You are not logged in. [Log In] KiXtart.org website » Forums » KiXtart » Basic Scripting » Reporting Group Policy applied
Register User       Forum List       Calendar       FAQ
Page 1 of 1 1
Topic Options
#180527 - 2007-09-13 02:05 PM Reporting Group Policy applied
gdstiers Offline
Fresh Scripter

Registered: 1999-08-11
Posts: 14
Loc: Chattanooga, TN, USA
Q: How does the logon script report Group Policies applied ?
A: The following code lists GPO names, but does not interpret the date/time field (REG_DWORD, variable $poltime) - Suggestions ??

;
; Registry locations for GPO applied to WinXP

; Current User
; enumerate gpextensions to capture SID. store GPO SID in log table. all variables global.
; *** 9/12/7 1231 gds need to convert Reg_Dword to KiXtart date format.
; hkcu\software\microsoft\windows nt\currentversion\winlogon\gpextensions\[sid]\LastpolicyTime (Reg_Dword)
$usersid="hkcu\software\microsoft\windows nt\currentversion\winlogon\gpextensions"


; enumerate SID - may bypass DisplayName='Local Group Policy'
; hkcu\software\microsoft\windows\currentversion\group policy\history\[sid]\0\DisplayName (String)
; hkcu\software\microsoft\windows\currentversion\group policy\history\[sid]\1\DisplayName (String)
; hkcu\software\microsoft\windows\currentversion\group policy\history\[sid]\2\DisplayName (String)
$userdname="hkcu\software\microsoft\windows\currentversion\group policy\history"

:loop1
$keyname=enumkey("$usersid",$index1)
if @error=0
$poltime=readvalue("$usersid\$keyname","LastPolicyTime")
$msg="User sid ($keyname)"
? "@DATE,@TIME,$msg"
:loop2
$sidname=enumkey("$userdname\$keyname",$index2)
if @ERROR=0
$dname=readvalue("$userdname\$keyname\$sidname","DisplayName")
$msg="User policy ($dname) was applied ($poltime)"
? "@DATE,@TIME,$msg"
goto loop2
endif
goto loop1
endif

; Local Machine
; enumerate gpextensions to capture SID
; hklm\software\microsoft\windows nt\currentversion\winlogon\gpextensions\[sid]\LastpolicyTime (Reg_Dword)
$computersid="hklm\software\microsoft\windows nt\currentversion\winlogon\gpextensions"

; enumerate SID - may bypass DisplayName='Local Group Policy'
; hklm\software\microsoft\windows\currentversion\group policy\history\[sid]\0\DisplayName (String)
; hklm\software\microsoft\windows\currentversion\group policy\history\[sid]\1\DisplayName (String)
; hklm\software\microsoft\windows\currentversion\group policy\history\[sid]\2\DisplayName (String)
$computerdname="hklm\software\microsoft\windows\currentversion\group policy\history"

[code repeats Current User]
_________________________
gdstiers@tva.gov

Top
#180556 - 2007-09-13 07:46 PM Re: Reporting Group Policy applied [Re: gdstiers]
NTDOC Administrator Offline
Administrator
*****

Registered: 2000-07-28
Posts: 11634
Loc: Space
Please format your code and place within [CODE TAGS]
Top
#180558 - 2007-09-13 08:07 PM Re: Reporting Group Policy applied [Re: NTDOC]
gdstiers Offline
Fresh Scripter

Registered: 1999-08-11
Posts: 14
Loc: Chattanooga, TN, USA
What is a [code tag] ? The sample text was Notepad-formated until previewed and submitted to the forum. The question to the forum is how to convert a Registry REG_DWORD value to a KiXtart date.
_________________________
gdstiers@tva.gov

Top
#180561 - 2007-09-13 08:12 PM Re: Reporting Group Policy applied [Re: gdstiers]
NTDOC Administrator Offline
Administrator
*****

Registered: 2000-07-28
Posts: 11634
Loc: Space
Please read this thread and it will help you become a better user of the board not only here but on every other board out there as well.

Thanks

The Post/Reply Formatting Box and How to use it
Top
#180562 - 2007-09-13 08:19 PM Re: Reporting Group Policy applied [Re: gdstiers]
Mart Moderator Offline
KiX Supporter
*****

Registered: 2002-03-27
Posts: 4673
Loc: The Netherlands
Code tags are the tags you can put around code you post. start with [ code ] paste your code and end with [ /code ] (leave out the spaces). The formatting will get preserved that way.

To get back on topic.
You might want to take a look at http://www.kixtart.org/forums/ubbthreads.php?ubb=showflat&Board=7&Number=113277
_________________________
Mart

- Chuck Norris once sold ebay to ebay on ebay.

Top
#180566 - 2007-09-13 08:54 PM Re: Reporting Group Policy applied [Re: NTDOC]
gdstiers Offline
Fresh Scripter

Registered: 1999-08-11
Posts: 14
Loc: Chattanooga, TN, USA
The [code tags] create a window in the post to view the code. Text outside the window can be formatted.

