Easy Solution: Have a kscript that runs as logged on user, on a custom schedule to catch the users info and write it to a txt file.
You can also add the other couple of user calls needed for the malware/adware portion of my Dell world presentation to this same batch file then you will only need one Kscript running as user to gather the needed data. I will be posting that blog in a couple of days so watch for that.
The gatherer kscript: the cron settings run 10am, noon, 2pm, and 4pm monday thru friday
invisible.vbs
CreateObject("Wscript.Shell").Run "run.bat",0,True
run.batrem: this part is for malware detection:once that has run it will build the needed txt files to read into the cirs below
reg.exe query hkcu\software\microsoft\windows\currentversion\run /s > C:\ProgramData\Dell\KACE\user\hkcuRunKeys.txt
reg.exe query hkcu\software\microsoft\windows\currentversion\uninstall /s /f DisplayName > C:\ProgramData\Dell\KACE\user\hkcuSoftware.txt
rem: this part lists the users network - drives and printers
wmic logicaldisk where "drivetype='4'" get deviceid,providername > C:\ProgramData\Dell\KACE\user\NetworkDrives.txt
wmic printer where 'network="true"' get name, default, network > C:\ProgramData\Dell\KACE\user\NetworkPrinters.txt
exit
This what you get returned under the CIR section of an individual computer, of course now you can also create reports on them
need for command:
"c:\windows\system32\wscript.exe"
should look like:
Launch “$(KACE_DEPENDENCY_DIR)\”c:\windows\system32\wscript.exe“” with params “invisible.vbs”
the vbs was to hide the batch in 6.3, they fixed that bug of batches showing in 6.4 where you can get away without using the script any longer. - SMal.tmcc 8 years ago
Thoughts? - joseph.belanger@nichols.edu 7 years ago
User run Script command
c:\windows\system32\reg.exe query HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\PublishingWizard\AddNetworkPlace\AddNetPlace\LocationMRU > C:\ProgramData\quest\kace\user\hkcuNetplace.txt
CIR
Shellcommandtextreturn(cmd /c if exist C:\ProgramData\quest\kace\user\hkcuNetplace.txt type C:\ProgramData\quest\kace\user\hkcuNetplace.txt) - SMal.tmcc 6 years ago