Open-AudIT

What's on your network?
It is currently Thu Jan 18, 2018 5:48 am

All times are UTC + 10 hours




Post new topic Reply to topic  [ 14 posts ] 
Author Message
PostPosted: Wed Feb 15, 2012 8:46 am 
Offline
Newbie

Joined: Wed Feb 15, 2012 1:15 am
Posts: 13
Location: Belgium
Hello,

Now I'm trying OAv2 with xampp on Windows 7 for auditing my network, but I can't seem to audit remote windows computers that are not part of a domain (audit by ip-range)

How do I do that? What script to use? (cfr. nmap.vbs & audit.config in OA)

thanks,
wouter.


Top
 Profile  
Reply with quote  
PostPosted: Wed Feb 15, 2012 8:54 pm 
Offline
Site Admin
User avatar

Joined: Mon Jun 07, 2004 11:48 am
Posts: 1933
Location: Brisbane, Australia
There is no nmap.vbs nor audit.config in OAv2. Are you sure you are using OAv2 and not Open-AudIT?

To order a non-domain system in OAv2, simply type the below:
Code:
cscript audit_windows.vbs strcomputer=PCNAME struser=PCNAME\USERNAME strpass=YOURPASSWORD


Make sure you replace the items above in CAPS with your own attributes.
You can also load these into the audit_list.vbs script. Just include "PCNAME struser=PCNAME\USERNAME strpass=YOURPASSWORD" in the array of computers.

_________________
Support and Development hours available from Opmantek.
Please consider a purchase to help make Open-AudIT better for everyone.


Top
 Profile  
Reply with quote  
PostPosted: Thu Feb 16, 2012 12:17 am 
Offline
Newbie

Joined: Wed Feb 15, 2012 1:15 am
Posts: 13
Location: Belgium
Mark wrote:
There is no nmap.vbs nor audit.config in OAv2. Are you sure you are using OAv2 and not Open-AudIT?

Yes, I tried OA first but nmap.vbs didn't work. Kept getting errors on webpage to post the data.
Could it be an incopatibility with IE9?

Mark wrote:
To order a non-domain system in OAv2, simply type the below:
Code:
cscript audit_windows.vbs strcomputer=PCNAME struser=PCNAME\USERNAME strpass=YOURPASSWORD

The problem is that I don't know the pcnames (not 100% sure at least) on my network.

Mark wrote:
Make sure you replace the items above in CAPS with your own attributes.
You can also load these into the audit_list.vbs script. Just include "PCNAME struser=PCNAME\USERNAME strpass=YOURPASSWORD" in the array of computers.

Is there a tool that can collect them?


Top
 Profile  
Reply with quote  
PostPosted: Thu Feb 16, 2012 8:29 pm 
Offline
Newbie

Joined: Wed Feb 15, 2012 1:15 am
Posts: 13
Location: Belgium
Mark wrote:
To order a non-domain system in OAv2, simply type the below:
Code:
cscript audit_windows.vbs strcomputer=PCNAME struser=PCNAME\USERNAME strpass=YOURPASSWORD

I tried this for some pc's from which I do know the pcname, but I get this error message:

audit_windows.vbs(122,2) SWbemLocator: The RPC-server is not available.

I haven't got the tech knowlegde to solve this.
Can you help?


Top
 Profile  
Reply with quote  
PostPosted: Sat Feb 18, 2012 8:53 am 
Offline
Site Admin
User avatar

Joined: Mon Jun 07, 2004 11:48 am
Posts: 1933
Location: Brisbane, Australia
Quote:
audit_windows.vbs(122,2) SWbemLocator: The RPC-server is not available.

Sounds like a firewall issue on the remote PC.

_________________
Support and Development hours available from Opmantek.
Please consider a purchase to help make Open-AudIT better for everyone.


Top
 Profile  
Reply with quote  
PostPosted: Tue Feb 21, 2012 6:17 am 
Offline
Newbie

Joined: Wed Feb 15, 2012 1:15 am
Posts: 13
Location: Belgium
Mark wrote:
Sounds like a firewall issue on the remote PC.

I disabled the firewall on the remote machine completly...
I ran the script "firewall_allow.vbs" locally on the remote machine.
What can it be then?


Top
 Profile  
Reply with quote  
PostPosted: Tue Feb 21, 2012 6:53 am 
Offline
Newbie

Joined: Wed Feb 15, 2012 1:15 am
Posts: 13
Location: Belgium
wouter wrote:
Mark wrote:
Sounds like a firewall issue on the remote PC.

I disabled the firewall on the remote machine completly...
I ran the script "firewall_allow.vbs" locally on the remote machine.
What can it be then?

