![[H]ard|Forum](/styles/hardforum/xenforo/logo_dark.png){kind=logo}
JayteeBates
[H]ard|Poof
- Joined
- Jul 21, 2007
- Messages
- 5,500
Well there are tools that do this for you (if you want to pay) but I wanted to learn more about file/folder security in Windows and I am updating my DSS setup scripts from VBS to PowerShell.
PowerShell Script : DSSAuditing
Description: This PowerShell script will set and check auditing on files/folders per DSS requirements
Usage:
.\DSSAuditing.ps1
Initial Auditing Settings (Null)
Set Execution Policy to RemoteSigned to allow local Powershell scripts to run (remember to set it back to default "Restricted")
Change to the directory containing DSSAuditing.ps1 and the two list files and execute the script
Enter Y to make corrections - Script will process INCORRECT entries and then verify the changes
Check a File/Folder manually to verify if you wish
filesToAudit.txt
foldersToAudit.txt
PowerShell Script : DSSAuditing
Description: This PowerShell script will set and check auditing on files/folders per DSS requirements
Usage:
.\DSSAuditing.ps1
Initial Auditing Settings (Null)
Set Execution Policy to RemoteSigned to allow local Powershell scripts to run (remember to set it back to default "Restricted")
Change to the directory containing DSSAuditing.ps1 and the two list files and execute the script
Enter Y to make corrections - Script will process INCORRECT entries and then verify the changes
Check a File/Folder manually to verify if you wish
Code:
# R.A.C.
#
# J.Bates
#
# Revision History
#
# Version 1.0 February 7 2014
# Version 1.1 August 28, 2015 Revision by D.Barras
#
# This powershell script will check for auditing on files/folders
# per the DSS July 2013 Baseline Technical Security Configuration of
# Microsoft Windows 7 and Microsoft Server 2008 R2
#
# Script should be run as an admin - it will mostly work but some
# folders (system32\config) will not be accessible as a non-admin
#
# Script expects two files be in the same directory as the script
# that contain the list of files/folders to be checked. They
# need to be named filesToAudit.txt and foldersToAudit.txt
# They should have one file/folder name per line
# For example:
# C:\windows\system32\at.exe
# C:\Windows\system32\ftp.exe
#
# NOTE
# To enable scripts to run on a system run this in a Powershell Window
# Set-ExecutionPolicy RemoteSigned
# Use RemoteSigned so local scrips run but downloaded or foreign do not
#
# FOR REFERENCE
# FOLDER ACCESS MASK
# PS C:\scripttemp> .\showAccessMask.ps1 852071
# Allowed Permissions
# ===================
# Bit 0: List Directory / read data (file)
# Bit 1: Create files / write data
# Bit 2: Create folders / append data
# Bit 5: Traverse folder / execute file
# Bit 6: Delete subfolders and files
# Bit 16: Delete
# Bit 18: Write DAC (Change permissions)
# Bit 19: Write Owner (Take Ownership)
# Denied Permissions
# ==================
# Bit 3: Read extended attributes
# Bit 4: Write extended attributes
# Bit 7: Read attributes
# Bit 8: Write attributes
# Bit 17: Read Control
# FILE ACCESS MASK
# PS C:\scripttemp> .\showAccessMask.ps1 852007
# Allowed Permissions
# ===================
# Bit 0: List Directory / read data (file)
# Bit 1: Create files / write data
# Bit 2: Create folders / append data
# Bit 5: Traverse folder / execute file
# Bit 16: Delete
# Bit 18: Write DAC (Change permissions)
# Bit 19: Write Owner (Take Ownership)
# Denied Permissions
# ==================
# Bit 3: Read extended attributes
# Bit 4: Write extended attributes
# Bit 6: Delete subfolders and files
# Bit 7: Read attributes
# Bit 8: Write attributes
# Bit 17: Read Control
# BEGIN SCRIPT
# *** START REVISION
# Get the current working directory
$scriptpath = $MyInvocation.MyCommand.Path
$workdir = Split-Path $scriptpath
