尝试制定审核程序

时间:2018-11-21 13:23:06

标签: powershell csv vbscript audit

前一段时间,当我为当地大学的IT部门工作时,我已经编译了此审核程序,而我对于实际抓取当前的工作驱动器并从 Programs中提取所有文件颇为执着。 strong>和程序x86 可以成功地构建此应用程序,而不是使用注册表(SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Uninstall),因为这不会只拉一些程序。

此外,我不确定如何获得当前活动目录驱动器(脚本最初位于该位置的第二个粗体部分)并创建一个文件夹,在其中将文件作为msinfo32.exe系统名称保存到新文件夹中

(名称无关紧要),这是我一直努力实现的长期目标,但我绝对迷失了。

' Sample VBScript to Export list of Installed Programs into CSV File.
' ------------------------------------------------------
const HKEY_LOCAL_MACHINE = &H80000002
Dim strComputer, strKeyPath
strComputer = "."

' Registry key path of Control panel items for installed programs

strKeyPath = "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\"

Dim objReg, strSubkey, arrSubkeys 

Set objReg=GetObject( _ 
    "winmgmts:{impersonationLevel=impersonate}!\\" & _
   strComputer & "\root\default:StdRegProv")

objReg.EnumKey HKEY_LOCAL_MACHINE, strKeyPath, arrSubkeys 

Dim objFSO, objCSVFile

' Create CSV file 
Const ForWriting = 2

Set objFSO = CreateObject("Scripting.FileSystemObject")

' Here, I have given CSV file path as "Installed-Softwares.csv", this will create Installed-Softwares.csv file
' where you placed and execute this VB Script file. You can give your own file path
' like "C:\Users\Administrator\Desktop\Installed-Softwares.csv"

Set objCSVFile = objFSO.CreateTextFile("F:\Custom\Installed-Softwares.csv", _ 
    ForWriting, True)**

' Write Software property names as CSV columns(first line)
 objCSVFile.Write "Name,Version,Publisher,Location,Size"
 objCSVFile.Writeline ' New Line

Dim Name,Version,Publisher,Location,Size

'Enumerate registry keys.
For Each strSubkey In arrSubkeys 
 objReg.GetStringValue HKEY_LOCAL_MACHINE, strKeyPath & strSubkey, "DisplayName" , Name
 If Name <> "" Then 
    objReg.GetStringValue HKEY_LOCAL_MACHINE, strKeyPath & strSubkey, "DisplayVersion", Version
           objReg.GetStringValue HKEY_LOCAL_MACHINE, strKeyPath & strSubkey, "Publisher",Publisher
           objReg.GetStringValue HKEY_LOCAL_MACHINE, strKeyPath & strSubkey, "InstallLocation", Location
           objReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath & strSubkey, "EstimatedSize" , Size
  If  Size <> "" Then 
   Size= Round(Size/1024, 3) & " MB"
  Else 
   Size= "0 MB"
  End If 

objCSVFile.Write Name &","&Version&","&Publisher&","&Location&","&Size
           objCSVFile.Writeline ' New Line
      End If 
Next

WScript.Quit

注释:例如,从(例如C:\或当前主驱动器)程序文件和程序文件x86中->放入列表中->输出Currentdrive:\ newfolder \ msinfo32systemname。

此外,它显示的是0 MB而不是实际的MB,我注意到输出文件正在执行此操作。这可以与其他文件结合使用,实际上我绝对没有完全从头开始编写此代码。

信用:https://www.morgantechspace.com/2014/04/VBScript-to-Get-List-of-Installed-Software-through-Registry.html

1 个答案:

答案 0 :(得分:0)

由于将其标记为Powershell,因此可以使用此功能在(远程)计算机上查找已安装的软件。它使用注册表,但同时在SOFTWARE\Microsoft\Windows\CurrentVersion\UninstallSOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall中查找软件。

# Get the current path this script is in
$ScriptPath = if ($PSScriptRoot) { $PSScriptRoot } else { Split-Path $script:MyInvocation.MyCommand.Path }
# Combine to make a valid path for the output file
$OutputPath = Join-Path -Path $ScriptPath -ChildPath 'InstalledSoftware'
if (!(Test-Path -Path $OutputPath -PathType Container)) {
    New-Item -Path $OutputPath -ItemType Directory -Force | Out-Null
}


function Get-InstalledSoftware {
    [CmdletBinding()]
    param(
        [Parameter(ValueFromPipeline = $true, ValueFromPipelineByPropertyName = $true, Position = 0)]
        [string[]]$ComputerName = $env:COMPUTERNAME,

        [Parameter(Mandatory = $false)]
        [string]$NamePattern = '*',

        [switch]$ExcludeUpdates
    )
    begin {
        $UninstallPaths = 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\',
                          'SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\'
    }
    process {
        foreach ($computer in $ComputerName) {
            $result = @()
            if ([string]::IsNullOrEmpty($computer) -or $computer -eq '.') { $computer = $env:COMPUTERNAME }
            $loggedOnUser = (Get-WmiObject -Class Win32_ComputerSystem -ComputerName $computer).UserName
            $regBaseKey   = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey([Microsoft.Win32.RegistryHive]::LocalMachine,$computer)
            foreach ($regPath in $UninstallPaths) {
                ($regBaseKey.OpenSubKey($regPath)) | foreach {
                    $_.GetSubKeyNames() | ForEach-Object {
                        $regSubKey   = $regBaseKey.OpenSubKey("$regPath$_")
                        $application = $regSubKey.GetValue('DisplayName')
                        $size        = [int64]$regSubKey.GetValue('EstimatedSize')
                        if (($application) -and ($application -like $NamePattern)) {
                            if (!$ExcludeUpdates -or ($application -notlike "*update*")) {
                                $result += [PSCustomObject]@{
                                    'Computer'        = $computer
                                    'Application'     = $application
                                    'Version'         = $regSubKey.GetValue('DisplayVersion')
                                    'InstallLocation' = $regSubKey.GetValue('InstallLocation')
                                    'UninstallString' = $regSubKey.GetValue('UninstallString')
                                    'Publisher'       = $regSubKey.GetValue('Publisher')
                                    'Size'            = '{0:F2} MB' -f ($size / 1MB)
                                    'LoggedOnUser'    = $loggedOnUser
                                }
                            }
                        }
                        # close $regSubKey
                        if ($regSubKey)  { $regSubKey.Close() }
                    }
                }
            }
            # close $regBaseKey
            if ($regBaseKey)  { $regBaseKey.Close() }

            # export the software list for this computer as CSV
            $outputFile = Join-Path -Path $OutputPath -ChildPath "msinfo32$computer"
            ($result | Sort-Object -Property 'Application' -Unique) | Export-Csv -Path $outputFile -NoTypeInformation

            # show on screen
            Write-Verbose "Created '$outputFile'"
        }
    }
}

它将在当前脚本路径中创建一个名为“ InstalledSoftware”的文件夹,其中每台计算机的csv文件另存为“ msinfo32COMPUTERNAME.csv”

像这样在本地计算机上调用它:

Get-InstalledSoftware -NamePattern * -ExcludeUpdates -Verbose

或向其提供一系列计算机名称(您具有管理员权限),如下所示:

Get-InstalledSoftware -ComputerName machine1,machine2,machine3 -NamePattern * -ExcludeUpdates -Verbose