Anthony Reinke » windows

Installing SNMP through the Command Line – Part 2

Anthony Reinke — Wed, 01 Feb 2012 22:01:19 +0000

I added a batch script I wrote to install SNMP on a bunch of machine back on Jan. 14, 2012 (http://www.anthonyreinke.com/2012/01/14/installing-snmp-through-the-command-line/). I have since modified the script. Changing the file from a .bat to a .cmd will allow you to right click and run as administrator on Windows 2008. Also I noticed in 2008, it defaults in to having the localhost as the only system that can communicate to the SNMP Service.

PsExec.exe @hosts.txt -s -c installsnmp.cmd

Below is the file to download. Rename the file to installsnmp.cmd
installsnmp.cmd.txt

As always, please contact me if you have questions.

@echo off

cls

REM Detect if the system is Windows Server 2003
systeminfo | find "2003" > nul
if %ERRORLEVEL% == 0 goto 2003

REM Detect if the system is Windows XP
systeminfo | find "XP Pro" > nul
if %ERRORLEVEL% == 0 goto XPPro

REM Detect if the system is Windows XP
systeminfo | find "2008" > nul
if %ERRORLEVEL% == 0 goto 2008

REM If the system is Windows Vista, Windows Server 2008, or higher, 
REM they have the required files built in.
goto ERROR

:2003
REM If Windows 2003, set the path to the i386 directory
REM Note: The path needs to be one level above the i386 directory
REM Example: if the path is \\server\share\windows2003\i386\ then
REM the path would be \\server\share\windows2003\
REM Note that the you need both a 32bit and 64bit versions

if (%PROCESSOR_ARCHITECTURE%) == (AMD64) (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup]
echo "SourcePath"="\\\\server\\share\\Extracted\\Win2003x64\\"
echo "ServicePackSourcePath"="\\\\server\\share\\Extracted\\Win2003x64\\"
) > %temp%\setW2003Path.reg

IF (%PROCESSOR_ARCHITECTURE%) == (x86) (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup]
echo "SourcePath"="\\\\server\\share\\Extracted\\Win2003\\"
echo "ServicePackSourcePath"="\\\\server\\share\\Extracted\\Win2003\\"
) > %temp%\setW2003Path.reg

REM Installing the created Registry File
regedit /s /q %temp%\setW2003Path.reg

goto SNMP

:XPPro
REM If Windows XP Professional, set the path to the i386 directory
REM Note: The path needs to be one level above the i386 directory
REM Example: if the path is \\server\share\windowsXP\i386\ then
REM the path would be \\server\share\windowsXP\
if (%PROCESSOR_ARCHITECTURE%) == (AMD64) (
(
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup]
echo "SourcePath"="\\\\server\\share\\Extracted\\XPProx64\\"
echo "ServicePackSourcePath"="\\\\server\\share\\Extracted\\XPProx64\\"
) > %temp%\setXPProPath.reg
) ELSE IF (%PROCESSOR_ARCHITECTURE%) == (x86)
(
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup]
echo "SourcePath"="\\\\server\\share\\Extracted\\XPPro\\"
echo "ServicePackSourcePath"="\\\\server\\share\\Extracted\\XPPro\\"
) > %temp%\setXPProPath.reg
)

REM Installing the created Registry File
regedit /s /q %temp%\setXPProPath.reg.reg

goto SNMP

:2008
REM Since 2008 stopped using the sysocmgr.exe to install features, in Vista and higher
REM you need to use the servermanagercmd.exe to add features. A great list of the 
REM features and their command line install string is at:
REM http://www.techrepublic.com/blog/datacenter/install-windows-server-2008-features-with-servermanagercmd/294

servermanagercmd.exe -install SNMP-Services

goto Strings

:SNMP
REM Building the Unattended Install

(
echo ;SetupMgrTag
echo [NetOptionalComponents]
echo SNMP=1
echo [SNMP]
echo Any_Host=YES
) > %temp%\snmp.txt

REM Installing the SNMP application with the Unattended Install

sysocmgr /i:%windir%\inf\sysoc.inf /u:%temp%\snmp.txt

goto Strings

:Strings

REM Removing the public string
(
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SNMP\Parameters\ValidCommunities]

REM Removing the only allow localhost communication, by default 2008 will only allow the 
REM localhsot to talk to the SNMP service
echo [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SNMP\Parameters\PermittedManagers]

REM Setting the SNMP strings
echo.

