Thank you for visiting my blog. It is all started with Microsoft Word/Excel document recovery method that I implemented at work. My coworkers were so impressed that they “forced” me to create a webpage and post steps required for that method. Later I realized that not many people are reading this blog and I decided to keep it for myself and post here some code and ideas that I could reuse for the future. If you find my posts useful drop a comment for me.

Monday, October 31, 2011

Microsoft Windows Updates Report for SOX Audit

Our system center server failed to provide a report that would satisfy the auditor.
He wanted to see the latest updates for every single computer :  servers and desktops.
To solve this problem I used a  PowerShell script to retrieve system event log and filter the output for event code 19 which is:” Installation Successful: Windows successfully installed the following update:...”

get-content f:\WindowsUpdates\pc.txt | f:\WindowsUpdates\reportevent.ps1 –debug

where

 Report-Events.ps1 was taken from here http://jdhitsolutions.com/resources/scripts/Report-Events.txt
and modified query string to filter out all other events:

$query="Select  ComputerName,Message,TimeWritten,Type,SourceName,EventCode,Logfile   from win32_NTLogEvent WHERE (EventCode=19) and Logfile='System'   "

And list computers thet were down or failed to obtain the updates:

$err+=" *** No matching events found  for $computername ****
"

To populate pc.txt I copied the script from

http://blogs.technet.com/b/heyscriptingguy/archive/2006/11/09/how-can-i-use-windows-powershell-to-get-a-list-of-all-my-computers.aspx

$strCategory = "computer"
$objDomain = New-Object System.DirectoryServices.DirectoryEntry
$objSearcher = New-Object System.DirectoryServices.DirectorySearcher
$objSearcher.SearchRoot = $objDomain
$objSearcher.Filter = ("(objectCategory=$strCategory)")
$colProplist = "name"
foreach ($i in $colPropList){$objSearcher.PropertiesToLoad.Add($i)}
$colResults = $objSearcher.FindAll()
foreach ($objResult in $colResults)
    {$objComputer = $objResult.Properties; $objComputer.name}

0 comments: