The following scripts and information can be used to audit Administrator privileges on local servers in Windows domain and non-Domain environments. These scripts require sufficient privileges on each of the servers to be audited.
Helpful ways of manipulating data in Excel
http://support.microsoft.com/kb/213889
Perform a FIND from the RIGHT hand side in Excel:
=IFERROR(RIGHT(E113406,LEN(E113406)-FIND("^^^^^",SUBSTITUTE(E113406,":","^^^^^",LEN(E113406)-LEN(SUBSTITUTE(E113406,":",""))))),E113406)
Remove the extra domain name "\" that the non-WMI audit of local servers currently puts even though it is returninig a local group.
=IFERROR(IF(FIND("\",SUBSTITUTE(B31876,"\","b",1))>0,RIGHT(B31876,LEN(B31876)-FIND("\",SUBSTITUTE(B31876,"\","b",2))),"False"),B31876)
Monday, March 14, 2011
Powershell: Remote Non-WMI auditing of Windows permissions
Labels:
audit,
HPA,
local administrators group,
non-WMI,
permissions,
powershell,
Scripting,
Technical,
windows,
windows audit
Subscribe to:
Post Comments (Atom)
Maybe I'm missing something, but I can't find the scripts mentioned in the first part of this blog post.
ReplyDeleteCan you provide a link to them as I would find them very useful.