Windows settings (services, registry, etc.) - creating report

Question

I'm looking for a tool which will allow me to save the settings (list of services and their configuration/state, registry, Windows patches, installed programs, etc.) of a machine to a file so I can later compare it with the current state of the same machine.

Answer 1

You can use 10-Strike Network Inventory Explorer for this. It can scan the inventory data (including everything you mentioned) from network computers. After scanning, you can create and save reports with the necessary data for referring to these reports later.

Answer 2

PowerShell:

1. List of Services

Save settings to file:

Easy:

PS\> Get-Service | Export-CliXML C:\Users\bwayne\Documents\services.xml

Advanced:

$TimeStamp = (Get-Date -Format s).Replace(":",".")
$ConfigFolder = "$env:USERPROFILE\Documents\Baseline-Config_$env:COMPUTERNAME\"
mkdir "$ConfigFolder"
Get-CimInstance win32_service | Select-Object Name, Caption, State, Startmode | Export-CliXML "$($ConfigFolder)services_$TimeStamp.xml"

Compare it later:

Easy:

PS\> Compare-Object (Import-CliXML C:\Users\bwayne\Documents\services.xml) (Get-Service)

Advanced:

$PastServices = "$($ConfigFolder)services_2017-01-17T16.29.23.xml"
Compare-Object (Import-CliXML $PastServices) (Get-CimInstance win32_service | Select-Object Name, Caption, State, Startmode) -IncludeEqual -Property Name, Caption

2. Registry

Save settings to file:

Easy:

PS\> REG EXPORT HKLM C:\Users\tstark\Documents\HKLM.reg

Advanced:

$TimeStamp = (Get-Date -Format s).Replace(":",".")
$ConfigFolder = "$env:USERPROFILE\Documents\Baseline-Config_$env:COMPUTERNAME\"
If(!(Test-Path $ConfigFolder)){New-Item -ItemType Directory -Force -Path $ConfigFolder} # Create folder to save config in if it does not exist
REG EXPORT HKLM "$($ConfigFolder)HKLM_$TimeStamp.reg"
REG EXPORT HKCU "$($ConfigFolder)HKCU_$TimeStamp.reg"
REG EXPORT HKCR "$($ConfigFolder)HKCR_$TimeStamp.reg"
REG EXPORT HKU "$($ConfigFolder)HKU_$TimeStamp.reg"
REG EXPORT HKCC "$($ConfigFolder)HKCC_$TimeStamp.reg"

Compare it later:

Easy:

PS\> Compare-Object $(Get-Content "C:\Users\tstark\Documents\HKLM.reg") $(Get-Content "C:\Users\tstark\Documents\HKLM_2.reg")

Advanced:

$ConfigFolder = "$env:USERPROFILE\Documents\Baseline-Config_$env:COMPUTERNAME\"
REG EXPORT HKLM "$($ConfigFolder)HKLM_Compare.reg"
REG EXPORT HKCU "$($ConfigFolder)HKCU_Compare.reg"
REG EXPORT HKCR "$($ConfigFolder)HKCR_Compare.reg"
REG EXPORT HKU "$($ConfigFolder)HKU_Compare.reg"
REG EXPORT HKCC "$($ConfigFolder)HKCC_Compare.reg"
Compare-Object $(Get-Content "$($ConfigFolder)HKLM_2017-01-30T16.09.28.reg") $(Get-Content "$($ConfigFolder)HKLM_Compare.reg")
Compare-Object $(Get-Content "$($ConfigFolder)HKCU_2017-01-30T16.09.28.reg") $(Get-Content "$($ConfigFolder)HKCU_Compare.reg")
Compare-Object $(Get-Content "$($ConfigFolder)HKCR_2017-01-30T16.09.28.reg") $(Get-Content "$($ConfigFolder)HKCR_Compare.reg")
Compare-Object $(Get-Content "$($ConfigFolder)HKU_2017-01-30T16.09.28.reg") $(Get-Content "$($ConfigFolder)HKU_Compare.reg")
Compare-Object $(Get-Content "$($ConfigFolder)HKCC_2017-01-30T16.09.28.reg") $(Get-Content "$($ConfigFolder)HKCC_Compare.reg")

