Forefront Security for Exchange 2007
Author | David Gilmore |
---|---|
Compatibility | Xymon 4.2 |
Requirements | Windows Server 2003 x64/Exchange 2007/Forefront Security Server for Exchange 2007/BBWin |
Download | None |
Last Update | 2007-07-12 |
Description
VBS Script that checks the status of multiple AV engines used by Microsoft’s Forefront Security Server for Exchange and reports status under the FSE column.
Installation
Client side
- Add to BBWin.cfg in externals
<load value="cscript 'C:\Program Files\BBWin\ext\forefront.vbs'" />
This may work as well
<load value="cscript ..\ext\forefront.vbs />
Server side
- None
Source
forefront.vbs
Show Code ⇲
Hide Code ⇱
'========================================================================================================== ' ' VBScript Source File ' ' NAME: MSForefront.vbs (formerly BBantigen-V8.vbs) ' Script to be used with BBWin to check ForeFront Server for Exchange 2007 virus definition version ' ' Version: 1.5 ' ' AUTHOR: David Gilmore; david@stenhouseconsulting.com ' DATE : 07/11/2007 ' ' COMMENT: This script will check a range of engines which are used in ForeFront Server for Exchange 2007 ' It will Warn or Alarm as configured and report the information back to the ' configured Xymon Server. It requires the BBWin client installed. ' You can put the script in the Externals Scripts or you can schedule it as a scheduled task. ' Since it is recommended to use no more than five engines you will need to modify script for engines ' in use. ' ' ' LICENSE: ' Copyright (c) 2005, Roos-IT ' All rights reserved. ' ' Redistribution and use in source and binary forms, with or without ' modification, are permitted provided that the following conditions are met: ' ' - Redistributions of source code must retain the above copyright notice, ' this list of conditions and the following disclaimer. ' - Redistributions in binary form must reproduce the above copyright notice, ' this list of conditions and the following disclaimer in the documentation ' and/or other materials provided with the distribution. ' - Neither the name of Roos-IT nor the names of its contributors ' may be used to endorse or promote products derived from this software without ' specific prior written permission. ' ' THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY ' EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES ' OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT ' SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, ' SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT ' OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) ' HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR ' TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, ' EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ' ' VERSION HISTORY: ' 0.1 - Initial Release ' 0.2 - fixe one engine with all status report ' 0.3 - fixe more engines with all status report ' 0.4 - fixe one engine with own status report ' 0.5 - fixe more engines with own status report ' 0.6 - counters for Admins ' 0.7 - page status warning by engines ' 0.8 - HTML layout dressing ' 0.9 - now change the page name in bb ' 1.0 - changed external path, read from registry ' ' 1.5 - script modified and updated for use with MS ' Forefront Server for Exchange 2007 and new ' engines. ' '========================================================================================================== '---Dimensionering. Dim zPageName,zRevChk,zPageStatus,zDateDiff,zOutFile,zRedChk,zYellowChk,zRedChk1,zYellowChk1,zShell,zExtPath,zFSO Dim aShell,aDef,aDate,aVer,aRev,aNDate,aToday,aTime,aEng,aRevDef Dim bShell,bDef,bDate,bVer,bRev,bNDate,bToday,bTime,bEng,bRevDef Dim cShell,cDef,cDate,cVer,cRev,cNDate,cToday,cTime,cEng,cRevDef Dim