# Close the current window
# Open a PowerShell window as Administrator
If (-NOT ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator"))
{
$arguments = "& '" + $myinvocation.mycommand.definition + "'"
Start-Process "$psHome\powershell.exe" -Verb runAs -ArgumentList $arguments
break
}
cd $workdir
# *** END REVISION
[console]::backgroundColor= "Black"
$folders =@()
$files =@()
$badFolders = @()
$badFiles = @()
$badFileCount = 0
$badFolderCount = 0
#$windir = gc env:windir
#Get-ChildItem C:\Scripts -recurse
#$folders
#Get-Content .\foldersToAudit.txt | Foreach-Object {$folder = $windir + "\" + $_;$folder = $folder.replace("\", "\\");$folders += $folder}
Get-Content .\foldersToAudit.txt | Foreach-Object {$folder = $_;$folder = $folder.replace("\", "\\");$folders += $folder}
#$files
#Get-Content .\filesToAudit.txt | Foreach-Object {$file = $windir + "\" + $_;$file = $file.replace("\", "\\");$files += $file}
Get-Content .\filesToAudit.txt | Foreach-Object {$file = $_;$file = $file.replace("\", "\\");$files += $file}
#Check that Folders meet the appropriate auditing SACL
function checkFolders($folderArray){
#Get the SD for the object we will process
$computer = gc env:computername
$badFolderCount = 0
foreach($folder in $folderArray){
$path = $folder
$folderExists=Test-Path $path
if($folderExists){
$wPrivilege = gwmi Win32_LogicalFileSecuritySetting -computername $computer -filter "path='$path'"
$wPrivilege.psbase.Scope.Options.EnablePrivileges = $true
$osd = $wPrivilege.GetSecurityDescriptor()
if (!$osd.Descriptor.SACL) {Write-Host INCORRECT $path No Auditing Set $osd.Descriptor.ControlFlags -foregroundcolor red; $badFolders += $path;$badFolderCount++}Else{
foreach ($acl in $osd.Descriptor.SACL){
if(($acl.AceFlags -eq 131) -and ($acl.AccessMask -eq 852071) -and ($acl.Trustee.Name -eq "Everyone")){
Write-Host "=correct=" $path AceFlags: $acl.AceFlags AccessMask: $acl.AccessMask Trustee: $acl.Trustee.Name -foregroundcolor green}
Else {Write-Host INCORRECT $path AceFlags`(131`): $acl.AceFlags AccessMask`(852071`): $acl.AccessMask Trustee`(Everyone`): $acl.Trustee.Name -foregroundcolor red; $badFolders += $path; $badFolderCount++}
}#End foreach acl
}#End if for SACL existance
}#End If for folderExists
Else{Write-Host ========= $path Does Not Exist -foregroundcolor "yellow"}
}#End foreach folder
fixIt
}#End checkFolders
#Check that files meet the appropriate auditing SACL
function checkFiles($fileArray){
#Get the SD for the object we will process
$computer = gc env:computername
$badFileCount = 0
foreach($file in $fileArray){
$path = $file
$fileExists=Test-Path $path
if($fileExists){
$wPrivilege = gwmi Win32_LogicalFileSecuritySetting -computername $computer -filter "path='$path'"
$wPrivilege.psbase.Scope.Options.EnablePrivileges = $true
$osd = $wPrivilege.GetSecurityDescriptor()
if (!$osd.Descriptor.SACL) {Write-Host INCORRECT $path No Auditing Set $osd.Descriptor.ControlFlags -foregroundcolor red;$badFiles += $path;$badFileCount++}Else{
foreach ($acl in $osd.Descriptor.SACL){
if(($acl.AceFlags -eq 128) -and ($acl.AccessMask -eq 852007) -and ($acl.Trustee.Name -eq "Everyone")){
Write-Host "=correct=" $path AceFlags: $acl.AceFlags AccessMask: $acl.AccessMask Trustee: $acl.Trustee.Name -foregroundcolor green
}
Else {Write-Host INCORRECT $path AceFlags`(128`): $acl.AceFlags AccessMask`(852007`): $acl.AccessMask Trustee`(Everyone`): $acl.Trustee.Name -foregroundcolor red; $badFiles += $path; $badFileCOunt++;}
}#End foreach acl
}#End if for SACL existance
}#End If for fileExists
Else{Write-Host ========= $path Does Not Exist -foregroundcolor yellow}
}#End foreach file
fixIt
}#End checkFiles
function fixIt(){
if($badFileCount -gt 0 -or $badFolderCount -gt 0){
$host.UI.WriteLine()
Write-Host $badFileCount Bad Files, $badFolderCount Bad Folders. Would you like to correct any incorrect entries now?
