RE: Checking if Windows was restarted after update

There is also a Nessus plugin (35453) which checks for this :

http://nessus.org/plugins/index.php?view=single&id=35453

- Mehul 

> -----Original Message-----
> From: [email protected] 
> [mailto:[email protected]] On Behalf Of Paul Davis
> Sent: Sunday, February 08, 2009 2:44 PM
> To: [email protected]
> Subject: Re: Checking if Windows was restarted after update
> 
> Another possibility, if you are not comfortable with plugin 
> writing, is to use the Nessus WMI auditing functionality 
> available to Professional Feed and Security Center users. WMI 
> stores the last boot time under root/CIMV2 => LastBootUpTime 
> in the following format:
> 
> 20090203100617.341500-300
> 
> It wouldn't be terribly difficult to whip up an audit to 
> check for users who haven't rebooted since a particular date:
> 
> <check_type:"Windows" version:"2">
> <group_policy: "Last boot audit">
> 
> <custom_item>
>   	type		: WMI_POLICY
>   	description	: "Check last boot time of remote device"
>   	value_type	: POLICY_TEXT
> 	# Will fail for users who have not rebooted since Jan 1, 2009
> 	value_data	: "200902.*" || "200901.*"
>   	wmi_namespace	: "root/CIMV2"
>   	wmi_request	: "select LastBootUpTime from 
> CIM_OperatingSystem"
>   	wmi_attribute	: "LastBootUpTime"
> 	wmi_key		: "LastBootUpTime"
> 	check_type	: CHECK_REGEX
> </item>
> 
> </group_policy>
> 
> </check_type>
> 
> This regex is oversimplified and could be modified to meet 
> your criteria. You'll have a challenge with relative dates though..
> 
> Paul
> 
> [email protected] wrote:
> > Could you not just write a plugin that issues the following command:
> > 
> > Net statistics Server/Workstation <-- choose whichever is relevant
> > 
> > The second line is "Statistics since MM/DD/YYYY M:S", where 
> it shows 
> > the last time and date the machine booted. Based on what 
> time and date 
> > the patch was pushed out, you should be able to tell whether the 
> > machine has rebooted since the patch install.
> > 
> > Andrew Court
> > 
> > IT Security Specialist | CEH | BT Retail - Ireland | 
> > E:[email protected] |Mobile: +353 86 1720 692 | Fax: +353 1 432 
> > 5899| www.btireland.com
> > 
> > 
> > -----Original Message-----
> > From: [email protected]
> > [mailto:[email protected]] On Behalf Of Bazy
> > Sent: 09 January 2009 12:10
> > To: [email protected]
> > Subject: Checking if Windows was restarted after update
> > 
> > Hello!
> > 
> > We use WSUS in our company for updates, but not everyone 
> restart's his 
> > workstation for days. So in some cases the computer is still 
> > vulnerable if not restarted. How would be the best practice 
> to check 
> > this? I'm using Nessus for about 3 months, read the book but have 
> > little experience.
> > 
> > Thank you!
> > 
> > 
> 
> --
> Best Regards,
> 
> Paul Davis
> Tenable Network Security Inc
> Phone: 410.872.0555 x245
> www.tenablesecurity.com
> 
> Is your network TENABLE?
> _______________________________________________
> Nessus mailing list
> [email protected]
> http://mail.nessus.org/mailman/listinfo/nessus
> 
> 

_______________________________________________
Nessus mailing list
[email protected]
http://mail.nessus.org/mailman/listinfo/nessus