dShell,dDef,dDate,dVer,dRev,dNDate,dToday,dTime,dEng,dRevDef Dim eShell,eDef,eDate,eVer,eRev,eNDate,eToday,eTime,eEng,eRevDef Dim fShell,fDef,fDate,fVer,fRev,fNDate,fToday,fTime,fEng,fRevDef Dim gShell,gDef,gDate,gVer,gRev,gNDate,gToday,gTime,gEng,gRevDef Dim hShell,hDef,hDate,hVer,hRev,hNDate,hToday,hTime,hEng,hRevDef Dim iShell,iDef,iDate,iVer,iRev,iNDate,iToday,iTime,iEng,iRevDef Dim jShell,jDef,jDate,jVer,jRev,jNDate,jToday,jTime,jEng,jRevDef Dim oShell,oDef,oDate,oVer,oRev,oNDate,oToday,oTime,oEng,oRevDef '***********************************Begin configurable counters for Admins*********************************** ' ---How many days before the engine defintion files expire and the warning status will change. zRevChk = 7 '---Warning levels for expired definition files. ' * how many engines are out of date to change the page status to yellow zYellowChk = 2 ' * how many engines are out of date to change the page status to red zRedChk = 4 '---Change the following path to point to your BBWin EXTERNALPATH location if the registry read does not work. '---There is a "'" in front of the line you don't want tot use. Set zShell = WScript.CreateObject("Wscript.Shell") zExtPath = zShell.RegRead("HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\BBWin\tmppath") ' Const zExtPath = "D:\Program Files (x86)\BBWin\tmp" '---Name of the header on page zPageName = "fse" '***********************************End configurable counters for Admins*********************************** '---Create BB object. Set zFSO= CreateObject("Scripting.FileSystemObject") '---Create Output file. Set zOutFile = zFSO.CreateTextFile (zExtPath &"\"& zPageName) '---resetting counters zPageStatus = 0 '---Check Virus Def Date by reading value from registry for AhnLab V3 Engine Set oShell = WScript.CreateObject("Wscript.Shell") oRev = oShell.RegRead ("HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Forefront Server Security\Exchange Server\Scan Engines\AhnLab\Signature Version") oEng = oShell.RegRead ("HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Forefront Server Security\Exchange Server\Scan Engines\AhnLab\Engine Version") oDef = oShell.RegRead ("HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Forefront Server Security\Exchange Server\Scan Engines\AhnLab\Last Updated") oVer = Right(oDef,19) oTime = Right(oVer,8) oDate = Left(oVer,8) oYear = Mid(oDate,6,2) oMonth = Left(oDate,2) oDay = Mid(oDate,3,2) oNDate = oVer oToday = FormatDateTime(Now, vbShortDate) '---Determine age of virus definitions, if more thn 7 days old display yellow on BB oDateDiff = DateDiff("d", oNDate, oToday) If (oDateDiff > zRevChk) then oRevDef = "<IMG SRC=/hobbit/gifs/yellow.gif ALT=yellow HEIGHT=16 WIDTH=16 BORDER=0>" Else oRevDef = "<IMG SRC=/hobbit/gifs/green.gif ALT=green HEIGHT=16 WIDTH=16 BORDER=0>" End If '---Check Virus Def Date by reading value from registry for CA Vet Set bShell = WScript.CreateObject("Wscript.Shell") bRev = bShell.RegRead ("HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Forefront Server Security\Exchange Server\Scan Engines\CAVet\Signature Version") bEng = bShell.RegRead ("HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Forefront Server Security\Exchange Server\Scan Engines\CAVet\Engine Version") bDef = bShell.RegRead ("HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Forefront Server Security\Exchange Server\Scan Engines\CAVet\Last Updated") bVer = Right(bDef,19) bTime = Right(bVer,8) bDate = Left(bVer,8) bYear = Mid(bDate,6,2) bMonth = Left(bDate,2) bDay = Mid(bDate,3,2) bNDate = bVer bToday = FormatDateTime(Now, vbShortDate) '---Determine age of virus definitions, if more thn 7 days old display yellow on BB bDateDiff = DateDiff("d", bNDate, bToday) If (bDateDiff > zRevChk) then bRevDef = "<IMG SRC=/hobbit/gifs/yellow.gif