[console]::foregroundColor= "Green"
$input = Read-Host "Y for YES | N for NO"
[console]::ResetColor()
if($input -Like "*y*")
{
if($badFolders.Length -gt 0){setAuditing $badFolders 0}
if($badFiles.Length -gt 0){setAuditing $badFiles 1}
Write-Host Correction`(s`) Complete
}
Else
{Write-Host You elected not to make corrections}
}Else{Write-Host There appears to be nothing to fix}
}#End Function fixIt
function setAuditing(){
Param([parameter(Mandatory=$true)]$arrayList,[parameter(Mandatory=$true)]$folders0Files1)#End Param
#if($folders1Files2 -eq 0){Write-Host I received an arrayList with $arrayList.Length and an indication that it is a list of folders}
#if($folders1Files2 -eq 1){Write-Host I received an arrayList with $arrayList.Length and an indication that it is a list of files}
$computer = gc env:computername
foreach ($item in $arrayList){
# Create a new SD per requirements
Write-Host Processing $item
$path = $item
$user = "everyone"
#$path = $path.replace("\", "\\")
$SD = ([WMIClass] "Win32_SecurityDescriptor").CreateInstance()
$ace = ([WMIClass] "Win32_ace").CreateInstance()
$Trustee = ([WMIClass] "Win32_Trustee").CreateInstance()
$SID = (new-object security.principal.ntaccount $user).translate([security.principal.securityidentifier])
[byte[]] $SIDArray = ,0 * $SID.BinaryLength
$SID.GetBinaryForm($SIDArray,0)
$Trustee.Name = $user
$Trustee.SID = $SIDArray
switch($folders0Files1)
{
0{$ace.AccessMask = "0xD0067"} #= 852071
1{$ace.AccessMask = "0xD0027"} #= 852007
default {$ace.AccessMask = [System.Security.AccessControl.FileSystemRights]"FullControl"}
}
switch($folders0Files1)
{
0{$ace.AceFlags = "0x83"} #0x83 = 131 = Failed Access Ace Flag (128) Container Inherit Ace (2) Object Inherit Ace (1)
1{$ace.AceFlags = "0x80"} #0x80 = 128 = Failed Access Ace Flag
}
$ace.AceType = 2 #2 = Audit ACE
$ace.Trustee = $trustee
$SD.SACL = $ace
$SD.ControlFlags = "0x10" #controlFlag($path) #Accepts a Hex string e.g. 0x10
$wPrivilege = gwmi Win32_LogicalFileSecuritySetting -computername $computer -filter "path='$path'"
$wPrivilege.psbase.Scope.Options.EnablePrivileges = $true
# $wPrivilege.setsecuritydescriptor($SD) #remove comment to remove output from this function from console | Out-Null
$wPrivilege.setsecuritydescriptor($SD) | Out-Null
}#End foreach $item
Write-Host Checking items to verify corrections...
