Source code for secstat2.vbs

```
Option Explicit
```
```
 
```
```
Dim arrOSVer
```

Dim blnDomainMember, blnWFwEnabled, blnWUAUServ, blnWUOK

```
Dim dtmLastCheck
```

Dim intLC, intLD, intLI, intMonth, intToday, lngProductState

Dim colItems, objFSO, objItem, objReg, objWMIService, wshShell

Dim strComputer, strLastBoot, strLastCheck, strLastDownload

Dim strLastInstall, strLB, strMsg, strProductName, strProductPath

Dim strRegKey, strProductVersion, strTmpMsg, strWUMsg

```
 
```
```
Const HKLM = &H80000002
```
```
 
```
```
blnWUOK  = True
```
```
 
```
```
With WScript.Arguments
```
```
	If .Named.Count > 0 Then
```

		If .Named.Exists( "?" ) And .Named.Count = 1 Then

```
			Syntax ""
```
```
		Else
```

			Syntax "Invalid command line switches"

```
		End If
```
```
	End If
```
```
	If .Unnamed.Count > 1 Then
```

		Syntax "Invalid number of command line arguments"

```
	End If
```
```
	If .Unnamed.Count = 1 Then
```
```
		strComputer = UCase( .Unnamed(0) )
```
```
	Else
```
```
		strComputer = "."
```
```
	End If
```
```
End With
```
```
 
```

Set objFSO   = CreateObject( "Scripting.FileSystemObject" )

Set wshShell = CreateObject( "WScript.Shell" )

```
 
```
```
 
```

' First check the OS version: Vista (6.0) is the minimum required

Set objWMIService = GetObject( "winmgmts://" & strComputer & "/root/cimv2" )

Set colItems      = objWMIService.ExecQuery( "Select * from Win32_OperatingSystem", , 48 )

```
For Each objItem in colItems
```

	' Read and store date and time of last boot

	strLB = Left( objItem.LastBootUpTime, 14 )

	strLastBoot = Left( strLB, 4 )    & "-" & Mid( strLB, 5, 2 )  & "-" _

	            & Mid( strLB, 7, 2 )  & " " & Mid( strLB, 9, 2 )  & ":" _

	            & Mid( strLB, 11, 2 ) & ":" & Mid( strLB, 13, 2 )

```
	' Read and check Windows version
```

	arrOSVer = Split( objItem.Version, "." )

```
	If arrOSVer(0) < 5 Then
```

		Syntax "This script requires Windows Vista or later." & vbCrLf _

		     & vbtab & "OS version detected: " & objItem.Caption & " SP " _

		     & objItem.ServicePackMajorVersion & "." _

		     & objItem.ServicePackMinorVersion & "."

```
	End If
```
```
	If arrOSVer(0) < 6 Then
```

		Syntax "SecStat2.vbs requires Windows Vista or later." & vbCrLf _

		     & vbtab & "OS version detected: " & objItem.Caption & " SP " _

		     & objItem.ServicePackMajorVersion & "." _

		     & objItem.ServicePackMinorVersion & vbCrLf _

		     & vbTab & "For Windows XP SP2 or SP3 use SecStat.vbs instead of SecStat2.vbs"

```
	End If
```
```
Next
```
```
 
```

' Check if the computer is a domain member

Set colItems = objWMIService.ExecQuery( "Select * from Win32_ComputerSystem" )

```
For Each objItem in colItems
```

	blnDomainMember = CBool( objItem.PartOfDomain )

```
Next
```
```
 
```

' Check if Windows Update service is running

Set colItems = objWMIService.ExecQuery( "Select * From Win32_Service Where Name='wuauserv'", , 48 )

```
For Each objItem in colItems
```

	blnWUAUServ = ( objItem.State = "Running" )

```
Next
```
```
 
```

' Custom error handling is required, since many properties to be queried may be invalid for the installed security products

```
On Error Resume Next
```
```
 
```

' Connect to the local or remote SecurityCenter through WMI

Set objWMIService = GetObject( "winmgmts:{impersonationLevel=impersonate}!//" & strComputer & "/root/SecurityCenter2" )

```
If Err Then
```
```
	If strComputer = "." Then
```

