I'm looking for a tool which will allow me to save the settings (list of services and their configuration/state, registry, Windows patches, installed programs, etc.) of a machine to a file so I can later compare it with the current state of the same machine.
2 Answers
You can use 10-Strike Network Inventory Explorer for this. It can scan the inventory data (including everything you mentioned) from network computers. After scanning, you can create and save reports with the necessary data for referring to these reports later.
-
-
The program can also track changes on computers (you can choose configuration items for tracking) in the automatic mode and send reports with detected changes to your email. I do not know your exact goal so this feature can be even more useful than those "fixed" reports I mentioned in the answer.– DmitriyJan 18, 2017 at 12:36
-
Ideally this tool would allow to include custom checks implemented by me. For instance I'd like to record certain files in each machine, among other things. I'll give it a spin and verify that as soon as I can. Jan 19, 2017 at 18:41
-
PowerShell:
Save settings to file:
Easy:
PS\> Get-Service | Export-CliXML C:\Users\bwayne\Documents\services.xml
Advanced:
$TimeStamp = (Get-Date -Format s).Replace(":",".")
$ConfigFolder = "$env:USERPROFILE\Documents\Baseline-Config_$env:COMPUTERNAME\"
mkdir "$ConfigFolder"
Get-CimInstance win32_service | Select-Object Name, Caption, State, Startmode | Export-CliXML "$($ConfigFolder)services_$TimeStamp.xml"
Compare it later:
Easy:
PS\> Compare-Object (Import-CliXML C:\Users\bwayne\Documents\services.xml) (Get-Service)
Advanced:
$PastServices = "$($ConfigFolder)services_2017-01-17T16.29.23.xml"
Compare-Object (Import-CliXML $PastServices) (Get-CimInstance win32_service | Select-Object Name, Caption, State, Startmode) -IncludeEqual -Property Name, Caption
2. Registry
Save settings to file:
PS\> REG EXPORT HKLM C:\Users\tstark\Documents\HKLM.reg
Advanced:
$TimeStamp = (Get-Date -Format s).Replace(":",".")
$ConfigFolder = "$env:USERPROFILE\Documents\Baseline-Config_$env:COMPUTERNAME\"
If(!(Test-Path $ConfigFolder)){New-Item -ItemType Directory -Force -Path $ConfigFolder} # Create folder to save config in if it does not exist
REG EXPORT HKLM "$($ConfigFolder)HKLM_$TimeStamp.reg"
REG EXPORT HKCU "$($ConfigFolder)HKCU_$TimeStamp.reg"
REG EXPORT HKCR "$($ConfigFolder)HKCR_$TimeStamp.reg"
REG EXPORT HKU "$($ConfigFolder)HKU_$TimeStamp.reg"
REG EXPORT HKCC "$($ConfigFolder)HKCC_$TimeStamp.reg"
Compare it later:
Easy:
PS\> Compare-Object $(Get-Content "C:\Users\tstark\Documents\HKLM.reg") $(Get-Content "C:\Users\tstark\Documents\HKLM_2.reg")
Advanced:
$ConfigFolder = "$env:USERPROFILE\Documents\Baseline-Config_$env:COMPUTERNAME\"
REG EXPORT HKLM "$($ConfigFolder)HKLM_Compare.reg"
REG EXPORT HKCU "$($ConfigFolder)HKCU_Compare.reg"
REG EXPORT HKCR "$($ConfigFolder)HKCR_Compare.reg"
REG EXPORT HKU "$($ConfigFolder)HKU_Compare.reg"
REG EXPORT HKCC "$($ConfigFolder)HKCC_Compare.reg"
Compare-Object $(Get-Content "$($ConfigFolder)HKLM_2017-01-30T16.09.28.reg") $(Get-Content "$($ConfigFolder)HKLM_Compare.reg")
Compare-Object $(Get-Content "$($ConfigFolder)HKCU_2017-01-30T16.09.28.reg") $(Get-Content "$($ConfigFolder)HKCU_Compare.reg")
Compare-Object $(Get-Content "$($ConfigFolder)HKCR_2017-01-30T16.09.28.reg") $(Get-Content "$($ConfigFolder)HKCR_Compare.reg")
Compare-Object $(Get-Content "$($ConfigFolder)HKU_2017-01-30T16.09.28.reg") $(Get-Content "$($ConfigFolder)HKU_Compare.reg")
Compare-Object $(Get-Content "$($ConfigFolder)HKCC_2017-01-30T16.09.28.reg") $(Get-Content "$($ConfigFolder)HKCC_Compare.reg")
Save settings to file:
Easy:
PS\> Get-WmiObject -Class "win32_quickfixengineering" | Export-CliXML C:\Users\emusk\Documents\patches.xml
Advanced:
CD $env:USERPROFILE
