'==========================================================================
'
' VBScript Source File -- Created with SAPIEN Technologies PrimalScript 4.0
'
' NAME: MOM Global Settings Change Audit
'
' AUTHOR: Pete Zerger , AKOS Technology Services
' DATE : 2/16/2006
'
' COMMENT: This script audits changes in MOM Global Settings.
'
' Key Variables: SQL_DSN = The name of your MOM Database Server
' POLL_INTERVAL_IN_HOURS = number of hours to check (last 1 hr by default)
'
'==========================================================================

'on Error Resume Next

'Probably could be parameters but aren't
Const MOM_SCRIPT_EVENT_ID = 5001
Const POLL_INTERVAL_IN_HOURS = -1 '***Note: This must be a negative number as it's going back in time!!!
Const SQL_DSN = "Your_MOM_Svr_Here"

Const EVENT_TYPE_SUCCESS = 0
Const EVENT_TYPE_ERROR = 1
Const EVENT_TYPE_WARNING = 2
Const EVENTLOG_INFORMATION_TYPE = 4
Const EVENTLOG_AUDIT_SUCCESS = 8
Const EVENTLOG_AUDIT_FAILURE = 16
Const SCRIPT_FAILURE_EVENT = 91001

Dim cn
Dim rs
Dim strSQLQuery
Dim UTCTime

InitSQL()
getUTCTime()
getRuleChanges()

'Log an error if script fails
If err.number <> 0 Then
LogEvent SCRIPT_FAILURE_EVENT,EVENT_TYPE_ERROR,"MOM Admin Script Error: " & vbcrlf & "err.number: " & err.number & vbcrlf & "err.description: " & err.description
end If

set cn = Nothing
set rs = Nothing

'***********************************************
'InitSQL() Create connection
'***********************************************
Sub InitSQL()
Set cn = CreateObject("ADODB.Connection")
Set rs = CreateObject("ADODB.Recordset")
cn.Open "Provider=SQLOLEDB.1;Integrated Security=SSPI;Persist Security Info=False;Initial Catalog=OnePoint;Data Source=" & SQL_DSN & ""
End Sub

'***********************************************
'getUTCTime() Gets UTC time difference (-6 or -5)
'***********************************************
sub getUTCTime()
strSQLQuery = "select DateDiff(hh,getutcdate(),getdate()) as UTCTime"
rs.Open strSQLQuery,cn,1,1
UTCTime = cstr(rs("UTCTime"))
end Sub


'***********************************************
'getRuleChanges Get the SQL Server for the given mgmt group
'**********************************************
sub getRuleChanges()
strSQLQuery = "select datacategory + dataname as GlobalSetting, datavalue, lastmodified, lastmodifiedby from OnePoint..configuration where lastmodified > dateadd(hh," & POLL_INTERVAL_IN_HOURS & ",getUTCdate()) and lastmodifiedby is not null and lastmodifiedby <> 'NT AUTHORITY\SYSTEM' and lastmodifiedby <> 'dbo' and lastmodifiedby <> 'ConfigChange' order by lastmodified"

'Pull all changes from last X hours
Set rs = cn.execute(strSQLQuery)

'If recordset is null, then report that no global settings have changed in the last reporting period.
If RS.EOF Then
LogEvent MOM_SCRIPT_EVENT_ID,EVENT_TYPE_SUCCESS,"No Global Settings Changes were made within the last " & abs(POLL_INTERVAL_IN_HOURS) & " hours."
exit Sub
end If

'Process global settings changes in the record Set
While Not rs.eof
globalsetting = rs("GlobalSetting")
datavalue = rs("datavalue")
sLastModified = DateAdd("H",UTCTime,rs("lastmodified"))
sLastModifiedBy = rs("lastmodifiedby")
'sIsRuleGroup = rs("IsRuleGroup")

'Generate an event noting the rule change (do we need all the fields listed after the 'Changed On' SecurityAllowLowEncryptionAgents

