Registrations to Open-AudIT forums are now closed. To ask any new questions please visit Opmantek Community Questions.

Open-AudIT

What's on your network?
It is currently Thu Mar 28, 2024 7:08 pm

All times are UTC + 10 hours




Forum locked This topic is locked, you cannot edit posts or make further replies.  [ 25 posts ]  Go to page Previous  1, 2
Author Message
PostPosted: Wed Oct 05, 2016 2:33 am 
Offline
Contributor

Joined: Thu May 03, 2007 10:38 am
Posts: 116
Location: Midwest
That helped.

Issue still is with Windows 8/10 machines.

Again it doesn't have a control key.

Only key it has is device parameters. Odd thing is some machines pull all monitors in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\DISPLAY\

Some don't so I am trying to look at the device to compare.


Top
 Profile  
Reply with quote  
PostPosted: Wed Oct 05, 2016 6:29 am 
Offline
Moderator

Joined: Fri Jul 20, 2007 8:27 am
Posts: 1259
What's the output of the following Powershell code on a computer that outputs all monitors it's ever seen? Specifically the "Active" property. Are they all True?

[code]Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorBasicDisplayParams[/code]


Top
 Profile  
Reply with quote  
PostPosted: Fri Oct 07, 2016 2:20 am 
Offline
Contributor

Joined: Thu May 03, 2007 10:38 am
Posts: 116
Location: Midwest
So For one of the surface pro 3s running windows 8.1.

I deleted the monitors from the sql table.

Rescanned the device. It shows 4 monitiors in Openaudit.

One being the surface screen itself. Though it should only show 3 monitors.

Here is the monitor info from the scan.

<monitor>
<item>
<manufacturer>Dell</manufacturer>
<device>A09A</device>
<manufacture_date>10/2014</manufacture_date>
<model>DELL P2414H</model>
<serial>524N349Q08WL</serial>
<edid_version>1.4</edid_version>
<aspect_ratio>16:10</aspect_ratio>
<size>24</size>
</item>
<item>
<manufacturer>Dell</manufacturer>
<device>A09A</device>
<manufacture_date>04/2014</manufacture_date>
<model>DELL P2414H</model>
<serial>524N344P1DYL</serial>
<edid_version>1.4</edid_version>
<aspect_ratio>16:10</aspect_ratio>
<size>24</size>
</item>
<item>
<manufacturer>Dell</manufacturer>
<device>A0A2</device>
<manufacture_date>08/2015</manufacture_date>
<model>DELL U2414H</model>
<serial>R9F1P5848FYL</serial>
<edid_version>1.4</edid_version>
<aspect_ratio>16:10</aspect_ratio>
<size>24</size>
</item>
<item>
<manufacturer>Samsung</manufacturer>
<device>3542</device>
<manufacture_date>01/2013</manufacture_date>
<model>Generic PNP Monitor</model>
<serial>Serial Number Not Found in EDID data</serial>
<edid_version>1.1</edid_version>
<aspect_ratio>16:10</aspect_ratio>
<size>11.9</size>
</item>
</monitor>

Running the powershell gave me -

Active : True
DisplayTransferCharacteristic : 120
InstanceName : DISPLAY\SEC3542\4&278a8b06&1&UID68092928_0
MaxHorizontalImageSize : 25
MaxVerticalImageSize : 17
SupportedDisplayFeatures : WmiMonitorSupportedDisplayFeatures
VideoInputType : 1


Active : True
DisplayTransferCharacteristic : 120
InstanceName : DISPLAY\DELA09A\4&278a8b06&1&UID59644672_0
MaxHorizontalImageSize : 53
MaxVerticalImageSize : 30
SupportedDisplayFeatures : WmiMonitorSupportedDisplayFeatures
VideoInputType : 1


Active : True
DisplayTransferCharacteristic : 120
InstanceName : DISPLAY\DELA0A2\4&278a8b06&1&UID57547520_0
MaxHorizontalImageSize : 53
MaxVerticalImageSize : 30
SupportedDisplayFeatures : WmiMonitorSupportedDisplayFeatures
VideoInputType : 1

Here is the registry key as well attached.


Attachments:
displays.txt [13.49 KiB]
Downloaded 502 times
Top
 Profile  
Reply with quote  
PostPosted: Sat Oct 08, 2016 3:03 am 
Offline
Moderator

Joined: Fri Jul 20, 2007 8:27 am
Posts: 1259
So maybe we give up on reading the ENUM registry keys directly and go with a more modern interface on newer Windows. What does the output of the attached script look like? (Change .txt to .vbs, then cscript monitors.vbs) It uses WmiMonitorID rather than direct registry reads.

