How close we can get to add remove programs monitoring via collection?

Question

question

KinowskiDamian-7394 asked Nov 25, '20 GarthJones-MVP commented Nov 26, '20

How close we can get to add remove programs monitoring via collection?

Hi,

I got a question that I was struggling to answer myself, if I want to monitor an application, let's say it's some Adobe, and make a collection that seeks the app name in add remove programs, how close to real time monitoring am I with this task and how can I improve it?

If I understand correctly - HW Inventory which is set to 7 Hours will gather the data for me once per 7h, so is it enough for this task to lets say, assure that I am getting the data whether Adobe is missing on any device that talks back in mentioned 7h ? Or am I missing anything here? I just get different numbers from SCCM and Nexthink

One thing I found out would be good to set, if I'm correct here is: Set the collection to incremental updates once per hour, so when HW Inventory hits in, it will have collection incrementally adds/removes members

mem-cm-general

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 1 · 2020-11-26T09:27:29.927Z

SunnyNiu-MSFT answered Nov 26, '20 GarthJones-MVP commented Nov 26, '20

@KinowskiDamian-7394
As Garth Jones mentioned that Every 7 hours for inventory is unreasonable. And as above mentioned, if you want to get real-time results when there is an APP (such as Adobe) installed or removed in any device, we can query the results through CMPivot.
1)In the Configuration Manager console, go to Assets and Compliance>Overview>Device Collections.
2)Select the All Systems collection.
3)In the ribbon, click Start CMPivot>Query, Enter the query: InstalledSoftware | where ProductName like '%Adobe%', You can get results similar to the following. If need, you can export the results.

If the response is helpful, please click "Accept Answer"and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

5.png (66.8 KiB)

· 2

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

KinowskiDamian-7394 · Nov 26, 2020 at 09:38 AM

That should be it, I didn't know about this function, yet I never had need of it, thank you

0 ·

GarthJones-MVP KinowskiDamian-7394 · Nov 26, 2020 at 01:34 PM

I love CMpivot BUT keep in mind that this will increase your network traffic each time you use it. So exact what is your goal?

0 ·

Answer 2 · 2020-11-25T17:05:34.227Z

RahulJindal-2267 answered Nov 25, '20

Collection membership is inventory based so it will never be real time. It all depends on what is your end goal here. If you are looking to check on compliance then you can deploy a compliance baseline and use that to create collections for administrative purposes. If you want real time data then you can leverage cmpivot to query against a collection.

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 3 · 2020-11-25T18:25:31.93Z

AravinthMathan-3183 answered Nov 25, '20

Nexthink as far as I know does a real time query, similar option in SCCM would be cmpivot as Rahul correctly pointed.

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 4 · 2020-11-25T20:30:39.867Z

GarthJones-MVP answered Nov 25, '20 GarthJones-MVP commented Nov 26, '20

Every 7 hours for inventory is a bit much, once a day is what is generally recommend. https://www.enhansoft.com/configuration-manager-inventory-cycle-recommendations.

What exactly is you end goal? Why real-time?

if this is for audit purposes what is wrong with using the built-in report and send them out once a day?

· 2

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

KinowskiDamian-7394 · Nov 26, 2020 at 01:51 PM

So, I'm in migration of old SCCM to new, when someone asks me - Ok, we did change antivirus in migration process, tell me how many machines and which machines have old AV and how many have new, people ask me for as precise data as I can give.

So the goal is to bring some list that contains assets having lets say - Mcafee, and a list of those that doesn't, so we can focus on why they do not have it, hence I had an idea in first place, with collection containing app in add remove programs, and collection based on that collection, that is the sum of devices that do not have it.

HW Takes place each 7 hours in my example. I want to have a quick list that I can send whenever asked on the status of those devices. If I will use report, it will base it on HW and you know, people want to have it as close to real time monitoring as SCCM can go , without killing the environment with constant scans of course. That Pivot seems nice idea if it queries the devices in real time

0 ·

GarthJones-MVP KinowskiDamian-7394 · Nov 26, 2020 at 03:02 PM

So what is wrong with looking at the deployment details for Mcafee? Status message are send every 15 minutes.
IMO have HW inv less than once a day is too much. and IMO 7 hours is not overly useful as it will inventory first thing in the morning and just before someone leaves for the day. So....

0 ·

question