If globalsetting="AgentConfigCachePollingInterval" Then
LogChangeEvent MOM_SCRIPT_EVENT_ID,EVENT_TYPE_WARNING,"The following Global Setting has changed in the last" & abs(POLL_INTERVAL_IN_HOURS) & "Hours:" & VbCrLf & "GlobalSetting:Attribute Discovery Interval" & VbCrLf & " Data Value: " & datavalue & vbcrlf & "Changed by: " & sLastModifiedBy & vbcrlf & "Changed on: " & sLastModified, GlobalSetting, datavalue, sLastModified, slastmodifiedby
ElseIf globalsetting="CommunicationsHeartBeat" Then
LogChangeEvent MOM_SCRIPT_EVENT_ID,EVENT_TYPE_WARNING,"The following Global Setting has changed in the last" & abs(POLL_INTERVAL_IN_HOURS) & "Hours:" & VbCrLf & "GlobalSetting:Agent Heartbeat Interval" & VbCrLf & " Data Value: " & datavalue & vbcrlf & "Changed by: " & sLastModifiedBy & vbcrlf & "Changed on: " & sLastModified, GlobalSetting, datavalue, sLastModified, slastmodifiedby
ElseIf globalsetting="CommunicationsMaxSendLatency" Then
LogChangeEvent MOM_SCRIPT_EVENT_ID,EVENT_TYPE_WARNING,"The following Global Setting has changed in the last" & abs(POLL_INTERVAL_IN_HOURS) & "Hours:" & VbCrLf & "GlobalSetting:Agent - Send event & perf data after (msec)" & VbCrLf & " Data Value: " & datavalue & vbcrlf & "Changed by: " & sLastModifiedBy & vbcrlf & "Changed on: " & sLastModified, GlobalSetting, datavalue, sLastModified, slastmodifiedby
ElseIf globalsetting="ConfigName" Then
LogChangeEvent MOM_SCRIPT_EVENT_ID,EVENT_TYPE_WARNING,"The following Global Setting has changed in the last" & abs(POLL_INTERVAL_IN_HOURS) & "Hours:" & VbCrLf & "GlobalSetting:Management Group Name" & VbCrLf & " Data Value: " & datavalue & vbcrlf & "Changed by: " & sLastModifiedBy & vbcrlf & "Changed on: " & sLastModified, GlobalSetting, datavalue, sLastModified, slastmodifiedby
ElseIf globalsetting="EmailSettingsMailbox" Then
LogChangeEvent MOM_SCRIPT_EVENT_ID,EVENT_TYPE_WARNING,"The following Global Setting has changed in the last" & abs(POLL_INTERVAL_IN_HOURS) & "Hours:" & VbCrLf & "GlobalSetting:Return Address" & VbCrLf & " Data Value: " & datavalue & vbcrlf & "Changed by: " & sLastModifiedBy & vbcrlf & "Changed on: " & sLastModified, GlobalSetting, datavalue, sLastModified, slastmodifiedby
ElseIf globalsetting="EmailSettingsServerName" Then
LogChangeEvent MOM_SCRIPT_EVENT_ID,EVENT_TYPE_WARNING,"The following Global Setting has changed in the last" & abs(POLL_INTERVAL_IN_HOURS) & "Hours:" & VbCrLf & "GlobalSetting:E-mail Server" & VbCrLf & " Data Value: " & datavalue & vbcrlf & "Changed by: " & sLastModifiedBy & vbcrlf & "Changed on: " & sLastModified, GlobalSetting, datavalue, sLastModified, slastmodifiedby
ElseIf globalsetting="EmailSettingsTransport" Then
LogChangeEvent MOM_SCRIPT_EVENT_ID,EVENT_TYPE_WARNING,"The following Global Setting has changed in the last" & abs(POLL_INTERVAL_IN_HOURS) & "Hours:" & VbCrLf & "GlobalSetting:Email transport protocol" & VbCrLf & " Data Value: " & datavalue & vbcrlf & "Changed by: " & sLastModifiedBy & vbcrlf & "Changed on: " & sLastModified, GlobalSetting, datavalue, sLastModified, slastmodifiedby
ElseIf globalsetting="ErrorReportingEnableErrorReporting" Then
LogChangeEvent MOM_SCRIPT_EVENT_ID,EVENT_TYPE_WARNING,"The following Global Setting has changed in the last" & abs(POLL_INTERVAL_IN_HOURS) & "Hours:" & VbCrLf & "GlobalSetting:Send Operational Data Reports to Microsoft" & VbCrLf & " Data Value: " & datavalue & vbcrlf & "Changed by: " & sLastModifiedBy & vbcrlf & "Changed on: " & sLastModified, GlobalSetting, datavalue, sLastModified, slastmodifiedby
ElseIf globalsetting="FormatCommand" Then
