Open-AudIT
https://www.open-audit.org/phpBB3/

auditing XPe or small footprint PCs
https://www.open-audit.org/phpBB3/viewtopic.php?f=5&t=2214
Page 1 of 1

Author:  shankwc [ Thu Apr 19, 2007 12:32 am ]
Post subject:  auditing XPe or small footprint PCs

We have a number of Windows XP Embedded PCs that have small flsh drives (192M) and limited RAM (256M). I've never been able to get the audit.vbs script to successfully run on these boxes. However, we have upgraded a few to 512M Flash Disk and 512M ram and the audit succeeds. It may be that the larger flash systems have a missing componenet - or it might be that the ram and disk space is needed. Is there any way to find out? I'd really like to audit the small terminals too.

Author:  A_Hull [ Thu Apr 19, 2007 2:06 am ]
Post subject: 

Can you "manage" them using the manage computer MMC plugin, are they running WMI?

Author:  shankwc [ Thu Apr 19, 2007 2:23 am ]
Post subject: 

sort-of. i have a demo unit which I can connect via manage - but can't do anything - permission denied. probably because it's in a domain that doesn't exist. i suspect any machines in production would probably work. i can't test them at this point.

Author:  shankwc [ Tue Apr 24, 2007 12:17 am ]
Post subject: 

it turns out the base model of these units don't have the MMC installed. could this be causing the issue?

Author:  shankwc [ Tue Apr 24, 2007 12:40 am ]
Post subject: 

it seems that if i comment out lines 159 & 160 in the audit script then the script runs - but i don't get any results.

here are the two lines:
Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\default:StdRegProv")
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")

I'm guessing this is the heart of the audit. Is there a way to do a 'light' audit? really, i'd just like to get the machine name, IP, and maybe some identifier that tells me the system is a terminal. that would be enough for my purposes at this time.

Author:  A_Hull [ Tue Apr 24, 2007 3:53 am ]
Post subject: 

NMAP seems the best way to go, run the nmap audit script and your thin boxes will show up under other items >networked items

Hope this helps. :)

Page 1 of 1 All times are UTC + 10 hours
Powered by phpBB® Forum Software © phpBB Group
https://www.phpbb.com/