Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 0 down vote favorite

Do anyone know of a script that uses no 3rd party executables (preferably a batch file) that can be used to audit windows machine state securitywise? (including best practices features - gpo, services, shares, updates etc.) so one can run the script on a server/workstation and analyze the output elsewhere?

share|improve this question
1  
Is there any reason you can't use a third party set of tools? SCAP (security content automation protocol) is designed specifically to do this with various policies and benchmarks. – iivel Nov 21 '11 at 15:57
1  
There is. It is supposed to serve us with auditing cliets off-site, and many of them are not eager to run a 3rd party tool on their production systems. – dalimama Nov 21 '11 at 17:58
Well, I can't think of anything solid out there other than MBSA for the moment, but it does look like MSFT and NIST are teaming up with some SCAP/OVAL cmdlets for powershell scap.nist.gov/events/2011/itsac/presentations/day2/… , services.nvd.nist.gov/jira/browse/SCAPDEV-1 – iivel Nov 22 '11 at 15:39
1  
@dalimama - I can sympathize with clients not being "eager to run a third-party tool on their production systems". However, you might want to keep in mind that even a script - especially one as complex as this task requires - can be considered a "third-party tool". Your clients may want a copy of the script for their IT folks to review prior to usage or, if they lack the expertise to review it, may still opt to disallow it altogether. – Iszi Nov 22 '11 at 22:10

1 Answer

up vote 2 down vote

No, not really. A script really doesn't have enough reach within a Windows environment to get all of the information you would need. PowerShell might be able to do it, but I would be surprised if such a script exists. +1 if there really is one.

With that being said, your best bet may be the Baseline Security Analyzer by Microsoft: http://technet.microsoft.com/en-us/security/cc184923. The nice thing about it is that it can be scripted, however parts of it need to be installed on the workstation.

share|improve this answer
I'm pretty sure a batch script could be used, if you can presume the presence of reg.exe on the system. I'm also fairly certain that PowerShell is more than capable of getting the information as well. The trick is knowing where to get it all, and writing the script so that it outputs only what you're looking for (and, ideally, flags policy violations). – Iszi Nov 22 '11 at 22:08
It's also worth noting that, while not technically "third-party", some clients may not want to install "additional" tools such as PowerShell on systems that don't already have it (i.e.: Windows XP/2003). – Iszi Nov 22 '11 at 22:14

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.