4

我需要有关 VBScript 的帮助，该脚本将递归搜索 WindowsHKU注册表配置单元以获取DWORD值。如果脚本可以忽略仅查看S-1-5-21*密钥的系统帐户，那将很有帮助。我必须使用HKUhive 而不是HKCUhive 来完成此任务，因为我计划用来运行脚本的程序在 system.context 中运行。没办法。

谢谢你。

Const HKCU = &H80000001  
Const HKLM = &H80000002  
Const HKU =  &H80000003  

strComputer = "."

Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & _
   strComputer & "\root\default:StdRegProv")

'Read the HKEY_CURRENT_USER hive, registry path, and valuename to retrieve settings
strKeyPath = "Software\Policies\Microsoft\Windows\System\Power"
strValueName = "PromptPasswordOnResume"
oReg.GetDWORDValue HKCU,strKeyPath,strValueName,dwValue

'Return a failure exit code if entry does not exist
If IsNull(dwValue) Then
   Wscript.Echo "The value is either Null or could not be found in the registry."
   WScript.Quit 1

'Return a failure exit code if value does not equal STIG setting    
ElseIf dwValue <> 1 Then
   Wscript.Echo "This is a finding. ", strValueName,"=", dwValue
   WScript.Quit 1

'Return a passing exit code if value matches STIG setting   
ElseIf dwValue = 1 Then
   Wscript.Echo "This is not a finding. "
   WScript.Quit 0

End If

所有这一切都是我最终想出来解决我的问题。 

Const HKEY_CURRENT_USER = &H80000001  
Const HKEY_LOCAL_MACHINE = &H80000002  
Const HKEY_USERS = &H80000003  

'Set the local computer as the target

strComputer = "."

'set the objRegistry Object 
Set objRegistry = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\default:StdRegProv")

'Enumerate All subkeys in HKEY_USERS
objRegistry.EnumKey HKEY_USERS, "", arrSubkeys

'Define variables
strKeyPath = "\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments"  
strValueName = "HideZoneInfoOnProperties"  
strSID = "S-1-5-21-\d*-\d*-\d*-\d{4,5}\\"  
strValue = 1  

f = True

For Each i in arrSubKeys
    Set objRegExp = New RegExp
        objRegExp.IgnoreCase = True
        objRegExp.Global = True
        objRegExp.Pattern = strSID

    Set colMatches = objRegExp.Execute(i + strKeyPath)  
        For Each objMatch In colMatches
        objRegistry.GetDWORDValue HKEY_USERS,i + strKeyPath,strValueName,dwValue

            If IsNull(dwValue) Then
                WScript.Echo "This is a finding, the key " & i + strKeyPath & "\" & strValueName & " does not exist."
                f = False
            ElseIf dwValue <> strValue Then
                WScript.Echo "This is a finding, the " & i + strKeyPath & "\" & strValueName & ": " & dwValue & " does not equal REG_DWORD = " & strValue & "."
                f = False
            ElseIf dwValue = strValue Then
                WScript.Echo "This is not a finding " & i + strKeyPath & "\" & strValueName & " = " & dwValue
            End If
        Next


Next

    If f Then
        WScript.Quit 0
    Else
        WScript.Quit 1
    End If
4

2 回答 2

3

这里不需要递归。只需遍历 HKEY_USERS 的子键并（尝试）读取该值。的返回码GetDWORDValue()将指示是否可以读取该值。

Const HKEY_USERS = &h80000003

subkey = "Software\Policies\Microsoft\Windows\System\Power"
name   = "PromptPasswordOnResume"

computer = "."

Set reg = GetObject("winmgmts://" & computer & "/root/default:StdRegProv")

reg.EnumKey HKEY_USERS, "", sidList
For Each sid In sidList
  key = sid & "\" & subkey
  rc = reg.GetDWORDValue(HKEY_USERS, key, name, val)
  If rc = 0 Then
    If val = 1 Then
      WScript.Echo "OK"
      WScript.Quit 0
    Else
      WScript.Echo "Not OK"
      WScript.Quit 1
    End If
  End If
Next
于 2012-11-04T13:04:57.033 回答
0

我不确定我是否正确。如果是你想在HKU而不是在HKCU中搜索，那么关键是HKU中的一个账户映射到了HKCU。就像您的情况一样，S-1-5-21* 将映射到 HKCU。您可以通过修改 HKCU 中的条目来检查它，这将反映在 HKU(S-1-5-21*) 中，反之亦然。

于 2012-11-04T09:09:09.390 回答