Re: Windows Patch Auditing & "File and Print Sharing" disabled

[Kurt Buff <kurt.buff () gmail com>]

WSUS is a "pull" technology - it relies on the workstations contacting
it for updates, and calculates patches needed based on that
conversation. The difficulty with this is that you have to push
settings to each machine to 1) enable/activate Automatic Updates and
BITS,  and 2) point AU to the machine running WSUS.

That's very doable in a couple of different ways (logon script, if
users are admins, or GPO regardless), but it's extra steps, and
perhaps beyond the scope of pentesting.

Kurt

On Thu, Apr 30, 2009 at 16:19, Gorgon Beast <gorgonbeast () hotmail com> wrote:
> Does WSUS work without F&P?  I use it to install the patches and see who has which patches.  I used to use GFI, but 
> with File sharing turned on.
>
>
>
> ----------------------------------------
> > Date: Thu, 30 Apr 2009 12:01:01 -0400
> > From: DRUGOVM () nychhc org
> > To: pen-test () securityfocus com
> > Subject: Windows Patch Auditing & "File and Print Sharing" disabled
> >
> > Hello list,
> >
> > I need some advise
> >
> > I'm trying to scan a Windows Network where all end nodes except Domain Controller have "File & Print Sharing" 
> > disabled.
> >
> > What I'm trying to get a list of Microsoft Updates that are missing.
> >
> >
> > So far I tried Nessus & Foundstone and none of them are able to provide a report with missing patches.(I'm able to 
> > get a report from Domain Controller)
> >
> > Nessus support stated that "File & Print Sharing" is required for patch auditing
> >
> >
> > What is my other options?
> >
> > Thanks
> >
> >
> > -----------------------------------------
> > Visit www.nyc.gov/hhc
> >
> > CONFIDENTIALITY NOTICE: The information in this E-Mail may be
> > confidential and may be legally privileged. It is intended solely
> > for the addressee(s). If you are not the intended recipient, any
> > disclosure, copying, distribution or any action taken or omitted to
> > be taken in reliance on this e-mail, is prohibited and may be
> > unlawful. If you have received this E-Mail message in error, notify
> > the sender by reply E-Mail and delete the message.
> >
> > ------------------------------------------------------------------------
> > This list is sponsored by: InfoSec Institute
> >
> > Tired of using other people's tools? Why not learn how to write your own exploits?
> > InfoSec Institute's Advanced Ethical Hacking class teaches you how to write stack and heap buffer overflow exploits 
> > for Windows and Linux. Gain your Certified Expert Penetration Tester (CEPT) cert as well.
> >
> > http://www.infosecinstitute.com/courses/advanced_ethical_hacking_training.html
> > ------------------------------------------------------------------------
>
> _________________________________________________________________
> Rediscover Hotmail®: Get quick friend updates right in your inbox.
> http://windowslive.com/RediscoverHotmail?ocid=TXT_TAGLM_WL_HM_Rediscover_Updates2_042009
> ------------------------------------------------------------------------
> This list is sponsored by: InfoSec Institute
>
> Tired of using other people's tools? Why not learn how to write your own exploits?
> InfoSec Institute's Advanced Ethical Hacking class teaches you how to write stack and heap buffer overflow exploits 
> for Windows and Linux. Gain your Certified Expert Penetration Tester (CEPT) cert as well.
>
> http://www.infosecinstitute.com/courses/advanced_ethical_hacking_training.html
> ------------------------------------------------------------------------

------------------------------------------------------------------------
This list is sponsored by: InfoSec Institute

Tired of using other people's tools? Why not learn how to write your own exploits?
InfoSec Institute's Advanced Ethical Hacking class teaches you how to write stack and heap buffer overflow exploits for 
Windows and Linux. Gain your Certified Expert Penetration Tester (CEPT) cert as well.

http://www.infosecinstitute.com/courses/advanced_ethical_hacking_training.html
------------------------------------------------------------------------