Open-AudIT

What's on your network?
It is currently Sat Apr 21, 2018 10:15 am

View unanswered posts | View active topics


Board index » Open-AudIT » Discussion

All times are UTC + 10 hours




Post new topic Reply to topic  Page 1 of 1
  [ 8 posts ] 
  Print view Previous topic | Next topic 
Author Message
spichelman
PostPosted: Tue Jan 20, 2015 2:42 am 
Offline
Newbie

Joined: Thu Apr 26, 2012 9:26 am
Posts: 37
Location: USA - Madison, Wi.
Hi-

Trying to audit a newer type laptop - Dell - failing on monitor or sound card info?
Tried debugging at cmd-line to file - not getting to point of creating debug file - sorry for verbose output here.

C:\>cscript //nologo C:\xampplite\open-audit\other\audit_windows.vbs strcomputer=computer submit_online=n echo_output=y create_file=y debugging=3 ping_target=y
starting audit - computer
Argurments
-------------------
create_file: y
debugging: 3
ldap:
org_id:
ping_target: y
run_netstat: s
self_delete: n
skip_printer: n
skip_software: n
skip_dns: n
skip_mount_point: n
strcomputer: computer
struser:
strpass:
submit_online: n
system_id:
url: http://localhost/index.php/system/add_system
use_proxy: n
windows_user_work_1: physicalDeliveryOfficeName
windows_user_work_2: company
details_to_lower: y
hide_audit_window: n
-------------------
LocalNet: 192.168.1.51 MDNAM
Target: computer
No Match: Auditing remote host.
PC computer responding to ping
My PID is : 692
Audit Start Time : 2015-01-19 10:36:29
Audit Location: remote
-------------------
system info
windows info
FullAD: OU=Users,OU=xxxxx,OU=xxxxxx,DC=xxxxxx,DC=local
Attribute: physicalDeliveryOfficeName
SAM: xxxxxx
select name, physicalDeliveryOfficeName from 'GC://OU=Users,OU=xxxxxx,OU=xxxxxx,DC=xxxxx,DC=local' where objectCategory = 'person' and sAMAccountName = 'xxxxx'
User data for physicalDeliveryOfficeName is: xxxxxx
Windows User: xxxxx@xxxxx (xxxxxxx)
bios info
scsi info
processor info
memory info
motherboard info
optical info
modem info
video info
monitor info

C:\xampplite\open-audit\other\audit_windows.vbs(1688, 4) Microsoft VBScript runtime error: Object not a collection

Researched this error and am not able to figure out if this has to do with VB and WMI and not recognizing sound card or Monitor info - HW driver?

Appreciate any help - thx.

-SP
Top
 Profile  
Reply with quote  
jpa
PostPosted: Tue Jan 20, 2015 3:18 am 
Offline
Moderator

Joined: Fri Jul 20, 2007 8:27 am
Posts: 1254
What's on line 1688 in your audit_windows.vbs file?
Top
 Profile  
Reply with quote  
spichelman
PostPosted: Tue Jan 20, 2015 3:48 am 
Offline
Newbie

Joined: Thu Apr 26, 2012 9:26 am
Posts: 37
Location: USA - Madison, Wi.
Hi Jpa-

1.
Yes - here it is...
"for each sKey2 In arSubKeys2"

2.
This comes after the code...

if debugging > "0" then wscript.echo "monitor info" end if
' note we exclude "monitors" that are plug'n'play types and have no real info
item = ""
dim strarrRawEDID(10)
dim temp_model(10)
dim temp_manuf(10)
intMonitorCount=0
sBaseKey = "SYSTEM\CurrentControlSet\Enum\DISPLAY\"
iRC = oReg.EnumKey(HKEY_LOCAL_MACHINE, sBaseKey, arSubKeys)
item = ""
all_device_serial = ""

if isnull(arSubKeys) then
' do nothing
if debugging > "1" then wscript.echo "Nothing in arSubKeys" end if
else...
Top
 Profile  
Reply with quote  
spichelman
PostPosted: Tue Jan 20, 2015 3:52 am 
Offline
Newbie

Joined: Thu Apr 26, 2012 9:26 am
Posts: 37
Location: USA - Madison, Wi.
I added On error Resume Next in VB code and then got these mesg's in next scan:

sound info
Unspecified wbem error: 451 (Win32_SoundDevice)
disk info
Unspecified wbem error: 451 (Win32_DiskDrive)

See attached debug - thx.

