From 30abc2b2a13f3c946324136ac566e9280fe014e7 Mon Sep 17 00:00:00 2001 From: strawgate Date: Fri, 22 Apr 2016 21:22:16 -0500 Subject: [PATCH] Adding additional Inventory content --- Analyses/Fonts - Windows.bes | 17 +++++++++ Analyses/Group Policy - Audit - Windows.bes | 32 +++++++++++++++++ .../Hibernation - Configuration - Windows.bes | 20 +++++++++++ .../Operating System - Audit - Windows.bes | 36 +++++++++++++++++++ .../Pagefile - Configuration - Windows.bes | 19 ++++++++++ Analyses/System - OS - Windows.bes | 33 +++++++++++++++++ ...nvoke - Group Policy Refresh - Windows.bes | 35 ++++++++++++++++++ ...Pagefile has non-default configuration.bes | 22 ++++++++++++ 8 files changed, 214 insertions(+) create mode 100644 Analyses/Fonts - Windows.bes create mode 100644 Analyses/Group Policy - Audit - Windows.bes create mode 100644 Analyses/Hibernation - Configuration - Windows.bes create mode 100644 Analyses/Operating System - Audit - Windows.bes create mode 100644 Analyses/Pagefile - Configuration - Windows.bes create mode 100644 Analyses/System - OS - Windows.bes create mode 100644 Fixlets/Invoke - Group Policy Refresh - Windows.bes create mode 100644 Fixlets/Warning - Pagefile has non-default configuration.bes diff --git a/Analyses/Fonts - Windows.bes b/Analyses/Fonts - Windows.bes new file mode 100644 index 0000000..85683f2 --- /dev/null +++ b/Analyses/Fonts - Windows.bes @@ -0,0 +1,17 @@ + + + + Fonts - Windows + Reports on the installed fonts on the system + true + Internal + 2016-04-21 + + x-fixlet-modification-time + Fri, 22 Apr 2016 03:14:07 +0000 + + BESC + names of files of folder "C:\Windows\Fonts" + + + diff --git a/Analyses/Group Policy - Audit - Windows.bes b/Analyses/Group Policy - Audit - Windows.bes new file mode 100644 index 0000000..2afbd6e --- /dev/null +++ b/Analyses/Group Policy - Audit - Windows.bes @@ -0,0 +1,32 @@ + + + + Group Policy - Audit - Windows + Provides the following pieces of information regarding Group Policy:

+
    +
  1. Average network wait on startup +
  2. Applied Group Policies +
  3. Enforced Group Policies +
  4. The Active Directory site the computer currently falls into +
  5. Assigned Software Installations in Group Policy +
  6. The currently connected domain controller +
  7. If the computer is on a slow link
+

The applied group policies and enforced group policies properties show the name of the group policy object, at what level the policy is linked (Site, Domain, OU) and at what OU in active directory the policy is linked at.

