[FIXED] Audit NT 4.0 domain [Can add to SVN if you like]

jsingh · **Joined:** Fri Sep 28, 2007 12:07 am **Posts:** 189

Your audit.vbs is quite old. There are no problems related to auditing an NT4 domain in there though.

Please try this:

Edit audit.config

Replace:

[code]
local_domain = "WINNT://iexplore"
[/code]

with:

[code]
local_domain = "WinNT://IEXPLORE"
[/code]

Let me know if that resolves your issue.

It appears WMI cannot connect to your domain. Do you have WMI and WSH 5.6 installed on your PDC? If not please do.

Thanks,

Jason

bterwill · **Joined:** Fri Dec 07, 2007 2:48 am **Posts:** 5

Yup, it looks like it is case sensitive as those last changes to the audit.config file look to have worked. I changed to local_domain from WINNT: to WinNT: and the audit then runs through the domain computers. Thanks again for all your (quick) help.

With regard to the old audit.vbs script, I thought I was using the latest version (downloaded the package from the website this week, and also setup SVN to get the latest repositories). What are the benefits of a newer audit.vbs and how might I find one?

Thanks again.

jsingh · **Joined:** Fri Sep 28, 2007 12:07 am **Posts:** 189

[quote="bterwill"]Yup, it looks like it is case sensitive as those last changes to the audit.config file look to have worked. I changed to local_domain from WINNT: to WinNT: and the audit then runs through the domain computers. Thanks again for all your (quick) help.

With regard to the old audit.vbs script, I thought I was using the latest version (downloaded the package from the website this week, and also setup SVN to get the latest repositories). What are the benefits of a newer audit.vbs and how might I find one?

Thanks again.

bterwill · **Joined:** Fri Dec 07, 2007 2:48 am **Posts:** 5

I had SVN setup, but just didn't update the files. I guess it helps to do that :lol:

jsingh · **Joined:** Fri Sep 28, 2007 12:07 am **Posts:** 189

[quote="bterwill"]I had SVN setup, but just didn't update the files. I guess it helps to do that :lol:

A_Hull · **Posted:** Sat Dec 15, 2007 3:29 am

If you give me the diffs between the current SVN and your current NT version, then I will add them in (now that I have fixed by SVN upload issue

).

jsingh · **Joined:** Fri Sep 28, 2007 12:07 am **Posts:** 189

[quote="A_Hull"]If you give me the diffs between the current SVN and your current NT version, then I will add them in (now that I have fixed by SVN upload issue

).

mikeyrb · **Posted:** Sun Dec 16, 2007 5:22 am

The svn client has one... just use "svn diff"

jsingh · **Joined:** Fri Sep 28, 2007 12:07 am **Posts:** 189

[quote="A_Hull"]If you give me the diffs between the current SVN and your current NT version, then I will add them in (now that I have fixed by SVN upload issue

).

A_Hull · **Posted:** Tue Dec 18, 2007 2:49 am

Couldn't make your DIFFs work with Tortoise SVN.

I created a Unified DIFF from the changes I made using your posts, however there is a slight risk that since you are using an older version of these files, we may trip over something.

I have posted this version. Blame me if it breaks things. :oops:

SVN 926 Commit text reads...

Added ability to audit NT4 style domains. In theory this includes SAMBA but I can't test this. Anyone?

Please test, thanks. Also can someone try this with a SAMBA Domain (security = domain SFAIK ) to see if my theory is correct?

Here's my DIFF

[code]
Index: audit.config.defaults
===================================================================
--- audit.config.defaults (revision 925)
+++ audit.config.defaults (working copy)
@@ -30,7 +30,20 @@
email_timeout = "60" ' In seconds

audit_local_domain = "y"
+'
+' Set domain_type = 'nt' for NT4 or SAMBA otherwise leave blank or set to ldap
+'domain_type = "nt"
+
local_domain = "LDAP://localhost.local"
+
+'
+' Example Set Domain name for NT ONLY for LDAP use the above format
+' NOTE This is Case Sensetive. See the example below.
+'
+'local_domain = "WinNT://IEXPLORE"
+'local_domain = "WinNT://<domainname>"
+'
+
hfnet = "n"
Count = 0
number_of_audits = 10
Index: audit.vbs
===================================================================
--- audit.vbs (revision 925)
+++ audit.vbs (working copy)
@@ -5,6 +5,7 @@
' Outputs into MySQL '
' (c) Mark Unwin 2003 '
'''''''''''''''''''''''''''''''''''
+'
Dim verbose
Public online
Dim strComputer
@@ -251,6 +252,9 @@
' Audit the local domain, if requested '
''''''''''''''''''''''''''''''''''''''''
if audit_local_domain = "y" then
+ if domain_type = "nt" then
+ comparray = GetDomainComputers(local_domain)
+ elseif domain_type = "ldap" then
Const ADS_SCOPE_SUBTREE = 2
Set objConnection = CreateObject("ADODB.Connection")
Set objCommand = CreateObject("ADODB.Command")
@@ -283,6 +287,7 @@
wscript.echo "Number of systems retrieved from ldap: " & Ubound(comparray)
wscript.echo "--------------"
end if
+end if

