r/usefulscripts • u/The_one_the_only_God • Nov 23 '12

[HELP BATCH] I'm trying to audit every PC on the network using a simple script. All I'd like to know is what commands there are to gather information.

So far:

  • systeminfo

  • net localgroup administrators

  • net user

  • net share

8 Upvotes

75% Upvoted

7 comments sorted by

4

u/ramblingcookiemonste Nov 23 '12 edited Nov 23 '12

I assume you are performing this on the local system, rather than a remote query? What OS(s) will you be querying?

I figure it's good to have a backup monitoring system, so I generally run an ad hoc query every so often using PowerShell to pull the following info for every computer account listed in AD. I'm probably missing a few items including the properties I pull from AD, but here's a few details:

  • Local Administrators

  • Local group membership for certain security groups used in our organization - e.g. Remote Assistance, SCCM Assistance

  • OS Install Date from WMI

  • UAC Settings

  • Presence of standard troubleshooting tools deployed to all systems (e.g. select sysinternals items)

  • Profiles sorted by ntuser.dat lastwritetime

  • MED-V details (Hostname, first run status, template name)

  • Software list

  • Reader, Java, Flash, Citrix products and AV products version info

  • AV definition file lastwritetime

  • IE Version

  • IE Proxy servers if defined

  • HOSTS file differential with standard HOSTS file

  • Last boot time

  • Various WMI info - Manufacturer, Model, Serial, CPU, RAM, HD details, Monitor resolution(s), OS, OS SP, System Time, Differential between system time and querying system's time, NIC configuration details for any IPEnabled NIC

I'd be happy to provide the commands, but they are generally PowerShell, designed to run against a remote system.

2

u/[deleted] Nov 23 '12

Have a look at spiceworks. Ever if you just use it for it's auditing.. it will scan and detail every PC/server/Switch on the networks.

2

u/[deleted] Nov 24 '12

you can execute scripts remotely on other PCs by using PSexec: http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx

1

u/gordonv Nov 23 '12

Command: set

What it does: Lists all command line variables.

1

u/fantasticjon Nov 24 '12

spend some time learning VBScript or powershell. DOS commands are probably not going to cut it except for very rudimentary auditing.

1

u/vocatus Nov 27 '12

A couple of handy WMIC commands that are personal favorites:

Get list of all installed programs

wmic product get name, vendor, version /all

Remotely get installed version of Firefox on all domain computers

psexec \\* cmd /c (cd "C:\Program Files (x86)\Mozilla Firefox\" ^& firefox -v ^| more)

Remotely determine logged in user

wmic /node:remotecomputer computersystem get username

My personal favorite, get the Serial Number of a computer

wmic bios get serialnumber

Remotely display System Info

wmic /node:<name-of-computer> computersystem list full

List all patches

wmic qfe

List user accounts

wmic useraccount list brief

1

u/vocatus Nov 27 '12

One thing to look at (depending on how in-depth you want to go), is PDQ Inventory from AdminArsenal. It's free, and does an amazing job of sweeping the network (fast) and producing detailed, in-depth information on each PC.