AD-COIT Configuration Video

I've taken the questions and feedback that I've received on AD-COIT and put together this short video which shows how to download, install, and configure it.

To create the video, I actually setup a small network on an ESX box using an isolated vSwitch to connect a domain controller, and some virtual machines. This entire setup process shown in the video actually occurs from the domain controller, and demonstrates how to download AD-COIT, edit the LDAP path to reflect your environment (minute 1:12), how to run the script (minute 2:05), and then how to modify the script to echo the results to a text file (minute 3:12).

Let me know what you think!

AD-COIT v2.546 Released - Adds basic command line functionality

This release adds basic command line functionality to the script, which includes options to enable/disable main inventory logic, FSMO role detection, and select output to CSV as an option. Also added to the main inventory logic is SQL server detection/status.

The command line functionality should make the script easier to use, and reduce some confusion associated with having to change the LDAP path, and path to the CSV output. You still need to make sure your LDAP path reflects reality, and that the path to your CSV output file actually exists (i.e. c:\scripts\output.csv), but it's more prominently displayed in the help.

As always, you can find the latest release on Sourceforge.

AD-COIT: Adding Command Line Options

Since adding the CSV output to AD-COIT in v2.5 I’ve been working on few other updates, focused primarily on building basic command line functionality. So instead of having the script automatically echo FSMO roles to the screen, output to the CSV, and execute the main logic, you’ll be able to specify these options on the command line. At this point, I’m not ready to drill down and add logic and command line parameters to handle each collection (it’s still an all or nothing type of thing), but I think that the above will add a bit more control for everyone.

As always, feedback and suggestions are appreciated! I’ll also post to this blog when the release is updated on SourceForge.

AD-COIT v2.52 Released - Adds CSV output and more inventory options

I posted an update today to my AD-COIT script over on SourceForge.

With the latest release, version 2.52 adds CSV output and local admin group enumeration. CSV output, together with improving readability, makes it easier to manipulate your data using a spreadsheet app. You may notice a few bugs in the output, but all-in-all I think it was worth the time to update the release.

The most recent changes were driven by internal needs – as well as your emails and comments – so keep them coming! Mainly we needed to find and fix local admin groups, as well as just make it easier to work with our data.

As always, your input is encouraged. Let me know if you have anything you’d like to see added!

AD-COIT: Reader question about the installed application list

I received a good question today about the application report in AD-COIT - the reader asks...

"In the list of installed applications that I am seeing it looks like a few applications that are installed are missing from the output. Specifically, we have a line-of-business application that's not showing up on the list... why?"

First, thanks for trying out the script, and for sending in the question! To answer you, you're correct. AD-COIT only returns information about applications that were installed by the Windows installer. Let me step you though the code to give you an idea of what I'm doing...

If you have the script opened, go down and look at the "ListInstalledApplications" function, and you'll see the the following line...

"Set colItemsProduct = objWMIService.ExecQuery("Select * from Win32_Product")".

What I'm doing there is connecting to Win32_Product class, and returning the description and version information. So... you're next question might be... "how did you know that Win32_Product class only returns apps installed by the Windows installer?". I checked the MSDN site... which says, "The Win32_Product WMI class represents products as they are installed by Windows Installer."

By now, you might be thinking... "Great, you told me it's not comprehensive, you showed me why it's not comprehensive, but you didn't tell me how to make it comprehensive"!" ;)

As to getting the rest of the information... I know there's a registry key that houses uninstall information, you can use regedit to browse here... HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

As to getting it out of the registry... that's a good question. Take a look at the "SavDate" function... it uses the "reg" command to pull stuff out of the registry. You could probably take some of the code in the SavDate, and work on it until you pull what you want out of the appropriate keys. Which will probably be a bit of a challenge. That said, I was just browsing though Microsoft's scriptcenter and found a code snippet that looks like it does exactly what you're looking for... Look at the "List all Installed Software" linked here. You can try taking that code, and playing with it to get an idea of how it works. Then try adding it to the script, and let me know how it goes.

AD-COIT v2.52, Inventory Tool Released on Sourceforge

Last updated: 5/14/2007

AD-COIT (Active Directory – Computer Object Inventory Tool) is a script that I’ve put together to automate the hardware/software information gathering and inventory process, with a focus on simplicity and portability. While the target audience for AD-COIT is small-to-midsized Active Directory environments – specifically for the SBS community - you can leverage it in much larger environments for information gathering and asset tracking. The highlights of what gets logged include: workstation hardware information, operating system and configuration information, installed software, enumeration of local admin groups, and more (see below).