LogChangeEvent MOM_SCRIPT_EVENT_ID,EVENT_TYPE_WARNING,"The following Global Setting has changed in the last" & abs(POLL_INTERVAL_IN_HOURS) & "Hours:" & VbCrLf & "GlobalSetting:Notif. cmd format: command Line" & VbCrLf & " Data Value: " & datavalue & vbcrlf & "Changed by: " & sLastModifiedBy & vbcrlf & "Changed on: " & sLastModified, GlobalSetting, datavalue, sLastModified, slastmodifiedby
ElseIf globalsetting="FormatEmailMessage" Then
LogChangeEvent MOM_SCRIPT_EVENT_ID,EVENT_TYPE_WARNING,"The following Global Setting has changed in the last" & abs(POLL_INTERVAL_IN_HOURS) & "Hours:" & VbCrLf & "GlobalSetting:Global Email Format (Body)" & VbCrLf & " Data Value: " & datavalue & vbcrlf & "Changed by: " & sLastModifiedBy & vbcrlf & "Changed on: " & sLastModified, GlobalSetting, datavalue, sLastModified, slastmodifiedby
ElseIf globalsetting="FormatEmailSubject" Then
LogChangeEvent MOM_SCRIPT_EVENT_ID,EVENT_TYPE_WARNING,"The following Global Setting has changed in the last" & abs(POLL_INTERVAL_IN_HOURS) & "Hours:" & VbCrLf & "GlobalSetting:Global Email Format (Subject)" & VbCrLf & " Data Value: " & datavalue & vbcrlf & "Changed by: " & sLastModifiedBy & vbcrlf & "Changed on: " & sLastModified, GlobalSetting, datavalue, sLastModified, slastmodifiedby
ElseIf globalsetting="HeartBeatHBMaxDelay" Then
LogChangeEvent MOM_SCRIPT_EVENT_ID,EVENT_TYPE_WARNING,"The following Global Setting has changed in the last" & abs(POLL_INTERVAL_IN_HOURS) & "Hours:" & VbCrLf & "GlobalSetting:MS Heartbeat Scan Interval" & VbCrLf & " Data Value: " & datavalue & vbcrlf & "Changed by: " & sLastModifiedBy & vbcrlf & "Changed on: " & sLastModified, GlobalSetting, datavalue, sLastModified, slastmodifiedby
ElseIf globalsetting="OtherAllowProxyForwarding" Then
LogChangeEvent MOM_SCRIPT_EVENT_ID,EVENT_TYPE_WARNING,"The following Global Setting has changed in the last" & abs(POLL_INTERVAL_IN_HOURS) & "Hours:" & VbCrLf & "GlobalSetting:Allow Agent Proxying" & VbCrLf & " Data Value: " & datavalue & vbcrlf & "Changed by: " & sLastModifiedBy & vbcrlf & "Changed on: " & sLastModified, GlobalSetting, datavalue, sLastModified, slastmodifiedby
ElseIf globalsetting="OtherConfigRequestInterval" Then
LogChangeEvent MOM_SCRIPT_EVENT_ID,EVENT_TYPE_WARNING,"The following Global Setting has changed in the last" & abs(POLL_INTERVAL_IN_HOURS) & "Hours:" & VbCrLf & "GlobalSetting:Agent Request Configuration Interval" & VbCrLf & " Data Value: " & datavalue & vbcrlf & "Changed by: " & sLastModifiedBy & vbcrlf & "Changed on: " & sLastModified, GlobalSetting, datavalue, sLastModified, slastmodifiedby
ElseIf globalsetting="OtherGlobalVdirLocation" Then
LogChangeEvent MOM_SCRIPT_EVENT_ID,EVENT_TYPE_WARNING,"The following Global Setting has changed in the last" & abs(POLL_INTERVAL_IN_HOURS) & "Hours:" & VbCrLf & "GlobalSetting:File Transfer Server Directory" & VbCrLf & " Data Value: " & datavalue & vbcrlf & "Changed by: " & sLastModifiedBy & vbcrlf & "Changed on: " & sLastModified, GlobalSetting, datavalue, sLastModified, slastmodifiedby
ElseIf globalsetting="OtherServiceCheckInterval" Then
LogChangeEvent MOM_SCRIPT_EVENT_ID,EVENT_TYPE_WARNING,"The following Global Setting has changed in the last" & abs(POLL_INTERVAL_IN_HOURS) & "Hours:" & VbCrLf & "GlobalSetting:Service Monitoring: Status Check Interval" & VbCrLf & " Data Value: " & datavalue & vbcrlf & "Changed by: " & sLastModifiedBy & vbcrlf & "Changed on: " & sLastModified, GlobalSetting, datavalue, sLastModified, slastmodifiedby
ElseIf globalsetting="PersistenceMaxFileSize" Then