		Syntax "Could not connect to SecurityCenter2"

```
	Else
```

		Syntax "Could not connect to SecurityCenter2 on " & strComputer

```
	End If
```
```
End If
```
```
 
```
```
' Query the installed AntiVirus product
```
```
strMsg = vbCrLf & "AntiVirus:" & vbCrLf
```

If InStr( UCase( WScript.FullName ), "\CSCRIPT.EXE" ) Then strMsg = strMsg & "=========="

```
 
```

Set colItems = objWMIService.ExecQuery( "SELECT * FROM AntiVirusProduct" )

```
If Err Then
```

	strMsg = strMsg & vbCrLf & "No AntiVirus product detected by WMI"

```
ElseIf colItems.Count = 0 Then
```

	strMsg = strMsg & vbCrLf & "No AntiVirus product detected by WMI"

```
End If
```
```
 
```
```
For Each objItem in colItems
```
```
	With objItem
```
```
		strProductName    = .displayName
```

		strProductPath    = wshShell.ExpandEnvironmentStrings( .pathToSignedProductExe )

		strProductVersion = objFSO.GetFileVersion( strProductPath )

		lngProductState   = CLng( .productState )

		strMsg            = strMsg & vbCrLf & strProductName & ",  Version " & strProductVersion

		strTmpMsg         = "Warning: unable to determine on-access scanning status!"

		If ( lngProductState And &H001000& ) = &H001000& Then

			strTmpMsg = "On-access scanning is enabled"

```
		Else
```

			strTmpMsg = "Warning: on-access scanning is disabled!"

```
		End If
```

		strMsg    = strMsg & vbCrLf & strTmpMsg

		strTmpMsg = "Warning: unable to determine whether virus definitions are up-to-date or not!"

		If ( lngProductState And &H000010& ) = 0 Then

			strTmpMsg = "Virus definitions are up-to-date"

```
		Else
```

			strTmpMsg = "Warning: virus definitions are NOT up-to-date!"

```
		End If
```
```
		strMsg = strMsg & vbCrLf & strTmpMsg
```
```
	End With
```
```
	strMsg = strMsg & vbCrLf
```
```
Next
```
```
 
```

' Query the installed AntiSpyware product

strMsg = strMsg & vbCrLf & "AntiSpyware:" & vbCrLf

If InStr( UCase( WScript.FullName ), "\CSCRIPT.EXE" ) Then strMsg = strMsg & "============"

```
 
```

Set colItems = objWMIService.ExecQuery( "SELECT * FROM AntiSpywareProduct" )

```
If Err Then
```

	strMsg = strMsg & vbCrLf & "No AntiSpyware product detected by WMI"

```
ElseIf colItems.Count = 0 Then
```

	strMsg = strMsg & vbCrLf & "No AntiSpyware product detected by WMI"

```
End If
```
```
 
```
```
For Each objItem in colItems
```
```
	With objItem
```
```
		strProductName    = .displayName
```

		strProductPath    = wshShell.ExpandEnvironmentStrings( .pathToSignedProductExe )

		strProductVersion = objFSO.GetFileVersion( strProductPath )

		lngProductState   = CLng( .productState )

		strMsg            = strMsg & vbCrLf & strProductName & ",  Version " & strProductVersion

		strTmpMsg         = "Warning: unable to determine on-access scanning status!"

		If ( lngProductState And &H001000& ) = &H001000& Then

			strTmpMsg = "On-access scanning is enabled"

```
		Else
```

			strTmpMsg = "Warning: on-access scanning is disabled!"

```
		End If
```

		strMsg    = strMsg & vbCrLf & strTmpMsg

		strTmpMsg = "Warning: unable to determine whether malware definitions are up-to-date or not!"

