SHOW:
|
|
- or go back to the newest paste.
| 1 | #Detailed Server Audit to Text File | |
| 2 | # | |
| 3 | #Thanks to all the Powershell Users who contributed their code. Created on 8/24/15. | |
| 4 | # | |
| 5 | #This Powershell script outputs a very verbose and detailed audit for a list of servers that can be put in a Word or OneNote Document. This script runs on the local server with the Invoke-Command command and saves the information to a detailed text file on a network file share. It requires the following commands to connect remotely and save to a network file share. | |
| 6 | # | |
| 7 | #Run Commands on Server in Powershell Console | |
| 8 | #"Set-ExecutionPolicy RemoteSigned -Force" | |
| 9 | #"Enable-PSRemoting -Force" | |
| 10 | #"Enable-WsManCredSSP -Role Server -Force" | |
| 11 | # | |
| 12 | #Run Commands on Your Computer in Powershell Console | |
| 13 | #"Enable-WSManCredSSP -Role Client -DelegateComputer *.YOURDOMAIN.COM" | |
| 14 | # | |
| 15 | #Replace the path to the text files in the script with your network file share location. | |
| 16 | #\\YOURSERVER\YOURFILESHARE\YOURTEXTFILE.txt | |
| 17 | # | |
| 18 | #Features To Update | |
| 19 | #-Add More Write-Host | |
| 20 | #-Add Logging | |
| 21 | #-Fix Date Time Formatting | |
| 22 | #-Cleanup Formatting | |
| 23 | ||
| 24 | #Pre-Script Commands | |
| 25 | Clear-Host | |
| 26 | ||
| 27 | #Get Credentials | |
| 28 | if($cred = $host.ui.PromptForCredential("Need credentials", "Please enter your user name and password.", "", "")){}else{exit}
| |
| 29 | ||
| 30 | #Get Servers | |
| 31 | $ServerList = Get-Content "\\YOURSERVER\YOURFILESHARE\Servers.txt" | |
| 32 | ForEach ($Server in $ServerList) {
| |
| 33 | ||
| 34 | #Remote Script | |
| 35 | Invoke-Command -ComputerName $Server -Credential $cred -Authentication CredSSP -ScriptBlock {
| |
| 36 | ||
| 37 | #Start Script | |
| 38 | #Import Modules | |
| 39 | Import-Module ServerManager | |
| 40 | ||
| 41 | #Misc Variables | |
| 42 | $ServerName = $env:computername | |
| 43 | $CurrentDateTime = Get-Date | |
| 44 | $FileOutput = "\\YOURSERVER\YOURFILESHARE\$ServerName.txt" | |
| 45 | Write-Host "$($ServerName) - Starting Script" | |
| 46 | #Create Files | |
| 47 | If(Test-Path -path $FileOutput) | |
| 48 | {}
| |
| 49 | else {New-Item $FileOutput -type file}
| |
| 50 | ||
| 51 | #Clear File Content | |
| 52 | Clear-Content $FileOutput | |
| 53 | ||
| 54 | #WMI Queries | |
| 55 | $OperatingSystems = Get-WmiObject -Class Win32_OperatingSystem | Select -Property Caption , CSDVersion , OSArchitecture , Description | |
| 56 | $Disk = Get-WmiObject -Class Win32_LogicalDisk -Filter DriveType=3 | Select SystemName , DeviceID , @{Name=”sizeGB”;Expression={“{0:N1}” -f($_.size/1gb)}} , @{Name=”freespaceGB”;Expression={“{0:N1}” -f($_.freespace/1gb)}}
| |
| 57 | $BIOS = Get-WmiObject -Class Win32_BIOS | Select -Property Manufacturer , Model , Version , SerialNumber | |
| 58 | $ComputerSystem = Get-WmiObject -Class Win32_ComputerSystem | Select -Property Name , Model , Manufacturer , NumberOfProcessors , Description | |
| 59 | $Processor = [object[]]$(get-WMIObject Win32_Processor) | |
| 60 | $ProcessorName = Get-WmiObject -Class Win32_Processor | Select -First 1 -Property Name | |
| 61 | $PhysicalMemory = (Get-WMIObject Win32_PhysicalMemory | Measure-Object Capacity -Sum).sum/1GB | |
