We now have our agents deployed to our end points, it’s now time to see exactly what information we can pull from the end points.
Having briefly skimmed over some of the below in previous blogs, I’m going to include the below with a little more detail:
- Inventory client Agents – hardware/software inventory’s etc.
- Viewing Inventory – what kinds of data can we view?
- Creating Collections – to help us “narrow down” and refine what views we can see
- MIF and MOF files – Allows us to customise the data pulled from clients
- Predefined Collection – We can use it to produce reports/or patch/deploy to specific collections
- Direct Membership Collections – Easy/Basic Collection’s (i.e the built in ones) which are installed by default.
Let’s start by taking a look at the hardware inventory client (as shown in the previous blog).
More importantly, let’s look at the MIF tab. Here we can see we have NOIDMIF and IDMIF. Well what is a MIF file? – Quite simply it’s a text based file which helps “extend” the amount of data collected.
NOIDMIF – this type is used to amend to existing records (adding additional information). If we take a look at a NOMIF file we can see it’s fairly easy to understand what is being collected/pulled. Because it is an EXISTING class there is already an ID, hence NO ID MIF (ID is not required).
Example of a NOIDMIF file
IDMIF – If there is no existing class, we can create one from scratch, which means we CREATE an ID.
Example of an IDMIF file
Once you have created your NOIDMIF or IDMIF you need to deploy this text file to each computer you wish to pull the information from. (We will cover deploying files in a later blog).
You would generally use MOF files (as they are a lot easier to read/understand) and MOST objects you will ever need to audit can be adjusted by a simple (true or false) against the text file.
The two MOF file’s can be found here:
If we take a look at a sample MOF file you can see quite easily what is currently being collected and what values are not. (BuildNumber is currently being collected, but those other values are not).
If we look at another example of a MOF file (you can see in this example) it’s a lot more complex in that you are now choosing specific registry values. Which quite obviously shows you just how precise and exactly how far you can inventory client machines.
Unlike MIF files, once the MOF files are updated, they automatically let the client know there is a newer version available and will distribute the updated file.
Let’s take a brief look at the resource explorer, select any of the machines you have installed an agent on and right click > start > resource explorer
From here we can see various information about both the hardware and software of the computer
As mentioned above there are a number of basic collections which come with SCCM (these are pre-defined). We can see the all systems collection simply shows us every computer which has been discovered.
Whereas the XP collection (does as it suggests) and shows us those computers with XP installed
How do these collections work? Well they run off queries…
If you expand the queries group you will see each query matches to a collection. Pretty self-explanatory really.
Let’s flick back to the all systems and take a look at the query which is being run.
Right click on All Systems Collection, and select the Membership Rules tab. Here we can see it’s using the All systems query.
click the button next to the red X to open the query
click on edit query statement and if we view the criteria tab, there is no criteria as it’s simply showing all resources.
General shows us those attributes it is searching for
and if we view the criteria tab, there is no criteria as it’s simply showing all resources.
If we move to the XP collection and check out the criteria we can see it’s specifying only those machines with workstation 5.1 installed.
Of course you can change this to 6, or 6.5 for later versions. But rather than play about with the default options it would be better to create your own