Open-AudIT
https://www.open-audit.org/phpBB3/

Monitor Pull information
https://www.open-audit.org/phpBB3/viewtopic.php?f=20&t=6496		 Page 2 of 2
Author:  cburbs [ Wed Oct 05, 2016 2:33 am ]
Post subject:  Re: Monitor Pull information
That helped.

Issue still is with Windows 8/10 machines.

Again it doesn't have a control key.

Only key it has is device parameters. Odd thing is some machines pull all monitors in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\DISPLAY\

Some don't so I am trying to look at the device to compare.
Author:  jpa [ Wed Oct 05, 2016 6:29 am ]
Post subject:  Re: Monitor Pull information
What's the output of the following Powershell code on a computer that outputs all monitors it's ever seen? Specifically the "Active" property. Are they all True?

[code]Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorBasicDisplayParams[/code]
Author:  cburbs [ Fri Oct 07, 2016 2:20 am ]
Post subject:  Re: Monitor Pull information
So For one of the surface pro 3s running windows 8.1.

I deleted the monitors from the sql table.

Rescanned the device. It shows 4 monitiors in Openaudit.

One being the surface screen itself. Though it should only show 3 monitors.

Here is the monitor info from the scan.

<monitor>
<item>
<manufacturer>Dell</manufacturer>
<device>A09A</device>
<manufacture_date>10/2014</manufacture_date>
<model>DELL P2414H</model>
<serial>524N349Q08WL</serial>
<edid_version>1.4</edid_version>
<aspect_ratio>16:10</aspect_ratio>
<size>24</size>
</item>
<item>
<manufacturer>Dell</manufacturer>
<device>A09A</device>
<manufacture_date>04/2014</manufacture_date>
<model>DELL P2414H</model>
<serial>524N344P1DYL</serial>
<edid_version>1.4</edid_version>
<aspect_ratio>16:10</aspect_ratio>
<size>24</size>
</item>
<item>
<manufacturer>Dell</manufacturer>
<device>A0A2</device>
<manufacture_date>08/2015</manufacture_date>
<model>DELL U2414H</model>
<serial>R9F1P5848FYL</serial>
<edid_version>1.4</edid_version>
<aspect_ratio>16:10</aspect_ratio>
<size>24</size>
</item>
<item>
<manufacturer>Samsung</manufacturer>
<device>3542</device>
<manufacture_date>01/2013</manufacture_date>
<model>Generic PNP Monitor</model>
<serial>Serial Number Not Found in EDID data</serial>
<edid_version>1.1</edid_version>
<aspect_ratio>16:10</aspect_ratio>
<size>11.9</size>
</item>
</monitor>

Running the powershell gave me -

Active : True
DisplayTransferCharacteristic : 120
InstanceName : DISPLAY\SEC3542\4&278a8b06&1&UID68092928_0
MaxHorizontalImageSize : 25
MaxVerticalImageSize : 17
SupportedDisplayFeatures : WmiMonitorSupportedDisplayFeatures
VideoInputType : 1


Active : True
DisplayTransferCharacteristic : 120
InstanceName : DISPLAY\DELA09A\4&278a8b06&1&UID59644672_0
MaxHorizontalImageSize : 53
MaxVerticalImageSize : 30
SupportedDisplayFeatures : WmiMonitorSupportedDisplayFeatures
VideoInputType : 1


Active : True
DisplayTransferCharacteristic : 120
InstanceName : DISPLAY\DELA0A2\4&278a8b06&1&UID57547520_0
MaxHorizontalImageSize : 53
MaxVerticalImageSize : 30
SupportedDisplayFeatures : WmiMonitorSupportedDisplayFeatures
VideoInputType : 1

Here is the registry key as well attached.

Attachments:
displays.txt [13.49 KiB]
Downloaded 542 times
Author:  jpa [ Sat Oct 08, 2016 3:03 am ]
Post subject:  Re: Monitor Pull information
So maybe we give up on reading the ENUM registry keys directly and go with a more modern interface on newer Windows. What does the output of the attached script look like? (Change .txt to .vbs, then cscript monitors.vbs) It uses WmiMonitorID rather than direct registry reads.

If it looks okay we'd need to update the audit script. I don't think WmiMonitorID has all the info we currently monitor so we'd need to dig that out of somewhere else. Probably the display adapter info.

Attachments:
monitors.txt [1.14 KiB]
Downloaded 571 times
Author:  cburbs [ Sat Oct 08, 2016 3:40 am ]
Post subject:  Re: Monitor Pull information
Ok so I am running cscript monitors.vbs

I get a return of
monitors.vbs(18, 1) (null): 0x8004100c

Oooops that is because my test device didn't have anything connected.

What do I need to do to run this on a remote P
Figured it out...

Ok so the user is gone with the previous setup but I found another user with a surface/multiple monitors and Openaudit pulls more.

The Powershell script returns two active monitors as well as the Monitor vbs script.
Author:  jpa [ Sat Oct 08, 2016 6:19 am ]
Post subject:  Re: Monitor Pull information
So I guess we just need to change the audit script to use WmiMonitorID as in the test script. This is not a one-liner as we'll need to get the extra audit info from a different interface. Are you in to scripting at all? We don't have anything newer than Win7 and they all seem to work fine here. I may take a stab at it as I doubt Mark has this high on his ToDo list unless you contract for it.
Author:  cburbs [ Sat Oct 08, 2016 6:38 am ]
Post subject:  Re: Monitor Pull information
I do some small stuff.

Should I have been able to run the code as cscript monitors.vbs computername - that didin't seem to work for me.

I added the following items
added strcomputer to Dim line -
Also added
strcomputer = "computername"

changed
Set WMI = GetObject("winmgmts:{impersonationlevel=impersonate}!root/wmi")

to

Set WMI = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\wmi")
Author:  jpa [ Sat Oct 08, 2016 6:47 am ]
Post subject:  Re: Monitor Pull information
[quote="cburbs"]Should I have been able to run the code as cscript monitors.vbs computernameNo. I just grabbed something that would run locally and dump the WmiMonitorID info. It should work remotely with your changes but it's really only useful to find out if WmiMonitorID returns the correct info on the problem computers.

If it does then it makes sense to change the audit script as necessary.
Author:  Mark [ Wed Oct 12, 2016 5:25 am ]
Post subject:  Re: Monitor Pull information
Just a quick comment. No, I don't have this high on my list :-( I'm head down working on the next release which will be, just let me say, BIIG. Finalising progression on the Bootstrap theme and API / URL access routine. Big changes to the user permissions system. No more admin or not. Now it's role based access combined with Org access. Groups are being demoted and not a central point of the application. You'll see. Anyway... I also don't have a Windows 8 machine in the house or a Surface Pro. I do have a couple of Windows 10 laptops though. I'll let you guys keep plugging away at this one and will be happy to integrate the code when you're ready.
Author:  jpa [ Sat Oct 15, 2016 7:46 am ]
Post subject:  Re: Monitor Pull information
Test changes against 1.12.8 audit_windows.vbs script using WMI calls on Vista and newer rather than directly reading the registry. May or may not work better against the troublesome monitors. I got most of the info but was a bit lazy and skipped the edid version.

I left the auditing as is for pre-Vista machines.

Should test this. No guarantees it won't set your machines on fire.

EDIT 20161020: GCD screen ratio calculation displays "8:5" instead of "16:10".

Attachments:
audit_windows.jpa.txt [330.89 KiB]
Downloaded 538 times
Page 2 of 2 All times are UTC + 10 hours
Powered by phpBB® Forum Software © phpBB Group
https://www.phpbb.com/