REM Setting the SNMP Contact Info
echo [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SNMP\Parameters\RFC1156Agent]
echo "sysContact"="Server Administrators"
echo "sysLocation"="Server Room"
echo "sysServices"=dword:0000004f
echo.
REM Setting the Read Only and Read Write Communities
echo [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SNMP\Parameters\ValidCommunities]
echo "readonly"=dword:00000004
echo "readwrite"=dword:00000008
echo.
REM Creating the Permitted Managers Key
echo [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SNMP\Parameters\PermittedManagers]
echo.
) > %temp%\setupsnmp.reg

REM Installing the created Registry File

regedit /s /q %temp%\setupsnmp.reg

REM Cleaning Up

IF EXIST %temp%\setupsnmp.reg del %temp%\setupsnmp.reg
IF EXIST %temp%\setW2003Path.reg del %temp%\setW2003Path.reg
IF EXIST %temp%\setXPProPath.reg.reg del %temp%\setXPProPath.reg.reg
IF EXIST %temp%\snmp.txt del %temp%\snmp.txt

echo %COMPUTERNAME% Complete >> \\server\share\SNMP\SNMPInstall.txt

goto END

:ERROR
echo.
echo Could not determine the OS type
pause

goto END

:END

Installing SNMP through the Command Line

Anthony Reinke — Sun, 15 Jan 2012 04:18:59 +0000

I needed a way to mass install SNMP to the servers in my environment. The problem I was having was Microsoft Windows Server 2003 needing files from the CD. We don’t copy the i386 directory from the CD for two reasons. We store the files on the network and drive space is limit on a lot of servers. The batch script will check if the server is 2003. If it is 2003, it will point the install cd to a network path or a local path. Next it builds the unattended install file. Once the file is written, the system will add the SNMP feature per the unattended file. After SNMP is installed, the registry keys are set for the SNMP community strings. Lastly the script removes the temporary files it created.

Use this script in combination to PSTools’ PSExec and you can mass install. Create a list of systems you want to install this on and call it hosts.txt. Each server needs to be on it’s own line and it is best to use the fully qualified name or IP Address. Copy the hosts.txt and installsnmp.bat file in to your PSTools directory and run the following command:

PsExec.exe @hosts.txt -s -c installsnmp.bat

Download the Install SNMP Batch File, just rename to a .bat file.

@echo off

echo %COMPUTERNAME% Started >> \\server\share\SNMP\SNMPInstall.txt

REM Detect if the system is Windows Server 2003
systeminfo | find "2003" > nul
if %ERRORLEVEL% == 0 goto 2003

REM Detect if the system is Windows XP
systeminfo | find "XP Pro" > nul
if %ERRORLEVEL% == 0 goto XPPro

REM If the system is Windows Vista, Windows Server 2008, or higher, 
REM they have the required files built in.
goto SNMP

:2003
REM If Windows 2003, set the path to the i386 directory
REM Note: The path needs to be one level above the i386 directory
REM Example: if the path is \\server\share\windows2003\i386\ then
REM the path would be \\server\share\windows2003\
REM Note that the you need both a 32bit and 64bit versions

if (%PROCESSOR_ARCHITECTURE%) == (AMD64) (
(
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup]
echo "SourcePath"="\\\\server\\share\\Extracted\\Win2003x64\\"
echo "ServicePackSourcePath"="\\\\server\\share\\Extracted\\Win2003x64\\"
) > %temp%\setW2003Path.reg
) ELSE IF (%PROCESSOR_ARCHITECTURE%) == (x86)
(
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup]
echo "SourcePath"="\\\\server\\share\\Extracted\\Win2003\\"
echo "ServicePackSourcePath"="\\\\server\\share\\Extracted\\Win2003\\"
) > %temp%\setW2003Path.reg
)

REM Installing the created Registry File
regedit /s /q %temp%\setW2003Path.reg

goto SNMP

:XPPro
REM If Windows XP Professional, set the path to the i386 directory
REM Note: The path needs to be one level above the i386 directory
REM Example: if the path is \\server\share\windowsXP\i386\ then
REM the path would be \\server\share\windowsXP\
if (%PROCESSOR_ARCHITECTURE%) == (AMD64) (
(
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup]
echo "SourcePath"="\\\\server\\share\\Extracted\\XPProx64\\"
echo "ServicePackSourcePath"="\\\\server\\share\\Extracted\\XPProx64\\"
) > %temp%\setXPProPath.reg
) ELSE IF (%PROCESSOR_ARCHITECTURE%) == (x86)
(
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup]
echo "SourcePath"="\\\\server\\share\\Extracted\\XPPro\\"
echo "ServicePackSourcePath"="\\\\server\\share\\Extracted\\XPPro\\"
) > %temp%\setXPProPath.reg
)

REM Installing the created Registry File
regedit /s /q %temp%\setXPProPath.reg.reg

goto SNMP

:SNMP
REM Building the Unattended Install

(
echo ;SetupMgrTag
echo [NetOptionalComponents]
echo SNMP=1
echo [SNMP]
echo Any_Host=YES
) > %temp%\snmp.txt