| 62 | $Adapters = Get-WmiObject -Class Win32_NetworkAdapterConfiguration | |
| 63 | $Features = Get-WindowsFeature | Where-Object {$_.Installed -eq $True} | Select -Property DisplayName
| |
| 64 | ||
| 65 | #Virtual or Physical System | |
| 66 | if($BIOS.Version -match "VRTUAL") {$PhysicalOrVirtual = "Virtual - Hyper-V"}
| |
| 67 | elseif($BIOS.Version -match "A M I") {$PhysicalOrVirtual = "Virtual - Virtual PC"}
| |
| 68 | elseif($BIOS.Version -like "*Xen*") {$PhysicalOrVirtual = "Virtual - Xen"}
| |
| 69 | elseif($BIOS.SerialNumber -like "*VMware*") {$PhysicalOrVirtual = "Virtual - VMWare"}
| |
| 70 | elseif($ComputerSystem.manufacturer -like "*Microsoft*") {$PhysicalOrVirtual = "Virtual - Hyper-V"}
| |
| 71 | elseif($ComputerSystem.manufacturer -like "*VMWare*") {$PhysicalOrVirtual = "Virtual - VMWare"}
| |
| 72 | elseif($ComputerSystem.model -like "*Virtual*") {$PhysicalOrVirtual = "Virtual"}
| |
| 73 | else {$PhysicalOrVirtual = "Physical"}
| |
| 74 | ||
| 75 | #Computer.txt File Content | |
| 76 | #Overview | |
| 77 | Add-Content $FileOutput "Overview" | |
| 78 | Add-Content $FileOutput "The $env:computername Server is the $($OperatingSystems.Description). This Server was last queried on $CurrentDateTime." | |
| 79 | Add-Content $FileOutput "" | |
| 80 | ||
| 81 | #Specifications | |
| 82 | Add-Content $FileOutput "Specifications" | |
| 83 | Write-Output "The $PhysicalOrVirtual Server $($ComputerSystem.Name) runs the $($OperatingSystems.Caption)$($OperatingSystems.CSDVersion) $($OperatingSystems.OSArchitecture) Operating System on $($ComputerSystem.Model) with $($PhysicalMemory) GBs of Memory running on $($SystemProcessor.Name) with $(($Processor|measure-object NumberOfLogicalProcessors -sum).Sum) Logical processors and $($Processor.count) Cores." | Out-File -FilePath “$FileOutput” -Encoding "UTF8" -Append | |
| 84 | Add-Content $FileOutput "" | |
| 85 | Write-Output "The Operating System is installed on the $env:SystemDrive Drive, and the rest of the drives are for data. The server has the following $($Disk.count) drives:" | Out-File -FilePath “$FileOutput” -Encoding "UTF8" -Append | |
| 86 | ||
| 87 | #Drives | |
| 88 | $Disk | Foreach-Object {
| |
| 89 | Write-Output "The $($_.DeviceID) Drive size is $($_.sizeGB) GBs with $($_.freespaceGB) GBs of free space." | Out-File -FilePath “$FileOutput” -Encoding "UTF8" -Append | |
| 90 | } | |
| 91 | Add-Content $FileOutput "" | |
| 92 | ||
| 93 | #Network Adapters | |
| 94 | Add-Content $FileOutput "This Server has the following active Network Adapters:" | |
| 95 | Foreach ($Adapter in ($Adapters | Where {$_.IPEnabled -eq $True})) {
| |
| 96 | $AdapterDetails = "" | Select Description, "Physical address" , "IP Address" , "Subnet Mask" , "Default Gateway" , "DHCP Enabled", DNSServerSearchOrder , WINS , DNS | |
| 97 | $AdapterDetails.Description = "$($Adapter.Description)" | |
| 98 | $AdapterDetails."Physical address" = "$($Adapter.MACaddress)" | |
| 99 | If ($Adapter.IPAddress -ne $Null) {
| |
| 100 | $AdapterDetails."IP Address" = "$($Adapter.IPAddress)" | |
| 101 | $AdapterDetails."Subnet Mask" = "$($Adapter.IPSubnet)" | |
| 102 | $AdapterDetails."Default Gateway" = "$($Adapter.DefaultIPGateway)" | |
| 103 | } | |
| 104 | If ($Adapter.DHCPEnabled -eq "True") {
| |
| 105 | $AdapterDetails."DHCP Enabled" = "enabled" | |
