In our last couple posts we described how to gather a general baseline of system demographics on a Microsoft Windows system you’ve been tasked with auditing. Hopefully the posts gave everyone some ideas for the capabilities that PowerShell offers, even if the information we gathered isn’t all that exciting. In this post I thought we would show you additional examples you could try if you want to explore other pieces of information you might be able to gather with PowerShell and WMI during an audit.
Once you have the general syntax of these commands, even if you don’t fully understand the scripting behind it, you should be able to copy and paste these commands into an audit script. If you want a full library of the various WMI objects that Microsoft makes available or the attributes they return, check out this link over at Microsoft:
http://msdn.microsoft.com/en-us/library/aa394084(v=vs.85).aspx
So here are a few other examples of WMI queries that might be useful during an audit:
List the available IPv4 Address(es) from a system:
get-wmiobject Win32_NetworkAdapterConfiguration | fl Name,IPAddress
List the available IPv6 Address(es) from a system:
ifconfig -a | awk '/inet6 addr:/ { print $3 }'
List the available MAC Address(es) from a system:
get-wmiobject Win32_NetworkAdapterConfiguration | fl Name,MACAddress
List the User Accounts on a system:
get-wmiobject Win32_UserAccount | ft Name,SID
List the Groups on a system:
get-wmiobject Win32_Group | ft Name,SID
I hope these help to inspire you to try out scripting in your audits and maybe even consider writing a few audit scripts of your own.