Open-AudIT

Hello there,

Im trying to audit domain PC's. When i add audit.vbs as a logon scrip for individual users, it runs, no problem with that. When i setup Group policy, so the script runs upon user login, it runs only once- once the audit.config is created, it doesnt run anymore for any user. In GPO I added the script "audit.vbs" into %systemroom%\sysvol\sysvol\script\ folder and add all relevant groups, so the script should run. No matter how many times i login\logout, it doesnt run again. It seems (my best guess), that the created file audit.config doesnt want to be ovewritten, even though i set the permissions on full access for everyone.
My questions:

Am i using correct vbs? I didnt find any domain related script inside the Script folder. Im using OAv1
Any way i can set NOT to create the file after the script runs?
In case i didnt set GPO correctly (attached picture), how to do it..?

Thank you for your support.

Ivan

If you're just starting out with OpenAudit I'd recommend starting with the Open Audit version 2 betas. OAv1 is old and no longer maintained.

With that out of the way. To audit with Open Audit v1 you need the audit.vbs script and a properly configured audit.config file. Depending on the audit.config file the audit.vbs will audit an individual machine or the domain. Post your audit.config file with any private information (passwords, domains, etc) removed and we can review.

If you want to audit an entire domain and you have relatively fast network links between all machines it's easiest to have a single machine run the audit.vbs which then queries all machines in the domain and posts the responses to the OA database. I think most of this is covered in the FAQ forum.

Thank you for your assistance with this. I managed to fix it. I didnt realize, i have to specify the OA URL in audit.vbs. Now it works fine.