ALT=yellow HEIGHT=16 WIDTH=16 BORDER=0>" Else bRevDef = "<IMG SRC=/hobbit/gifs/green.gif ALT=green HEIGHT=16 WIDTH=16 BORDER=0>" End If '---Check Virus Def Date by reading value from registry for Command Set cShell = WScript.CreateObject("Wscript.Shell") cRev = cShell.RegRead ("HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Forefront Server Security\Exchange Server\Scan Engines\Command\Signature Version") cEng = cShell.RegRead ("HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Forefront Server Security\Exchange Server\Scan Engines\Command\Engine Version") cDef = cShell.RegRead ("HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Forefront Server Security\Exchange Server\Scan Engines\Command\Last Updated") cVer = Right(cDef,19) cTime = Right(cVer,8) cDate = Left(cVer,8) cYear = Mid(cDate,6,2) cMonth = Left(cDate,2) cDay = Mid(cDate,3,2) cNDate = cVer cToday = FormatDateTime(Now, vbShortDate) '---Determine age of virus definitions, if more thn 7 days old display yellow on BB cDateDiff = DateDiff("d", cNDate, cToday) If (cDateDiff > zRevChk) then cRevDef = "<IMG SRC=/hobbit/gifs/yellow.gif ALT=yellow HEIGHT=16 WIDTH=16 BORDER=0>" Else cRevDef = "<IMG SRC=/hobbit/gifs/green.gif ALT=green HEIGHT=16 WIDTH=16 BORDER=0>" End If '---Check Virus Def Date by reading value from registry for Kaspersky Set dShell = WScript.CreateObject("Wscript.Shell") dRev = dShell.RegRead ("HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Forefront Server Security\Exchange Server\Scan Engines\Kaspersky5\Signature Version") dEng = dShell.RegRead ("HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Forefront Server Security\Exchange Server\Scan Engines\Kaspersky5\Engine Version") dDef = dShell.RegRead ("HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Forefront Server Security\Exchange Server\Scan Engines\Kaspersky5\Last Updated") dVer = Right(dDef,19) dTime = Right(dVer,8) dDate = Left(dVer,8) dYear = Mid(dDate,6,2) dMonth = Left(dDate,2) dDay = Mid(dDate,3,2) dNDate = dVer dToday = FormatDateTime(Now, vbShortDate) '---Determine age of virus definitions, if more thn 7 days old display yellow on BB dDateDiff = DateDiff("d", dNDate, dToday) If (dDateDiff > zRevChk) then dRevDef = "<IMG SRC=/hobbit/gifs/yellow.gif ALT=yellow HEIGHT=16 WIDTH=16 BORDER=0>" Else dRevDef = "<IMG SRC=/hobbit/gifs/green.gif ALT=green HEIGHT=16 WIDTH=16 BORDER=0>" End If '---Check Virus Def Date by reading value from registry for Norman Data Defense Set fShell = WScript.CreateObject("Wscript.Shell") fRev = fShell.RegRead ("HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Forefront Server Security\Exchange Server\Scan Engines\Norman\Signature Version") fEng = fShell.RegRead ("HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Forefront Server Security\Exchange Server\Scan Engines\Norman\Engine Version") fDef = fShell.RegRead ("HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Forefront Server Security\Exchange Server\Scan Engines\Norman\Last Updated") fVer = Right(fDef,19) fTime = Right(fVer,8) fDate = Left(fVer,8) fYear = Mid(fDate,6,2) fMonth = Left(fDate,2) fDay = Mid(fDate,3,2) fNDate = fVer fToday = FormatDateTime(Now, vbShortDate) '---Determine age of virus definitions, if more thn 7 days old display yellow on BB fDateDiff = DateDiff("d", fNDate, fToday) If (fDateDiff > zRevChk) then fRevDef = "<IMG SRC=/hobbit/gifs/yellow.gif ALT=yellow HEIGHT=16 WIDTH=16 BORDER=0>" Else fRevDef = "<IMG SRC=/hobbit/gifs/green.gif ALT=green HEIGHT=16 WIDTH=16 BORDER=0>" End If '---Check Virus Def Date by reading value from registry for Sophos Anti-Virus Set gShell = WScript.CreateObject("Wscript.Shell") gRev = gShell.RegRead ("HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Forefront Server Security\Exchange