Monitoring Windows Registry

[quepasa]

I wanted to be able to monitor changes to the windows registry of my Zabbix clients, and I wasn't able to find something that did this. So, I wrote a vbscript that allows me to do this. Consider this a test version of the script. I have been using it a little, but haven't done any rigorous testing of the code yet. I am more familiar with vb/vb.net, so I am not entirely comfortable with the nuances of vbscript yet. Also, I haven't done any error trapping. I just wanted to get this first version out so that other people can look at it and offer suggestions. I am also very new to Zabbix.

The script is called reginfo.vbs. Depending on the command line arguments, it will:
1. Return the number of registry entries in a given registry key
2. Return a string containing all the entries and values in a given registry key
3. Return the number of subkeys within a given registry key
4. Return the value of a specific registry entry

The script has three required arguments, and a fourth optional one:
First Argument: An integer value representing the ID of the registry hive to look in
0 = HKEY_CLASSES_ROOT
1 = HKEY_CURRENT_USER
2 = HKEY_LOCAL_MACHINE
3 = HKEY_USERS
5 = HKEY_CURRENT_CONFIG
9 = HKEY_USERS but the keys/entries for the most recently logged in user

Second Argument: A string, in quotes, of the path to the registry key to look in (ie: "Software\Microsoft\Windows\CurrentVersion\Run ")

Third Argument: Integer value representing what to return
0 = returns integer value representing number of registry entries
1 = returns string containing all registry entries and their values
2 = returns integer value representing number of sub keys
3 = returns the value in a given registry entry

Fourth Argument: A string, in quotes, of the specific registry entry to get the value of (only necessary for return-type 3)

Examples:
To get the entries and their values for: HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run (please note that the "Current User" is the user running the script... chances are you will not want to use this for zabbix monitoring since the Server Service, or maybe Administrator user, will be running the script. Use the next example instead)

reginfo.vbs 1 "Software\Microsoft\Windows\CurrentVersion\Run" 1

To get the entries and their values for the Software\Microsoft\Windows\CurrentVersion\Run for the most recently logged in user (this is the example you want to follow if you want to monitor the registry for the currently logged in user's "CURRENT_USER" hive. Just note that in reality this is the "CURRENT_USER" hive for the most recently logged in user. The script doesn't know if the last user has already logged-off):

reginfo.vbs 9 "Software\Microsoft\Windows\CurrentVersion\Run" 1

To get the number of subkeys in: HKEY_LOCAL_MACHINE\Software

reginfo.vbs 2 "Software" 2

To get the value of the ProxyEnable entry within the HKEY_USERS Hive for the most recently logged in user (HKEY_USERS\[SID OF LOGGED IN USER]\Software\Microsoft\Windows\CurrentVersion\Interne t Settings)

reginfo.vbs 9 "Software\Microsoft\Windows\CurrentVersion\Internet Settings" 3 "ProxyEnable"

So, in order to use this in Zabbix, you need to create User Parameters in the zabbix_agentd.conf (this assumes reginfo.vbs is located in c:\zabbix\scripts\):

#Number of subkeys in HKEY_LOCAL_MACHINE\Software (change may indicate a program has been installed/uninstalled)
UserParameter=reg.LMSoftwareSubKeyCount,%systemroot%\system32\cscript.exe /nologo /T:10 c:\zabbix\scripts\reginfo.vbs 2 "Software\" 2

#Number of subkeys in "Software" for most recently logged in user (change may indicate a program has been installed/uninstalled)
UserParameter=reg.CUSoftwareSubKeyCount,%systemroot%\system32\cscript.exe /nologo /T:10 c:\zabbix\scripts\reginfo.vbs 9 "Software\" 2

#See if most recent user is using a proxy (may indicate man in middle attack, or user trying to bypass corporate policies)
UserParameter=reg.CUProxyEnable,%systemroot%\system32\cscript.exe /nologo /T:10 c:\zabbix\scripts\reginfo.vbs 9 "Software\Microsoft\Windows\CurrentVersion\Internet Settings" 3 "ProxyEnable"

