Detecting Rogue RAS servers?

[Ralph]

Due to this Sorbenas and Oxly requirement I need to be sure I
kill all of the RAS server services running on more than 75 servers.
Due to poor record keeping years ago I am not sure if there are any
undocumented RAS servers running. Is there a way to check all of the
Win 2000 Win 2003 servers in an A/D domain to see if that service is
running?

Thanks,

REB

 

[FE-FR]

Do you have a super power user to connect as admin on each of them ?

If so create a script that will list all the services and redirect this in a
text file

Mc Gyver option ;-)

FE

 

[Ralph]

That is what I wish to do, I am not proficient at scripting. Any
examples?

 

[FE-FR]

Check this

create a file called 'dumpsrvs.vbs' and copy and paste the script :
strComputer = FileToAnalyse=args(0)
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colListOfServices = objWMIService.ExecQuery _
("Select * from Win32_Service")
For Each objService in colListOfServices
Wscript.Echo objService.DisplayName
End If
Next


Then, in a dos prompt type 'cscript.exe dumpsrvs.vbs Myserver1'

Of course, replace MyServer1 by the name of 1 of your server.

If it works, create a .bat file called dumpeverything.bat, and ad this :

Echo start >c:\result.txt
cscript.exe dumpsrvs.vbs Myserver1'>>c:\result.txt
cscript.exe dumpsrvs.vbs Myserver2'>>c:\result.txt
cscript.exe dumpsrvs.vbs Myserver3'>>c:\result.txt
cscript.exe dumpsrvs.vbs Myserver4'>>c:\result.txt
cscript.exe dumpsrvs.vbs Myserver5'>>c:\result.txt

.... and so on,..


Let us know.
--
FE (MVP ISA)
(e-mail address removed)
You plan to implement Quarantine on ISA 2004 ?
Check this : http://www.esnouf.net/programs/QSS/qssinaction/QssInAction.htm