		If ( lngProductState And &H000010& ) = 0 Then

			strTmpMsg = "Malware definitions are up-to-date"

```
		Else
```

			strTmpMsg = "Warning: malware definitions are NOT up-to-date!"

```
		End If
```
```
		strMsg = strMsg & vbCrLf & strTmpMsg
```
```
	End With
```
```
	strMsg = strMsg & vbCrLf
```
```
Next
```
```
 
```
```
' Query the installed Firewall product
```

strMsg = strMsg & vbCrLf & "Firewall:" & vbCrLf

If InStr( UCase( WScript.FullName ), "\CSCRIPT.EXE" ) Then strMsg = strMsg & "========="

```
 
```

Set colItems = objWMIService.ExecQuery( "SELECT * FROM FirewallProduct" )

```
If Err Then
```

	strMsg = strMsg & vbCrLf & "No third party firewall detected by WMI"

```
ElseIf colItems.Count = 0 Then
```

	strMsg = strMsg & vbCrLf & "No third party firewall detected by WMI"

```
End If
```
```
 
```
```
For Each objItem in colItems
```
```
	With objItem
```
```
		strProductName    = .displayName
```

		strProductVersion = objFSO.GetFileVersion( .pathToSignedProductExe )

		lngProductState   = CLng( .productState )

		strMsg            = strMsg & vbCrLf & strProductName & ",  Version " & strProductVersion

		strTmpMsg         = "Warning: unable to determine whether third party firewall is enabled or not!"

		If ( lngProductState And &H010000& ) = &H001000& Then

			strTmpMsg = "Third party firewall is enabled"

```
		Else
```

			strTmpMsg = "Warning: third party firewall is disabled!"

```
		End If
```
```
		strMsg = strMsg & vbCrLf & strTmpMsg
```
```
	End With
```
```
	strMsg = strMsg & vbCrLf
```
```
Next
```
```
 
```

strRegKey = "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\"

```
If blnDomainMember Then
```

	strRegKey = strregkey & "DomainProfile"

```
Else
```

	strRegKey = strregkey & "StandardProfile"

```
End If
```

strRegKey     = strregkey & "\EnableFirewall"

blnWFwEnabled = ( wshShell.RegRead( strRegKey ) = 1 )

```
If Err Then
```

	strTmpMsg = "Warning: unable to determine whether Windows Firewall is enabled or not!"

```
Else
```
```
	If blnWFwEnabled Then
```

		strTmpMsg = "Windows Firewall is enabled"

```
	Else
```

		strTmpMsg = "Warning: Windows Firewall is disabled!"

```
	End If
```
```
End If
```
```
strMsg = strMsg & vbCrLf & strTmpMsg
```
```
 
```

strMsg = strMsg & vbCrLf & vbCrLf & "Windows Update:" & vbCrLf

If InStr( UCase( WScript.FullName ), "\CSCRIPT.EXE" ) Then strMsg = strMsg & "==============="

```
 
```

' Check if the Windows Update service is running

```
If blnWUAUServ Then
```

	strMsg = strMsg & vbCrLf & "Windows Update Service is active"

```
Else
```

	strMsg = strMsg & vbCrLf & "Warning: Windows Update Service NOT active!"

```
	blnWUOK = False
```
```
End If
```
```
 
```

' Windows Update results are read from the registry

Set objReg = GetObject( "winmgmts:{impersonationLevel=impersonate}!//" & strComputer & "/root/default:StdRegProv" )

```
 
```

strRegKey = "SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\"

```
 
```

' Read the time and date of the last successful download

objReg.GetStringValue HKLM, strRegKey & "Download", "LastSuccessTime", strLastDownload

strWUMsg = vbCrLf & "Last Download : " & strLastDownload

' Convert the time and date string to a long integer

```
intLD = Left( strLastDownload, 10 )
```
```
intLD = Replace( IntLD, " ", "" )
```
```
intLD = Replace( intLD, "-", "" )
```
```
intLD = Replace( intLD, ":", "" )
```
```
intLD = CLng( intLD )
```
```
 
```

' Read the time and date of the last successful install

objReg.GetStringValue HKLM, strRegKey & "Install",  "LastSuccessTime", strLastInstall

strWUMsg = strWUMsg & vbCrLf & "Last Install  : " & strLastInstall

' Convert the time and date string to a long integer

```
intLI = Left( strLastInstall, 10 )
```
```
intLI = Replace( intLI,  " ", "" )
```
```
intLI = Replace( intLI, "-", "" )
```
```
intLI = Replace( intLI, ":", "" )
```
```
intLI = CLng( intLI )
```
```
 
