Private Function is64bit()
	Dim filesys : Set filesys = CreateObject("Scripting.FileSystemObject")
	Dim bln64bit : bln64bit = False
	If filesys.FolderExists("C:\Program Files (x86)") then bln64bit = True
	is64bit = bln64bit
End Function

'==========================================================================
' VBScript Source File
' NAME: get-bad-hosts.vbs
' AUTHOR: Andrew J Healey
' WEB: http://halfloaded.com/
' DATE  : Dec 21 2009
' COMMENT: This script will return data in csv format for use in determining
'	hack, lockout or bad logon attempts
' PROCESS: 1) query event log for event id 529; 2) parse data to return
'	useful data; 3) output to screen
' USAGE: cscript /nologo get-bad-hosts.vbs c:\bad-hosts.csv
'==========================================================================
 
Option Explicit
On Error Resume Next
 
Dim strComputer, objWMIService, colLoggedEvents
Dim objEvent, objRegEx, colMatches, strMatch
Dim strUserName, strWorkstation, strIPAddress, strDomain
 
'Change to name of computer to query remote machine
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
 
'Event 529 in the security log are "Failure Audit" for a "Logon/Logoff"
Set colLoggedEvents = objWMIService.ExecQuery _
        ("Select * from Win32_NTLogEvent Where Logfile = 'Security' and " _
            & "EventCode = '529'")
 
'Write header to screen
wscript.echo chr(34) & "User Name" & chr(34) & "," & _
			 chr(34) & "Workstation" & chr(34) & "," & _
			 chr(34) & "Source IP" & chr(34) & "," & _
			 chr(34) & "Windows Domain" & chr(34) & "," & _
			 chr(34) & "Date/Time" & chr(34)
 
'Loop through all events matching criteria above: 529 in sec log
For Each objEvent in colLoggedEvents
	'Use regex to parse any ip addresses from event
	' if no address found, goto next record
	Set objRegEx = CreateObject("VBScript.RegExp")
	objRegEx.Global = True
	objRegEx.IgnoreCase = True
 
	'Will return the line of the user name that was used
	objRegEx.Pattern = "(\tUser Name:.*\n)"
	Set colMatches = objRegEx.Execute(objEvent.Message)
	For Each strMatch in colMatches
	   strUserName = strMatch.Value
	Next
 
	'Will return the line of the workstation name that was used
	objRegEx.Pattern = "(\tWorkstation Name:.*\n)"
	Set colMatches = objRegEx.Execute(objEvent.Message)
	For Each strMatch in colMatches
	   strWorkstation = strMatch.Value
	Next
 
	'Will return the line of the source ip address
	objRegEx.Pattern = "(\tSource Network Address:.*\n)"
	Set colMatches = objRegEx.Execute(objEvent.Message)
	For Each strMatch in colMatches
	   strIPAddress = strMatch.Value
	Next
 
	'Will return the line of the domain that was used
	objRegEx.Pattern = "\tDomain:(.*\n)"
	Set colMatches = objRegEx.Execute(objEvent.Message)
	For Each strMatch in colMatches
	   strDomain = strMatch.Value
	Next
 
	'Output clean csv line for easy reading in spreadsheet program
	wscript.echo chr(34) & GetCleanText(strUserName) & chr(34) & "," & _
				 chr(34) & GetCleanText(strWorkstation) & chr(34) & "," & _
				 chr(34) & GetCleanText(strIpAddress) & chr(34) & "," & _
				 chr(34) & GetCleanText(strDomain) & chr(34) & "," & _
				 chr(34) & WMIDateStringToDate(objEvent.TimeWritten) & chr(34)
Next
 
Private Function GetCleanText(byVal strText)
	'This will cleanup the text and return only necessary data
	' I'm sure there is a better way to do this :)
	dim tmp,txt
	tmp = Split(strText,":")
	txt = tmp(1)
	txt = Replace(txt,vbTab,"")
	txt = Replace(txt,vbCrLf,"")
	txt = Trim(txt)
	GetCleanText = txt
End Function
 
