Do anyone know of a script that uses no 3rd party executables (preferably a batch file) that can be used to audit windows machine state securitywise? (including best practices features - gpo, services, shares, updates etc.) so one can run the script on a server/workstation and analyze the output elsewhere?
No, not really. A script really doesn't have enough reach within a Windows environment to get all of the information you would need. PowerShell might be able to do it, but I would be surprised if such a script exists. +1 if there really is one.
With that being said, your best bet may be the Baseline Security Analyzer by Microsoft: http://technet.microsoft.com/en-us/security/cc184923. The nice thing about it is that it can be scripted, however parts of it need to be installed on the workstation.