Registrations to Open-AudIT forums are now closed. To ask any new questions please visit Opmantek Community Questions.

Open-AudIT

What's on your network?
It is currently Fri Mar 29, 2024 7:07 am

All times are UTC + 10 hours




Forum locked This topic is locked, you cannot edit posts or make further replies.  [ 3 posts ] 
Author Message
PostPosted: Sat Jun 08, 2013 5:27 am 
Offline
Moderator

Joined: Fri Jul 20, 2007 8:27 am
Posts: 1259
Not sure if it's just me or a bug but I needed to run audit_domain with audit_run_type = "remote" and it wasn't working. Attached is my changed audit_domain.vbs that gets it to work.

Need to run as a user with admin permissions to the remote machine and psexec.exe needs to be in your path. You don't need to supply remote_user and remote_path in my testing from Win7 and WinServer2003R2.

I disabled CheckForHungWMI because I don't think it does what it advertises (beyond the fact that it does nothing in it's current state.) And I also made audit_run_type remote obey number_of_audits.

p.s. I needed to audit "remotely" because Scheduled Tasks are not audited on remote machines with a "local" domain audit. I could have used a GPO or something but we might as well get audit_domain fixed. Needs testing but works here.


Attachments:
audit_domain_jpa.txt [13.08 KiB]
Downloaded 385 times
Top
 Profile  
Reply with quote  
PostPosted: Tue Jun 11, 2013 6:12 am 
Offline
Moderator

Joined: Fri Jul 20, 2007 8:27 am
Posts: 1259
And now I see the new scheduled task format has messed everything up and scheduled task data isn't even processed by OpenAudit v2. At least the remote audit stuff is working better than the across the WAN WMI audits.


Top
 Profile  
Reply with quote  
PostPosted: Tue Jun 11, 2013 11:29 am 
Offline
Site Admin
User avatar

Joined: Mon Jun 07, 2004 11:48 am
Posts: 1964
Location: Brisbane, Australia
Thanks JPA - have included your mods.

_________________
Support and Development hours available from [url=https://opmantek.com]Opmantek[/url].
Please consider a purchase to help make Open-AudIT better for everyone.


Top
 Profile  
Reply with quote  
Display posts from previous:  Sort by  
Forum locked This topic is locked, you cannot edit posts or make further replies.  [ 3 posts ] 

All times are UTC + 10 hours


Who is online

Users browsing this forum: No registered users and 2 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group