Useful Links:

• Download it now from Sourceforge.net.
• View the sample output (go here for screenshots)
• Usage Information and How-To article
• Frequently Asked Questions (FAQ)
• Look at the source (older post)
  

When you go to run the script ("cscript scriptname.vbs"), the output is both echoed to the screen and written to the .CSV file. During the previous release (2.3), I had a few people ask how to tell if the script was working. Basically, if you see text being written to your command-prompt window, and you’ve configured a valid path for the CSV output (c:\scripts by default), then just let it run. You can always open a read-only copy of the output while it’s working. When it’s finished, use Excel (or something similar) to view/sort the output.

What if I need something specific, will you customize the script for me?
Sure thing. For instance, if you want the results output to a spreadsheet (as of 2.52), or have a different antivirus package you want to check – or… whatever the case may be, just let me know and we can discuss your objectives, and hopefully work out a solution.

Does it do “X”, “Y”, and/or “Z”?
Maybe… if it doesn’t yet, send me an email or post a comment and I’ll consider adding the functionality in a future release.

Does it output to .CSV?
Yes… as of v2.52. Thanks to everyone who emailed me with this suggestion! If you havn't updated recently, go grab the latest copy!

What gets included in the inventory?
The full list includes: Individual system information organized by computer name, including… operating system, service pack level, installation date, manufacturer name, BIOS name, service tag, processor information, domain role, current user, model, RAM, daylight savings status, time zone, Symantec Antivirus definition date, free space on the local drives, list of installed applications, enumeration of the local admin group, as well as a summary of the FSMO-role holders, non-responsive systems, and systems which logged errors.

Why did you write the script?
It started out to help me troubleshoot some daylight savings time problems for a new client, and then just evolved from there… adding functionality where appropriate.

Did you know something - fill-in-the-blank - doesn’t work right?
I probably am not aware of it. If you find something doesn’t work the way you expect, or is simply broken, please let me know, and I’ll take a look (yes, I do know that FSMO roles aren't written to the CSV file).

AD-COIT: AD-COIT Frequently Asked Questions (FAQ)

AD-COIT Frequently Asked Questions (FAQ):

Where can I download the tool?
The project is hosted over on Sourceforge. You can grab a copy here.

How long will it take to run the script?
It depends on the size of your AD-environment, the number of computer objects in it, how many are online, and your network architecture.

How long will it take assuming 30 computers, with most of them being on-line, and very little AD-clutter in terms of retired computer accounts that remain in AD.
Maybe 5-10 minutes.

Who is the script designed for?
Small-to-Midsized environments.

Will this script work in enterprise environments?
Probably. I've tested it in smaller environments - say, a few hundred clients or less. If you've used it in a medium-to-large environment, email me and let me know about your experience.

When I run the script, it doesn’t report the FSMO role holders. Why?
FSMO role detection uses "DSQUERY" to grab the role-holders. You'll need the "Windows 2003 Admin Pack" installed on the computer that you're executing the script from.

Where can I get DSQUERY/Admin-Pack from?
I't s available for download from the Microsoft download center... http://www.microsoft.com/downloads/details.aspx?FamilyID=c16ae515-c8f4-47ef-a1e4-a8dcbacff8e3&DisplayLang=en

I can't get any of my computer's to respond, what's going on?
AD-COIT needs to be able to talk to client computers on port 135. If you have a firewall enabled on your clients, you'd need an exception for unsolicited DCOM requests on port 135.

How do I create an exception for this (and other) scripts to run, using Group Policy?
If you're using the Windows Firewall, this can get configured via a Group Policy setting called "Allow Remote Administration Exception" (Open up Group Policy Manager, and go here under your Computer objects OU - Computer Configuration\Administrative Template\Network\Windows Firewall\Domain Profile).

AD-COIT: AD-COIT Usage and How-To

Usage: "cscript ad.inventory.v2.3.vbs >inventoryreport.txt"

How-To:

1. Download the latest version of AD-COIT.
2. Uncompress and extract the files to a folder on the local computer ("c:\scripts\AD-COIT")
3. Edit the script using a text editor
4. Edit the following line to reflect your organization's LDAP path: StrLdapPath = "'LDAP://DC=domain,DC=local' - In most cases you simply need to update the domain.
   Save the file and exit.
5. Open a command prompt (start>run>"cmd"), and run the script: "cscript ad.inventory.v2.3.vbs >inventoryreport.txt"
6. Keep in mind that when redirecting the output, you wont see the command-prompt window update until the script finishes. If you want to see the output, just use the following commend: "cscript ad.inventory.v2.3.vbs"