Home > Windows Applications > Web Tracks Audit
Web Tracks Audit
Executable Name: WTAudit.exe
Default Location: C:\Program Files\Gritware\Web Tracks\WTAudit
Requirements: .Net Framework Version 2.0 through 3.5.1 (will also run on .Net 4 or 4.5 if the WTAudit.exe.config file is present.
Purpose: Perform unattended Audits, Audit single workstations, Audit computers in different domains, Import Audit Files.
Remarks: WTAudit.exe may be copied to other computers meeting the above requirements.
COMMAND LINE PARAMETERS:
MODE
|
NORMAL
|
Audit runs and user must press Close to end the program.
|
|
SILENT
|
Audit runs hidden and closes when completed
|
|
AUTO_CLOSE
|
Audit runs visible but closes when completed
|
|
NETWORK
|
Triggers a network audit. When using this mode you must specify either LDQ, COMPLIST, or IPRANGE. In addition you must also specify the USERID, DOMAIN and PASSWORD parameters.
|
|
IMPORT
|
Open a graphical user interface used to import XML files into the database. The WEB_SERVICE_URL parameter is required for IMPORT mode.
|
WEB_SERVICE_URL (may be abbreviated as WSU)
The URL to the Web Tracks Web Service (RootOfWebTracksSite/Services/WebTracksServices.asmx)
Example: WEB_SERVICE_URL=http://YourServer/WebTracks/Services/WebTracksServices.asmx
NOTE: This parameter is required when the MODE is set to NETWORK or IMPORT. If this parameter is SET for NORMAL, SILENT, OR AUTO_CLOSE the program will use the Web Service to record the audit directly to the Web Tracks database. If this parameter is not supplied the audit will be written to a file named <ComputerName>.xml.
LDQ (NETWORK MODE)
This must be a valid LDAP Query String. Use Quotes if the query contains spaces.
Examples:
|
LDQ= LDAP://DC=yourdomain,DC=com
|
Retrieves all computers from the yourdomain.com domain
|
|
LDQ= LDAP://MYLDAPSERVER
|
Retrieves all computers listed on the MYLDAPSERVER server
|
|
LDQ=LDAP://OU=IT,DC=hq,DC=yourdomain,DC=com
|
Retrieves computer from the IT organizational unit in the domain hq.yourdomain.com
|
|
"LDQ=LDAP://OU=Accounts,OU=Finance,DC=hq,DC=yourdomain,DC=com"
|
Retrieves computers from the Accounts organizational unit contained within the Finance organizational unit in the domain hq.yourdomain.com. Note the quotation marks surrounding the entire parameter. This is required if your LDAP Query contains spaces.
|
NOTE: The order of the items is important. For example if you have an Organizational Unit Named Accounts that contains the Organizational Units Accounts Payable and Accounts Receivable you would need to list the end node of the tree first and work your way up. The valid order for the tags is OU, then DC.
(Correct)
LDAP://OU=Accounts Payable,OU=Accounting,DC=yourdomain,DC=com
(Incorrect)
LDAP://OU=Accounting,OU=Accounts Payable,DC=yourdomain,DC=com
Note: specifying the LDQ parameter forces MODE=NETWORK
IPRANGE (NETWORK MODE)
The 4th octet specifies the range with a dash (-). Do not include spaces in this string.
Example: IPRANGE=192.168.0.100-200
Note: specifying the IPRANGE parameter forces MODE=NETWORK
COMPLIST (NETWORK MODE)
Use a comma with no spaces to separate computer names.
Example: COMPLIST=ComputerA,ComputerB,ServerC
Note: specifying the COMPLIST parameter forces MODE=NETWORK
USERID (Only applies and is required when MODE=NETWORK)
A User ID with Administrative Access to the computers in the Domain.
Note: You may also specify the USERID in the domain\username format. If you specify it in this manner the DOMAIN parameter is not needed.