]]> + true + Internal + 2016-04-21 + + x-fixlet-modification-time + Fri, 22 Apr 2016 19:45:27 +0000 + + BESC + value "AvgWaitTimeoutAtStartup" of key "HKEY_LOCAL_MACHINE\Software\microsoft\windows\currentversion\group policy\history" of native registry as integer + (value "DisplayName" of it, (if (it = 0) then "Unknown" else (if (it = 1) then "Local Group Policy" else (if (it = 2) then "Site Linked" else (if (it = 3) then "Domain Linked" else ("OU Linked"))))) of (value "GPOLink" of it as integer), value "Link" of it) of keys of keys of key "HKEY_LOCAL_MACHINE\Software\microsoft\windows\currentversion\group policy\history" of native registry + (value "DisplayName" of it, (if (it = 0) then "Unknown" else (if (it = 1) then "Local Group Policy" else (if (it = 2) then "Site Linked" else (if (it = 3) then "Domain Linked" else ("OU Linked"))))) of (value "GPOLink" of it as integer), value "Link" of it) of keys whose (bit 1 of (value "Options" of it as integer as bit set) = true) of keys of key "HKEY_LOCAL_MACHINE\Software\microsoft\windows\currentversion\group policy\history" of native registry + value "Site-Name" of key "HKEY_LOCAL_MACHINE\Software\microsoft\windows\currentversion\group policy\State\Machine" of native registry + (value "GPO Name" of it, value "Deployment Name" of it, value "GPO ID" of it) of keys of key "HKEY_LOCAL_MACHINE\Software\microsoft\windows\currentversion\group policy\Appmgmt" of native registry + value "DCName" of key "HKEY_LOCAL_MACHINE\Software\microsoft\windows\currentversion\group policy\History" of native registry + if (value "IsSlowLink" of key "HKEY_LOCAL_MACHINE\Software\microsoft\windows\currentversion\group policy\History" of native registry as integer = 0) then false else true + + + diff --git a/Analyses/Hibernation - Configuration - Windows.bes b/Analyses/Hibernation - Configuration - Windows.bes new file mode 100644 index 0000000..0f0b973 --- /dev/null +++ b/Analyses/Hibernation - Configuration - Windows.bes @@ -0,0 +1,20 @@ + + + + Hibernation - Configuration - Windows + Hibernation Configuration for Windows + windows of operating system + not in proxy agent context + Internal + 2016-04-21 + + x-fixlet-modification-time + Fri, 22 Apr 2016 19:37:30 +0000 + + BESC + if (value "HibernateEnabled" of key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power" of native registry as string = "1") then "Enabled" else "Disabled" + + + + + diff --git a/Analyses/Operating System - Audit - Windows.bes b/Analyses/Operating System - Audit - Windows.bes new file mode 100644 index 0000000..6c8ec33 --- /dev/null +++ b/Analyses/Operating System - Audit - Windows.bes @@ -0,0 +1,36 @@ + + + + Operating System - Audit - Windows + Provides information regarding the installed Windows Operating System.

+

Credit, compliments, and kudos to jgstew for the source of this analysis: https://bigfix.me/analysis/details/2994800

