PSU FIT audit - Windows
| 0 Votes |
Versioning - This is the latest version.
| 1 | PSU FIT | 8/4/2014 3:04:41 PM |
| 2 | PSU FIT audit - Windows | 8/6/2014 6:33:52 AM |
Description
This is an audit of the installation status of the PSU FIT application and associated reports, files, and associations.
Resources:
http://technet.microsoft.com/en-us/library/cc753525.aspx
http://support.microsoft.com/kb/220167
http://technet.microsoft.com/en-us/library/bb727008.aspx
http://bigfix.me/fixlet/details/771
Property Details
Properties
version of FIT
Period
2 days
| * Results in a true/false |
unique values of (it as string) of values "DisplayVersion" of keys whose(value "DisplayName" of it as string as lowercase starts with "fitwin" AND value "DisplayName" of it as string as lowercase does not start with "fitwinrpts") of key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" of native registry
version of FIT Reports
Period
2 days
| * Results in a true/false |
unique values of (it as string) of values "DisplayVersion" of keys whose(value "DisplayName" of it as string as lowercase starts with "fitwinrpts") of key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" of native registry
SHA1 of FIT.im
Period
7 days
| * Results in a true/false |
unique values of (it as string) of sha1s of files "fit.im" of folders "ibisfit" of folders whose(name of it as lowercase starts with "program files") of root folder of drive of windows folder
Permissions of ibisfit FOLDER
Period
6 hours
| * Results in a true/false |
unique values of (it as bit set as string) of effective access modes for "Users" of dacls of security descriptors of folders "ibisfit" of folders whose(name of it as lowercase starts with "program files") of root folder of drive of windows folder
# of files of componentsConfig FOLDER
Period
6 hours
| * Results in a true/false |
number of files of folders "componentsConfig" of folders "ibisfit" of folders whose(name of it as lowercase starts with "program files") of root folder of drive of windows folder
permissions of fit FOLDERS
Period
6 hours
| * Results in a true/false |
(((it as bit set as string) of effective access mode for "Users" of dacl of security descriptor of it) & " " & name of it) of (it;folder "componentsConfig" of it;folder "data" of it;folder "excel" of it;folder "fitrpts" of it) of folders "ibisfit" of folders whose(name of it as lowercase starts with "program files") of root folder of drive of windows folder
permissions of fit FILES
Period
6 hours
| * Results in a true/false |
(((it as bit set as string) of effective access mode for "Users" of dacl of security descriptor of it) & " " & following text of first ((it & "\") of unique value of pathnames of folders "ibisfit" of folders whose(name of it as lowercase starts with "program files") of root folder of drive of windows folder) of pathname of it) of descendants of folders "ibisfit" of folders whose(name of it as lowercase starts with "program files") of root folder of drive of windows folder
mod time of fit FILES
Period
6 hours
| * Results in a true/false |
(((it as string) of ((year of it as string & month of it as two digits & day_of_month of it as two digits) of date (local time zone) of it) of modification time of it) & " " & following text of first ((it & "\") of unique value of pathnames of folders "ibisfit" of folders whose(name of it as lowercase starts with "program files") of root folder of drive of windows folder) of pathname of it) of descendants of folders "ibisfit" of folders whose(name of it as lowercase starts with "program files") of root folder of drive of windows folder
mod time of fit FOLDERS
Period
6 hours
| * Results in a true/false |
(((it as string) of ((year of it as string & month of it as two digits & day_of_month of it as two digits) of date (local time zone) of it) of modification time of it) & " " & name of it) of (it;folder "componentsConfig" of it;folder "data" of it;folder "excel" of it;folder "fitrpts" of it) of folders "ibisfit" of folders whose(name of it as lowercase starts with "program files") of root folder of drive of windows folder
.im file type registered?
Period
1 day
| * Results in a true/false |
exists key "HKEY_CLASSES_ROOT\.im\visual.works" of registry
visual.works registered?
Period
1 day
| * Results in a true/false |
values "" of keys "HKEY_CLASSES_ROOT\visual.works\shell\open\command" of registry
# of files of data FOLDER
Period
2 days
| * Results in a true/false |
number of files of folders "data" of folders "ibisfit" of folders whose(name of it as lowercase starts with "program files") of root folder of drive of windows folder
visual.works command entry
Period
2 days
| * Results in a true/false |
values "command" of keys "HKEY_CLASSES_ROOT\visual.works\shell\open\command" of registry
Relevance
Windows Only (Relevance 2997197)
/* Windows Only */ windows of operating system
/* Windows XP or Higher */ version of operating system >= "5.1"
| Used in 2 analyses | * Results in a true/false |
(exists keys whose(value "DisplayName" of it as string as lowercase starts with "fitwin") of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" of (native registry;registry)) OR (exists folders "ibisfit" of folders whose(name of it as lowercase starts with "program files") of root folder of drive of windows folder)
Sharing
| Social Media: |
