Open-AudIT

So, the way I'm running this using "audit_domain.vbs" with the option set to run the script locally... however, when I do this, it executes a "route print 0.0.0.0" on the server running the audit and seems to use it's local IP address for the "man_ip_address" field in the records for that system.

Am I the only one seeing this?

_________________
Colin

It is a problem with the new code trying to set man_ip_address to the IP of the adapter with the default route. Previously it was getting it "wrong" by choosing an undesired network adapter to get the IP address. The new code assumes it's running on the machine being audited and this is not the case when called from audit_domain.

Mark will need to fix this. Instead of using a shell to run "route print" we'll probably need to use WMI or a simple nslookup like we do for ldap audits.

Or here's a stab at the problem. Works in my testing. May need more error checking or I've assumed things that aren't true.

This uses WMI to get the routing table, finds the default route and the associated network adapter then grabs the primary ip address from that if it can or it looks in the registry for the ip address if it can't.



This doesn't find an ip address if the ipv4 gateway is blank. But the previous didn't either so it's no worse that way. The WMI routing stuff is IPV4 only so it also doesn't work with IPV6 only configs. Haven't tested how it breaks. Probably just doesn't get an ip address. I also threw this together quick so it could use some pretty-ifiying.

I'm bumping this because it didn't make it into 1.8.4