| 106 | } | |
| 107 | Else {
| |
| 108 | $AdapterDetails."DHCP Enabled" = "not enabled" | |
| 109 | } | |
| 110 | If ($Adapter.DNSServerSearchOrder -ne $Null) {
| |
| 111 | $AdapterDetails.DNS = "$($Adapter.DNSServerSearchOrder)" | |
| 112 | } | |
| 113 | $AdapterDetails.WINS = "$($Adapter.WINSPrimaryServer) $($Adapter.WINSSecondaryServer)" | |
| 114 | Write-Output "The Network Adapter '$($AdapterDetails.Description)' has the IP Address of $($AdapterDetails.”IP Address"), Subnet Mask of $($AdapterDetails.”Subnet Mask"), Default Gateway of $($AdapterDetails.”Default Gateway"), WINS Servers are $($AdapterDetails.WINS) and the DNS Servers are $($AdapterDetails.DNS) with the MAC Address of $($AdapterDetails.”Physical address"). DHCP Addressing is $($AdapterDetails."DHCP Enabled")." | Out-File -FilePath “$FileOutput” -Encoding "UTF8" -Append | |
| 115 | Add-Content $FileOutput "" | |
| 116 | } | |
| 117 | ||
| 118 | #Local Administrators | |
| 119 | Add-Content $FileOutput "Local Administrators" | |
| 120 | Add-Content $FileOutput "$env:ComputerName has the following Local Administrators:" | |
| 121 | net localgroup administrators | where {$_ -AND $_ -notmatch "command completed successfully"} | select -skip 4 | Out-File -FilePath “$FileOutput” -Encoding "UTF8" -Append
| |
| 122 | Add-Content $FileOutput "" | |
| 123 | ||
| 124 | #Roles and Features Section | |
| 125 | Add-Content $FileOutput "Roles and Features" | |
| 126 | Add-Content $FileOutput "$env:ComputerName has the following Roles and Features installed:" | |
| 127 | $Features | Foreach-Object {
| |
| 128 | Write-Output $_.DisplayName | Out-File -FilePath “$FileOutput” -Encoding "UTF8" -Append | |
| 129 | } | |
| 130 | Add-Content $FileOutput "" | |
| 131 | ||
| 132 | #Applications Section | |
| 133 | Add-Content $FileOutput "Applications" | |
| 134 | Add-Content $FileOutput "This Server has the following non-default Applications installed:" | |
| 135 | $ServerAppFilter = Get-Content -Path "\\YOURSERVER\YOURFILESHARE\ServerAppFilter.txt" | |
| 136 | $ServerApps = Get-WmiObject Win32_Product | Select Name , Version | |
| 137 | $ServerApps | Where-Object {!($ServerAppFilter -contains $_.Name -or $_.Name -like "*Microsoft*" -or $_.Name -Like "*NetIQ*" -or $_.Name -like "*SQL Server*" -or $_.Name -like "*Symantec*" -or $_.Name -like "*Visual Studio*" -or $_.Name -like "*Visual Basic*")} | Sort Name | Foreach-Object {
| |
| 138 | Write-Output "$($_.Name)" | Out-File -FilePath “$FileOutput” -Encoding "UTF8" -Append | |
| 139 | } | |
| 140 | Add-Content $FileOutput "" | |
| 141 | Add-Content $FileOutput "This Server has the following default Applications installed:" | |
| 142 | $ServerAppFilter = Get-Content -Path "\\YOURSERVER\YOURFILESHARE\ServerAppFilter.txt" | |
| 143 | $ServerApps | Where-Object {$ServerAppFilter -contains $_.Name -or $_.Name -like "*Microsoft*" -or $_.Name -Like "*NetIQ*" -or $_.Name -like "*SQL Server*" -or $_.Name -like "*Symantec*" -or $_.Name -like "*Visual Studio*" -or $_.Name -like "*Visual Basic*"} | Sort Name | Foreach-Object {
| |
| 144 | Write-Output "$($_.Name)" | Out-File -FilePath “$FileOutput” -Encoding "UTF8" -Append | |
| 145 | } | |
| 146 | Add-Content $FileOutput "" | |
| 147 | ||
| 148 | #Services Section | |
| 149 | Add-Content $FileOutput "Services" | |