-SP


Attachments:
Computer_Debug-1-19-15.zip [35.07 KiB]
Downloaded 156 times
Top
 Profile  
Reply with quote  
jpa
PostPosted: Tue Jan 20, 2015 7:44 am 
Offline
Moderator

Joined: Fri Jul 20, 2007 8:27 am
Posts: 1254
It looks like the code should be checking the iRC2 return code for success. If arSubKeys2 is not a collection then bad things happen. Hopefully Mark will notice this thread and a check in the next version.

Something like this (untested) if statement addition:
Code:
         sBaseKey2 = sBaseKey & sKey & "\"
         iRC2 = oReg.EnumKey(HKEY_LOCAL_MACHINE, sBaseKey2, arSubKeys2)
         if iRC2 = 0 then
            for each sKey2 In arSubKeys2
               oReg.GetMultiStringValue HKEY_LOCAL_MACHINE, sBaseKey2 & sKey2 & "\", "HardwareID", sValue
               for tmpctr=0 to ubound(svalue)
                  if lcase (left(svalue(tmpctr),8))="monitor\" then
                     sBaseKey3 = sBaseKey2 & sKey2 & "\"
                     iRC3 = oReg.EnumKey(HKEY_LOCAL_MACHINE, sBaseKey3, arSubKeys3)
                     for each sKey3 In arSubKeys3
                        if skey3="Control" then
                           strRawEDID = ""
                           oReg.GetStringValue HKEY_LOCAL_MACHINE, sbasekey3, "DeviceDesc", temp_model(intMonitorCount)
                           oReg.GetStringValue HKEY_LOCAL_MACHINE, sbasekey3, "Mfg", temp_manuf(intMonitorCount)
                           oReg.GetBinaryValue HKEY_LOCAL_MACHINE, sbasekey3 & "Device Parameters\", "EDID", arrintEDID
                           if VarType(arrintedid) <> 8204 then
                              strRawEDID="EDID Not Available"
                           else
                              for each bytevalue in arrintedid
                                 strRawEDID=strRawEDID & chr(bytevalue)
                              next
                           end if
                           'redim Preserve strarrRawEDID(intMonitorCount)
                           strarrRawEDID(intMonitorCount)=strRawEDID
                           intMonitorCount=intMonitorCount+1
                        end if
                     next
                  end if
               next
            next
         end if

Should be slightly less nuclear an option than the Resume Next presuming it works.

Not sure on the next errors you found. Did you put an On error Resume 0 after the monitor stuff to turn error checking back on?
Top
 Profile  
Reply with quote  
spichelman
PostPosted: Wed Jan 21, 2015 1:03 am 
Offline
Newbie

Joined: Thu Apr 26, 2012 9:26 am
Posts: 37
Location: USA - Madison, Wi.
Thanks JPA.
Appreciate the code and will test and let you know.

No - I did not add "On error Resume 0" after monitor code - I will test.
Again - grateful for your quick responses and help.

-SP
Top
 Profile  
Reply with quote  
spichelman
PostPosted: Wed Jan 21, 2015 5:52 am 
Offline
Newbie

Joined: Thu Apr 26, 2012 9:26 am
Posts: 37
Location: USA - Madison, Wi.
Hi JPA-

1.
I tried adding code you suggested - still the same error.

monitor info
C:\xampplite\open-audit\other\audit_windows.vbs(1689, 13) Microsoft VBScript runtime error: Object not a collection"

Code:
 