#Number of entries in Software\Microsoft\Windows\CurrentVersion\Run for most recently logged in user (Change may indicate installed software, or malicious program trying to run on windows boot)
UserParameter=reg.CURunCount,%systemroot%\system32\cscript.exe /nologo /T:10 c:\zabbix\scripts\reginfo.vbs 9 "Software\Microsoft\Windows\CurrentVersion\Run" 0

#Number of entries in Software\Microsoft\Windows\CurrentVersion\RunOnce for most recently logged in user (Change may indicate installed software, or malicious program trying to run on windows boot)
UserParameter=reg.CURunOnceCount,%systemroot%\system32\cscript.exe /nologo /T:10 c:\zabbix\scripts\reginfo.vbs 9 "Software\Microsoft\Windows\CurrentVersion\RunOnce" 0

#Get name of most recently logged in user
UserParameter=reg.LoggedInUser,%systemroot%\system32\cscript.exe /nologo /T:10 c:\zabbix\scripts\reginfo.vbs 2 "SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon" 3 "DefaultUserName"

This uses the Windows command-line-based scripting host (cscript.exe). The "/nologo" argument hides the banner normally displayed by cscript, and the "/T:10" argument prevents the script from running for more than ten seconds.

Then in zabbix server, you create an Item of type "Zabbix Agent" with the key you defined in the zabbix_agentd.conf file of your client(s). Using the above examples the keys would be: reg.LMSoftwareSubKeyCount, reg.CUSoftwareSubKeyCount, reg.CUProxyEnable, reg.CURunCount, reg.CURunOnceCount, and reg.LoggedInUser

Hope all this makes sense, and that I just didn't re-invent the wheel!

-Ben

[Scheffie]

Hi!

Maybe this would be a nice feature to be integrated in a future release of the Windows Zabbix agent!

Grtz
Scheffie

[frater]

@quepasa

Thank you very much for your VB-script. I needed to get registry values inside Zabbix.

The one thing I didn't understand was all the different "UserParameter=" in zabbix_agentd.conf
I am only using 1 entry in my config and let Zabbix pass the parameters to the script.

UserParameter=reg.info[*],%systemroot%\system32\cscript.exe /nologo /T:10 c:\zabbix\scripts\reginfo.vbs $1 "$2" $3 "$4"

key =  reg.info[9, "Software\Microsoft\Windows\CurrentVersion\Run", 0]

[frater]

@quepasa

I'm now getting all kind of info from your script, but I now ran into a little problem. It seems I'm not getting any value when I want to query a registry key that doesn't exist.
This means the item becomes unsupported.

I looked into your script to see if I could change it, but as far as I can understand your script it seems to return "Registry Entry Not Found"
This isn't the case.
I never programmed in VB though.

I want to prevent the item from becoming unsupported.
When I write a script (in bash) I would return a dot in case the value would be empty.

Can you tell me what I have to change to achieve this?

[frater]

@quepasa

It seems there's (also) an error in your script.
It will always return "Registry Entry Not Found"

I therefore don't understand why it turns unsupported on those servers where I have no forwarding enabled....

C:\>%systemroot%\system32\cscript.exe /nologo /T:10 "C:\Program
 Files (x86)\Zabbix Agent\reginfo.vbs" 2 "SYSTEM\CurrentControlSet\services\DNS\
Parameters" 3 "Forwarders" 2>NULL
Registry Entry Not Found10.0.0.38

[frater]

@quepasa

It now turns out it was all due to the error of the script always returning "Registry Entry Not Found"
The item that became unsupported was numeric and that of course can't cope with that text.

I'm now doing a quick-and-dirty fix by making that string empty

strValue = "Registry Entry Not Found"

strValue = ""

[karzer]

Hi,

can we monitor registry with WMI?

Zabbix function "wmi.get[<namespace>,<query>]"

Thanks

[alientm]

@quepasa

It now turns out it was all due to the error of the script always returning "Registry Entry Not Found"
The item that became unsupported was numeric and that of course can't cope with that text.

I'm now doing a quick-and-dirty fix by making that string empty

strValue = "Registry Entry Not Found"

strValue = ""

Can you explain more about how it works ?