Hello All,
I am working on a blacklist function for Open Audit. I have encountered some systems that for whatever reason don't like to be audited. Could be a WMI thing but I have little interest in figuring out why at the moment. I have noticed it hand on some SQL servers. Anyway, I am creating a balcklist.txt file that is read into an array. At each call of the audit I compare comparray(i) to ArrSkipList(z). If they match, dont audit. If they dont match go ahead and audit it. I don't want to get too far into this if someone else is further along than I am. Let me know what you think!
for z = 0 to Ubound(ArrSkipList)
if comparray(i) <> ArrSkipList(z)
Do The Audit
Else
wscript.echo "BLACKLIST HIT!"
Write ArrSkipList to skip.txt for logging
endif
Next
Thanks!
-mwm
http://www.blatbox.com