| 150 | Add-Content $FileOutput "This Server has the following non-default services installed:" | |
| 151 | $ServerServiceFilter = Get-Content -Path "\\YOURSERVER\YOURFILESHARE\ServerServiceFilter.txt" | |
| 152 | $Service = Get-WmiObject win32_service | Select DisplayName , State , StartName | Where-Object { $ServerServiceFilter -notcontains $_.DisplayName}
| |
| 153 | $Service | Foreach-Object {
| |
| 154 | Write-Output "$($_.DisplayName) runs as $($_.State) on $($_.StartName)." | Out-File -FilePath “$FileOutput” -Encoding "UTF8" -Append | |
| 155 | } | |
| 156 | Add-Content $FileOutput "" | |
| 157 | ||
| 158 | #File Shares | |
| 159 | Add-Content $FileOutput "File Shares" | |
| 160 | Add-Content $FileOutput "$env:ComputerName has the following File Shares installed:" | |
| 161 | $FileShares = Get-WmiObject -Class Win32_Share | Select -Property Name , Path , Description | |
| 162 | $FileShares | Foreach-Object {
| |
| 163 | Write-Output "$($_.Name) with the path of $($_.Path) is used for $($_.Description)." | Out-File -FilePath “$FileOutput” -Encoding "UTF8" -Append | |
| 164 | } | |
| 165 | Add-Content $FileOutput "" | |
| 166 | ||
| 167 | #Scheduled Tasks Section | |
| 168 | $SchedTasks = New-Object -Com "Schedule.Service" | |
| 169 | $SchedTasks.Connect() | |
| 170 | $SchedOut = @() | |
| 171 | $SchedTasks.GetFolder("\").GetTasks(0) | % {
| |
| 172 | $xml = [xml]$_.xml | |
| 173 | $SchedOut += New-Object psobject -Property @{
| |
| 174 | "Name" = $_.Name | |
| 175 | "Path" = $_.Path | |
| 176 | "Status" = switch($_.State) {0 {"Unknown"} 1 {"Disabled"} 2 {"Queued"} 3 {"Ready"} 4 {"Running"}}
| |
| 177 | "NextRunTime" = $_.NextRunTime | |
| 178 | "LastRunTime" = $_.LastRunTime | |
| 179 | "LastRunResult" = $_.LastTaskResult | |
| 180 | "NumberOfMissedRuns" = $_.numberofmissedruns | |
| 181 | "Actions" = ($xml.Task.Actions.Exec | % { "$($_.Command) $($_.Arguments)" }) -join "`n"
| |
| 182 | "Author" = $xml.Task.RegistrationInfo.Author | |
| 183 | "Created" = $xml.Task.RegistrationInfo.Date | |
| 184 | "Description" = ([xml]$_.xml).Task.RegistrationInfo.Description | |
| 185 | "UserId" = ([xml]$_.xml).Task.Principals.Principal.UserId | |
| 186 | } | |
| 187 | } | |
| 188 | Add-Content $FileOutput "Scheduled Tasks" | |
| 189 | Add-Content $FileOutput "This Server has the following Scheduled Tasks:" | |
| 190 | $SchedOut | Select Name , Path , Status , NextRunTime , LastRunTime , LastRunResult , NumberOfMissedRuns , Actions , Author , Created , Description , UserId , GroupId |` | |
| 191 | Foreach-Object {
| |
| 192 | Write-Output "The Scheduled Task '$($_.Name)' which $($_.Description) was created by $($_.Author). This task runs the command '$($_.Actions)' with the NT Account '$($_.UserId)'. The Status is $($_.Status), the Last Run Time is $($_.LastRunTime), the Next Run Time is $($_.NextRunTime), and it has missed running $($_.NumberOfMissedRuns) times." | Out-File -FilePath “$FileOutput” -Encoding "UTF8" -Append | |
| 193 | Add-Content $FileOutput "" | |
| 194 | } | |
| 195 | ||
| 196 | #Replace Text | |
| 197 | (Get-Content $FileOutput) | Foreach-Object {$_ -replace "NT Account 'S-1-5-18'", "NT Account 'NT Authority\SYSTEM'"} | Set-Content $FileOutput
| |
| 198 | ||
| 199 | #End of Remote Script | |
| 200 | Write-Host "$($ServerName) - Stopping Script" | |
| 201 | } | |
| 202 | } |