switch($folders0Files1)
{
0{checkFolders($arrayList)}
1{checkFiles($arrayList)}
default {Write-Host Could not determine if a Files or Folders request had been made}
}
}#End function setAuditingOld
function controlFlag($path){
$fileExists=Test-Path $path
if($fileExists){
$wPrivilege = gwmi Win32_LogicalFileSecuritySetting -computername $computer -filter "path='$path'"
$wPrivilege.psbase.Scope.Options.EnablePrivileges = $true
$osd = $wPrivilege.GetSecurityDescriptor()
$returnValue = determineSDControlFlagValue($osd.Descriptor.ControlFlags)
$returnValue = convertBinaryStringToIntString($returnValue)
return $returnValue
}
}#End function controlFlag
function determineSDControlFlagValue($controlFlags){
# First take the passed int and convert to binary
$myControlFlagsBinary = [Convert]::ToString($ControlFlags,2)
# Second converty the int to a char array
$text = $myControlFlagsBinary.ToCharArray()
Write-Host Text is $text
# Third reverse the char array to have the binary string in a reverse order array
[Array]::Reverse($text)
Write-Host Reversed Text is $text
#Since we only care to check if the SACL Exists check for bit 5
if($text[4] -eq "0"){$text[4] = "1"}
[Array]::Reverse($text)
#$text = [string]::Join("", $text )
Write-Host Text is $text
return $text
}
function convertBinaryStringToIntString($arrayOfChar){
# Function accepts a Char[] object variable that contains a binary representation of a number
# Function returns a string with hex value represented by the binary number
# First we need to get the decimal value
[Array]::Reverse($arrayOfChar)
$index = 0
$sum = 0
do{if($arrayOfChar[$index] -eq "1"){$sum = $sum + [math]::Pow(2,$index)};$index++}while($index -lt $arrayOfChar.Length)
return $sum
}#End function convertBinaryStringToHexString
function presentMenu(){
$done = $false
do{
Write-Host "Make a Selection:"
Write-Host "1: Check Auditing on Files Only"
Write-Host "2: Check Auditing on Folders Only"
Write-Host "3: Check Auditing on Both Files and Folders"
Write-Host "4: Quit"
$input = Read-Host "Enter the number of your selection"
if($input -Like 1 -or $input -Like 2 -or $input -Like 3 -or $input -Like 4){
switch($input){
1 {checkFiles($files)}
2 {checkFolders($folders)}
3 {checkFolders($folders);checkFiles($files)}
4 {$done = $true}
default {}
}
#Write-Host "--" | Out-Default; Clear-Host;
}Else{Write-Host Invalid}
}while(!$done)
}#End function presentMenu
# Main Section of the script that presents the menu and awaits input from user
presentMenufilesToAudit.txt
Code:
C:\Windows\System32\activeds.dll
C:\Windows\System32\adsldpc.dll
C:\Windows\System32\advapi32.dll
C:\Windows\System32\advpack.dll
C:\Windows\System32\apphelp.dll
C:\Windows\System32\arp.exe
C:\Windows\System32\at.exe
C:\Windows\System32\atl.dll
C:\Windows\System32\attrib.exe
C:\Windows\System32\authz.dll
C:\Windows\System32\bootvid.dll
C:\Windows\System32\browseui.dll
C:\Windows\System32\cabinet.dll
C:\Windows\System32\cacls.exe
C:\Windows\System32\certcli.dll
