Option Explicit

Dim arrMonth, arrOSVer
Dim blnWUAUServ, blnWUOK
Dim dtmLastCheck
Dim intLC, intLD, intLI, intMonth, intToday
Dim colItems, objItem, objReg, objWMISvc
Dim strComputer, strLastBoot, strLastCheck, strLastDownload
Dim strLastInstall, strLB, strMsg, strRegKey, strWUMsg

Const HKLM = &H80000002

arrMonth  = Array( "Error", "January", "February", "March", "April", "May", "June", _
                  "July", "August", "September", "October", "November", "December" )
blnWUOK   = True

With WScript.Arguments
	If .Named.Count > 0 Then
		If .Named.Exists( "?" ) And .Named.Count = 1 Then
			Syntax ""
		Else
			Syntax "Invalid command line switches"
		End If
	End If
	If .Unnamed.Count > 1 Then
		Syntax "Invalid number of command line arguments"
	End If
	If .Unnamed.Count = 1 Then
		strComputer = UCase( .Unnamed(0) )
	Else
		strComputer = "."
	End If
End With

' First check the OS version: XP (5.1) SP2 is the minimum required
Set objWMISvc = GetObject( "winmgmts://" & strComputer & "/root/cimv2" )
Set colItems = objWMISvc.ExecQuery( "Select * from Win32_OperatingSystem", , 48 )
For Each objItem in colItems
	' Read and store date and time of last boot
	strLB = Left( objItem.LastBootUpTime, 14 )
	strLastBoot = Left( strLB, 4 )    & "-" & Mid( strLB, 5, 2 )  & "-" _
	            & Mid( strLB, 7, 2 )  & " " & Mid( strLB, 9, 2 )  & ":" _
	            & Mid( strLB, 11, 2 ) & ":" & Mid( strLB, 13, 2 )
	' Read and check Windows version
	arrOSVer = Split( objItem.Version, "." )
	If arrOSVer(0) < 5 Then
		Syntax "This script requires Windows XP SP2 or later." & vbCrLf _
		     & "       OS version detected: " & objItem.Caption & " SP " _
		     & objItem.ServicePackMajorVersion & "." _
		     & objItem.ServicePackMinorVersion & "."
	End If
	If arrOSVer(0) = 5 Then
		If arrOSVer(1) = 0 Then
			Syntax "This script requires Windows XP SP2 or later"
		End If
		If objItem.ServicePackMajorVersion < 2 Then
			Syntax "This script requires Windows XP SP2 or later"
		End If
	End If
Next

' Check if Windows Update service is running
Set colItems = objWMISvc.ExecQuery( "Select * From Win32_Service Where Name='wuauserv'", , 48 )
For Each objItem in colItems
	If objItem.State = "Running" Then
		blnWUAUServ = True
	Else
		blnWUAUServ = False
	End If
Next

' Custom error handling is required, since many properties to
' be queried may be invalid for the installed security products
'On Error Resume Next

' Connect to the local or remote SecurityCenter through WMI
Set objWMISvc = GetObject( "winmgmts:{impersonationLevel=impersonate}!//" _
              & strComputer & "/root/SecurityCenter" )
If Err Then
	If strComputer = "." Then
		Syntax "Could not connect to SecurityCenter"
	Else
		Syntax "Could not connect to SecurityCenter on " & strComputer
	End If
End If

' Query the installed AntiVirus product
Set colItems = objWMISvc.ExecQuery( "SELECT * FROM AntiVirusProduct" )
If Err Then
	Syntax "No AntiVirus product detected by WMI"
End If

strMsg = vbCrLf & "AntiVirus:" & vbCrLf
If InStr( UCase( WScript.FullName ), "\CSCRIPT.EXE" ) Then strMsg = strMsg & "=========="

For Each objItem in colItems
	With objItem
		'WScript.Echo .companyName
		'WScript.Echo .instanceGuid
		strMsg = strMsg & vbCrLf & .displayName & ",  Version " & .versionNumber
		If .onAccessScanningEnabled Then
			strMsg = strMsg & vbCrLf & "On-access scanning is enabled"
		Else
			strMsg = strMsg & vbCrLf & "Warning: on-access scanning is disabled!"
		End If
		If .productUptoDate Then
			strMsg = strMsg & vbCrLf & "Virus definitions are up-to-date"
		Else
			strMsg = strMsg & vbCrLf & "Warning: virus definitions are NOT up-to-date!"
		End If
	End With
Next

' Query the installed Firewall product
Set colItems = objWMISvc.ExecQuery( "SELECT * FROM FirewallProduct" )
If Err Then
	Syntax "No firewall detected by WMI"
End If

strMsg = strMsg & vbCrLf & vbCrLf & "Firewall:" & vbCrLf
If InStr( UCase( WScript.FullName ), "\CSCRIPT.EXE" ) Then strMsg = strMsg & "========="

For Each objItem in colItems
	With objItem
		'WScript.Echo .companyName
		'WScript.Echo .instanceGuid
		strMsg = strMsg & vbCrLf & .displayName & ", Version " & .versionNumber
		If .enabled Then
			strMsg = strMsg & vbCrLf & "Firewall is enabled"
		Else
			strMsg = strMsg & vbCrLf & "Warning: firewall is disabled!"
		End If
	End With
Next

strMsg = strMsg & vbCrLf & vbCrLf & "Windows Update:" & vbCrLf
If InStr( UCase( WScript.FullName ), "\CSCRIPT.EXE" ) Then strMsg = strMsg & "==============="