LogChangeEvent MOM_SCRIPT_EVENT_ID,EVENT_TYPE_WARNING,"The following Global Setting has changed in the last" & abs(POLL_INTERVAL_IN_HOURS) & "Hours:" & VbCrLf & "GlobalSetting:Storage threshold (agent or MS)" & VbCrLf & " Data Value: " & datavalue & vbcrlf & "Changed by: " & sLastModifiedBy & vbcrlf & "Changed on: " & sLastModified, GlobalSetting, datavalue, sLastModified, slastmodifiedby
ElseIf globalsetting="ResponseProcessingAllowCustomResponseExecution" Then
LogChangeEvent MOM_SCRIPT_EVENT_ID,EVENT_TYPE_WARNING,"The following Global Setting has changed in the last" & abs(POLL_INTERVAL_IN_HOURS) & "Hours:" & VbCrLf & "GlobalSetting:Disable custom response execution (MS)" & VbCrLf & " Data Value: " & datavalue & vbcrlf & "Changed by: " & sLastModifiedBy & vbcrlf & "Changed on: " & sLastModified, GlobalSetting, datavalue, sLastModified, slastmodifiedby
ElseIf globalsetting="ResponseProcessingNumResponseThreads" Then
LogChangeEvent MOM_SCRIPT_EVENT_ID,EVENT_TYPE_WARNING,"The following Global Setting has changed in the last" & abs(POLL_INTERVAL_IN_HOURS) & "Hours:" & VbCrLf & "GlobalSetting:Simultaneous Responses Allowed (agent or MS)" & VbCrLf & " Data Value: " & datavalue & vbcrlf & "Changed by: " & sLastModifiedBy & vbcrlf & "Changed on: " & sLastModified, GlobalSetting, datavalue, sLastModified, slastmodifiedby
ElseIf globalsetting="SecurityAllowLowEncryptionAgents" Then
LogChangeEvent MOM_SCRIPT_EVENT_ID,EVENT_TYPE_WARNING,"The following Global Setting has changed in the last" & abs(POLL_INTERVAL_IN_HOURS) & "Hours:" & VbCrLf & "GlobalSetting:Block MOM 2000 / 2000 SP1 agents" & VbCrLf & " Data Value: " & datavalue & vbcrlf & "Changed by: " & sLastModifiedBy & vbcrlf & "Changed on: " & sLastModified, GlobalSetting, datavalue, sLastModified, slastmodifiedby
ElseIf globalsetting="SecurityAllowNewManualAgents" Then
LogChangeEvent MOM_SCRIPT_EVENT_ID,EVENT_TYPE_WARNING,"The following Global Setting has changed in the last" & abs(POLL_INTERVAL_IN_HOURS) & "Hours:" & VbCrLf & "GlobalSetting:Reject Manual Agent Installs" & VbCrLf & " Data Value: " & datavalue & vbcrlf & "Changed by: " & sLastModifiedBy & vbcrlf & "Changed on: " & sLastModified, GlobalSetting, datavalue, sLastModified, slastmodifiedby
ElseIf globalsetting="SecurityAuthenticatedCommunicationsOnly" Then
LogChangeEvent MOM_SCRIPT_EVENT_ID,EVENT_TYPE_WARNING,"The following Global Setting has changed in the last" & abs(POLL_INTERVAL_IN_HOURS) & "Hours:" & VbCrLf & "GlobalSetting:Require Mutual Authentication" & VbCrLf & " Data Value: " & datavalue & vbcrlf & "Changed by: " & sLastModifiedBy & vbcrlf & "Changed on: " & sLastModified, GlobalSetting, datavalue, sLastModified, slastmodifiedby
ElseIf globalsetting="URLCompanyKB" Then
LogChangeEvent MOM_SCRIPT_EVENT_ID,EVENT_TYPE_WARNING,"The following Global Setting has changed in the last" & abs(POLL_INTERVAL_IN_HOURS) & "Hours:" & VbCrLf & "GlobalSetting:Online company knowledge address" & VbCrLf & " Data Value: " & datavalue & vbcrlf & "Changed by: " & sLastModifiedBy & vbcrlf & "Changed on: " & sLastModified, GlobalSetting, datavalue, sLastModified, slastmodifiedby
ElseIf globalsetting="URLProductKB" Then
LogChangeEvent MOM_SCRIPT_EVENT_ID,EVENT_TYPE_WARNING,"The following Global Setting has changed in the last" & abs(POLL_INTERVAL_IN_HOURS) & "Hours:" & VbCrLf & "GlobalSetting:Online product knowledge address" & VbCrLf & " Data Value: " & datavalue & vbcrlf & "Changed by: " & sLastModifiedBy & vbcrlf & "Changed on: " & sLastModified, GlobalSetting, datavalue, sLastModified, slastmodifiedby
ElseIf globalsetting="URLWebClient" Then
