What I'd really like to see is a script that applies standard security fixes, but runs as follows:

1. Can run interactively or silently. I.e. one could prompt a network administrator about which fixes to apply and expect reasonable answers. But for Joe User, just set some default options and go.
2. Allow all fixes to be controlled from one line. Maybe an array of fix names.

For instance, we routinely disable certain extensions via our logon script. However, we want the flexibility to add another extension almost immediately, if necessary. Here is a code fragment just for file extensions:

code:
:SCRIPTFIX
WriteHeader('SCRIPTFIX')
IF @DAY <> 'Thursday' OR @MDayNo <= 24
	Write('INF - This section skipped today.',1)
	RETURN
ENDIF
; Disable/enable various script file associations per security requirements.
$sSwitch   = 'disable'                     ; 'enable' or 'disable' script associations here
$sExt      = 'VBS,WSH'                    ; Valid extension strings: VBS,JS,JSE,VBE,WSH,WSF
Write('INF - ScriptFix setting = '+$sSwitch+' '+$sExt,1)
; The following two settings work for windows 2000 or windows NT only
$sWScript  = '%systemroot%\system32\wscript.exe "%%1" %%*'
$sCScript  = '%systemroot%\system32\cscript.exe "%%1" %%*'
$sRegType  = 'reg_expand_sz'
$sRegKey   = 'HKCR\txtfile\shell\open\command'
IF KeyExist($sRegKey)
	$sTxtFile  = ReadValue($sRegKey,'')
	FOR EACH $Ext IN Split($sExt,',')
		Write('',1)
		Write('INF - Setting up variables to ' + $sSwitch + ' ' + $Ext + ' file extensions.',1)
		$sDscrptn = '.' + LCase($Ext)
		FOR EACH $sCase IN Split('open,open2',',')
			$sRegKey  = 'HKCR\'+LCase($Ext)+'file\shell\'+$sCase+'\command'
			IF InStr($sSwitch,'enab')
				IF $sCase='open' 
					$sEnable=$sWScript 
				ELSE 
					$sEnable=$sCScript
				ENDIF
			ELSE 
				$sEnable  = $sTxtFile
			ENDIF
			IF KeyExist($sRegKey)
				$sRegVal = ReadValue($sRegKey,'')
				IF $sRegVal <> '' ; Registry value returned
					IF $sRegVal = $sEnable
						Write('INF - ' + $sDscrptn+' '+$sCase+' file associations already '+$sSwitch+'d.',1)
					ELSE
						Write('INF - ' + $sDscrptn+' '+$sCase+' file associations need to be '+$sSwitch+'d.',1)
						Write('INF - Reg key is: ' + $sRegKey,1)
						Write('INF - Reg val is: ' + $sRegVal,1)
						Write('INF - Attempting to change value to: '+$sEnable,1)
						IF WriteValue($sRegKey,'',$sEnable,$sRegType)
							IF $iLPriv = 3
								Write('ERR - Unable to set ' + $sDscrptn + ' extensions to use ' + $sEnable,1)
								$iExCode = $iExCode | 65536
							ELSE
								Write('NFE - Unable to set ' + $sDscrptn + ' extensions to use ' + $sEnable,1)
								$iExCode = $iExCode | 512
							ENDIF
						ELSE
							Write('SCC - '+$Ext+' association successfully '+$sSwitch+'d.',1)
							$iExCode = $iExCode | 8
						ENDIF
					ENDIF
				ENDIF
			ELSE
				Write('NFE - ' + $sDscrptn + ' file associations do not appear to be installed on this system.',1)
				$iExCode = $iExCode | 512
			ENDIF
		NEXT
	NEXT
ELSE
	Write('NFE - Registry key ' + $sRegKey + ' not found.',1)
	$iExCode = $iExCode | 512
ENDIF
RETURN
New Mexico Mark