# Program name - URAUDIT.PL written by Paul Popour 11/99
# Perl Win32 script tested with AS version 5.005_02
# Purpose - To report and record user rights on all servers in a domain
use Win32::AdminMisc;
use Win32::NetAdmin;
use Win32::Lanman;
unless ($domain = Win32::DomainName){die "Unable to obtain the domain
name";}
unless (Win32::NetAdmin::GetDomainController("", $domain, $pdc)){die "Unable
to obtain the PDC name for $domain.";}
unless (Win32::NetAdmin::GetServers($pdc, $domain, 0x00000008, \@DC))
{&logit("Unable to read NetBios 0008.");}
unless (Win32::NetAdmin::GetServers($pdc, $domain, 0x00008000, \@servers))
{&logit("Unable to read NetBios 8000.");}
for (@servers) { $srvname{$_} = 1 }
$adir = "C:\\TEMP\\AUDIT";
if (!-e "$adir"){mkdir ($adir, 0777)|| die "Unable to create $adir";}
@DCrights =(
SE_SERVICE_LOGON_NAME,
SE_BATCH_LOGON_NAME,
SE_AUDIT_NAME,
SE_CREATE_PERMANENT_NAME,
SE_MACHINE_ACCOUNT_NAME,
SE_TCB_NAME,);
@rights =(
SE_INTERACTIVE_LOGON_NAME,
SE_NETWORK_LOGON_NAME,
SE_BACKUP_NAME,
SE_CHANGE_NOTIFY_NAME,
SE_CREATE_PAGEFILE_NAME,
SE_DEBUG_NAME,
SE_INC_BASE_PRIORITY_NAME,
SE_INCREASE_QUOTA_NAME,
SE_LOAD_DRIVER_NAME,
SE_PROF_SINGLE_PROCESS_NAME,
SE_REMOTE_SHUTDOWN_NAME,
SE_RESTORE_NAME,
SE_SECURITY_NAME,
SE_SHUTDOWN_NAME,
SE_SYSTEM_ENVIRONMENT_NAME,
SE_SYSTEM_PROFILE_NAME,
SE_SYSTEMTIME_NAME,
SE_TAKE_OWNERSHIP_NAME,);
@A1 = split(/\\/, "$pdc");
$server = $A1[2];
print "Auditing the PDC - $server\n";
$output = "$adir\\$server.txt";
open(OUTFILE, ">$output") || die "Cannot open output file $output";
close OUTFILE;
unless (open(OUTFILE, ">>$output")){die ("Cannot open output file
$output");}
foreach $right (@DCrights){&cright($server, $right);}
foreach $right (@rights){&cright($server, $right);}
close OUTFILE;
foreach $server (@servers)
{
print "Auditing $server\n";
$output = "$adir\\$server.txt";
open(OUTFILE, ">$output") || die "Cannot open output file $output";
close OUTFILE;
unless (open(OUTFILE, ">>$output")){die ("Cannot open output file
$output");}
foreach $right (@rights){&cright($server, $right);}
close OUTFILE;
}
sub cright
{
my ($server, $right) = @_;
print OUTFILE "\n\n$server - $right\n\n";
if(!Win32::Lanman::LsaEnumerateAccountsWithUserRight("\\\\$server", $right,
\@sids))
{
$error = Win32::Lanman::GetLastError();
print OUTFILE "$server - Error: $error\n";
return();
}
if(!Win32::Lanman::LsaLookupSids($server, \@sids, \@infos))
{
$error = Win32::Lanman::GetLastError();
print OUTFILE "$server - Error: $error\n";
return();
}
foreach $info (@infos)
{
if (${$info}{'use'} eq "2")
{
print OUTFILE "\n\t${$info}{'name'} Group (Global)\n\n";
&global(${$info}{'domain'}, ${$info}{'name'}, "P");
next;
}
elsif (${$info}{'use'} eq "4")
{
print OUTFILE "\n\t${$info}{'name'} Group (Local)\n\n";
&lgroups($server, ${$info}{'name'});
next;
}
elsif (${$info}{'use'} eq "1")
{
print OUTFILE "\t${$info}{'name'}";
&getname(${$info}{'domain'}, ${$info}{'name'});
next;
}
else
{
print OUTFILE "\n\t${$info}{'name'}\n\n";
next;
}
print OUTFILE "\n";
}
}
sub global
{
my ($domain, $ggroup, $source) = @_;
my ($PDC, @users);
return if ($ggroup eq "Domain Users");
