Skip to content

Instantly share code, notes, and snippets.

@curi0usJack

curi0usJack/CmdlineProcessArgCheck.vbs

Created June 1, 2018 15:14
Show Gist options
  • Star 3 You must be signed in to star a gist
  • Fork 2 You must be signed in to fork a gist
  • Save curi0usJack/919d3aa512f2ca8832e7b51fe561097e to your computer and use it in GitHub Desktop.
Save curi0usJack/919d3aa512f2ca8832e7b51fe561097e to your computer and use it in GitHub Desktop.
Download ZIP
Raw
CmdlineProcessArgCheck.vbs
Const HKLM = &H80000002 'HKEY_LOCAL_MACHINE
strComputer = "."
strKey = "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit"
Set objLocator = CreateObject("WbemScripting.SWbemLocator")
Set objReg = objLocator.ConnectServer(strComputer, "root\cimv2").Get("StdRegProv")
objReg.EnumKey HKLM, strKey, arrSubKeys
objReg.GetDWORDValue HKLM, strkey, "ProcessCreationIncludeCmdLine_Enabled", isenabled
If IsNull(isenabled) Then
retval = "Not Enabled"
Else
If isenabled > 0 Then
retval = "Enabled!"
Else
retval = "Not Enabled"
End If
End If
wscript.echo retval
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment