Over our last few posts we’ve talked a lot about using Unix BASH scripting to audit Unix systems. But we certainly don’t want our Windows friends to feel left out. The more I talk with people and listen to their security challenges, the more interest I hear about how to use PowerShell for audit or security purposes. Who knows, maybe it’s your New Year’s resolution to learn PowerShell this year and integrate it more into your audit activities. Well if it is, maybe we can help to inspire you and get you started on the right foot.
Just like last month, we thought we would post scripting one liners that you can use to query information about a system you’re auditing. These one liners also work very nice in incident response scenarios as well if you find your self in that situation.
For consistency’s sake, I’ll start by following the same script we used on Unix the last few months. As a first step, what commands might someone issue in order to gather general demographic information about a Windows system they’re auditing using PowerShell. Here’s a few to get started:
Display the name of the system:
(get-wmiobject win32_computersystem).Name
Display the domain name of the system:
(get-wmiobject win32_computersystem).Domain
Display the CPU installed in the sytem:
(get-wmiobject win32_processor).Name
Display the CPU speed of the installed CPU:
(get-wmiobject win32_processor).MaxClockSpeed
Display the installed physical memory:
(get-wmiobject Win32_ComputerSystem).TotalPhysicalMemory / 1GB
Display the available memory on the system:
(get-wmiobject Win32_OperatingSystem).FreePhysicalMemory / 1GB
In all these cases so far we’re using the Get-WMIObject cmdlet in PowerShell to gather general demographic information. The nice thing about running each of these commands in PowerShell is that you can easily place them all into one script and you aren’t dependent on any OS specific or version specific binaries being present on the system. As long as PowerShell is available on the system (which certainly most all Windows boxes should have it by now), you’re able to use these commands.
We’ll post more ideas to add to your scripts later, but hopefully scripting is on your list of things to learn this year and we can give you a little shove in the right direction.