Registrations to Open-AudIT forums are now closed. To ask any new questions please visit Opmantek Community Questions.

Open-AudIT

What's on your network?
It is currently Fri Mar 29, 2024 1:42 am

All times are UTC + 10 hours




Forum locked This topic is locked, you cannot edit posts or make further replies.  [ 3 posts ] 
Author Message
PostPosted: Sat Mar 15, 2014 8:44 am 
Offline
Newbie

Joined: Fri Mar 14, 2014 7:30 am
Posts: 6
Hello!

I hope this is something easy. I've successfully discovered and audited a subnet, a single computer, and now a few servers (both linux and Windows). Now, I'd like to audit & discover my domain.

Using the web "Audit a Windows Domain", the discover_domain and audit_windows scripts copied themselves over to the server I wanted to run this on (one of our DCs). I checked out both scripts to make sure variables were set correctly. From there, I opened an administrative command prompt and ran "cscript audit_windows.vbs" - cool, it audited the server I was on, and the results were posted back to Open-AudIT as expected. So my variables are correct for where the results should be posted.

I then ran "cscript discover_domain.vbs". It kicked off the max number of processes and worked its way through the list. Unfortunately, the computers never showed up in Open-AudIT.

One thing I noticed - in the head of audit_windows.vbs - when run on the local machine, it says local. When run through discover-domain.vbs, it says remote. I know, that makes sense, but I also read in the documentation to use local for now. Am I putting this instruction where it shouldn't be?

I see other script windows pop up that are running the audit_windows.vbs on the remote machine, so I know the script path is working and the information that flashes by in the script window seems specific to that machine, so I think it's working. There's just some breakdown in getting bit back to Open-AudIT.

Audit_windows.vbs is v. 1.2
discover_domain.vbs is v. 1.2

Any hints as to where I should start troubleshooting or what more information I should provide? Thanks!

-Stead Halstead
Eugene, OR 97401


Top
 Profile  
Reply with quote  
PostPosted: Sat Mar 15, 2014 1:26 pm 
Offline
Site Admin
User avatar

Joined: Mon Jun 07, 2004 11:48 am
Posts: 1964
Location: Brisbane, Australia
Maybe hard set the url variable in the audit_windows.vbs script and don't bother setting it when you run discover_domain.vbs?

Also, in the Open-AudIT web interface, try this. Go to Menu -> admin -> List Groups and click the "update" icon on the right for the All devices group. Do you know see those computers in that Group?

Have you tried a Domain Audit from the web GUI? This should work as well... Menu -> admin -> Discovery -> Discover active Directory.

FYI - I have recently (as in the last couple of days) done some more work on Discovery to make it a bit more robust. v1.2.2 should be out soon (he says and then takes a month :-( )

_________________
Support and Development hours available from [url=https://opmantek.com]Opmantek[/url].
Please consider a purchase to help make Open-AudIT better for everyone.


Top
 Profile  
Reply with quote  
PostPosted: Sat Mar 15, 2014 3:01 pm 
Offline
Newbie

Joined: Fri Mar 14, 2014 7:30 am
Posts: 6
Thanks for the reply!

I didn't see a space in discover_domain for URL - so I don't think it's set. In audit_windows.vbs, the string is coded:
url = "http://192.168.2.172/index.php/system" - which seems correct. And the audit_windows.vbs script works if it's run on it's own (and results appear in Open-AudIT).

I started from the web gui, but for some reason it says it started the script but I don't see it kick off any audits. There's about 5 seconds of high CPU usage, but then it goes back to normal. Process viewer doesn't show any scripts being run. From the web gui, I did use a domain admin account to get this going, so it shouldn't be a permissions issue. The OA log shows:
Mar 14 21:53:35 openaudit 2502 C:discovery F:process_subnet Attempt to run audit_domain.vbs on 192.168.2.17 has succeeded.
Mar 14 21:53:35 openaudit 2502 C:discovery F:process_subnet SMBClient copy of audit_windows.vbs to 192.168.2.17 has succeeded.
Mar 14 21:53:35 openaudit 2502 C:discovery F:process_subnet SMBClient copy of audit_domain.vbs to 192.168.2.17 has succeeded.

Unfortunately, updating the groups didn't do the trick either. Very weird!

Does the script keep a log of why it might be stopping so quickly?

Thanks for the help!


Top
 Profile  
Reply with quote  
Display posts from previous:  Sort by  
Forum locked This topic is locked, you cannot edit posts or make further replies.  [ 3 posts ] 

All times are UTC + 10 hours


Who is online

Users browsing this forum: No registered users and 2 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
cron
Powered by phpBB® Forum Software © phpBB Group