Open-AudIT
https://www.open-audit.org/phpBB3/

Missing software in audit?
https://www.open-audit.org/phpBB3/viewtopic.php?f=20&t=5837
Page 1 of 1

Author:  MarkD [ Fri Feb 03, 2012 11:26 pm ]
Post subject:  Missing software in audit?

Just been asked to audit al browser version on the domain and I'm seeing something odd.

I've chrome v18.x installed yet it's not showing up in the audit log for my machine.
Additionally, when I check the software installed report that shows hundreds of Google Chrome installs but shows v15.x

Is anyone else seeing this behaviour before I start pulling at things or is it just me?

Author:  jpa [ Mon Feb 06, 2012 2:14 pm ]
Post subject:  Re: Missing software in audit?

OpenAudit doesn't audit per-user installed software. Perhaps your Chrome is installed this way.

Author:  Mark [ Tue Feb 07, 2012 9:26 am ]
Post subject:  Re: Missing software in audit?

If your software shows up in add/remove programs, it shoudl show in Open-AudIT.
If it's something like a portable app (http://www.portableapps.com) then there is no actuall installation, nor a record in the registry - it will not appear in Open-AudIT. Short of scanning your entire filesystem and knowing what every .exe does, etc, there is no easy way to accomplish detection of all non-installed applications.

Author:  MarkD [ Tue Feb 07, 2012 9:58 pm ]
Post subject:  Re: Missing software in audit?

very odd. It's definitely in add/remove programs which is why I was expecting it to show up in the audit logs. I had wondered if it was because software auditing wasn't (I didn't think) finished but then everything else I've looked for seems to be there.

Further testing reveals the following:

Many installs on the domain for Internet Explorer - 7.0.5730.11

My Win7 machine had Internet Explorer - 8.x but after installing IE 9 (Internet Explorer - 9.0.8112.16421) this does not show up anywhere in OA as having been installed after a successful audit other than when I specifically look at my machine.

OA *appears* to be bundling my version 9 into the reports for v8. I checked by doing:

Listing all Win7 systems (as xp can't install IE9)
Running the installed software report
Searching for Internet Explorer which showed this: Internet Explorer - 8.0.7600.16385

Now, when I select this application I get a list of all the systems and sort by version I can see 8, 8.0.x which is what I'd expect but it also shows 37 installs for IE9. Version 9.0.8112.16421

At some point Mark could you separate these out?

Typical that I start with one Chrome problem and now have an IE problem as well :roll:

Author:  jpa [ Wed Feb 08, 2012 2:55 am ]
Post subject:  Re: Missing software in audit?

[quote="Mark"]If your software shows up in add/remove programs, it shoudl show in Open-AudIT.Unfortunately, I'm pretty sure this isn't true.

OA audits the HKLM version of "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" and not the HKCU which is where the Chrome install info lives as it's installed per-user.

Log on to the machine as a different user (that doesn't have Chrome installed) and the Chrome stuff will disappear from Add-Remove Programs.

Author:  jpa [ Wed Feb 08, 2012 4:46 am ]
Post subject:  Re: Missing software in audit?

[quote="MarkD"]Running the installed software report
The "Installed Software" report groups by package name and I guess if multiple versions are installed picks the version number to display based on the first one it sees from the data returned by MySQL. It does this for all software, not just Internet Explorer, so this report isn't a great way to see if you're up to date for a given software package.

Author:  Mark [ Wed Feb 08, 2012 7:00 am ]
Post subject:  Re: Missing software in audit?

[quote]The "Installed Software" report groups by package name
Yes, so if you then click on the text "Internet Explorer" it should should show a list of PCs and the individual versions of IE that are installed.

Author:  Mark [ Wed Feb 08, 2012 7:02 am ]
Post subject:  Re: Missing software in audit?

[quote] and not the HKCU which is where the Chrome install info lives as it's installed per-user.
Ahh yes - my apologies. I didn't realise it could be installed like that... I will not be enumerating all possible user installs as OAv2 is designed around the MACHINE, not the user. Hence no mapped drives show up, etc, etc.

Author:  jpa [ Wed Feb 08, 2012 7:48 am ]
Post subject:  Re: Missing software in audit?

[quote="Mark"][quote]The "Installed Software" report groups by package name
Yes, so if you then click on the text "Internet Explorer" it should should show a list of PCs and the individual versions of IE that are installed.
Cool, that's useful. Although I think that's not implemented yet in my version of OA (b4). I get a blank page when clicking on the link which looks like this: "http://openaudit2/index.php//report/specific_software/1/3498". When looking in the controllers\report.php file I don't see a specific_software function which from my terrible understanding of the code should be there for this to work.

Author:  Mark [ Thu Feb 09, 2012 7:12 am ]
Post subject:  Re: Missing software in audit?

Go to admin-list reports. Make sure there is a report called "specific software" that is activated.

Author:  jpa [ Thu Feb 09, 2012 8:11 am ]
Post subject:  Re: Missing software in audit?

Found it. Told you I have a terrible understanding of OAv2. :oops:

Author:  MarkD [ Thu Feb 09, 2012 8:45 am ]
Post subject:  Re: Missing software in audit?

haha not as bad as mine it seems. Thanks guys for the info. I bare it in mind when I'm running audits etc. in the future. Today wasn't wasted, I learnt something new. :D

Page 1 of 1 All times are UTC + 10 hours
Powered by phpBB® Forum Software © phpBB Group
https://www.phpbb.com/