Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Do anyone know of a script that uses no third party executables (preferably a batch file) that can be used to audit windows machine state security wise? (including best practices features - gpo, services, shares, updates etc.) so one can run the script on a server/workstation and analyze the output elsewhere?

share|improve this question

closed as too broad by Iszi, Gilles, AJ Henderson, Rory Alsop Dec 30 '13 at 20:24

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

Is there any reason you can't use a third party set of tools? SCAP (security content automation protocol) is designed specifically to do this with various policies and benchmarks. – iivel Nov 21 '11 at 15:57
There is. It is supposed to serve us with auditing cliets off-site, and many of them are not eager to run a 3rd party tool on their production systems. – dalimama Nov 21 '11 at 17:58
Well, I can't think of anything solid out there other than MBSA for the moment, but it does look like MSFT and NIST are teaming up with some SCAP/OVAL cmdlets for powershell… , – iivel Nov 22 '11 at 15:39
@dalimama - I can sympathize with clients not being "eager to run a third-party tool on their production systems". However, you might want to keep in mind that even a script - especially one as complex as this task requires - can be considered a "third-party tool". Your clients may want a copy of the script for their IT folks to review prior to usage or, if they lack the expertise to review it, may still opt to disallow it altogether. – Iszi Nov 22 '11 at 22:10

No, not really. A script really doesn't have enough reach within a Windows environment to get all of the information you would need. PowerShell might be able to do it, but I would be surprised if such a script exists. +1 if there really is one.

With that being said, your best bet may be the Baseline Security Analyzer by Microsoft: The nice thing about it is that it can be scripted, however parts of it need to be installed on the workstation.

share|improve this answer
I'm pretty sure a batch script could be used, if you can presume the presence of reg.exe on the system. I'm also fairly certain that PowerShell is more than capable of getting the information as well. The trick is knowing where to get it all, and writing the script so that it outputs only what you're looking for (and, ideally, flags policy violations). – Iszi Nov 22 '11 at 22:08
It's also worth noting that, while not technically "third-party", some clients may not want to install "additional" tools such as PowerShell on systems that don't already have it (i.e.: Windows XP/2003). – Iszi Nov 22 '11 at 22:14

Tenable Nessus Vulnerability scanner can be used as a compliance scanner to determine configurations that do not meet a particular standard including FDCC, Center for Internet Security, SCAP, DISA STIG, etc. Another tool that can be used for free is the Microsoft Security Compliance Manager. There are a lot more. Google those products first.

share|improve this answer
The op explicitly requested no 3rd party tools. – Rory Alsop Dec 30 '13 at 1:08

Not the answer you're looking for? Browse other questions tagged or ask your own question.