SCCM 2012 Query report for specific software installed.

Question

_{Thursday, January 16, 2014 4:52 PM}

I have Reporting point installed and it seems to be working as I was able to run OS reports.

Here's what I would like to do.

1. I need a query/report to show us all the machines that do not have Microsoft Forefront Endpoint Protection installed.

2. I also need a query/report showing what machines still have Sophos AV installed.

Any help is greatly appreciated it.

Thanks,

Voev

All replies (4)

_{Tuesday, January 28, 2014 2:37 PM ✅Answered | 1 vote}

I was not able to use the Reporting to get computers without FEP installed. So I did a workaround.

Create Device Collection for computers with FEP installed

1. Device Collections => Create Device Collection =>name it "Computers with FEP installed=> Query Rule Properties => Edit Query Statement => Criteria tab => Add the following statements

Criterion Type: Simple value

Where: Installed Software - ARPDisplay Name

Operator: is equal to

Value: System Center 2012 Endpoint Protection          (as appeared in Add/remove program name)

Create Device Collection for computers without FEP installed

1. Device Collections => Create Device Collection => Name "Computers without FEP Installed" => Query Rule Properties => Add Rule => Include Collections => Tick "All Systems" => OK =>  then you need to add the Exclude by => Add Rule => Exclude Collections => Tick " Computers with FEP Installed => OK

So in my "All Systems" Collection has 1000 members

Computers with FEP Installed collection has 900 members
Computers without FEP Installed collection has 100 members

Add the with FEP installed & without FEP installed collections together is equal to 1000 members of the All Systems.

_{Thursday, January 16, 2014 7:04 PM}

I enabled the Asset Intelligence and installed the Asset Intelligence synchronization point then went to Monitoring => Reporting => Asset Intelligence => Software 02D - Computers with specific software installed. This answered my question#2.

How about I would like to do a query to show me all systems that do not have FEP installed?

Thanks,

Voev

_{Thursday, January 16, 2014 8:57 PM}

Create a query based on Installed Software looking for the exact name of FEP as it would show in the Resource Explorer on a machine that you have verified.

Use the query as an exclude rule and then include all of the other clients that you would like evaluated. The clients that end up in that collection did not have FEP detected.

select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_INSTALLED_SOFTWARE on SMS_G_System_INSTALLED_SOFTWARE.ResourceId = SMS_R_System.ResourceId where SMS_G_System_INSTALLED_SOFTWARE.ProductName = "Your AV Program"

_{Thursday, January 16, 2014 9:21 PM}

I know in Device Collections we can create a new collection and query with a specific software installed, and modify an exclusion rule. This will give us devices with FEP installed and no FEP installed. However I am trying to run it via Monitoring => Overview => Reporting =Reports

Thanks