Odd cscript audit issue

 
1
0
-1

Running version 3.5.3 of Open-AudIT.

I am seeing the following with some PCs but not all when running  - Cscript audit_windows.vbs pcname

CD Keys

X:\audit_windows.vbs(5777, 5) WshShell.Exec: Access is denied.

If I do debugging = 5

CD Keys

Win 2000 Key

Win 64bit Key

Office XP Key

X:\audit_windows.vbs(5777, 5) WshShell.Exec: Access is denied.





Hi Chad,

Line 5777 is the command executed to query the SqlLite database for Adobe keys.

set rexec = objShell.exec(cmd)

I'm assuming it's not working because of a Windows user permissions issue.

Are you auditing the local PC or running the script locally and targetting a remote PC?

If you don't need or care about the Adobe keys, you could just comment out or delete this entire function (lines 5753 → 5824).

Mark.

    CommentAdd your comment...

    6 answers

    1.  
      1
      0
      -1

      To get executables to run when called from the open audit scan script, we had to add execute permissions on the .exe files in the directory where the script is stored.


      Sqlite3.exe was failing with “Access Denied” when the audit_windows.vbs script would call it. Only certain PCs would fail because it would only run sqlite if Adobe Acrobat Pro had been installed in the past.

      Here are the changes we made:


      Basically we ran this:  chmod 5555 /smb/openaudit/open-audit/other/*.exe



        CommentAdd your comment...
      1.  
        1
        0
        -1

        Yeah odd as it scans fine on our super old linux 1.12 and on a test bed windows 3.2.2.

        But issues with this linux 3.5.3 build.

        Should I take the audit_windows.vbs file from the Windows 3.2.2 file and copy it over to the Linux build and try it?


        1. Mark Unwin

          It's worth a try. Just take a backup of your existing audit_windows.vbs first so you can restore it afterwards.

        CommentAdd your comment...
      2.  
        1
        0
        -1

        Chad,

        I don't know what your old version was but if you check GitHub you can see there hasn't been any major changes to audit_windows.vbs for quite a while.

        https://github.com/Opmantek/open-audit/commits/master/other/audit_windows.vbs

        I am unsure what could be causing this issue.

        You can always click the "Browse the repository at this point in the history" button on the page above, navigate to other/audit_windows.vbs and grab an older version. Make a backup of your existing script and test using the older one.

        Mark.

          CommentAdd your comment...
        1.  
          1
          0
          -1

          Fails auditing the PC locally or remotely using those commands. At least with that one.

          cscript audit_windows.vbs


            CommentAdd your comment...
          1.  
            1
            0
            -1

            Chad,

            debugging=5 is the maximum. Debugging wouldn't help as it's hard failing.

            Are you auditing the local PC or running the script locally and targeting a remote PC?

            Mark.

              CommentAdd your comment...
            1.  
              1
              0
              -1

              Didn't mean to delete that post.

              Account has domain admin rights and only seems to be failing on a few.

              Seems odd to me that it is only failing on a few any other logging I can turn on?

                CommentAdd your comment...