C:\Windows\System32\cfgmgr32.dll
C:\Windows\System32\clbcatq.dll
C:\Windows\System32\clusapi.dll
C:\Windows\System32\comdlg32.dll
C:\Windows\System32\comres.dll
C:\Windows\System32\credui.dll
C:\Windows\System32\crypt32.dll
C:\Windows\System32\cryptdll.dll
C:\Windows\System32\cryptui.dll
C:\Windows\System32\cscdll.dll
C:\Windows\System32\dbghelp.dll
C:\Windows\System32\devmgr.dll
C:\Windows\System32\dhcpcsvc.dll
C:\Windows\System32\dnsapi.dll
C:\Windows\System32\drivers\ksecdd.sys
C:\Windows\System32\DRIVERS\ntfs.sys
C:\Windows\System32\duser.dll
C:\Windows\System32\efsadu.dll
C:\Windows\System32\esent.dll
C:\Windows\System32\eventcreate.exe
C:\Windows\System32\ftp.exe
C:\Windows\System32\gdi32.dll
C:\Windows\System32\hal.dll
C:\Windows\System32\imagehlp.dll
C:\Windows\System32\imm32.dll
C:\Windows\System32\inetcomm.dll
C:\Windows\System32\iphlpapi.dll
C:\Windows\System32\kdcom.dll
C:\Windows\System32\kdcsvc.dll
C:\Windows\System32\kerberos.dll
C:\Windows\System32\kernel32.dll
C:\Windows\System32\linkinfo.dll
C:\Windows\System32\loadperf.dll
C:\Windows\System32\lsasrv.dll
C:\Windows\System32\lsass.exe
C:\Windows\System32\lz32.dll
C:\Windows\System32\mfc42u.dll
C:\Windows\System32\mlang.dll
C:\Windows\System32\mobsync.exe
C:\Windows\System32\mpr.dll
C:\Windows\System32\mprapi.dll
C:\Windows\System32\msasn1.dll
C:\Windows\System32\msgina.dll
C:\Windows\System32\mshtml.dll
C:\Windows\System32\msi.dll
C:\Windows\System32\msimg32.dll
C:\Windows\System32\msoert2.dll
C:\Windows\System32\msrating.dll
C:\Windows\System32\mssign32.dll
C:\Windows\System32\msv1_0.dll
C:\Windows\System32\msvcp60.dll
C:\Windows\System32\msvcrt.dll
C:\Windows\System32\mswsock.dll
C:\Windows\System32\nbtstat.exe
C:\Windows\System32\nddeapi.dll
C:\Windows\System32\net.exe
C:\Windows\System32\net1.exe
C:\Windows\System32\netapi32.dll
C:\Windows\System32\netcfgx.dll
C:\Windows\System32\netman.dll
C:\Windows\System32\netplwiz.dll
C:\Windows\System32\netsh.exe
C:\Windows\System32\netshell.dll
C:\Windows\System32\netstat.exe
C:\Windows\System32\ntbackup.exe
C:\Windows\System32\ntdll.dll
C:\Windows\System32\ntdsa.dll
C:\Windows\System32\ntdsapi.dll
C:\Windows\System32\ntdsatq.dll
C:\Windows\System32\ntlanman.dll
C:\Windows\System32\ntoskrnl.exe
C:\Windows\System32\odbc32.dll
C:\Windows\System32\ole32.dll
C:\Windows\System32\oleacc.dll
C:\Windows\System32\oleaut32.dll
C:\Windows\System32\oledlg.dll
C:\Windows\System32\pautoenr.dll
C:\Windows\System32\powrprof.dll
C:\Windows\System32\printui.dll
C:\Windows\System32\psapi.dll
C:\Windows\System32\query.dll
C:\Windows\System32\rasapi32.dll
C:\Windows\System32\rasdlg.dll
C:\Windows\System32\rasman.dll
C:\Windows\System32\reg.exe
C:\Windows\System32\regapi.dll
C:\Windows\System32\regedt32.exe
C:\Windows\System32\regini.exe
C:\Windows\System32\regsvr32.exe
C:\Windows\System32\route.exe
C:\Windows\System32\rpcrt4.dll
C:\Windows\System32\rshx32.exe
C:\Windows\System32\rtutils.dll
C:\Windows\System32\samlib.dll
C:\Windows\System32\samsrv.dll
