Page 1 of 1 1
Topic Options
#192800 - 2009-03-10 10:47 PM find a certain share within a domain
dwb Offline
Fresh Scripter

Registered: 2009-02-04
Posts: 7
Loc: nv
looking for help on a script that would be able to find a certain share on all computers in a domain, servers and user computers. WMI comes to mind and looking for other ways too, maybe kixtart can help with this.

tia

Top
#192801 - 2009-03-10 11:25 PM Re: find a certain share within a domain [Re: dwb]
Allen Administrator Offline
KiX Supporter
*****

Registered: 2003-04-19
Posts: 4572
Loc: USA
I think you need to better explain what it is you want to do. Off the top of my head, it sounds like you just need a list of computer names, which could be accessed via a text file, or ldap, etc, then add the share name to it, and check if it exists.

;psuedo code
 Code:
$computers= ;query ldap, load a text file
$share="shared"
for each $computer in $computers
  ? $computer + " : "
  if exist("\\" + $computer + "\" + $share)
    "found"
  else
    "not found"
  endif
next
_________________________
(... better days ahead)

Top
#192803 - 2009-03-11 06:21 AM Re: find a certain share within a domain [Re: Allen]
dwb Offline
Fresh Scripter

Registered: 2009-02-04
Posts: 7
Loc: nv
to be more explicit:

this particular user would like a script that finds all shares that are shared via "everybody" has no user/password. he has 6000 machines to check

Top
#192804 - 2009-03-11 07:45 AM Re: find a certain share within a domain [Re: dwb]
NTDOC Administrator Offline
Administrator
*****

Registered: 2000-07-28
Posts: 11634
Loc: Space
This script might work, will need Admin rights on all remote systems and I'll leave populating the list up to you. Some use the NET VIEW or a UDF here like it but that often misses a LOT of computers. You also might need to add some code to make sure WMI is functional and you can connect to it otherwise you'll get a lot of timeouts and maybe even a script abend. WMIConfirm() - Confirm access to WMI

Here is a link to the SharePerms() - Share Permission Control

There are many other UDF scripts here: UDF Script Library

 Code:
Dim $SO
$SO=SetOption('Explicit','On')
$SO=SetOption('NoVarsInStrings','On')
$SO=SetOption('NoMacrosInStrings','On')
$SO=SetOption('WrapAtEOL','On')

Dim $Systems, $Shares, $sComputer, $File, $Report
$Systems = ReadFile(@ScriptDir+'\systems.txt')
$File = @ScriptDir+'\'+'system_shares.txt'
If Exist($File)
  Del $File
EndIf
$Report = RedirectOutput($File,0)
For Each $sComputer In $Systems
 If $sComputer
   $Shares = ListSharesAndPerms($sComputer)
 EndIf
Next
$Report = RedirectOutput("")
RUN 'Notepad.exe ' + $File

Function ListSharesAndPerms($sComputer)
  Dim $File, $Report, $objWMIService, $colShares, $objShare
  $objWMIService = GetObject("winmgmts:" + "{impersonationLevel=impersonate}!\\" + $sComputer + "\root\cimv2")
  $colShares = $objWMIService.ExecQuery("Select * from Win32_Share")
  For Each $objShare In $colShares
    If $objShare
      If Not $objShare.Type = '-2147483648' And Not InStr($objShare.Name,'IPC'+'$')
        $sComputer + ' ' + 'SHARE-NAME:' + ' ' + $objShare.Name + ' Path: ' + $objShare.Path ?
        SharePerms('SHOW','\\'+$sComputer+'\'+$objShare.Name)
      EndIf
    EndIf
  Next
EndFunction

