Network Audit and Documentation, CENTREL Solutions Blog

We've been asked several times about getting the security identifier (SID) from remote machines on the network. This is somewhat complex for people using scripting as the information is (annoyingly) not available using WMI unless you read the Win32_LocalAccounts class and string parse some of the SIDs from the user accounts. This isn't ideal especially on a domain controller where the queries can be somewhat slow for this class. We've therefore decided to add both the machine security identifier and the domain security identifier (the SID assigned to the computer by it's domain) to our server audit and documentation tool , and have used the low level Win32 APIs to obtain this information rather than using the less reliable string parsing method. For more information why not download the free trial ?

When you run the nbtstat.exe command you may see the error "Failed to Purge the NBT Remote Cache Table" This can occur when the user running the command doesn't have permissions to execute the command. If you are using UAC ensure that you right click the command prompt and select "Run as Administrator"

If you want to list all of the settings for advanced audit policy then just use the following command in an elevated command prompt Auditpol /get /category:* We network documentation tool automatically documents advanced audit policy configuration http://www.centrel-solutions.com/xiaconfiguration/capabilities.aspx?capability=inventory-windows-advanced-audit-policy-settings-and-create-documentation