]]> + (if (name of operating system starts with "Win") then platform id of operating system != 3 else true) AND (if exists property "in proxy agent context" then (not in proxy agent context) else true) AND (if exists property "android" of type "operating system" then (not android of operating system) else true) + name of operating system as lowercase starts with "win" + = "5.0"]]> + TRUE + + + x-fixlet-first-propagation + Thu, 23 Jan 2014 23:04:56 +0000 + + + x-fixlet-modification-time + Fri, 22 Apr 2016 20:44:46 +0000 + + BESC + + + + (if (exists key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" whose (exists value "ProductId" of it) of native registry AND NOT (name of operating system = "WinNT")) then (value "ProductId" of key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" of native registry as string) else (if (exists key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" whose (exists value "ProductId" of it) of native registry) then (value "ProductId" of key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" of native registry as string) else "Unknown")) + if (name of operating system = "Win95" AND exists key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" whose (exists value "ProductId" of it) of registry) then (value "ProductId" of key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" of registry as string) else (if ((name of operating system = "Win98" OR name of operating system = "WinME") AND exists key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" whose (exists value "ProductKey" of it) of registry) then (value "ProductKey" of key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" of registry as string) else ("Unknown")) + + + + system language + user language + if (x64 of operating system) then "64-bit" else if (not x64 of operating system) then "32-bit" else "Undefined" + uptime of operating system + (if (exists true whose (if true then (exists select object "* from Win32_ServerFeature" of wmi) else false)) then (string values of (selects "Name from Win32_ServerFeature" of wmi)) else "None") + + + diff --git a/Analyses/Pagefile - Configuration - Windows.bes b/Analyses/Pagefile - Configuration - Windows.bes new file mode 100644 index 0000000..5421a2c --- /dev/null +++ b/Analyses/Pagefile - Configuration - Windows.bes @@ -0,0 +1,19 @@ + + + + Pagefile - Configuration - Windows + Covers Pagefile configuration for Windows + windows of operating system + not in proxy agent context + Internal + 2016-04-21 + + x-fixlet-modification-time + Fri, 22 Apr 2016 02:58:45 +0000 + + BESC + (preceding text of first " " of it | it, preceding text of first " " of following text of first " " of it | "Default", following text of first " " of following text of first " " of it | "Default") of (substrings separated by "%00" whose (it != "") of (value "PagingFiles" of key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" of native registry as string)) + if (value "ClearPageFileAtShutdown" of key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" of native registry as string = "0") then "Disabled" else "Enabled" + + + diff --git a/Analyses/System - OS - Windows.bes b/Analyses/System - OS - Windows.bes new file mode 100644 index 0000000..29c7136 --- /dev/null +++ b/Analyses/System - OS - Windows.bes @@ -0,0 +1,33 @@ + + + + System - OS - Windows + + (if (name of operating system starts with "Win") then platform id of operating system != 3 else true) AND (if exists property "in proxy agent context" then (not in proxy agent context) else true) AND (if exists property "android" of type "operating system" then (not android of operating system) else true) + name of operating system as lowercase starts with "win" + = "5.0"]]> + TRUE + + + x-fixlet-first-propagation + Thu, 23 Jan 2014 23:04:56 +0000 + + + x-fixlet-modification-time + Mon, 18 Apr 2016 16:01:03 +0000 + + BESC + + + + (if (exists key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" whose (exists value "ProductId" of it) of native registry AND NOT (name of operating system = "WinNT")) then (value "ProductId" of key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" of native registry as string) else (if (exists key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" whose (exists value "ProductId" of it) of native registry) then (value "ProductId" of key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" of native registry as string) else "Unknown")) + if (name of operating system = "Win95" AND exists key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" whose (exists value "ProductId" of it) of registry) then (value "ProductId" of key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" of registry as string) else (if ((name of operating system = "Win98" OR name of operating system = "WinME") AND exists key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" whose (exists value "ProductKey" of it) of registry) then (value "ProductKey" of key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" of registry as string) else ("Unknown")) + + + + system language + user language + if (x64 of operating system) then "64-bit" else if (not x64 of operating system) then "32-bit" else "Undefined" + + + diff --git a/Fixlets/Invoke - Group Policy Refresh - Windows.bes b/Fixlets/Invoke - Group Policy Refresh - Windows.bes new file mode 100644 index 0000000..af52bc2 --- /dev/null +++ b/Fixlets/Invoke - Group Policy Refresh - Windows.bes @@ -0,0 +1,35 @@ + + + + Invoke - Group Policy Refresh - Windows + This will invoke a group policy refresh on the target endpoint.

+

NOTE: Performing a group policy refresh may cause a explorer to flash during a user session and it may drop a connected user's remote desktop session.

]]> + "5.1"]]> + exists file "gpupdate.exe" of system folder + + Internal + + 2016-04-22 + + + + + x-fixlet-modification-time + Fri, 22 Apr 2016 19:40:58 +0000 + + BESC + + + Click + here + to deploy this action. + + // Enter your action script here + +wait gpupdate /target:computer /force +wait gpupdate /target:user /force + + + + + diff --git a/Fixlets/Warning - Pagefile has non-default configuration.bes b/Fixlets/Warning - Pagefile has non-default configuration.bes new file mode 100644 index 0000000..17bef99 --- /dev/null +++ b/Fixlets/Warning - Pagefile has non-default configuration.bes @@ -0,0 +1,22 @@ + + + + Warning - Pagefile has non-default configuration + The system pagefile has a non-default configuration.

+

This is normally done as a troubleshooting step but is often not undone after troubleshooting.

]]> + (value "PagingFiles" of key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" of native registry as string) != "?:\pagefile.sys%00%00" + + Internal + + 2016-04-21 + + + + + x-fixlet-modification-time + Fri, 22 Apr 2016 03:04:35 +0000 + + BESC + + +