```

' Insert the line with the last reboot date and time

strWUMsg = strWUMsg & vbCrLf & "Last Reboot   : " & strLastBoot

```
 
```

' Read the time and date of the last successful check for new updates

objReg.GetStringValue HKLM, strRegKey & "Detect",   "LastSuccessTime", strLastCheck

strWUMsg = strWUMsg & vbCrLf & "Last Check    : " & strLastCheck

' Convert the time and date string to a long integer

```
intLC = Left( strLastCheck, 10 )
```
```
dtmLastCheck = CDate( intLC )
```
```
On Error Goto 0
```
```
 
```

' WU check includes the following requirements:

' * Automatic Updates service must be running

' * last successful download must be BEFORE last successful install

' * last reboot must be AFTER last successful install

' * last check must be no more than 7 days ago

' If any of these tests fails, all intermediate results will be displayed,

' if all tests are passed, a brief summary will be displayed

```
If intLD > intLI Then
```

	strWUMsg = strWUMsg & vbCrLf & "Warning: last install was unsuccessful!"

```
	blnWUOK  = False
```
```
End If
```
```
 
```

If DateDiff( "d", dtmLastCheck, Now ) > 7 Then

	strWUMsg = strWUMsg & vbCrLf & "Warning: the last check was " & DateDiff( "d", dtmLastCheck, Now ) & " days ago!"

```
	blnWUOK  = False
```
```
End If
```
```
 
```

If CLng( Left( strLB, 8 ) ) < intLI Then

	strWUMsg = strWUMsg & vbCrLf & "Warning: a reboot is required!"

```
	blnWUOK  = False
```
```
End If
```
```
 
```

' Forget the intermediate results if everything turns out OK

If blnWUOK Then strWUMsg = vbCrLf & "Windows Update reports: everything OK"

```
 
```
```
WScript.Echo strMsg & strWUMsg
```
```
 
```
```
Set objFSO        = Nothing
```
```
Set objReg        = Nothing
```
```
Set colItems      = Nothing
```
```
Set objWMIService = Nothing
```
```
Set wshShell      = Nothing
```
```
 
```
```
 
```
```
Sub Syntax( myMsg )
```
```
	If myMsg <> "" Then
```

		strMsg = vbcrlf & "Error:" & vbTab & myMsg & vbCrLf

```
	Else
```
```
		strMsg = ""
```
```
	End If
```
```
	strMsg = strMsg & vbCrLf _
```

	       & "SecStat2.vbs,  Version 1.01 for Windows Vista and later" _

```
	       & vbCrLf _
```

	       & "Display a SecurityCenter2 and Windows Update status overview for any computer" _

```
	       & vbCrLf & vbCrLf _
```

	       & "Usage:  " & vbTab & "SECSTAT.VBS" & vbTab & "[ computer ]" _

```
	       & vbCrLf & vbCrLf _
```

	       & "Where:  " & vbTab & """computer""" & vbTab & "is an optional remote computer name" _

```
	       & vbCrLf _
```

	       & "        " & vbTab & vbTab & vbTab & "(default is the local computer)" _

```
	       & vbCrLf & vbCrLf _
```

	       & "Credits:" & vbTab & "Inspired by a blog entry on neophob.com:" _

```
	       & vbCrLf _
```

	       & "        " & vbTab & "http://neophob.com/2010/03/#post-154" _

```
	       & vbCrLf & vbCrLf _
```

	       & "Use WBEMTEST.EXE (or WMIGEN.HTA) to find all properties for specific products." _

```
	       & vbCrLf & vbCrLf _
```

	       & "Written by Rob van der Woude" _

```
	       & vbCrLf _
```

	       & "http://www.robvanderwoude.com"

```
	WScript.Echo strMsg
```
```
	WScript.Quit 1
```
```
End Sub
```
```
 
```