Hi Jim, I agree that getting the job done is the right thing to do. But, as you can see like me, that no two programmers are consistent with their declarations and when lots of folks submitting various scripts For us to use, it might be a good idea to make some attempt at ISA scripting standards to make it a tad easier to share our scripts With each other. For example: This script is simple and follows some naming standards. If you pass into this script a list of domain computers you will get a nice listing of all The run type keys for each machine on your domain. Is good for checking on Hidden Trojans. I owned this to Amy B any way so It was a good time to Post it. Joseph '****************************************************************" ' Module/Class: getRunKeys.vbs ' ' Version: 1.00.0000" ' Description: Admin tools for automating updating MTU info ' ' ' Last update: 12/18/2002 Joseph Kravis(josephk@xxxxxxxxx)" ' Last Time : ' ' Notes: from the command line run as: cscript.exe getRunKeys.vbs ' ' ** REVISIONS**" ' ' Date By Description" ' -------- ---------- ------------------------------------------" ' See individual subs for revision information" '****************************************************************" '*** ' Initialize Error Trapping '*** 'Option Explicit '*** ' Create Constants '*** const HKEY_LOCAL_MACHINE = &H80000002 const REG_SZ = 1 const REG_EXPAND_SZ = 2 const REG_BINARY = 3 const REG_DWORD = 4 const REG_MULTI_SZ = 7 '*** ' Create variables '*** Dim strServerName(1000), strErrMsg, strServer, Result, strInputFile, strLogFile, WshShell, WshNetwork Dim strComputer, objFS, Computers, i, objGroup, strMyDocuments, strFTPUpLoad, strUploadCMD,strFTPSITE, strDate Dim strFTPWindowTitle, strFolderToCheck, objSoftware Dim strNameSpace, strClass '*** 'Create Objects '*** set WshShell = WScript.CreateObject("WScript.Shell") Set WshNetwork = WScript.CreateObject("WScript.Network") Set objFS = CreateObject("Scripting.FileSystemObject") CONST SERVERNAMES = "DomainUsers.txt" strInputFile = "c:\InputData\domaincomputers.txt" Set objFSO = CreateObject("Scripting.FileSystemObject") Set objTextFile = objFSO.CreateTextFile("d:\_projects\ejm development\RegKeys.txt", True) Const ForReading = 1, ForWriting = 2, ForAppending = 8 '*** ' Get Name of Input File and Check to see if its valid '*** Set Computers = objFS.OpenTextFile(strInputFile) '*** ' Get Name of Log File and Check to see if its valid and Writable '*** '*** ' Parse Input File ' This loop processes the incoming server list that could be different for ' each site processed. '*** do while Computers.AtEndOfStream <> True strServerName(i) = Computers.ReadLine If not Isblank(strServerName(i)) then 'Get only once. StrServer = StrServerName(i) 'doCheck(strServer) readReg(strServer) i = i + 1 'Increment Counter End if loop Set objFS = Nothing Set objGroup = Nothing ' *********************** ' Functions and Subs here ' *********************** ' Trims leading and trailing spaces Function IsBlank(strInput) IsBlank = not CBool(Len(trim(strInput))) End Function SUB readReg(strComputer) On Error Resume Next Set StdOut = WScript.StdOut Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\default:StdRegProv") If (Err.Number <> 0) Then objTextFile.WriteLine "Machine not found: " & strComputer objTextFile.WriteLine " " objTextFile.WriteLine "*********************************************************************** ********************************************" objTextFile.WriteLine strComputer objTextFile.WriteLine "*********************************************************************** ********************************************" objTextFile.WriteLine " " objTextFile.WriteLine Err.Number & " " & Err.Description objTextFile.WriteLine " " objTextFile.WriteLine "*********************************************************************** ********************************************" objTextFile.WriteLine " " 'set oReg = nothing exit sub END IF strKeyPath = "SOFTWARE\Microsoft\Windows\CurrentVersion" oReg.EnumKey HKEY_LOCAL_MACHINE, strKeyPath, arrSubKeys '*** 'Retreive the sub keys for RUN, etc '*** StdOut.WriteLine " " StdOut.WriteLine "*********************************************************************** ********************************************" StdOut.WriteLine strComputer StdOut.WriteLine "*********************************************************************** ********************************************" For Each subkey In arrSubKeys IF subkey = "Run" or subkey = "Run-Disabled" or subkey = "RunOnce" or subkey = "RunEx" or subkey = "RunServices" or subkey = "Run-" or subkey = "RunServicesOnce" THEN StdOut.WriteLine " " StdOut.WriteLine "New Key " & subkey '*** 'Retreive the sub keys for passed in subkey data '*** strKeyPathB = "SOFTWARE\Microsoft\Windows\CurrentVersion" & "\" & subKey oReg.EnumValues HKEY_LOCAL_MACHINE, strKeyPathB, arrValueNames, arrValueTypes StdOut.WriteLine strKeyPathB For i=0 To UBound(arrValueNames) oReg.GetExpandedStringValue HKEY_LOCAL_MACHINE, strKeyPathB, arrValueNames(i) , strValue StdOut.WriteLine "Value Name: " & arrValueNames(i) & " = " & strValue NEXT END IF Next StdOut.WriteLine " " StdOut.WriteLine "*********************************************************************** ********************************************" StdOut.WriteLine " " END SUB