Single Computer Audit Script

4 answers

1.  

   2

   1

   0

   • Mark Unwin
   • Jul 09, 2015

   You might try the WMI Diagnosis Utility -

   http://www.microsoft.com/en-us/download/details.aspx?id=7684

   If you have Visual Studio installed you might try -

   https://msdn.microsoft.com/en-us/library/bb961987.aspx

   Failing both of those you can edit the script. Note the "on error resume next" and the "on error goto 0" lines. Those should force the script to skip that section if an error occurs.

   if debugging > "0" then wscript.echo "scsi info" end if
   item = ""
   on error resume next
   set colItems = objWMIService.ExecQuery("Select * from Win32_SCSIController",,32)
   error_returned = Err.Number : if (error_returned <> 0 and debugging > "0") then wscript.echo check_wbem_error(error_returned) & " (Win32_SCSIController)" : audit_wmi_fails = audit_wmi_fails & "Win32_SCSIController " : end if
   for each objItem in colItems
       item = item & "     <scsi_controller>" & vbcrlf
       item = item & "         <name>" & escape_xml(objItem.Name) & "</name>" & vbcrlf
       item = item & "         <manufacturer>" & escape_xml(objItem.Manufacturer) & "</manufacturer>" & vbcrlf
       item = item & "         <device_id>" & escape_xml(objItem.PNPDeviceID) & "</device_id>" & vbcrlf
       item = item & "         <type>other</type>" & vbcrlf
       item = item & "     </scsi_controller>" & vbcrlf
   next
   if item > "" then
       result.WriteText "  <scsi_controllers>" & vbcrlf
       result.WriteText item
       result.WriteText "  </scsi_controllers>" & vbcrlf
   end if
   on error goto 0

   •  Comment

   CommentAdd your comment...
2.  

   1

   0

   -1

   • Aaron Castillo
   • Jul 10, 2015

   Definitely WMI issues on the system. Rebuilding WMI didn't work, but at least I know where the issue is. It appears to be only the SCSI provider. It's the only WMI Class I see that is failing.

    

   Thanks for your help

   •  Comment

   CommentAdd your comment...
3.  

   1

   0

   -1

   • Aaron Castillo
   • Jul 09, 2015

   Running this on a Windows Server 2008 R2. WMI looks fine

    

   Please see attached code block requested...

    

   if item > "" then
   	result.WriteText "	<bios>" & vbcrlf
   	result.WriteText item
   	result.WriteText "	</bios>" & vbcrlf
   end if
   
   if debugging > "0" then wscript.echo "scsi info" end if
   item = ""
   set colItems = objWMIService.ExecQuery("Select * from Win32_SCSIController",,32)
   error_returned = Err.Number : if (error_returned <> 0 and debugging > "0") then wscript.echo check_wbem_error(error_returned) & " (Win32_SCSIController)" : audit_wmi_fails = audit_wmi_fails & "Win32_SCSIController " : end if
   for each objItem in colItems
   	item = item & "		<scsi_controller>" & vbcrlf
   	item = item & "			<name>" & escape_xml(objItem.Name) & "</name>" & vbcrlf
   	item = item & "			<manufacturer>" & escape_xml(objItem.Manufacturer) & "</manufacturer>" & vbcrlf
   	item = item & "			<device_id>" & escape_xml(objItem.PNPDeviceID) & "</device_id>" & vbcrlf
   	item = item & "			<type>other</type>" & vbcrlf
   	item = item & "		</scsi_controller>" & vbcrlf
   next
   if item > "" then
   	result.WriteText "	<scsi_controllers>" & vbcrlf

   C:\Windows\system32>Winmgmt /salvagerepository
   WMI repository is consistent

   •  Comment

   CommentAdd your comment...
4.  

   1

   0

   -1

   • Mark Unwin
   • Jul 09, 2015

   Can you paste lines 1360 - 1380 from audit_windows.vbs so I can see the specific area causing the issue?

   In "my" audit_windows.vbs the line in question is

   set colItems = objWMIService.ExecQuery("Select * from Win32_SCSIController",,32)

   Which should be present on all Windows PCs. If this is the same I'd guess your WMI is bad.

   http://blogs.technet.com/b/askperf/archive/2009/04/13/wmi-rebuilding-the-wmi-repository.aspx

   •  Comment

   CommentAdd your comment...