x11forwarding

利用既有SSH通道傳送X畫面

ssh -X -v username@server

監控FS存取狀態

strComputer = "."
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")

Set colShare = objWMIService.ExecNotificationQuery("Select * From __InstanceCreationEvent Within 10 Where TargetInstance ISA 'Win32_ServerConnection'")

Do While True
Set objShare = colShare.NextEvent
If Right(objShare.TargetInstance.ShareName,1) <> "$" Then
Wscript.echo objShare.TargetInstance.ShareName
Wscript.echo objShare.TargetInstance.ComputerName
Wscript.echo objShare.TargetInstance.UserName
Wscript.echo objShare.TargetInstance.NumberOfFiles
Wscript.echo objShare.TargetInstance.ActiveTime
End If
'ShareName
'ComputerName
'UserName
'上述三者為pk,當比對不到資料時進行DUMP
Loop

重整user本機群組

可以在AD上透過此script來達成修改本機群組的需求

Set WshShell = WScript.CreateObject("WScript.Shell")
HostName = WshShell.ExpandEnvironmentStrings("%COMPUTERNAME%")
set objWMIService = GetObject("winmgmts:\\.\root\cimv2")
Set oADsSysInfo = CreateObject("ADSystemInfo")

'get domain dns name
'Set GroupSetup = objWMIService.ExecQuery("select Domain from Win32_ComputerSystem where PartOfDomain = True")
'For Each objGroupSetup in GroupSetup
' LocalDomain = objGroupSetup.Domain
'Next

'convert domain from dns name
'If Trim(LocalDomain) <> "" Then
' RegKey = """HKLM\Software\Microsoft\Windows nt\CurrentVersion\Winlogon\DomainCache""|find/I """ & LocalDomain & """"
' Result = WshShell.Exec("%ComSpec% /c reg query " & RegKey ).StdOut.ReadAll
' For Each tmp in Split(Result,vbCrLf)
' If Trim(tmp) <> "" Then
' Data = Split(Tmp,vbTab)
' If UCASE(data(2)) = UCASE(LocalDomain) Then
' Domain = UCase(Trim(data(0)))
' End If
' ENd If
' Next
'End If
Domain = oADsSysInfo.DomainShortName


set colGroup = objWMIService.ExecQuery("select * from Win32_Group where ((SID = 'S-1-5-32-544') and (Domain = '" & HostName & "')) or ((SID like 'S-1-5-%-512') and (Domain = '" & Domain & "'))")
For Each objGroup in colGroup
If UCase(objGroup.Domain) = UCase(HostName) Then
LocalAdminGroup = objGroup.name
Else
DomainAdminGroup = objGroup.name
End If
next


set colAccount = objWMIService.ExecQuery("select * from Win32_UserAccount where SID like 'S-1-5-%-500' and Domain = '" & HostName &"'")
For Each objAccount In colAccount
LocalAdminUser = objAccount.name
next


'remove account from local administrators
' Set objGroup = GetObject("WinNT://" & HostName & "/" & LocalAdminGroup)
' Set memberlist = objGroup.members
' For Each member In memberlist
' Tmp = Split(member.Parent,"/")
' If UCase(Tmp(UBound(Tmp))) = UCase(HostName) Then 'local account
' If UCase(member.Name) <> UCase(LocalAdminUser) Then
' objGroup.Remove(member.AdsPath)
' End If
' Else 'Domain Account
' If UCASE(member.AdsPath) <> UCASE("WinNT://" & Domain & "/" & DomainAdminGroup) Then ' Keep domain admins in the local administrators group
' objGroup.Remove(member.AdsPath)
' End If
' End IF
' next

'change local admin password
' set objUser = GetObject("WinNT://" & HostName & "/" & LocalAdminUser)
' objUser.SetPassword("Password")

windows預設分享權限設置

機碼位置
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\DefaultSecurity
此內容會被經過編碼,導致無法直接進行修改
可以透過tweakui將預設值修改完成後,匯出重新整入系統
注意:因為此為HKLM等級機碼,非一般user即可套用,此時可採用GPO的開機指令碼,亦或是利用autohotkey來作patch

exchange使用空間監控通知

If Weekday(Date) <2 OR Weekday(Date)>6 Then
Wscript.Quit
End If

ExChangeServer = "kido.idv.tw"
ExtremeSize = 50*1024

Set objService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & ExChangeServer & "\root\MicrosoftExchangeV2")