WMIC QFE LIST FULL /format:htable > hotfixes.htm
START iexplore $env:USERPROFILE\hotfixes.htm
Compare it later:
Easy:
PS\> Compare-Object (Import-CliXML C:\Users\emusk\Documents\patches.xml) (Get-WmiObject -Class "win32_quickfixengineering")
Advanced:
WMIC QFE LIST FULL /format:htable > hotfixes2.htm
Compare-Object $(Get-Content $env:USERPROFILE\hotfixes.htm) $(Get-Content $env:USERPROFILE\hotfixes2.htm)
Save settings to file:
Easy:
PS\> Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | Format-Table –AutoSize > C:\Users\jbezos\Documents\applications.txt
Compare it later:
Easy:
PS\> Compare-Object -ReferenceObject (Get-Content C:\Users\jbezos\Documents\applications.txt) -DifferenceObject (Get-Content C:\Users\jbezos\Documents\applications2.txt)
5. et cetera...
"The output will show any differences between those two sets. So this is a neat example - but the real magic is that PowerShell can do this with just about anything. Query service information via WMI, for example. OS configuration information. Memory configuration. You name it." ~ Don Jones in PowerShell with a Purpose Blog
For more information on how to customize each cmdlet, including examples and available switches:
PS\> Update-Help
PS\> help Compare-Object -full
To script it, paste the commands into Notepad.exe and save it with .ps1
extension. Use #
for comments. Make one script for saving the current config, and one to compare to a past config. Or, put it all in the same script and prompt user at run time which option to use. Or, just copy and paste the commands from the file to the console as you go. Make it as complex or as simple as you please.
To run a script from PowerShell: PS\> . C:\mypath\script.ps1
Make sure you set Execution Policy: PS\> Set-ExecutionPolicy RemoteSigned
For more information see: PS\> help about_Scripts
To search help: PS\> help about_*
ISE
To open ISE:
- WinKey+R (Run prompt)
- type
powershell_ise
For experimenting and running parts of a script ad hoc, there is no better tool than PowerShell's own built-in ISE component (Integrated Scripting Environment). It features an editor pane to tweak your script (with IntelliSense), and an actual powershell CLI pane to run bits & pieces as you go.
The two best features of ISE that set it apart from using a standard editor:
- Run Selection (F8) Select any number of lines in the script and run them without ever using copy n' paste.
- Ctrl+C and Ctrl+V You can use standard copy & paste keyboard shortcuts in ISE's cli pane, without having to use right-clicks.
If you see 3 panes when you open ISE, you are running PowerShell v2
and should upgrade. This is personal preference but 3 panes (editor, input, output) is confusing to me.
To upgrade PoSh: Open an elevated command prompt (Run As Administrator cmd.exe) (NOT powershell.exe)
CMD\> @powershell -NoProfile -ExecutionPolicy Bypass -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))" && SET "PATH=%PATH%;%ALLUSERSPROFILE%\chocolatey\bin"
CMD\> refreshenv
CMD\> choco upgrade powershell
Differencing files
Considering that you really want to A) save machine's current config to a file, and B) compare it at a later date at your convenience, you really should not be restricted to only using Compare-Object
. Consider a GUI diff tool, like KDiff3.
To install: choco install kdiff3
This way, you can leave out any lines using Compare-Object
as those only output to the screen, and use just the lines that save a config to a standard file type (*.xml, *.reg, *.csv). This is powershell tho, so of course you could still tweak Compare-Object
to output its results to a file, for you to view at your later convenience.
Disclaimer: Never run any code from the internet unless you know exactly what it does. I am not responsible for you 'sploding your machine.