LogChangeEvent MOM_SCRIPT_EVENT_ID,EVENT_TYPE_WARNING,"The following Global Setting has changed in the last" & abs(POLL_INTERVAL_IN_HOURS) & "Hours:" & VbCrLf & "GlobalSetting:Online product knowledge address" & VbCrLf & " Data Value: " & datavalue & vbcrlf & "Changed by: " & sLastModifiedBy & vbcrlf & "Changed on: " & sLastModified, GlobalSetting, datavalue, sLastModified, slastmodifiedby
ElseIf globalsetting="AttributeCollectionScheduleInterval" Then
LogChangeEvent MOM_SCRIPT_EVENT_ID,EVENT_TYPE_WARNING,"The following Global Setting has changed in the last" & abs(POLL_INTERVAL_IN_HOURS) & "Hours:" & VbCrLf & "GlobalSetting:MS Rule Change Poll Interval" & VbCrLf & " Data Value: " & datavalue & vbcrlf & "Changed by: " & sLastModifiedBy & vbcrlf & "Changed on: " & sLastModified, GlobalSetting, datavalue, sLastModified, slastmodifiedby
ElseIf globalsetting="HeartBeatHBAgentlessScanTime" Then
LogChangeEvent MOM_SCRIPT_EVENT_ID,EVENT_TYPE_WARNING,"The following Global Setting has changed in the last" & abs(POLL_INTERVAL_IN_HOURS) & "Hours:" & VbCrLf & "GlobalSetting:Heartbeat Checking - Scan agentless computer every " & VbCrLf & " Data Value: " & datavalue & vbcrlf & "Changed by: " & sLastModifiedBy & vbcrlf & "Changed on: " & sLastModified, GlobalSetting, datavalue, sLastModified, slastmodifiedby
ElseIf globalsetting="InstallationGracePeriod" Then
LogChangeEvent MOM_SCRIPT_EVENT_ID,EVENT_TYPE_WARNING,"The following Global Setting has changed in the last" & abs(POLL_INTERVAL_IN_HOURS) & "Hours:" & VbCrLf & "GlobalSetting:Automatic Managment - Agent Uninstall Delay" & VbCrLf & " Data Value: " & datavalue & vbcrlf & "Changed by: " & sLastModifiedBy & vbcrlf & "Changed on: " & sLastModified, GlobalSetting, datavalue, sLastModified, slastmodifiedby
ElseIf globalsetting="CommunicationsThrottleMaxBytes" Then
LogChangeEvent MOM_SCRIPT_EVENT_ID,EVENT_TYPE_WARNING,"The following Global Setting has changed in the last" & abs(POLL_INTERVAL_IN_HOURS) & "Hours:" & VbCrLf & "GlobalSetting: Communications - Maximum amount of data per second (agent) " & VbCrLf & " Data Value: " & datavalue & vbcrlf & "Changed by: " & sLastModifiedBy & vbcrlf & "Changed on: " & sLastModified, GlobalSetting, datavalue, sLastModified, slastmodifiedby
ElseIf globalsetting="CommunicationsPacketSendSize" Then
LogChangeEvent MOM_SCRIPT_EVENT_ID,EVENT_TYPE_WARNING,"The following Global Setting has changed in the last" & abs(POLL_INTERVAL_IN_HOURS) & "Hours:" & VbCrLf & "GlobalSetting: Communications - Packet size (agent)" & VbCrLf & " Data Value: " & datavalue & vbcrlf & "Changed by: " & sLastModifiedBy & vbcrlf & "Changed on: " & sLastModified, GlobalSetting, datavalue, sLastModified, slastmodifiedby
ElseIf globalsetting="CommunicationsAlertSendLatency" Then
LogChangeEvent MOM_SCRIPT_EVENT_ID,EVENT_TYPE_WARNING,"The following Global Setting has changed in the last" & abs(POLL_INTERVAL_IN_HOURS) & "Hours:" & VbCrLf & "GlobalSetting: Buffering - alert buffering " & VbCrLf & " Data Value: " & datavalue & vbcrlf & "Changed by: " & sLastModifiedBy & vbcrlf & "Changed on: " & sLastModified, GlobalSetting, datavalue, sLastModified, slastmodifiedby
Else
LogChangeEvent MOM_SCRIPT_EVENT_ID,EVENT_TYPE_WARNING,"The following Global Setting has changed in the last " & abs(POLL_INTERVAL_IN_HOURS) & " Hours: " & VbCrLf & "GlobalSetting: Other - Please Investigate - " & GlobalSetting & VbCrLf & "Data Value: " & datavalue & vbcrlf & "Changed by: " & sLastModifiedBy & vbcrlf & "Changed on: " & sLastModified, GlobalSetting, datavalue, sLastModified, slastmodifiedby
End If