unless (Win32::NetAdmin::GetDomainController("", $domain, $PDC))
{
print OUTFILE ("Unable to obtain the PDC name for $domain.\n");
return();
}
if(!Win32::Lanman::NetGroupGetUsers("$PDC", $ggroup, \@users))
{
$error = Win32::Lanman::GetLastError();
print OUTFILE "$server, $ggroup - Error: $error\n";
return();
}
foreach $user (@users)
{
next if (${$user}{'name'} eq "");
if ($source eq "P")
{
print OUTFILE "\t\t\t${$user}{'name'}";
&getname($domain, ${$user}{'name'});
}
elsif ($source eq "L")
{
print OUTFILE "\t\t\t\t${$user}{'name'}";
&getname($domain, ${$user}{'name'});
}
}
print OUTFILE "\n";
}
sub lgroups
{
my ($server, $lgroup) = @_;
my (@users, @A1);
if(!Win32::Lanman::NetLocalGroupGetMembers("\\\\$server", $lgroup,
\@users))
{
$error = Win32::Lanman::GetLastError();
print OUTFILE "$server, $lgroup - Error: $error\n";
return();
}
foreach $user (@users)
{
next if (${$user}{'domainandname'} eq "");
@A1 = split (/\\/, ${$user}{'domainandname'});
if (${$user}{'sidusage'} eq 2)
{
print OUTFILE "\n\t\t\t$A1[1] Group (Global)\n\n";
&global($A1[0], $A1[1], "L");
}
else
{
print OUTFILE "\t\t\t$A1[1]";
&getname($A1[0], $A1[1]);
}
}
print OUTFILE "\n";
}
sub getname
{
my ($domain, $user) = @_;
my ($PDC, @Hash1, @luinfo);
if ($srvname{$domain})
{
unless(Win32::Lanman::NetUserGetInfo("\\\\$domain", "$user", \%luinfo))
{
$error = Win32::Lanman::GetLastError();
print OUTFILE "$server - Error: $error\n";
return();
}
print OUTFILE "$luinfo{'full_name'}\n";
return();
}
unless (Win32::NetAdmin::GetDomainController("", $domain, $PDC))
{
print OUTFILE ("Unable to obtain the PDC name for $domain.");
return();
}
unless (Win32::AdminMisc::UserGetMiscAttributes("$PDC", "$user", \%Hash1))
{
print OUTFILE "Unable to obtain information on $user from $PDC\n";
next;
}
print OUTFILE " = $Hash1{USER_FULL_NAME}\n";
}
|
Note: Neither Roth Consulting nor its affiliates are responsible for problems resulting
from the misuse, modification or execution of any of the scripts on this web site. It is best that the
the user read over the script carefully to insure that the code is not harmful to his environment.
This site has been hit times since May 22, 2001
Copyright © 1996 - 2010 Roth Consulting.
Last updated 2010.07.31
.NET, Perl, Python, script, scripting, VB, Visual Basic, java, javascript, perlscript, odbc, database, SQL, Win32, NT, Windows, coding, programing, c, c++, c#,
Linux, Microsoft, IBM, Windows, Exchange, Outlook, Oracle, Sybase,
Windows XP, SP2, Windows Server 2003,
consult, consulting, Dave Roth, David Roth, Adminmisc, Perms, Daemon, Pipe, book, extensions,
IT, administration,
Microsoft Office, Microsoft Word, Microsoft Excel, Microsoft Powerpoint,
security, anti virus, antivirus, firewall, NAT,
WMI, COM, MOM, administration, IT,
network, DSL, Cable, Dial-up, phone, telephone, long distance,
Tablet PC, tabletpc, tablet pcs, tablet pc questions, tablet pc faqs, tablet pc comparisons, tablet pc reviews, Windows XP Tablet PC Edition, popular tablet pc software, Windows XP Tablet PC, utilities, tablet pc games, tabletpc software, tablet pc utilities, windows tablet software
desktop computer, notebook, notebook computer, computer,
