Open-AudIT

Hi guys,

I'm rolling this out to my networks and have a nice healthy range of operating systems.
So far it has worked a treat in 2008 R2 environments, i've started rolling it out to 2003 and have hit a bit of a snag.

When it gets to "Scheduled tasks" it fails with an error (and closes), something about being out of range (I'm running it again to get the exact error).
This is using the latest 1.2 audit_windows.vbs script.

Can anyone help?

The audit script parses the output of the schtasks command. It might be choking on your particular output.

Post or PM the output from the following command run on a machine where the audit script dies.
[code]schtasks.exe /query /v /nh /fo csv[/code]

Scheduled Tasks are [url=http://www.open-audit.org/phpBB3/viewtopic.php?f=20&t=6220&hilit=+scheduled#p22343]not stored by OpenAudit[/url] right now so you could also just remove that section from the audit script.

Hi there,

It says:
Microsoft VBScript runtime error: "Subscript out of range: `[number: 12]`
Line 2634 is: item = item & " <state><![CDATA[" & sTask(11+intOffset) & "]]></state>" & vbcrlf

I'm not sure if I'd be able to provide the schtasks dump without mashing up some of the titles/scripts it runs but they are just standard tasks.
There's 8 of them, 1 is disabled and 1 has never actually run. I ran your command and the comma separated values looked normal to me.

In any case, I've made some changes to the script to have a 'skip' flag for the tasks, which I defaulted to "y" since openaudit doesn't use it.

Hit another roadblock...

2003/IIS6.

Error: Microsoft VBScript runtime error: Path not found
Line at fault: Set objFolder = objFSO.GetFolder(iis_path)

I'm going to nullify it and see what else I find but it's a bit strange.

A little error checking for the iis_path. To be honest the error checking is not exhaustive in the audit script so if things don't go as expected things die. Each time there is a report like this the error handling gets a bit better. (This is a simple check but I typed this but didn't test it.)

[code]
if audit_location = "local" then
if objFSO.FolderExists(iis_path) then
Set objFolder = objFSO.GetFolder(iis_path)
site_size = int(objFolder.size / 1024 / 1024) ' NOTE - only works when run locally. Returns in MB.
else
site_size = ""
end if
else
site_size = ""
end if
[/code]

Even though scheduled tasks are not saved currently they might be at some time. If you wanted to help out there you could remove your skip code and put an echo statement in just before the script dies. Then we would have an example without you having to dump all tasks.
So change line 2621 from:
[code]MyArray = Split(strResults, vbcrlf)[/code]
to
[code]
wscript.echo "Task info: " & strResults
MyArray = Split(strResults, vbcrlf)[/code]
Run an audit and the "Task info" line should have the task causing the problem. Post that after sanitizing if necessary.

Also be aware that the scheduled tasks code should only run if you're running the audit script locally on the device being audited. It should not run if you are running the script on one PC and targeting another.

In turn this means that if you run the audit locally (maybe a login script, etc), then remotely (discovery or domain audit), the second audit result will not contain any tasks info and (if it was actually stored in the database), would then Alert that none of the originally retrieved scheduled tasks have been found.

To put this into practical use, we must have a way to retrieve task information remotely.

_________________
Support and Development hours available from [url=https://opmantek.com]Opmantek[/url].
Please consider a purchase to help make Open-AudIT better for everyone.

Hey there,

That worked (the IIS workaround). I've actually made quite a few improvements to the script. Is it possible if we can speak on Skype or what-not?
I've got some ideas and would like to help OpenAudit out.

I'll PM you directly.

Regards,
augrunt

I was a bit too quick to call it fixed. On another host, same deal.

audit_windows.vbs(4319, Microsoft VBScript runtime error: Path not found

[code]
if audit_location = "local" then
if objFSO.FolderExists(iis_path) then
Set objFolder = objFSO.GetFolder(iis_path)
site_size = int(objFolder.size / 1024 / 1024) ' NOTE - only works when run locally. Returns in MB. ' <-- 4319
else
site_size = ""
end if
else
site_size = ""
end if[/code]

After some fooling around...

I updated the code to have after Set objFolder = objFSO.GetFolder(iis_path) to have
if debugging > "1" then wscript.echo "IIS Path info: " & objFolder end if

Now the path it echos before it complains about "Path not found" is a W:\Inetpub
The script is being run from C:\...\..\scripts\audit_windows.vbs

For all intents and purposes, the folder exists and I'm running as Administrator so it should have the privs to query the size. The fact it passes the .FolderExists portion is proof enough it can see it. I really can't see why objFolder.size would report it cannot find the path. This is on a 2008R2 box.

Regards,
augrunt

*EDITS*
The Folder Size is about 200GB when I look in explorer. I'd imagine there may be some files in their that are marked hidden or are unable to be queried, which may be the reason this is happening. We need to find a way to gracefully handle this anomaly I'll look around for a fix.

It might be easiest to remove the FolderExists stuff and just wrap the size calculation in an "On Error Resume Next, On Error GoTo 0".