C:\Windows\System32\sc.exe
C:\Windows\System32\scecli.dll
C:\Windows\System32\secedit.exe
C:\Windows\System32\secur32.dll
C:\Windows\System32\security.dll
C:\Windows\System32\setupapi.dll
C:\Windows\System32\sfc.dll
C:\Windows\System32\shdocvw.dll
C:\Windows\System32\shlwapi.dll
C:\Windows\System32\shsvcs.dll
C:\Windows\System32\subst.exe
C:\Windows\Systeminfo.exe
C:\Windows\System32\tapi32.dll
C:\Windows\System32\urlmon.dll
C:\Windows\System32\user32.dll
C:\Windows\System32\userenv.dll
C:\Windows\System32\utildll.dll
C:\Windows\System32\uxtheme.dll
C:\Windows\System32\version.dll
C:\Windows\System32\w32topl.dll
C:\Windows\System32\wininet.dll
C:\Windows\System32\winipsec.dll
C:\Windows\System32\winlogon.exe
C:\Windows\System32\winmm.dll
C:\Windows\System32\winscard.dll
C:\Windows\System32\winspool.drv
C:\Windows\System32\winsta.dll
C:\Windows\System32\wintrust.dll
C:\Windows\System32\wldap32.dll
C:\Windows\System32\wmi.dll
C:\Windows\System32\ws2_32.dll
C:\Windows\System32\ws2help.dll
C:\Windows\System32\wsock32.dll
C:\Windows\System32\wtsapi32.dll
C:\Windows\System32\wzcdlg.dll
C:\Windows\System32\regedit.exe
C:\Windows\System32\timedate.cpl
C:\Windows\winsxs\x86_microsoft-Windows-msvbvm60_31bf3856ad364e35_6.1.7600.16385_none_c25a1af6b30d72ee\msvbvm60.dll
C:\Windows\winsxs\amd64_microsoft-Windows-telnet-client_31bf3856ad364e35_6.1.7600.16385_none_1426830c3ebb712d\telnet.exe
C:\Windows\winsxs\amd64_microsoft-Windows-t..-deployment-package_31bf3856ad364e35_6.1.7600.16385_none_bac291589d407fde\tftp.exe
C:\Windows\winsxs\amd64_microsoft-Windows-telnet-server-tlntsvr_31bf3856ad364e35_6.1.7600.16385_none_1ab997fb0a83afdd\tlntsvr.exe
C:\Windows\SysWOW64\activeds.dll
C:\Windows\SysWOW64\adsldpc.dll
C:\Windows\SysWOW64\advapi32.dll
C:\Windows\SysWOW64\advpack.dll
C:\Windows\SysWOW64\arp.exe
C:\Windows\SysWOW64\at.exe
C:\Windows\SysWOW64\atl.dll
C:\Windows\SysWOW64\attrib.exe
C:\Windows\SysWOW64\apphelp.dll
C:\Windows\SysWOW64\authz.dll
C:\Windows\SysWOW64\bootvid.dll
C:\Windows\SysWOW64\browseui.dll
C:\Windows\SysWOW64\cabinet.dll
C:\Windows\SysWOW64\cacls.exe
C:\Windows\SysWOW64\certcli.dll
C:\Windows\SysWOW64\cfgmgr32.dll
C:\Windows\SysWOW64\clbcatq.dll
C:\Windows\SysWOW64\clusapi.dll
C:\Windows\SysWOW64\comdlg32.dll
C:\Windows\SysWOW64\comres.dll
C:\Windows\SysWOW64\credui.dll
C:\Windows\SysWOW64\crypt32.dll
C:\Windows\SysWOW64\cryptdll.dll
C:\Windows\SysWOW64\cryptui.dll
C:\Windows\SysWOW64\cscdll.dll
C:\Windows\SysWOW64\dbghelp.dll
C:\Windows\SysWOW64\devmgr.dll
C:\Windows\SysWOW64\dhcpcsvc.dll
C:\Windows\SysWOW64\dnsapi.dll
C:\Windows\SysWOW64\duser.dll
C:\Windows\SysWOW64\efsadu.dll
C:\Windows\SysWOW64\esent.dll
C:\Windows\SysWOW64\eventcreate.exe
C:\Windows\SysWOW64\ftp.exe
C:\Windows\SysWOW64\gdi32.dll
C:\Windows\SysWOW64\imagehlp.dll
C:\Windows\SysWOW64\imm32.dll
C:\Windows\SysWOW64\inetcomm.dll
C:\Windows\SysWOW64\iphlpapi.dll
C:\Windows\SysWOW64\kerberos.dll
C:\Windows\SysWOW64\kernel32.dll
C:\Windows\SysWOW64\linkinfo.dll