For i = 0 To Ubound(comparray)
' For i = 118 To 128
@@ -310,7 +315,6 @@
Next
end if

-
'''''''''''''''''''''''''''''''''''
' Read the text file if requested '
' and audit PCs within - line '
@@ -3862,3 +3866,34 @@
chr(34)) & chr(34)
End Function

+'-------------------------------------------------------------------------------
+' Function: GetDomainComputers
+' Description: Returns a listing of NT Computer Accounts for a given domain
+' Parameters: ByVal strDomain - Name of an NT Domain to retrieve the
+' list of Computer from.
+' Returns: Variant array of NT Computer names for the specified domain.
+'-------------------------------------------------------------------------------
+Function GetDomainComputers(ByVal local_domain)
+ Dim objIADsContainer ' ActiveDs.IADsDomain
+ Dim objIADsComputer ' ActiveDs.IADsComputer
+ Dim vReturn ' Variant
+
+ ' connect to the computer.
+ Set objIADsContainer = GetObject(local_domain)
+
+ ' set the filter to retrieve only objects of class Computer
+ objIADsContainer.Filter = Array("Computer")
+
+ ReDim vReturn(0)
+ For Each objIADsComputer In objIADsContainer
+ If Trim(vReturn(0)) <> "" Then
+ ReDim Preserve vReturn(UBound(vReturn) + 1)
+ End If
+ vReturn(UBound(vReturn)) = objIADsComputer.Name
+ Next
+
+ GetDomainComputers = vReturn
+ Set objIADsComputer = Nothing
+ Set objIADsContainer = Nothing
+End Function
+
[/code]

I have added these new domain options to the FAQ.

A_Hull · **Posted:** Tue Dec 18, 2007 3:36 am

BIG OOPS. This breaks the LDAP audit, I get ...

C:\Program Files\xampp\htdocs\OpenAuditSVN\scripts>cscript audit.vbs
Microsoft (R) Windows Script Host Version 5.6
Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.

C:\Program Files\xampp\htdocs\OpenAuditSVN\scripts\audit.vbs(292, 5) Microsoft VBScript runtime error: Type mismatch: 'Ubound'

Seems likely to be a problem with your if/then logic.

Can you take a look.

jsingh · **Joined:** Fri Sep 28, 2007 12:07 am **Posts:** 189

Hey Andrew,

I am not. I am using Tortoise as well, however I could only generate the diffs by using modification history. I guess I don't have my client setup correctly. Once you use the options in the early part of the post it should be fine.

I am always SVN up to date

Jason

jsingh · **Joined:** Fri Sep 28, 2007 12:07 am **Posts:** 189

[quote="A_Hull"]BIG OOPS. This breaks the LDAP audit, I get ...

C:\Program Files\xampp\htdocs\OpenAuditSVN\scripts>cscript audit.vbs
Microsoft (R) Windows Script Host Version 5.6
Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.

C:\Program Files\xampp\htdocs\OpenAuditSVN\scripts\audit.vbs(292, 5) Microsoft VBScript runtime error: Type mismatch: 'Ubound'

Seems likely to be a problem with your if/then logic.

Can you take a look.

jsingh · **Joined:** Fri Sep 28, 2007 12:07 am **Posts:** 189

[quote="A_Hull"]BIG OOPS. This breaks the LDAP audit, I get ...

C:\Program Files\xampp\htdocs\OpenAuditSVN\scripts>cscript audit.vbs
Microsoft (R) Windows Script Host Version 5.6
Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.

C:\Program Files\xampp\htdocs\OpenAuditSVN\scripts\audit.vbs(292, 5) Microsoft VBScript runtime error: Type mismatch: 'Ubound'

Seems likely to be a problem with your if/then logic.

Can you take a look.

A_Hull · **Posted:** Tue Dec 18, 2007 3:48 am

Coool....... sussed it you MUST declare the domain_type = "ldap" (and not for example as "LDAP") otherwise it wont match in the conditional logic.

Suggest we lower case this var at the start of the section of the script and set it to ldap if it is not declared otherwise we break older versions of the config.

Modded the start to read...

[code]
if audit_local_domain = "y" then
domain_type = LCase(domain_type)
if domain_type <> "nt" then
domain_type = "ldap"
end if
if domain_type = "nt" then
comparray = GetDomainComputers(local_domain)
end if
[/code]

Posted to SVN 927 Please try and let me know the results. You should now be able to declare or not declare domain_type, and use any case you like.

Unless it is specified as "nt" (or "NT" or "nT" or whatever) it is assumed to be "ldap"

Slightly logically dangerous, but it fixes our problem. :twisted:

Open-AudIT

[FIXED] Audit NT 4.0 domain [Can add to SVN if you like]

Who is online