If it looks okay we'd need to update the audit script. I don't think WmiMonitorID has all the info we currently monitor so we'd need to dig that out of somewhere else. Probably the display adapter info.


Attachments:
monitors.txt [1.14 KiB]
Downloaded 502 times
Top
 Profile  
Reply with quote  
PostPosted: Sat Oct 08, 2016 3:40 am 
Offline
Contributor

Joined: Thu May 03, 2007 10:38 am
Posts: 116
Location: Midwest
Ok so I am running cscript monitors.vbs

I get a return of
monitors.vbs(18, 1) (null): 0x8004100c

Oooops that is because my test device didn't have anything connected.

What do I need to do to run this on a remote P
Figured it out...

Ok so the user is gone with the previous setup but I found another user with a surface/multiple monitors and Openaudit pulls more.

The Powershell script returns two active monitors as well as the Monitor vbs script.


Top
 Profile  
Reply with quote  
PostPosted: Sat Oct 08, 2016 6:19 am 
Offline
Moderator

Joined: Fri Jul 20, 2007 8:27 am
Posts: 1259
So I guess we just need to change the audit script to use WmiMonitorID as in the test script. This is not a one-liner as we'll need to get the extra audit info from a different interface. Are you in to scripting at all? We don't have anything newer than Win7 and they all seem to work fine here. I may take a stab at it as I doubt Mark has this high on his ToDo list unless you contract for it.


Top
 Profile  
Reply with quote  
PostPosted: Sat Oct 08, 2016 6:38 am 
Offline
Contributor

Joined: Thu May 03, 2007 10:38 am
Posts: 116
Location: Midwest
I do some small stuff.

Should I have been able to run the code as cscript monitors.vbs computername - that didin't seem to work for me.

I added the following items
added strcomputer to Dim line -
Also added
strcomputer = "computername"

changed
Set WMI = GetObject("winmgmts:{impersonationlevel=impersonate}!root/wmi")

to

Set WMI = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\wmi")


Top
 Profile  
Reply with quote  
PostPosted: Sat Oct 08, 2016 6:47 am 
Offline
Moderator

Joined: Fri Jul 20, 2007 8:27 am
Posts: 1259
[quote="cburbs"]Should I have been able to run the code as cscript monitors.vbs computername
No. I just grabbed something that would run locally and dump the WmiMonitorID info. It should work remotely with your changes but it's really only useful to find out if WmiMonitorID returns the correct info on the problem computers.

If it does then it makes sense to change the audit script as necessary.

Top
 Profile  
Reply with quote  
PostPosted: Wed Oct 12, 2016 5:25 am 
Offline
Site Admin
User avatar

Joined: Mon Jun 07, 2004 11:48 am
Posts: 1964
Location: Brisbane, Australia
Just a quick comment. No, I don't have this high on my list :-( I'm head down working on the next release which will be, just let me say, BIIG. Finalising progression on the Bootstrap theme and API / URL access routine. Big changes to the user permissions system. No more admin or not. Now it's role based access combined with Org access. Groups are being demoted and not a central point of the application. You'll see. Anyway... I also don't have a Windows 8 machine in the house or a Surface Pro. I do have a couple of Windows 10 laptops though. I'll let you guys keep plugging away at this one and will be happy to integrate the code when you're ready.

_________________
Support and Development hours available from [url=https://opmantek.com]Opmantek[/url].
Please consider a purchase to help make Open-AudIT better for everyone.


Top
 Profile  
Reply with quote  
PostPosted: Sat Oct 15, 2016 7:46 am 
Offline
Moderator

Joined: Fri Jul 20, 2007 8:27 am
Posts: 1259
Test changes against 1.12.8 audit_windows.vbs script using WMI calls on Vista and newer rather than directly reading the registry. May or may not work better against the troublesome monitors. I got most of the info but was a bit lazy and skipped the edid version.

I left the auditing as is for pre-Vista machines.

Should test this. No guarantees it won't set your machines on fire.

EDIT 20161020: GCD screen ratio calculation displays "8:5" instead of "16:10".


Attachments:
audit_windows.jpa.txt [330.89 KiB]
Downloaded 477 times
Top
 Profile  
Reply with quote  
Display posts from previous:  Sort by  
Forum locked This topic is locked, you cannot edit posts or make further replies.  [ 25 posts ]  Go to page Previous  1, 2

All times are UTC + 10 hours


Who is online

Users browsing this forum: No registered users and 2 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group