-----Original Message-----
From: Robert Myers [mailto:ccrider@whiterose.net]
Sent: Wednesday, May 25, 2005 9:39 AM
To: nessus@list.nessus.org
Subject: Windows Service Pack scanning
I am receiving the following error while trying to scan a windows XP machine
for it's service pack revision:
user root : Not launching smb_reg_service_pack _XP.nasl against
192.168.1.102 because the key SMB/WindowsVersion is missing (th is is not an
error)
I've checked the remote registry service, and triple checked the logon
information in the scan, auto dependencies checking is enabled, what am I
missing?
-Bob Myers
After extensive testing, I've managed to get a consistent success at reading windows workstation
machines by doing the following things.
1. Creating a local group nessus_group
2. Creating a local user nessus_user
3. Adding nessus_user to nessus_group, and removing it from Users group
4. Ensuring that the Remote Registry service was running, and set to
automatically start at boot
5. Adding read permissions for nessus_group to the following registry key
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg
6. Open gpedit.msc and goto the following:
Windows Settings -> Security Settings -> Local policies -> Security Options
Change value of "Network access: Sharing and security model for local accounts" to "Classic - local
users authenticate as themselves"
And finally, on a Windows XP box with a firewall, you need to open port 445 to the machine that your
scanning from. This can be done by going to Control Panel -> Windows Firewall -> Exceptions. From
there, edit the File and Printer Sharing, and open port 445. You can change the scope on that port
to include just your nessus scanner, the entire subnet, or totally open, whichever you prefer.
All of this can be set up in a simple .cmd script. These are the tools I use
net localgroup <- Adds local group
net user <- Adds local user
sc <- Allows you to change settings on windows services
regperm.exe <- Third Party Registry Permission tool
(http://homepages.cae.wisc.edu/~micro/regperm/)
netsh firewall <- Allows you to change firewall settings
secedit <- Adds a security template, which is the same as gpedit.msc
from the command line
See if that fixes your problem.
-Branden McKagen
_______________________________________________
Nessus mailing list
Nessus@list.nessus.org
http://mail.nessus.org/mailman/listinfo/nessus