I've had succes when using an ip-adress in stead of the pcname:

Code:
cscript.exe audit_windows.vbs strcomputer:IP-ADRESS struser=PCNAME\USERNAME strpass=PASSWORD

BUT...
the audit stops prematurely on:

Code:
local groups info
C:\audit_windows.vbs(1727,4) Active Directory: unspecified error

Since I'm not using Active Directory, can I disable this?
Or how can I solve this?


Top
 Profile  
Reply with quote  
PostPosted: Tue Feb 21, 2012 10:11 am 
Offline
Site Admin
User avatar

Joined: Mon Jun 07, 2004 11:48 am
Posts: 1933
Location: Brisbane, Australia
I'll take a look at the beta4 script tonight.

_________________
Support and Development hours available from Opmantek.
Please consider a purchase to help make Open-AudIT better for everyone.


Top
 Profile  
Reply with quote  
PostPosted: Mon Feb 27, 2012 9:40 pm 
Offline
Newbie

Joined: Thu Feb 09, 2012 9:34 pm
Posts: 1
Hello,

I would like to do a scan on a windows 2003 R2 X64 server with AD from a windows 7 x64 computer.

Code:
C:\xampp\OAv2\other>cscript.exe audit_windows.vbs strcomputer:192.xxx.xxx.206 strus
er=domain\administrateur strpass=xxxxx
Microsoft (R) Windows Script Host Version 5.8
Copyright (C) Microsoft Corporation 1996-2001. Tous droits réservés.

starting audit - strcomputer:192.xxx.xxx.206
C:\xampp\OAv2\other\audit_windows.vbs(122, 2) SWbemLocator: Le serveur RPC n'est
 pas disponible.


"Le serveur RPC n'est pas disponible" = The RPC-server is not available

I have disable the firewall on my windows 7 and there is no firewal on my server.

I haven't the same error of Wouter with active directory.

Do you think it could be because my win 7 is not in the domain ?


Top
 Profile  
Reply with quote  
PostPosted: Tue Feb 28, 2012 10:42 am 
Offline
Moderator

Joined: Fri Jul 20, 2007 8:27 am
Posts: 1224
That would be my guess. OpenAudit is trying to connect to the target machine using the DOMAIN\Administrateur user which isn't valid if the machine is not in the domain. Instead of DOMAIN\Administrateur for struser use MACHINENAME\Administrateur (or equivalent user) and pass in the appropriate password in strpass.


Top
 Profile  
Reply with quote  
PostPosted: Thu Mar 01, 2012 5:18 am 
Offline
Newbie

Joined: Wed Feb 15, 2012 1:15 am
Posts: 13
Location: Belgium
Sparadra wrote:
Code:
C:\xampp\OAv2\other>cscript.exe audit_windows.vbs strcomputer:192.xxx.xxx.206 struser=domain\administrateur strpass=xxxxx


I made a typo in my previous post, maybe you made the same one:

strcomputer:192.xxx.xxx.206

should be

strcomputer=192.xxx.xxx.206


Top
 Profile  
Reply with quote  
PostPosted: Thu Mar 01, 2012 5:24 am 
Offline
Moderator

Joined: Fri Jul 20, 2007 8:27 am
Posts: 1224
Didn't notice that. That makes more sense with that error message. Although once you've got that fixed then you might need to fixed the struser as I pointed out.


Top
 Profile  
Reply with quote  
PostPosted: Thu Mar 01, 2012 5:26 am 
Offline
Newbie

Joined: Wed Feb 15, 2012 1:15 am
Posts: 13
Location: Belgium
jpa wrote:
Instead of DOMAIN\Administrateur for struser use MACHINENAME\Administrateur (or equivalent user) and pass in the appropriate password in strpass.

I allready tried
Code:
cscript.exe audit_windows.vbs strcomputer=IP-ADRESS struser=USERNAME strpass=PASSWORD

Code:
cscript.exe audit_windows.vbs strcomputer=IP-ADRESS struser=PCNAME\USERNAME strpass=PASSWORD

Code:
cscript.exe audit_windows.vbs strcomputer=IP-ADRESS struser=IP-ADRESS\USERNAME strpass=PASSWORD

All 3 return this error:
Code:
local groups info
C:\audit_windows.vbs(1727,4) Active Directory: unspecified error


Any ideas, Mark?


Top
 Profile  
Reply with quote  
PostPosted: Sat Mar 03, 2012 4:59 pm 
Offline
Site Admin
User avatar

Joined: Mon Jun 07, 2004 11:48 am
Posts: 1933
Location: Brisbane, Australia
Am posting a new audit script (in another thread) - give it a whirl...

_________________
Support and Development hours available from Opmantek.
Please consider a purchase to help make Open-AudIT better for everyone.


Top
 Profile  
Reply with quote  
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 14 posts ] 

All times are UTC + 10 hours


Who is online

Users browsing this forum: No registered users and 6 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group