Server\Scan Engines\Sophos\Signature Version") gEng = gShell.RegRead ("HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Forefront Server Security\Exchange Server\Scan Engines\Sophos\Engine Version") gDef = gShell.RegRead ("HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Forefront Server Security\Exchange Server\Scan Engines\Sophos\Last Updated") gVer = Right(gDef,19) gTime = Right(gVer,8) gDate = Left(gVer,8) gYear = Mid(gDate,6,2) gMonth = Left(gDate,2) gDay = Mid(gDate,3,2) gNDate = gVer gToday = FormatDateTime(Now, vbShortDate) '---Determine age of virus definitions, if more thn 7 days old display yellow on BB gDateDiff = DateDiff("d", gNDate, gToday) If (gDateDiff > zRevChk) then gRevDef = "<IMG SRC=/hobbit/gifs/yellow.gif ALT=yellow HEIGHT=16 WIDTH=16 BORDER=0>" Else gRevDef = "<IMG SRC=/hobbit/gifs/green.gif ALT=green HEIGHT=16 WIDTH=16 BORDER=0>" End If '---Check Virus Def Date by reading value from registry for Sybari Worm List Set iShell = WScript.CreateObject("Wscript.Shell") iRev = iShell.RegRead ("HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Forefront Server Security\Exchange Server\Scan Engines\WormList\Signature Version") iEng = iShell.RegRead ("HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Forefront Server Security\Exchange Server\Scan Engines\WormList\Engine Version") iDef = iShell.RegRead ("HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Forefront Server Security\Exchange Server\Scan Engines\WormList\Last Updated") iVer = Right(iDef,19) iTime = Right(iVer,8) iDate = Left(iVer,8) iYear = Mid(iDate,6,2) iMonth = Left(iDate,2) iDay = Mid(iDate,3,2) iNDate = iVer iToday = FormatDateTime(Now, vbShortDate) '---Determine age of virus definitions, if more thn 7 days old display yellow on BB iDateDiff = DateDiff("d", iNDate, iToday) If (iDateDiff > zRevChk) then iRevDef = "<IMG SRC=/hobbit/gifs/yellow.gif ALT=yellow HEIGHT=16 WIDTH=16 BORDER=0>" Else iRevDef = "<IMG SRC=/hobbit/gifs/green.gif ALT=green HEIGHT=16 WIDTH=16 BORDER=0>" End If '---Check Virus Def Date by reading value from registry for Virus Buster Set jShell = WScript.CreateObject("Wscript.Shell") jRev = jShell.RegRead ("HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Forefront Server Security\Exchange Server\Scan Engines\VBuster\Signature Version") jEng = jShell.RegRead ("HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Forefront Server Security\Exchange Server\Scan Engines\VBuster\Engine Version") jDef = jShell.RegRead ("HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Forefront Server Security\Exchange Server\Scan Engines\VBuster\Last Updated") jVer = Right(jDef,19) jTime = Right(jVer,8) jDate = Left(jVer,8) jYear = Mid(jDate,6,2) jMonth = Left(jDate,2) jDay = Mid(jDate,3,2) jNDate = jVer jToday = FormatDateTime(Now, vbShortDate) '---Determine age of virus definitions, if more thn 7 days old display yellow on BB jDateDiff = DateDiff("d", jNDate, jToday) If (jDateDiff > zRevChk) then jRevDef = "<IMG SRC=/hobbit/gifs/yellow.gif ALT=yellow HEIGHT=16 WIDTH=16 BORDER=0>" Else jRevDef = "<IMG SRC=/hobbit/gifs/green.gif ALT=green HEIGHT=16 WIDTH=16 BORDER=0>" End If '---determine page error status If (oDateDiff > zRevChk) then zPageStatus = zPageStatus + 1 Else zPageStatus = zPageStatus End If If (aDateDiff > zRevChk) then zPageStatus = zPageStatus + 1 Else zPageStatus = zPageStatus End If If (bDateDiff > zRevChk) then zPageStatus = zPageStatus + 1 Else zPageStatus = zPageStatus End If If (cDateDiff > zRevChk) then zPageStatus = zPageStatus + 1 Else zPageStatus = zPageStatus End If If (dDateDiff > zRevChk) then zPageStatus = zPageStatus + 1 Else zPageStatus = zPageStatus End If If (eDateDiff > zRevChk) then zPageStatus = zPageStatus + 1 Else zPageStatus = zPageStatus End If If (fDateDiff > zRevChk) then zPageStatus = zPageStatus + 1 Else zPageStatus = zPageStatus End If If (gDateDiff > zRevChk) then zPageStatus = zPageStatus + 1 Else zPageStatus = zPageStatus End If If (hDateDiff > zRevChk) then zPageStatus = zPageStatus + 1 Else zPageStatus = zPageStatus End If If (iDateDiff > zRevChk) then zPageStatus = zPageStatus + 1 Else zPageStatus = zPageStatus End If If (jDateDiff > zRevChk) then zPageStatus = zPageStatus + 1 Else zPageStatus = zPageStatus End If '---Page status to green, yellow or red If (zPageStatus > zYellowChk) then zDateDiff = "yellow+25h" If (zPageStatus > zRedChk) then zDateDiff = "red+25h" End If Else zDateDiff = "green+25h" End If '---write results to file zOutFile.WriteLine zDateDiff & vbCrLf zOutFile.WriteLine vbCrLf &"<b><font size=3>Found Forefront Security v1 for Exchange 2007</font></b>" & vbCrLf zOutFile.WriteLine zPageStatus & " Virus Scanner definition file(s) is/are out of date" & vbCrLf & vbCrLf zOutFile.WriteLine "<b><font size=3 color=#008CEA>AhnLab V3 Engine</font></b>" zOutFile.WriteLine oRevDef & " Engine version: " & vbTab & oEng zOutFile.WriteLine oRevDef & " Definition version: " & vbTab & oRev & vbTab &" date: "& oNDate zOutFile.WriteLine " Virus definitions are "& oDateDiff &" day(s) old" & vbCrLf zOutFile.WriteLine "<b><font size=3 color=#008CEA>CA Vet</font></b>" zOutFile.WriteLine bRevDef & " Engine version: " & vbTab & bEng zOutFile.WriteLine bRevDef & " Definition version: " & vbTab & bRev & vbTab &" date: "& bNDate zOutFile.WriteLine " Virus definitions are "& bDateDiff &" day(s) old" & vbCrLf zOutFile.WriteLine "<b><font size=3 color=#008CEA>Command</font></b>" zOutFile.WriteLine cRevDef & " Engine version: " & vbTab & cEng zOutFile.WriteLine cRevDef & " Definition version: " & vbTab & cRev & vbTab &" date: "& cNDate zOutFile.WriteLine " Virus definitions are "& cDateDiff &" day(s) old" & vbCrLf zOutFile.WriteLine "<b><font size=3 color=#008CEA>Kaspersky</font></b>" zOutFile.WriteLine dRevDef & " Engine version: " & vbTab & dEng zOutFile.WriteLine dRevDef & " Definition version: " & vbTab & dRev & vbTab &" date: "& dNDate zOutFile.WriteLine " Virus definitions are "& dDateDiff &" day(s) old" & vbCrLf zOutFile.WriteLine "<b><font size=3 color=#008CEA>Norman Data Defense</font></b>" zOutFile.WriteLine fRevDef & " Engine version: " & vbTab & fEng zOutFile.WriteLine fRevDef & " Definition version: " & vbTab & fRev & vbTab & vbTab &" date: "& fNDate zOutFile.WriteLine " Virus definitions are "& fDateDiff &" day(s) old" & vbCrLf zOutFile.WriteLine "<b><font size=3 color=#008CEA>Sophos Anti-Virus</font></b>" zOutFile.WriteLine gRevDef & " Engine version: " & vbTab & gEng zOutFile.WriteLine gRevDef & " Definition version: " & vbTab & gRev & vbTab & vbTab &" date: "& gNDate zOutFile.WriteLine " Virus definitions are "& gDateDiff &" day(s) old" & vbCrLf zOutFile.WriteLine "<b><font size=3 color=#008CEA>Sybari Worm List</font></b>" zOutFile.WriteLine iRevDef & " Engine version: " & vbTab & iEng zOutFile.WriteLine iRevDef & " Definition version: " & vbTab & iRev & vbTab &" date: "& iNDate zOutFile.WriteLine " Virus definitions are "& iDateDiff &" day(s) old" & vbCrLf zOutFile.WriteLine "<b><font size=3 color=#008CEA>Virus Buster</font></b>" zOutFile.WriteLine jRevDef & " Engine version: " & vbTab & jEng zOutFile.WriteLine jRevDef & " Definition version: " & vbTab & jRev & vbTab & vbTab &" date: "& jNDate zOutFile.WriteLine " Virus definitions are "& jDateDiff &" day(s) old" & vbCrLf & vbCrLf & vbCrLf zOutFile.WriteLine "<font size=1 color=#33CCCC><p align=right>" & ZpageName & " script updated by stenhouseconsulting.com</p></font>" '---Close log file zOutFile.Close
Known Bugs and Issues
To Do
Credits
Changelog
- 2007-07-12
- Initial release