Jump to content

Recommended Posts

Posted

I need to audit about 500 machines registry settings. There are about 150 individual registry enteries that need to be audited and I would like to use AutoIT to send the results to a text file. Problem is the RegRead line fails to read the registry. My $regdata variable yeilds no results. What could be wrong?

Here is my code presently.

$filereg = FileOpen("manual_checks.txt", 0)
If $filereg = -1 Then
    SplashOff()
    MsgBox(0, "Error", "Unable to open or find manual_checks.txt")
    Exit
EndIf

$fileresults = FileOpen(@ProgramFilesDir & "\source\" & @ComputerName & "_manual_checks.txt", 9)

While 1
    $line = FileReadLine($filereg)
    If @error = -1 Then ExitLoop

    $vkey = StringLeft($line, 8)

    $regstring = StringTrimLeft($line, 9)
    $regstring2 = StringLeft($regstring, StringInStr($regstring, ";", 0, 1) - 1)
    
    $regvalue = StringTrimLeft($line, StringInStr($line, ";", 0, 2) - 1)
    $regvalue2 = StringTrimLeft($regvalue, 1)
    
    $regdata = RegRead($regstring2, $regvalue2)

    FileWrite ($fileresults, $vkey & @CRLF)
    FileWrite ($fileresults, $regstring2 & @CRLF)
    FileWrite ($fileresults, $regvalue2 & " = " & $regdata & @CRLF & @CRLF)

WEnd
FileClose($fileresults)
FileClose($filereg)

Here is an example of what the source file "manual_checks.txt" looks like:

V0006474;"HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\VSCore\On Access Scanner\McShield\Configuration";"bLogToFile"

V0006475;"HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\VSCore\On Access Scanner\McShield\Configuration";"bLimitSize"

V0006475;"HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\VSCore\On Access Scanner\McShield\Configuration";"dwMaxLogSizeMB"

V0006476;"HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\VSCore\On Access Scanner\McShield\Configuration";"bLogSettings"

And the result file (Computername_manual_checks.txt) should look like this:

V0006474

"HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\VSCore\On Access Scanner\McShield\Configuration"

"bLogToFile" = 1

V0006475

"HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\VSCore\On Access Scanner\McShield\Configuration"

"bLimitSize" = 1

V0006475

"HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\VSCore\On Access Scanner\McShield\Configuration"

"dwMaxLogSizeMB" = 0

V0006476

"HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\VSCore\On Access Scanner\McShield\Configuration"

"bLogSettings" = 0

manual_checks.txt

Posted (edited)

You need to remove your " " from around the key value/location in the text file otherwise it looks for a value containing the quotes.

for example it search the register for

"HKLM\SOFTWARE\McAfee\VScore\On Access Scanner\McShield\Configuration"

not

HKLM\SOFTWARE\McAfee\VScore\On Access Scanner\McShield\Configuration

Which is what you need

Your file should look like this

V0006474;HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\VSCore\On Access Scanner\McShield\Configuration;bLogToFile

V0006475;HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\VSCore\On Access Scanner\McShield\Configuration;bLimitSize

V0006475;HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\VSCore\On Access Scanner\McShield\Configuration;dwMaxLogSizeMB

V0006476;HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\VSCore\On Access Scanner\McShield\Configuration;bLogSettings

No need to ammend the script.

Edited by Steveiwonder

They call me MrRegExpMan

Posted

Are you sure you want literal quotation marks as part of those strings? I would take them out with StringReplace() or use StringRegExp to pull the data from each line without them in the first place.

:mellow:

Valuater's AutoIt 1-2-3, Class... Is now in Session!For those who want somebody to write the script for them: RentACoder"Any technology distinguishable from magic is insufficiently advanced." -- Geek's corollary to Clarke's law
Posted

You need to remove your " " from around the key value/location in the text file otherwise it looks for a value containing the quotes.

for example it search the register for

"HKLM\SOFTWARE\McAfee\VScore\On Access Scanner\McShield\Configuration"

not

HKLM\SOFTWARE\McAfee\VScore\On Access Scanner\McShield\Configuration

Which is what you need

Your file should look like this

V0006474;HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\VSCore\On Access Scanner\McShield\Configuration;bLogToFile

V0006475;HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\VSCore\On Access Scanner\McShield\Configuration;bLimitSize

V0006475;HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\VSCore\On Access Scanner\McShield\Configuration;dwMaxLogSizeMB

V0006476;HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\VSCore\On Access Scanner\McShield\Configuration;bLogSettings

No need to ammend the script.

Thank you... Removing the quotes worked... Don't know why I did think to try that.

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...