;-------------------------------------------------------------------- 
; Local Admin Audit  
;-------------------------------------------------------------------- 
;Title 
; 
? "Local Admin Audit #3 "
;----------------------------------------------- 
;Declaring Variables. 
; 
DIM $lgroup, $admin, $output
  
;----------------------------------------------- 
;Cheack if PC has aready Audited 
  
"Checking Registry key..." ?
  
If ReadValue ("HKCU\Software\kix","AuditLog3")
  "- PC aready Audited!" ?
  Exit 1
EndIf
  
;----------------------------------------------- 
;Win2k/XP Audit 
  
If @PRODUCTTYPE = "Windows 2000 Professional"
  Or @PRODUCTTYPE= "Windows XP Professional"
  "Starting " + @PRODUCTTYPE + " Audit" ?
  
  If InGroup(@WKSTA+'\'+SidToName('S-1-5-32-544'))
    $output="Administrator"
  Else
    $output="User"
  EndIf
  
  "Creating Audit Logs" ?
  
  If Open( 3 , "\\zeus\kixlog$\LOG3_$output.TXT" , 5 ) = 0
    $x = "____________________________________________________ " + @CRLF
    $x = $x + "Logged on " + @DATE + @CRLF
    $x = $x + " at " + @TIME + @CRLF)
    $x = $x + "Username - " + @USERID + @CRLF
    $x = $x + "Workstation - " + @WKSTA + @CRLF
    $x = $x + "Local Group Membership - " + $output + @CRLF
    $x = WriteLine(3,"Kix Version - " + @KIX + $x + @CRLF)
    $x = Close(3)
  EndIf
  
  If Open( 4 , "\\zeus\kixlog$\EXCEL3_$output.TXT" , 5 ) = 0
    $x = "," + @CRLF
    $x = $x + "," + @DATE
    $x = $x + "," + @TIME)
    $x = $x + "," + @USERID)
    $x = $x + "," + @WKSTA)
    $x = $x + "," + $output + @CRLF)
    $x = WriteLine(4,"," + @KIX + $x + @CRLF)
    $x = Close(4)
  EndIf
  
  ;----------------------------------------------- 
  ;Setting Audited flag 
  
  "Creating Registry Keys " ?
  $x = WriteValue("HKCU\Software\kix","AuditLog3","1",REG_SZ)
  "Audit complete" ?
  Exit 1
EndIf
;----------------------------------------------- 
;Win98 Audit 
  
If @PRODUCTTYPE = "Windows 98"
  "Starting @PRODUCTTYPE Audit" ?
  If Not ReadValue("HKCU\Software\kix","AuditLog3")
    If Open(5, "\\zeus\kixlog$\LOG3_Win98.TXT" , 5 ) = 0
      $x = "____________________________________________________ " + @CRLF
      $x = $x + "Logged on ," + @DATE + @CRLF
      $x = $x + "Username ," + @USERID + @CRLF
      $x = $x + "Workstation ," + @WKSTA + @CRLF
      $x = $x + "OS ," + @PRODUCTTYPE + @CRLF
      $x = WriteLine(5,"Kix Version" + @KIX + $x + @CRLF)
      $x = Close(5)
    EndIf
  EndIf
  ;----------------------------------------------- 
  ;Setting Audited flag 
  
  "Creating Registry Keys " ?
  $x = WriteValue("HKCU\Software\kix","AuditLog3","1",REG_SZ)
  "Audit complete" ?
  Exit 1
EndIf
  
;-------------------------------------------------------------------- 
; END OF Local Admin Audit Script 
;--------------------------------------------------------------------