DOMAIN (Only applies and is required when MODE=NETWORK)
The Domain of the USERID
PASSWORD (Only applies and is required when MODE=NETWORK)
The Password of the USERID in the specified DOMAIN
REAUDIT (optional – default is true – only applies when the LDQ parameter is specified)
If set to true the Audit process will update computer records which are already in the Web Tracks Database. If this value is set to False the Audit process will only audit computers which do not currently exist in the Web Tracks database. Typically you would set REAUDIT to false only if you were only wanting to discover new computers. This parameter is only available when auditing using a LDAP Query (the LDQ parameter).
CONCURRENT (optional – default is 4 – only applies when MODE=NETWORK)
Specifies the number of audits to run concurrently (valid values 1-10)
EMAIL (optional – only applies when MODE=NETWORK)
If an email address is supplied a summary report will be mailed to this address upon completion of the audit. For this option to work make sure you have configured the Email Settings (Mail Server Tab) from Web Tracks in the Admin section.
EXAMPLES:
Use this example to audit all computers in your domain and email a summary report to myemail@myDomainName.com:
WTAudit.exe MODE=NETWORK LDQ=LDAP://MYDOMAINNAME USERID=myUserID DOMAIN=myDomainName PASSWORD=myPassword EMAIL=myemail@myDomainName.com WEB_SERVICE_URL=http://YourServer/WebTracks/Services/WebTracksServices.asmx
Use this example to create an XML audit file on the computer which the program is running. You may want to run the audit program in this manner when the computer does not have access to the Web Tracks website.
WTAudit.exe
Use this example to Audit computers which do not currently exist in the Web Tracks database from the Accounting organizational unit contained within the Finance organizational unit in the domain hq.yourdomain.com:
WTAudit.exe MODE=NETWORK LDQ= LDAP://OU=Accounting,OU=Finance,DC=hq,DC=yourdomain,DC=com USERID=myUserID DOMAIN=myDomainName PASSWORD=myPassword EMAIL=myemail@myDomainName.com REAUDIT=FALSE WEB_SERVICE_URL=http://YourServer/WebTracks/Services/WebTracksServices.asmx
This sample will silently audit the computer on which the program is running and automatically record the information to the database.
WTAudit.exe MODE=SILENT WEB_SERVICE_URL=http://YourServer/WebTracks/Services/WebTracksServices.asmx
This sample will audit the IP Addresses between 192.168.0.100 and 192.168.0.200. This sample also uses a few shorthand notations by specifying the root of the site, including the domain in the USERID, and omitting the MODE parameter (MODE=NETWORK is forced since the parameter IPRANGE was supplied).
WTAudit.exe IPRANGE=192.168.0.100-200 USERID=myDomain\myUserName PASSWORD=myPassword WSU=http://YourServer/WebTracks
AUTOMATING:
The real power of WTAudit.exe comes from automating the audit process. To automate this process, simply copy the command into a batch files (e.g., audit.bat). You can also create a scheduled task to run this batch file. See How to Schedule Tasks for additional information.
TIP: You may copy the WTAudit.exe and WTAudit.exe.config files to USB drives and/or shared network locations for convenience.
RUNNING WTAUDIT.EXE FROM A REMOTE DRIVE
The audit program was written in .NET and conforms to the managed code security enforced by Windows Operating Systems. Due to the fact that the audit program reads registry information the application must run as 'FullTrust'. By default applications which are executed from a local file path on the computer receive FullTrust. For this reason we recommend auditing computers that are not on your network using a USB flash drive or other portable disk.
If you wish to run WTAudit.exe from a disconnected network you will need to elevate the share from which the program will be run to a 'FullTrust' share. Below are the steps to enable a computer to fully trust managed code from a network share…
1. Open a command prompt
2. Type "cd %windir%\Microsoft.Net\Framework\2.0.50727
3. Type "CasPol.exe -m -ag 1.2 -url file://\\YourServer/YourMtAuditShare/* FullTrust"
For more information on caspol.exe visit…
http://blogs.msdn.com/shawnfa/archive/2004/12/30/344554.aspx
See also
|