Q: How does the logon script report Group Policies applied ?
A: The following code lists GPO names (REG_SZ), but does not interpret the date/time field (REG_DWORD, variable $poltime) - Suggestions ??
;
; Registry locations for GPO applied to WinXP (Current User)
; Loop1
; Enumerate gpextensions to capture [sid]
; hkcu\software\microsoft\windows nt\currentversion\winlogon\gpextensions\[sid]\LastpolicyTime (Reg_Dword)
; Loop2
; Enumerate SID to capture display name
; hkcu\software\microsoft\windows\currentversion\group policy\history\[sid]\0\DisplayName (String)
; hkcu\software\microsoft\windows\currentversion\group policy\history\[sid]\1\DisplayName (String)
; hkcu\software\microsoft\windows\currentversion\group policy\history\[sid]\2\DisplayName (String)

 Code:
dim $usersid, $userdname, $keyname, $index1, $index2, $msg, $err
dim $poltime, $sidname, $dname
$usersid="hkcu\software\microsoft\windows nt\currentversion\winlogon\gpextensions"
$userdname="hkcu\software\microsoft\windows\currentversion\group policy\history"

:loop1
$keyname=enumkey("$usersid",$index1)
if @error=0
  $poltime=readvalue("$usersid\$keyname","LastPolicyTime")
  $msg="User sid ($keyname)"
  ? "@DATE,@TIME,$msg"
  :loop2
  $sidname=enumkey("$userdname\$keyname",$index2)
  if @ERROR=0
    $dname=readvalue("$userdname\$keyname\$sidname","DisplayName")
    $msg="User policy ($dname) was applied ($poltime)"
    ? "@DATE,@TIME,$msg"
    goto loop2
  endif
  goto loop1
endif
_________________________
gdstiers@tva.gov

Top
#180568 - 2007-09-13 09:07 PM Re: Reporting Group Policy applied [Re: gdstiers]
Mart Moderator Offline
KiX Supporter
*****

Registered: 2002-03-27
Posts: 4673
Loc: The Netherlands
You might want to take the attitude down a bit. All members on this board are doing this for free and in the rare spare time there is from regular work. We are not people that can do some kind of magic and pull a script out of a head just like that. Sure we give a solution or a push in the right direction most of the time and we want to help but lets just be nice and polite to each other.

The code tags create something that looks like an iframe but that is all off topic and does not really matter.


Did you look at the link I posted? It converts hex values to decimal values that can be used for e.g. calculations.
_________________________
Mart

- Chuck Norris once sold ebay to ebay on ebay.

Top
#180581 - 2007-09-13 09:53 PM Re: Reporting Group Policy applied [Re: Mart]
gdstiers Offline
Fresh Scripter

Registered: 1999-08-11
Posts: 14
Loc: Chattanooga, TN, USA
Please accept my apology. I did not intend to offend anyone. The board members provide valuable assistance in the forums and UDF library that have helped me more than once. I did not understand the board formatting until practicing your suggestions and referenced link. I did not realize that the hex value, read from the Registry, that was converted to decimal, by the function in Mart's link, would still need to be converted, by some other calculations, to a date. I tried a UDF from the library, but I knew a 1904 date was missing something.
_________________________
gdstiers@tva.gov

Top
#180582 - 2007-09-13 09:56 PM Re: Reporting Group Policy applied [Re: gdstiers]
NTDOC Administrator Offline
Administrator
*****

Registered: 2000-07-28
Posts: 11634
Loc: Space
There are a few formatting scripts in the UDF forum.

So were you able to accomplish what you're looking for yet or do you still need assistance?

If you need more help, maybe post the exact return value of the key that you want converted and I'm sure we can find the correct conversion for you.
Top
#180585 - 2007-09-13 10:14 PM Re: Reporting Group Policy applied [Re: gdstiers]
Mart Moderator Offline
KiX Supporter
*****

Registered: 2002-03-27
Posts: 4673
Loc: The Netherlands
 Quote:

Please accept my apology.
....


Accepted.
_________________________
Mart

- Chuck Norris once sold ebay to ebay on ebay.

Top
#180589 - 2007-09-13 10:54 PM Re: Reporting Group Policy applied [Re: Mart]
gdstiers Offline
Fresh Scripter

Registered: 1999-08-11
Posts: 14
Loc: Chattanooga, TN, USA
Mission accomplished.

Thanks everyone !!
_________________________
gdstiers@tva.gov

Top
#180590 - 2007-09-13 10:57 PM Re: Reporting Group Policy applied [Re: gdstiers]
Mart Moderator Offline
KiX Supporter
*****

Registered: 2002-03-27
Posts: 4673
Loc: The Netherlands
Cool
Would you mind posting the script you ended up using? With code tags ;\) \:D Who knows, we might learn something from it.

Edited by Mart (2007-09-13 10:58 PM)
Edit Reason: Typo.
_________________________
Mart

- Chuck Norris once sold ebay to ebay on ebay.

Top
Page 1 of 1 1


Moderator:  Jochen, Allen, Radimus, Glenn Barnas, ShaneEP, Ruud van Velsen, Arend_, Mart 
Hop to:
Shout Box

Who's Online
0 registered and 2220 anonymous users online.
details
Newest Members
Viginette, ManuvdWielNL, Sir_Barrington, batdk82, StuTheCoder
17888 Registered Users
My Cookies · Mark all read Powered by UBB.threads™ Contact Us · KiXtart.org website · Top

Generated in 0.072 seconds in which 0.033 seconds were spent on a total of 13 queries. Zlib compression enabled.
Search the board with:
superb Board Search
or try with google:
Google
Web kixtart.org