Welcome pepafuqi..,

Maybe this will help:

code:
 CLS BREAK ON
 SHELL 'CMD /X/C "net view > @CURDIR\NeTvIeW.dat"'
 SHELL 'CMD /X/C "sort < @CURDIR\NeTvIeW.dat > @CURDIR\AcTiVeWoRkStAtIoNs.dat"'
 MD "@CURDIR\Dat"
 DEL "@CURDIR\NeTvIeW.dat"
 DEL "@CURDIR\Dat\*.dat"
 $NULL=OPEN(1,"@CURDIR\AcTiVeWoRkStAtIoNs.dat")
 $Check1=CHR(34)+"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters"+CHR(34)
 $Check2=CHR(34)+"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters"+CHR(34)
 WHILE INSTR("$LINE1","\\")=0
  $LINE1=READLINE(1)
 LOOP
 CLS
 WHILE @ERROR=0 AND INSTR("$LINE1","\\")<>0
  $WKSTA1=RTRIM(SUBSTR($LINE1,3,16))
  ? "Checking Workstation : "+$WKSTA1+" ProcesCode : "
  SHELL 'CMD /X/C "reg query $Check1 \\$WKSTA1 > @CURDIR\dat\$WKSTA1.dat"'
  SHELL 'CMD /X/C "reg query $Check2 \\$WKSTA1 >> @CURDIR\dat\$WKSTA1.dat"'
  $LINE1=READLINE(1) " Done !!"
 LOOP
 GOTO End
 
:End
 DEL "@CURDIR\AcTiVeWoRkStAtIoNs.dat"
 $NULL=CLOSE(1)
 $NULL=CLOSE(2)

The reg.exe is part of the NTResKit.
This the content os a <hostname>.dat file
code:
Connecting to remote machine \\<hostname>
Listing of [SYSTEM\CurrentControlSet\Services\Tcpip\Parameters]
EXPAND_SZ	DataBasePath	%SystemRoot%\System32\drivers\etc
REG_SZ   	Domain	<somewher>.<inthe>.<world>.com
REG_SZ   	Hostname	<hostname>
REG_SZ   	NameServer	<IP Primary DNS> <IP Secondary DNS>
REG_DWORD	ForwardBroadcasts	0
REG_DWORD	IPEnableRouter	0
REG_SZ   	SearchList	
REG_DWORD	EnableSecurityFilters	0
[PersistentRoutes]
[Winsock]
Connecting to remote machine \\<hostname>
Listing of [SYSTEM\CurrentControlSet\Services\NetBT\Parameters]
REG_SZ   	NbProvider	_tcp
REG_DWORD	NameServerPort	137
REG_DWORD	EnableLMHOSTS	1
REG_DWORD	EnableProxy	0
REG_DWORD	EnableDNS	0
REG_DWORD	CacheTimeout	600000
REG_DWORD	BcastNameQueryCount	3
REG_DWORD	BcastQueryTimeout	750
REG_DWORD	NameSrvQueryCount	3
REG_DWORD	NameSrvQueryTimeout	1500
REG_DWORD	Size/Small/Medium/Large	1
REG_DWORD	SessionKeepAlive	3600000
REG_SZ   	ScopeID	
REG_SZ   	TransportBindName	\Device\

If you subsequencally open these files to search for certain keys you could get a lot of info.

Could you specify what you exactly need to audit.. maybe we could be more helpfull

------------------
To Be Of Service..,
Fabian.
-----------------Paranoia is reality on a finer scale-----------------