Function SharePerms($cmd,$object,Optional $trustee,Optional $perms)
  Dim $ADSU, $GSD, $oDacl, $Ace, $oAce
  $ADSU = CreateObject("ADsSecurityUtility")
  $GSD = $ADSU.GetSecurityDescriptor($object, 2, 1)
  $oDacl = $GSD.DiscretionaryAcl
  If $cmd = "SHOW"
    For Each $Ace In $oDacl
      If $Ace
       $SharePerms = $SharePerms + @CRLF
       "Trustee: " + $Ace.Trustee + @CRLF
       "Flags: " + $Ace.AceFlags + @CRLF
       "AccessMask: " + $Ace.AccessMask + @CRLF
       "Type: " + $Ace.AceType + @CRLF + @CRLF
      EndIf
    Next
  EndIf
  If $cmd = "DEL"
    If $trustee <> ""
      For Each $Ace in $oDacl
        If $Ace.trustee = $trustee
           $oDacl.RemoveAce($Ace)
        EndIf
      Next
      $GSD.DiscretionaryAcl = $oDacl
      $ADSU.SetSecurityDescriptor($object, 2, $GSD, 1)
    Else
      Exit 1
    EndIf
  EndIf
  If $cmd = "ADD"
    If $trustee <> ""
      $oAce = CreateObject("AccessControlEntry")
      $oAce.Trustee = $trustee
      Select
        Case $perms = "READ"
          $oAce.AccessMask = 1179817
        Case $perms = "WRITE"
          $oAce.AccessMask = 1245631
        Case $perms = "FULL"
          $oAce.AccessMask = 2032127
        Case 1
          $oAce.AccessMask = 1179817
      EndSelect
      $oDacl.AddAce($oAce)
      $GSD.DiscretionaryAcl = $oDacl
      $ADSU.SetSecurityDescriptor($object, 2, $GSD, 1)
    Else
      Exit 1
    EndIf
  EndIf
  Exit @ERROR
EndFunction

Function ReadFile($file)
	Dim $lf, $f, $_, $t
	$lf=Chr(10)
	$f=FreeFileHandle
	$_=Open($f,$file)
	If @ERROR   Exit @ERROR   EndIf
	Do $t=$t+$lf+ReadLine($f) Until @ERROR
	$_=Close($f)
	$ReadFile=Split(SubStr($t,2),$lf)
EndFunction

Top
#192805 - 2009-03-11 07:52 AM Re: find a certain share within a domain [Re: dwb]
dwb Offline
Fresh Scripter

Registered: 2009-02-04
Posts: 7
Loc: nv
i was thinking about searching AD and all the computers say listed in the container "computers" and/or other OU's containing computers. that would get me my computer list, then search for shares and test the share property for it's status. versus, say, reading from a text file that has 6000+ computers listed.

i could then write those results to a CSV text file to import into, say Excel.

if not AD then what about WMI or something?

Top
#192808 - 2009-03-11 09:20 AM Re: find a certain share within a domain [Re: dwb]
Lonkero Administrator Offline
KiX Master Guru
*****

Registered: 2001-06-05
Posts: 22346
Loc: OK
uhm.
everyone shares are not that bad.
by default, in order to access those one needs to provide user and password anyhow.

anonymous isn't mapped by default to everyone.
so everyone shares actually mean "authenticated users"
_________________________
!

download KiXnet

Top
#192809 - 2009-03-11 09:20 AM Re: find a certain share within a domain [Re: Lonkero]
Lonkero Administrator Offline
KiX Master Guru
*****

Registered: 2001-06-05
Posts: 22346
Loc: OK
or is there some MCP around who can prove me wrong?
_________________________
!

download KiXnet

Top
#192814 - 2009-03-11 09:50 AM Re: find a certain share within a domain [Re: Lonkero]
NTDOC Administrator Offline
Administrator
*****

Registered: 2000-07-28
Posts: 11634
Loc: Space
I'm not MCP so will MCSE do?

Depends on OS and version as Microsoft changed some along the way.
I general though as long as the underlying NTFS permissions are set correctly it shouldn't matter and is only a secondary protection method.

Top
#192816 - 2009-03-11 11:29 AM Re: find a certain share within a domain [Re: NTDOC]
BradV Offline
Seasoned Scripter
****

Registered: 2006-08-16
Posts: 687
Loc: Maryland, USA
As far as getting the list, yes you can query active directory and get that list. I'm sure there is current code in the forums that covers this. I have code I built from examples I found here.
Top
#192817 - 2009-03-11 11:29 AM Re: find a certain share within a domain [Re: NTDOC]
Lonkero Administrator Offline
KiX Master Guru
*****

Registered: 2001-06-05
Posts: 22346
Loc: OK
MCSE is by definition a MCP.

or do you wish to correct me again? :P

also, this "map anonymous to everyone" is a policy you can set, without working your brains out trying to develop a script that just lists such shares and then someone needs to do lot more work to change them.
_________________________
!

download KiXnet

Top
#192819 - 2009-03-11 12:03 PM Re: find a certain share within a domain [Re: Lonkero]
Glenn Barnas Administrator Offline
KiX Supporter
*****

Registered: 2003-01-28
Posts: 4402
Loc: New Jersey
Well, when I taught MCSE classes, the general rule was that you use share permissions in a workgroup where central authentication wasn't available, or on systems that still ran FAT filesystems. Barring those unusual situations, you set the share to Everyone/Full Control and applied appropriate NTFS permissions.