REM Installing the SNMP application with the Unattended Install

sysocmgr /i:%windir%\inf\sysoc.inf /u:%temp%\snmp.txt

goto Strings

:2008
REM Since 2008 stopped using the sysocmgr.exe to install features, in Vista and higher
REM you need to use the servermanagercmd.exe to add features. A great list of the 
REM features and their command line install string is at:
REM http://www.techrepublic.com/blog/datacenter/install-windows-server-2008-features-with-servermanagercmd/294

servermanagercmd.exe -install SNMP-Services

goto Strings

:Strings

REM Removing the public string
(
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SNMP\Parameters\ValidCommunities]

REM Setting the SNMP strings
echo.
echo [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SNMP\Parameters\RFC1156Agent]
echo "sysContact"="Server Administrators"
echo "sysLocation"="Server Room"
echo "sysServices"=dword:0000004f
echo.
echo [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SNMP\Parameters\ValidCommunities]
echo "readonly"=dword:00000004
echo "readwrite"=dword:00000008
) > %temp%\setupsnmp.reg

REM Installing the created Registry File

regedit /s /q %temp%\setupsnmp.reg

REM Cleaning Up

IF EXIST %temp%\setupsnmp.reg del %temp%\setupsnmp.reg
IF EXIST %temp%\setW2003Path.reg del %temp%\setW2003Path.reg
IF EXIST %temp%\setXPProPath.reg.reg del %temp%\setXPProPath.reg.reg
IF EXIST %temp%\snmp.txt del %temp%\snmp.txt

echo %COMPUTERNAME% Complete >> \\server\share\SNMP\SNMPInstall.txt

Exporting from 2003

Anthony Reinke — Mon, 10 Oct 2011 14:29:29 +0000

There are still people using 2003 as I found out. While helping convert from 2003 to a web based email solution for Exchange, I needed to export a full list of email addresses. I was searching for a while on Google before I found a quick and easy way to export the list.

ldifde -d "DC=domain,DC=com" -r "(&(mailnickname=*))" -l proxyAddresses -f emailaddresses.txt

-d set the domain you are connecting to

-r set the filter for the query

-l set the query to list the attribute(s) you are looking for

-f tells the query to write to the following filename

Windows 7 Problem Step Recorder – Create Step By Step Recordings | Technibble

Anthony Reinke — Fri, 24 Dec 2010 04:13:38 +0000

A big problem for computer technicians is trying to reproduce the error that the client is encountering. If we don’t know exactly what they did to cause it, it is hard to track down the problem. This is where an application built into Windows 7 called “Problem Step Recorder” can help.

Monitoring the Filesystem with Splunk

Anthony Reinke — Mon, 31 Aug 2009 19:17:06 +0000

I have used OSSEC in the past to watch the file system for changes. When I found that I can have the Splunk agent handle the monitoring itself, I was pretty excited. Since I would send my OSSEC data to Splunk anyways, it just seemed logical to have Splunk do everything.

In Windows, you need to edit the “c:program filesSplunketcsystemlocalinputs.conf” file. Of course your path could be different if you installed it in a different place. There are a lot of options and switches you can use. I went for the simplest set.

[fschange:d:temp]
recurse=true
pollPeriod=3600

This will monitor the d:temp folder and all files and folders under it. It will check the system every 3600 seconds (1 hour).

This has helped me keep track of the changes in my servers. I can see when a file was add/deleted/changed (due to the hash) and then look at who was logged in during the period that the file was changed.

Splunk article on the switches and FSCHANGE.
http://www.splunk.com/base/Documentation/4.0.3/Admin/Monitorchangestoyourfilesystem

[fschange:d:temp]
recurse=true
followLinks=false
pollPeriod=60

OSSEC and Splunk

Anthony Reinke — Tue, 28 Jul 2009 01:55:54 +0000

I have been playing with OSSEC and Splunk. OSSEC is a Host based Intrusion Detection System (HIDS). Splunk is a log archiving and searching system. OSSEC is open source and is multiple platform. You can run it on Linux/Unix and Windows. I am using OSSEC to forward Windows Event Logs to Splunk. Splunk makes the searching and correlation. Splunk can do WMI. This would be great since no agent would need to be installed. The problems is that if you have more than 30-50 systems, the amount time and traffic would cause issues. Using the OSSEC agent, I am able to push the event logs to the OSSEC server. From there the OSSEC server will upload to the Splunk server via Syslog.

Right now I have the servers all talking but I do need to adjust a few things. Right now Splunk sees all the hosts as the OSSEC server. I believe I just need to tweak the fields. The question is how.

Splunk
http://www.splunk.com

OSSEC
http://www.ossec.net