'Global values missing from this script
'Comm port (1270 by default)
'Computer discovery schedule
'Mgmt Server rule change poll interval

rs.MoveNext
Wend

end Sub

Sub LogChangeEvent(lEventID, lEventType, lEventMessage, lParam1, lParam2, lParam3, lParam4) ', lParam5)
'On Error Resume Next
Set oEvent = ScriptContext.CreateEvent

oEvent.EventNumber = lEventID
oEvent.EventType = lEventType
oEvent.Message = lEventMessage
oEvent.SetEventParameter(lParam1)
oEvent.SetEventParameter(lParam2)
oEvent.SetEventParameter(lParam3)
oEvent.SetEventParameter(lParam4)
'oEvent.SetEventParameter(lParam5)

ScriptContext.Submit oEvent
Set oEvent = Nothing

Set objShell = CreateObject("WScript.Shell")
objShell.LogEvent 4, "MOM Script: " & ScriptContext.Name & " MOMEventID: " & lEventID & " MOMEventType: " & lEventType & " MOMEventMsg: " & lEventMessage & " lParam1: " & lParam1 & " lParam2: " & lParam2 & " lParam3: " & lParam3 & " lParam4: " & lParam4 & " lParam5: " & lParam5
set objShell = Nothing
end Sub

Sub LogEvent(lEventID, lEventType, lEventMessage)
Dim oEvent
'On Error Resume Next
Set oEvent = ScriptContext.CreateEvent
oEvent.EventNumber = lEventID
oEvent.EventType = lEventType
oEvent.Message = lEventMessage
ScriptContext.Submit oEvent
Set oEvent = nothing

Set objShell = CreateObject("WScript.Shell")
objShell.LogEvent 4, "MOM Script: " & ScriptContext.Name & " MOMEventID: " & lEventID & " MOMEventType: " & lEventType & " MOMEventMsg: " & lEventMessage
set objShell = nothing

End Sub