As part of current work projects we are being asked to profile servers here is a quick dirty script being used. Has several useful pieces.
$servers = import-csv \\ciwfsxxp0003\andrew\PowershellScripts\ServerMigFunctions\BPO_Policy\servers2.txt -Delimiter “,”
$output = “c:\temp\ServerPreScan.txt”
foreach ($server in $servers)
{
#Header
write-output “________________________________________________” | tee-object -filepath $output -append
write-output “————————–” | tee-object -filepath $output -append
write-output “—-$($server.ServerName) $($server.Application)”—- | tee-object -filepath $output -append
write-output “————————–” | tee-object -filepath $output -append
#Get OS Version we only care about server 2003
$windowsversion = (Get-WmiObject -class Win32_OperatingSystem -computer $server.ServerName).Caption
Write-Output $windowsversion | tee-object -filepath $output -append
#if the version is not 2003 no reason to continue this charade
if ($windowsversion -like “*2003*”) {
#Get Shares
write-output “————————–” | tee-object -filepath $output -append
write-output “—-Shares—-” | tee-object -filepath $output -append
get-WmiObject -class Win32_Share -computer $server.ServerName | tee-object -filepath $output -append#Get Services note removing most standard services
(Get-WmiObject -class Win32_OperatingSystem).Caption
write-output “—-Services—-” | tee-object -filepath $output -append
get-WmiObject -class Win32_Service -computer $server.ServerName |
where { $_.Caption -notmatch “Windows” -and $_.PathName -notmatch “Windows” -and $_.PathName -notmatch “policyhost.exe” -and $_.Name -ne “LSM” `
-and $_.PathName -notmatch “OSE.EXE” -and $_.PathName -notmatch “OSPPSVC.EXE” -and $_.PathName -notmatch “Microsoft Security Client” `
-and $_.Pathname -notmatch “WINNT” [keep adding them here if you have some others] -and $_.state -eq “Running” } |
Format-Table Name,StartMode,State,Status, Pathname, Caption | tee-object -filepath $output -append#Is the certain services installed
write-output “—-Connect Service—-” | tee-object -filepath $output -append
get-WmiObject -class Win32_Service -computer $server.ServerName |
where { $_.Caption -match “[service name]” -and $_.state -eq “Running” } |
Format-Table Name,StartMode,State,Status, Pathname, Caption |
tee-object -filepath $output -append#get a list of websites
write-output “—-WebSites—-” | tee-object -filepath $output -append
Try{
Get-WmiObject -Namespace ROOT\microsoftiisv2 -Class IISWebServerSetting -ComputerName $server.ServerName -erroraction ‘silentlycontinue’ |
Format-Table Namespace,Name,ServerComment,AppPoolId |
tee-object -filepath $output -append
}Catch{
write-output “N/A” | tee-object -filepath $output -append
}#check the bpo policy
write-output “—-BPO Policy—-” | tee-object -filepath $output -append
$Priv=Get-WMIObject -computername $server.ServerName RSOP_UserPrivilegeRight -namespace root\rsop\computer |
Where {$_.UserRight -eq “SeDenyNetworkLogonRight” } |
Select -expand AccountList
$RBY = “[account we care about denying access to]”
If ($Priv |select-string -pattern $RBY -simplematch)
{ $BPO = “NO” }
Else
{ $BPO = “YES”}
write-output $BPO | tee-object -filepath $output -append#Get any odbc connections
write-output “—-odbc connections—-” | tee-object -filepath $output -append
$standardkeys=@(“[list of standard odbc keys we’ll find on the server to filter out]”)
$odbckey =”SOFTWARE\\odbc\\odbc.ini”
$reg=[microsoft.win32.registrykey]::OpenRemoteBaseKey(‘LocalMachine’,$server.ServerName)
$regkey=$reg.OpenSubKey($odbckey)
#Retrieve an array of string that contain all the subkey names
$subkeys=$regkey.GetSubKeyNames()
#Open each Subkey and use GetValue Method to return the required values for each
foreach($key in $subkeys){
# $thisKey=$odbckey+”\\”+$key
# $thisSubKey=$reg.OpenSubKey($thisKey)
if ($standardkeys -notcontains $key) { Write-Output $key | tee-object -filepath $output -append }
}#Get any scheduled tasks exxcep w2k3 though there are others we can remove as well.
write-output “—-Scheduled Tasks—-” | tee-object -filepath $output -append
get-wmiobject -class “Win32_ScheduledJob” -namespace “root\CIMV2” -computername $server.ServerName |
Where { $_.Command -notmatch “E:\W2K3.bat” } |
Format-Table Caption, Command, Jobstatus |
tee-object -filepath $output -append
}
else
{
write-output “Nothing to do here. Kindly move along.” | tee-object -filepath $output -append
}
}
NashKen 