
#137294 - 2005-04-06 11:30 PM
Re: cheking System rights (revisited)
|
burnsc
Starting to like KiXtart
Registered: 2004-04-14
Posts: 171
|
how would the space in OU3 be handled. I have a feeling this will cause a parseing problem if not handled in some manner.
Thanks
|
|
Top
|
|
|
|
|
#137295 - 2005-04-06 11:47 PM
Re: cheking System rights (revisited)
|
Howard Bullock
KiX Supporter
Registered: 2000-09-15
Posts: 5809
Loc: Harrisburg, PA USA
|
$LDAPstring = "LDAP://domainname/OU=OU 3,OU=OU1,DC=timken,DC=com" should be ok.
|
|
Top
|
|
|
|
|
#137296 - 2005-04-07 12:24 AM
Re: cheking System rights (revisited)
|
NTDOC
Administrator
Registered: 2000-07-28
Posts: 11634
Loc: Space
|
Download and install KiXforms from here
KiXforms Website
Then copy and run this script from Chris S.
It will allow you to copy the correct OU pathing to use in your script
KiXforms - Active Directory Browser
|
|
Top
|
|
|
|
|
#137297 - 2005-04-07 01:38 AM
Re: cheking System rights (revisited)
|
Howard Bullock
KiX Supporter
Registered: 2000-09-15
Posts: 5809
Loc: Harrisburg, PA USA
|
The Translatename() UDF can also get you the DN for a user or computer.
|
|
Top
|
|
|
|
|
#137298 - 2005-04-07 01:56 AM
Re: cheking System rights (revisited)
|
NTDOC
Administrator
Registered: 2000-07-28
Posts: 11634
Loc: Space
|
Yeah, but you still need to read and semi-understand what the UDF wants for parameters 
The KiXform Chris wrote needs no modification or input that I recall. Just run it, browse and copy the path anywhere you're at.
However, your UDF does work as well so that gives at least two methods to retrieve back the correct path.
|
|
Top
|
|
|
|
Moderator: Arend_, Allen, Jochen, Radimus, Glenn Barnas, ShaneEP, Ruud van Velsen, Mart
|
0 registered
and 1046 anonymous users online.
|
|
|