Set colSettings = objService.ExecQuery("Select * from Exchange_Mailbox")
On Error Resume Next
For Each obj in colSettings
If Instr(UCase(obj.MailboxDisplayName),"(NTCTX)") And CLng(obj.Size) > CLng(ExtremeSize) Then
Result = Result & "" & vbCrLf &_
"" & obj.MailboxDisplayName & "" & vbCrLf &_
"" & obj.Size & "" & vbCrLf &_
"" & obj.TotalItems & "" & vbCrLf &_
""
End If
Next
If Result <> "" Then
Mail "Mailbox healthy check!",RebuildMsg(Result)
End If
Function RebuildMsg(msg)
msg = "" &_
"" & vbCrLf &_
"" & vbCrLf &_
"" & vbCrLf &_
"" & vbCrLf &_
"" &_
msg
msg = msg & "

" & "Emp Name" & "

" & "Mail Size (KB)" & "

" & "Mail Count" & "

"
RebuildMsg = msg
End Function

Sub Mail(Subject,Content)
MailFrom = "kido@kido.idv.tw"
MailTo = "kido@kido.idv.tw"
If Len(Content) = 0 Then
Exit Sub
End If
Set objEmail = CreateObject("CDO.Message")
objEmail.From = MailFrom
objEmail.To = MailTo
objEmail.Cc = MailCC
objEmail.Subject = Subject
objEmail.HTMLBody = Content
objEmail.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/sendusing") = 2
objEmail.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/smtpserver") = ExChangeServer
objEmail.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/smtpserverport") = 25
objEmail.Configuration.Fields.Update
objEmail.Send
End Sub

除此方法外~~上可利用powershell來作~~功能相同~~都是利用WMI去截取Exchange的值

iptables的設定

1:先將iptables全數
iptables -F
iptables -Z
iptables -X
2:確認現有policy chain
iptables -L
3:定立規則並初始化policy chain
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP
iptables -P INPUT DROP
4:初始化本機連線,啟用連線保留功能,方便遠端調整
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
5:新增區塊連入
iptables -A INPUT -s NETWORKID/NETMASK -j ACCEPT
6:將設定寫回系統
/etc/init.d/iptables save active

iptables設定的porting -> /etc/sysconfig/iptables

sample!
# Generated by iptables-save v1.2.11 on Tue Sep 16 20:00:17 2008
*filter
:INPUT ACCEPT [3181787:4475034848]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [1601837:84186272]
-A INPUT -s ! 192.168.0.0/255.255.255.0 -p tcp -m tcp --dport 22 -j DROP
-A INPUT -d 192.168.0.51 -p tcp -m iprange --src-range 192.168.0.1-192.168.0.10 -m tcp --dport 5500 -j DROP
COMMIT
# Completed on Tue Sep 16 20:00:17 2008

傳送互動式job至用戶端

一般要讓指令碼在用戶端執行~~僅需使用wmi中win32_process處理即可

若要讓指令碼作互動執行,則需透過Win32_ScheduledJob來處理~~

此外尚可透過現成的sysinternal的工具來直接部屬會更快速~~

On Error Resume Next

RemoteHost = "kido"

SendSourceToRemote RemoteHost

InstallScheduleJob RemoteHost

Sub SendSourceToRemote(RemoteHost)

Set WshShell = CreateObject("WScript.Shell")

ScriptPath = Left(WScript.ScriptFullName,Len(WScript.ScriptFullName) - Len(WScript.ScriptName))

SRCFile = ScriptPath & "writeEventLog.vbs"

DestPath = "c$\"

WshShell.Exec("cmd.exe /c xcopy " & SRCFile & " \\" & RemoteHost & "\" & DestPath & " /Y").StdOut.ReadAll

End Sub

Sub InstallScheduleJob(RemoteHost)

Const Delay = 2

Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate, authenticationLevel=pktPrivacy}!\\" & RemoteHost & "\root\cimv2")

Set colItems = objWMIService.ExecQuery("Select * from Win32_OperatingSystem")

For Each obj in colItems

LocalDateTime = obj.LocalDateTime

CurrentTimeZone = obj.CurrentTimeZone

Next

CurrentTime = Mid(LocalDateTime,9,2) & ":" & Mid(LocalDateTime,11,2)

ScheduleTime = "********" & Replace(FormatDateTime(DateAdd("n", Delay ,CurrentTime),4),":","") & "00.000000" & CurrentTimeZone

Set objFSO = CreateObject("Scripting.FileSystemObject")

Set objNewJob = objWMIService.Get("Win32_ScheduledJob")

errcode = objNewJob.Create("c:\writeEventLog.vbs", ScheduleTime ,False, 0, , True, JobID)

End Sub

參照http://www.microsoft.com/taiwan/technet/scriptcenter/resources/qanda/sept05/hey0906.mspx