if iRC2 = 0 then
            for each sKey2 In arSubKeys2
               oReg.GetMultiStringValue HKEY_LOCAL_MACHINE, sBaseKey2 & sKey2 & "\", "HardwareID", sValue
               for tmpctr=0 to ubound(svalue)
                  if lcase (left(svalue(tmpctr),8))="monitor\" then
                     sBaseKey3 = sBaseKey2 & sKey2 & "\"
                     iRC3 = oReg.EnumKey(HKEY_LOCAL_MACHINE, sBaseKey3, arSubKeys3)
                     for each sKey3 In arSubKeys3
                        if skey3="Control" then
                           strRawEDID = ""
                           oReg.GetStringValue HKEY_LOCAL_MACHINE, sbasekey3, "DeviceDesc", temp_model(intMonitorCount)
                           oReg.GetStringValue HKEY_LOCAL_MACHINE, sbasekey3, "Mfg", temp_manuf(intMonitorCount)
                           oReg.GetBinaryValue HKEY_LOCAL_MACHINE, sbasekey3 & "Device Parameters\", "EDID", arrintEDID
                           if VarType(arrintedid) <> 8204 then
                              strRawEDID="EDID Not Available"
                           else
                              for each bytevalue in arrintedid
                                 strRawEDID=strRawEDID & chr(bytevalue)
                              next
                           end if
                           'redim Preserve strarrRawEDID(intMonitorCount)
                           strarrRawEDID(intMonitorCount)=strRawEDID
                           intMonitorCount=intMonitorCount+1
                        end if
                next
                  end if
               next
            next
         end if


2.
Yes - added "On error Resume 0" now for error checking to be enabled after that bit of code.
And keeping this code - so we can get thru audit with certain machines that error out with current code....

Code:
for each sKey In arSubKeys
      if sKey > "" then
         ' note - using the above because the key SYSTEM\CurrentControlSet\Enum\DISPLAY\Default_Monitor is not returning any value for some reason?
         sBaseKey2 = sBaseKey & sKey & "\"
         iRC2 = oReg.EnumKey(HKEY_LOCAL_MACHINE, sBaseKey2, arSubKeys2)
         for each sKey2 In arSubKeys2
         On error Resume Next
            oReg.GetMultiStringValue HKEY_LOCAL_MACHINE, sBaseKey2 & sKey2 & "\", "HardwareID", sValue
            for tmpctr=0 to ubound(svalue)
               if lcase (left(svalue(tmpctr),8))="monitor\" then
                  sBaseKey3 = sBaseKey2 & sKey2 & "\"
                  iRC3 = oReg.EnumKey(HKEY_LOCAL_MACHINE, sBaseKey3, arSubKeys3)
                  for each sKey3 In arSubKeys3
                     if skey3="Control" then
                        strRawEDID = ""
                        oReg.GetStringValue HKEY_LOCAL_MACHINE, sbasekey3, "DeviceDesc", temp_model(intMonitorCount)
                        oReg.GetStringValue HKEY_LOCAL_MACHINE, sbasekey3, "Mfg", temp_manuf(intMonitorCount)
                        oReg.GetBinaryValue HKEY_LOCAL_MACHINE, sbasekey3 & "Device Parameters\", "EDID", arrintEDID
                        if VarType(arrintedid) <> 8204 then
                           strRawEDID="EDID Not Available"
                        else
                           for each bytevalue in arrintedid
                              strRawEDID=strRawEDID & chr(bytevalue)
                           next
                        end if
                        'redim Preserve strarrRawEDID(intMonitorCount)
                        strarrRawEDID(intMonitorCount)=strRawEDID
                        intMonitorCount=intMonitorCount+1
                     end if
                  next
               end if
            next
         next
      end if
   next
   On error Resume 0


3.
Would like to know if this is a software/driver issue?
Perhaps in Dev Mgr - the device(s) have Yellow Exclamation points or are using incorrect/mis-configured driver/software for machine - we'll check further.

Any other thoughts from you or Mark?
Thx.

-SP
Top
 Profile  
Reply with quote  
jpa
PostPosted: Wed Jan 21, 2015 8:39 am 
Offline
Moderator

Joined: Fri Jul 20, 2007 8:27 am
Posts: 1254
For whatever reason enumkey isn't returning a valid collection in arSubKeys2. Without access to your machine it's hard to debug. Maybe a dump of your HKLM\SYSTEM\CurrentControlSet\Enum\DISPLAY\ registry would help.

It's probably just easiest to blow over the error as you've done.
Top
 Profile  
Reply with quote  
Display posts from previous:  Sort by  
Post new topic Reply to topic  Page 1 of 1
  [ 8 posts ] 

Board index » Open-AudIT » Discussion

All times are UTC + 10 hours


Who is online

Users browsing this forum: No registered users and 2 guests

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
cron
Powered by phpBB® Forum Software © phpBB Group