C:\Windows\SysWOW64\loadperf.dll
C:\Windows\SysWOW64\lz32.dll
C:\Windows\SysWOW64\mfc42u.dll
C:\Windows\SysWOW64\mlang.dll
C:\Windows\SysWOW64\mobsync.exe
C:\Windows\SysWOW64\mpr.dll
C:\Windows\SysWOW64\mprapi.dll
C:\Windows\SysWOW64\msasn1.dll
C:\Windows\SysWOW64\mshtml.dll
C:\Windows\SysWOW64\msi.dll
C:\Windows\SysWOW64\msimg32.dll
C:\Windows\SysWOW64\msoert2.dll
C:\Windows\SysWOW64\msrating.dll
C:\Windows\SysWOW64\mssign32.dll
C:\Windows\SysWOW64\msv1_0.dll
C:\Windows\SysWOW64\msvcp60.dll
C:\Windows\SysWOW64\msvcrt.dll
C:\Windows\SysWOW64\mswsock.dll
C:\Windows\SysWOW64\nddeapi.dll
C:\Windows\SysWOW64\net.exe
C:\Windows\SysWOW64\net1.exe
C:\Windows\SysWOW64\netapi32.dll
C:\Windows\SysWOW64\netcfgx.dll
C:\Windows\SysWOW64\netplwiz.dll
C:\Windows\SysWOW64\netsh.exe
C:\Windows\SysWOW64\netshell.dll
C:\Windows\SysWOW64\netstat.exe
C:\Windows\SysWOW64\nslookup.exe
C:\Windows\SysWOW64\ntdll.dll
C:\Windows\SysWOW64\ntdsapi.dll
C:\Windows\SysWOW64\ntlanman.dll
C:\Windows\SysWOW64\ntoskrnl.exe
C:\Windows\SysWOW64\odbc32.dll
C:\Windows\SysWOW64\ole32.dll
C:\Windows\SysWOW64\oleacc.dll
C:\Windows\SysWOW64\oleaut32.dll
C:\Windows\SysWOW64\oledlg.dll
C:\Windows\SysWOW64\olepro32.dll
C:\Windows\SysWOW64\pautoenr.dll
C:\Windows\SysWOW64\powrprof.dll
C:\Windows\SysWOW64\printui.dll
C:\Windows\SysWOW64\psapi.dll
C:\Windows\SysWOW64\query.dll
C:\Windows\SysWOW64\rasapi32.dll
C:\Windows\SysWOW64\rasdlg.dll
C:\Windows\SysWOW64\rasman.dll
C:\Windows\SysWOW64\reg.exe
C:\Windows\SysWOW64\regapi.dll
C:\Windows\SysWOW64\regedt32.exe
C:\Windows\SysWOW64\regini.exe
C:\Windows\SysWOW64\regsvr32.exe
C:\Windows\SysWOW64\route.exe
C:\Windows\SysWOW64\rpcrt4.dll
C:\Windows\SysWOW64\rshx32.exe
C:\Windows\SysWOW64\rtutils.dll
C:\Windows\SysWOW64\samlib.dll
C:\Windows\SysWOW64\sc.exe
C:\Windows\SysWOW64\scecli.dll
C:\Windows\SysWOW64\secedit.exe
C:\Windows\SysWOW64\secur32.dll
C:\Windows\SysWOW64\security.dll
C:\Windows\SysWOW64\setupapi.dll
C:\Windows\SysWOW64\sfc.dll
C:\Windows\SysWOW64\shdocvw.dll
C:\Windows\SysWOW64\shlwapi.dll
C:\Windows\SysWOW64\shsvcs.dll
C:\Windows\SysWOW64\subst.exe
C:\Windows\Systeminfo.exe
C:\Windows\SysWOW64\tapi32.dll
C:\Windows\SysWOW64\urlmon.dll
C:\Windows\SysWOW64\user32.dll
C:\Windows\SysWOW64\userenv.dll
C:\Windows\SysWOW64\utildll.dll
C:\Windows\SysWOW64\uxtheme.dll
C:\Windows\SysWOW64\version.dll
C:\Windows\SysWOW64\w32topl.dll
C:\Windows\SysWOW64\wininet.dll
C:\Windows\SysWOW64\winipsec.dll
C:\Windows\SysWOW64\winmm.dll
C:\Windows\SysWOW64\winscard.dll
C:\Windows\SysWOW64\winspool.drv
C:\Windows\SysWOW64\winsta.dll
C:\Windows\SysWOW64\wintrust.dll
C:\Windows\SysWOW64\wldap32.dll
C:\Windows\SysWOW64\wmi.dll
C:\Windows\SysWOW64\ws2_32.dll
C:\Windows\SysWOW64\ws2help.dll
C:\Windows\SysWOW64\wsock32.dll
C:\Windows\SysWOW64\wtsapi32.dll
C:\Windows\SysWOW64\wzcdlg.dll
C:\Windows\SysWOW64\regedit.exefoldersToAudit.txt
Code:
C:\Windows\System32\winevt\Logs
C:\Windows\System32\config
C:\Windows\SysWOW64\spool\printers
Last edited:
) {}, RuntimeException