' Check if the Windows Update service is running
If blnWUAUServ Then
	strMsg = strMsg & vbCrLf & "Windows Update Service is active"
Else
	strMsg = strMsg & vbCrLf & "Warning: Windows Update Service NOT active!"
	blnWUOK = False
End If

' Windows Update results are read from the registry
Set objReg = GetObject( "winmgmts:{impersonationLevel=impersonate}!//" _
           & strComputer & "/root/default:StdRegProv" )

strRegKey = "SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\"

' Read the time and date of the last successful download
objReg.GetStringValue HKLM, strRegKey & "Download", "LastSuccessTime", strLastDownload
strWUMsg = vbCrLf & "Last Download : " & strLastDownload
' Convert the time and date string to a long integer
intLD = Left( strLastDownload, 10 )
intLD = Replace( IntLD, " ", "" )
intLD = Replace( intLD, "-", "" )
intLD = Replace( intLD, ":", "" )
intLD = CLng( intLD )

' Read the time and date of the last successful install
objReg.GetStringValue HKLM, strRegKey & "Install",  "LastSuccessTime", strLastInstall
strWUMsg = strWUMsg & vbCrLf & "Last Install  : " & strLastInstall
' Convert the time and date string to a long integer
intLI = Left( strLastInstall, 10 )
intLI = Replace( intLI,  " ", "" )
intLI = Replace( intLI, "-", "" )
intLI = Replace( intLI, ":", "" )
intLI = CLng( intLI )

' Insert the line with the last reboot date and time
strWUMsg = strWUMsg & vbCrLf & "Last Reboot   : " & strLastBoot

' Read the time and date of the last successful check for new updates
objReg.GetStringValue HKLM, strRegKey & "Detect",   "LastSuccessTime", strLastCheck
strWUMsg = strWUMsg & vbCrLf & "Last Check    : " & strLastCheck
' Convert the time and date string to a long integer
intLC = Left( strLastCheck, 10 )
intLC = Replace( intLC, " ", "" )
intLC = Replace( intLC, "-", "" )
intLC = Replace( intLC, ":", "" )
intLC = CLng( intLC )
' Convert the long integer to a true date
intMonth = CInt( "1" & Mid( intLC, 5, 2 ) ) - 100
dtmLastCheck = CDate( Mid( intLC, 7, 2 ) & " " & arrMonth(intMonth) & " " & Left( intLC, 4 ) )

On Error Goto 0

' WU check includes the following requirements:
' * Automatic Updates service must be running
' * last successful download must be BEFORE last successful install
' * last reboot must be AFTER last successful install
' * last check must be no more than 7 days ago
' If any of these tests fails, all intermediate results will be displayed,
' if all tests are passed, a brief summary will be displayed
If intLD > intLI Then
	strWUMsg = strWUMsg & vbCrLf & "Warning: last install was unsuccessful!"
	blnWUOK  = False
End If

If DateDiff( "d", dtmLastCheck, Now ) > 7 Then
	strWUMsg = strWUMsg & vbCrLf & "Warning: the last check was " & DateDiff( "d", dtmLastCheck, Now ) & " days ago!"
	blnWUOK  = False
End If

If CLng( Left( strLB, 8 ) ) < intLI Then
	strWUMsg = strWUMsg & vbCrLf & "Warning: a reboot is required!"
	blnWUOK  = False
End If

If blnWUOK Then strWUMsg = vbCrLf & "Windows Update seems to be functioning OK"

WScript.Echo strMsg & strWUMsg

Set objReg    = Nothing
Set colItems  = Nothing
Set objWMISvc = Nothing


Sub Syntax( myMsg )
	If myMsg <> "" Then
		strMsg = vbcrlf & "Error: " & myMsg & vbCrLf
	Else
		strMsg = ""
	End If
	strMsg = strMsg & vbCrLf _
	       & "SecStat.vbs,  Version 2.01 for Windows XP SP2 and later" _
	       & vbCrLf _
	       & "Display a SecurityCenter and Windows Update status overview for any computer" _
	       & vbCrLf & vbCrLf _
	       & "Usage:  SECSTAT.VBS  [ computer ]" _
	       & vbCrLf & vbCrLf _
	       & "Where:  ""computer""   is an optional remote computer name" _
	       & vbCrLf _
	       & "                     (default is the local computer)" _
	       & vbCrLf & vbCrLf _
	       & "Inspired by an entry in Alejandro Campos Magencio's blog:" _
	       & vbCrLf _
	       & "http://blogs.msdn.com/alejacma/archive/2008/05/12/how-" _
	       & vbCrLf _
	       & "to-get-antivirus-information-with-wmi-vbscript.aspx." _
	       & vbCrLf & vbCrLf _
	       & "Use WBEMTEST to find all properties for specific products." _
	       & vbCrLf & vbCrLf _
	       & "Written by Rob van der Woude" _
	       & vbCrLf _
	       & "http://www.robvanderwoude.com"
	WScript.Echo strMsg
	WScript.Quit 1
End Sub