Private Function WMIDateStringToDate(byVal dtmEventDate)
	'Borrowed from the "Hey, Scripting Guy! BLOG"
	' --> Search: WMIDateStringToDate
    WMIDateStringToDate = CDate(Mid(dtmEventDate, 5, 2) & "/" & _
        Mid(dtmEventDate, 7, 2) & "/" & Left(dtmEventDate, 4) _
            & " " & Mid (dtmEventDate, 9, 2) & ":" & _
                Mid(dtmEventDate, 11, 2) & ":" & Mid(dtmEventDate, _
                    13, 2))
End Function

'==========================================================================
' VBScript Source File
' NAME: Active Directory Admin Audit
' AUTHOR: Andrew J Healey
' DATE  : 2009.04.16
' COMMENT: This script will check all the domains within a forest
'		and report all the members of the following groups: Schema
'		Admins, Enterprise Admins and Domain Admins. See notes to
'		expand on the groups.
'==========================================================================

'Define Constants
Const adUseClient = 3
Const ForWriting = 2
 
'Set the path and filename for the dump of sensitive users
'  Folder must exist!
fileTemp = "C:\AD Admin Audit.txt"
 
'Create tmp file and report file
Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objTempFile = objFSO.OpenTextFile(fileTemp, ForWriting, True)
 
'Query RootDSE and return array with all AD domains in forest
Set adoComm = CreateObject("ADODB.Command")
Set adoConn = CreateObject("ADODB.Connection")
adoConn.Provider = "ADsDSOObject"
adoConn.cursorLocation = adUseClient
adoConn.Open "Active Directory Provider"
adoComm.ActiveConnection = adoConn
 
Set objRootDSE = GetObject("LDAP://RootDSE")
strBase   =  "<GC://" & objRootDSE.Get("rootDomainNamingContext") & ">;"
strFilter = "(objectcategory=domainDNS);"
strAttrs  = "distinguishedName;"
strScope  = "subtree"
 
strQuery = strBase &amp; strFilter &amp; strAttrs &amp; strScope
adoComm.CommandText = strQuery
adoComm.Properties("Page Size") = 50
adoComm.Properties("Timeout") = 30
adoComm.Properties("Cache Results") = False
 
Set adoRS = adoComm.Execute
 
'Start Loop
Do Until adoRS.EOF
	'Parse ad search results to create well formed DNS domain
	strDomain = Replace(adoRS.Fields(0).Value,"DC=","")
	strDomain = Replace(strDomain,",",".")
	Call GrpAll(strDomain)
	adoRS.MoveNext
Loop
adoRS.Close
adoConn.Close
wscript.quit
 
Function GrpAll(x)
	'To search for more groups, edit the "strFilter" line. It uses a simple
	' LDAP or (|) so multiple groups can be added. It uses ADO record sets
	' to loop so it doesn't have to find all of them, just one. Every domain
	' will contain at least the Domain Admins group.
	Set adoCommand = CreateObject("ADODB.Command")
	Set adoConnection = CreateObject("ADODB.Connection")
	adoConnection.Provider = "ADsDSOObject"
	adoConnection.cursorLocation = adUseClient
	adoConnection.Open "Active Directory Provider"
	adoCommand.ActiveConnection = adoConnection
 
	strBase   = ";"
	strFilter = "(&amp;(objectCategory=group)(|((name=Enterprise Admins*)" &amp; _
				"(name=Domain Admins*)(name=Schema Admins*))));"
	strAttrs  = "name,member;"
	strScope  = "subtree"
 
	strQuery = strBase &amp; strFilter &amp; strAttrs &amp; strScope
	adoCommand.CommandText = strQuery
	adoCommand.Properties("Page Size") = 5000
	adoCommand.Properties("Timeout") = 30
	adoCommand.Properties("Cache Results") = False
 
	Set adoRecordset = adoCommand.Execute
 
	objTempFile.WriteLine "Group report for domain: " &amp; x
 
	adoRecordset.MoveFirst
 
	Do Until adoRecordset.EOF
	    objTempFile.WriteLine vbTab &amp; adoRecordset.Fields(0).Value
		For Each strMember in adoRecordset.Fields(1).Value
			objTempFile.WriteLine vbTab &amp; vbTab &amp; strMember
		Next
	    adoRecordset.MoveNext
	Loop
 
	adoRecordset.Close
	adoConnection.Close
End Function