Combining physical (NTFS) and logical (share) permissions can create an environment that's difficult to manage. The prior admin team at the organization that I support today never learned that, and the helpdesk regularly gets calls about people not having access and they can't figure out why - because the NTFS permissions are correct. We remove share restrictions and things work as expected.

Basically, you use one or the other, but not both in combination. NTFS provides higher security and more granularity, which is why it's the recommended option.

Glenn
_________________________
Actually I am a Rocket Scientist! \:D

Top
#192820 - 2009-03-11 12:38 PM Re: find a certain share within a domain [Re: Glenn Barnas]
NTDOC Administrator Offline
Administrator
*****

Registered: 2000-07-28
Posts: 11634
Loc: Space
Well there are special cases when I think it comes in handy so I use both at times.

Article for those that are not aware of how it works.
http://www.windowsecurity.com/articles/Share-Permissions.html

Top
#192829 - 2009-03-11 06:49 PM Re: find a certain share within a domain [Re: NTDOC]
dwb Offline
Fresh Scripter

Registered: 2009-02-04
Posts: 7
Loc: nv
Enabling "Network access: Let Everyone permissions apply to anonymous users" does not generate the list this client would like. Your suggestion does solve a problem however, but not the requested solution of this particular client.
Top
#192830 - 2009-03-11 06:52 PM Re: find a certain share within a domain [Re: dwb]
dwb Offline
Fresh Scripter

Registered: 2009-02-04
Posts: 7
Loc: nv
NTDOC,

thanks, i'll give the code a run and check it out. mucho gracias

Top
#192831 - 2009-03-11 07:05 PM Re: find a certain share within a domain [Re: dwb]
Lonkero Administrator Offline
KiX Master Guru
*****

Registered: 2001-06-05
Posts: 22346
Loc: OK
dwb, it does, your client just doesn't know it and you might not understand it.

there is no reason for the list, if it's disabled, as it is by default.
_________________________
!

download KiXnet

Top
#192834 - 2009-03-11 09:00 PM Re: find a certain share within a domain [Re: Lonkero]
dwb Offline
Fresh Scripter

Registered: 2009-02-04
Posts: 7
Loc: nv
lonkero, ok, i'll pass the suggestion onward to him and get his feedback
Top
#192836 - 2009-03-11 09:14 PM Re: find a certain share within a domain [Re: dwb]
Lonkero Administrator Offline
KiX Master Guru
*****

Registered: 2001-06-05
Posts: 22346
Loc: OK
hmm... stumbled to this one: http://www.nirsoft.net/utils/netresview.html
doesn't show anything at my home and the screenshot is not complete, so can't say if it shows the rights or not.
_________________________
!

download KiXnet

Top
#192875 - 2009-03-13 08:01 PM Re: find a certain share within a domain [Re: Lonkero]
dwb Offline
Fresh Scripter

Registered: 2009-02-04
Posts: 7
Loc: nv
NTDOC: thanks. that works fine. i'll look for a UDF Script that could substitute for the "net view" command so the program could grab a list versus the user manually doing that -- or give him the option for both.

Lonkero: thanks for the link. the user may make use of that util or something like "hyena" also.

meanwhile the script is doing ok as an option too.

mucho gracias

Top
Page 1 of 1 1


Moderator:  Jochen, Allen, Radimus, Glenn Barnas, ShaneEP, Ruud van Velsen, Arend_, Mart 
Hop to:
Shout Box

Who's Online
0 registered and 2220 anonymous users online.
Newest Members
Viginette, ManuvdWielNL, Sir_Barrington, batdk82, StuTheCoder
17888 Registered Users

Generated in 1.115 seconds in which 0.062 seconds were spent on a total of 13 queries. Zlib compression enabled.

Search the board with:
superb Board Search
or try with google:
Google
Web kixtart.org