3. Windows patches

Save settings to file:

Easy:

PS\> Get-WmiObject -Class "win32_quickfixengineering" | Export-CliXML C:\Users\emusk\Documents\patches.xml

Advanced:

CD $env:USERPROFILE
WMIC QFE LIST FULL /format:htable > hotfixes.htm
START iexplore $env:USERPROFILE\hotfixes.htm

Compare it later:

Easy:

PS\> Compare-Object (Import-CliXML C:\Users\emusk\Documents\patches.xml) (Get-WmiObject -Class "win32_quickfixengineering")

Advanced:

WMIC QFE LIST FULL /format:htable > hotfixes2.htm
Compare-Object $(Get-Content $env:USERPROFILE\hotfixes.htm) $(Get-Content $env:USERPROFILE\hotfixes2.htm)

4. Installed Programs

Save settings to file:

Easy:

PS\> Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | Format-Table –AutoSize > C:\Users\jbezos\Documents\applications.txt

Advanced:

Compare it later:

Easy:

PS\> Compare-Object -ReferenceObject (Get-Content C:\Users\jbezos\Documents\applications.txt) -DifferenceObject (Get-Content C:\Users\jbezos\Documents\applications2.txt)

5. et cetera...

"The output will show any differences between those two sets. So this is a neat example - but the real magic is that PowerShell can do this with just about anything. Query service information via WMI, for example. OS configuration information. Memory configuration. You name it." ~ Don Jones in PowerShell with a Purpose Blog

For more information on how to customize each cmdlet, including examples and available switches:

PS\> Update-Help
PS\> help Compare-Object -full

To script it, paste the commands into Notepad.exe and save it with .ps1 extension. Use # for comments. Make one script for saving the current config, and one to compare to a past config. Or, put it all in the same script and prompt user at run time which option to use. Or, just copy and paste the commands from the file to the console as you go. Make it as complex or as simple as you please.

To run a script from PowerShell: PS\> . C:\mypath\script.ps1

(dot sourcing)

Make sure you set Execution Policy: PS\> Set-ExecutionPolicy RemoteSigned

For more information see: PS\> help about_Scripts

To search help: PS\> help about_*

ISE

To open ISE:

1. WinKey+R (Run prompt)
2. type powershell_ise

For experimenting and running parts of a script ad hoc, there is no better tool than PowerShell's own built-in ISE component (Integrated Scripting Environment). It features an editor pane to tweak your script (with IntelliSense), and an actual powershell CLI pane to run bits & pieces as you go.

The two best features of ISE that set it apart from using a standard editor:

1. Run Selection (F8) Select any number of lines in the script and run them without ever using copy n' paste.
2. Ctrl+C and Ctrl+V You can use standard copy & paste keyboard shortcuts in ISE's cli pane, without having to use right-clicks.

If you see 3 panes when you open ISE, you are running PowerShell v2 and should upgrade. This is personal preference but 3 panes (editor, input, output) is confusing to me.

To upgrade PoSh: Open an elevated command prompt (Run As Administrator cmd.exe) (NOT powershell.exe)

CMD\> @powershell -NoProfile -ExecutionPolicy Bypass -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))" && SET "PATH=%PATH%;%ALLUSERSPROFILE%\chocolatey\bin"
CMD\> refreshenv
CMD\> choco upgrade powershell

Differencing files

Considering that you really want to A) save machine's current config to a file, and B) compare it at a later date at your convenience, you really should not be restricted to only using Compare-Object. Consider a GUI diff tool, like KDiff3.

To install: choco install kdiff3

This way, you can leave out any lines using Compare-Object as those only output to the screen, and use just the lines that save a config to a standard file type (*.xml, *.reg, *.csv). This is powershell tho, so of course you could still tweak Compare-Object to output its results to a file, for you to view at your later convenience.

Disclaimer: Never run any code from the internet unless you know exactly what it does. I am not responsible for you 'sploding your machine.