Create Notification or Report to see any new software installed on my network
We have to give some privileged users admin rights to their machine and sometimes these get abused and we end up with software installed that shouldn't be. Is there away in the k1000 to create a notification or report that will tell me when a software has been installed?
0 Comments
[ + ] Show comments
Answers (1)
Answer Summary:
http://www.itninja.com/blog/view/how-to-get-an-alert-in-case-of-inventory-changes-on-the-kace-k1000
http://www.itninja.com/blog/view/how-to-get-an-alert-in-case-of-inventory-changes-on-the-kace-k1000
Please log in to answer
Posted by:
jaredv
12 years ago
You can create a scheduled report for software changes which are recorded in the 'Asset History'. It is not perfect, as it records many updates, as well as software that was installed via KACE itself, but if you can weed that stuff out, you will find what you need.
See this article:
http://www.itninja.com/blog/view/how-to-get-an-alert-in-case-of-inventory-changes-on-the-kace-k1000
Here is the SQL for the software changes report (You'd want to change the time interval to be however often you run the report, so if you run it once a day, I would suggest changing '60 DAY' to '24 HOUR'):
select ASSET_HISTORY.TIME, ASSET.NAME, ASSET_HISTORY.DESCRIPTION
from ASSET
left join ASSET_TYPE on ASSET.ASSET_TYPE_ID = ASSET_TYPE.ID
left join ASSET_HISTORY on ASSET.ID = ASSET_HISTORY.ASSET_ID
where (ASSET_TYPE.ID = 5
and NOW() < DATE_ADD(ASSET_HISTORY.TIME, INTERVAL 60 DAY)
and ASSET_HISTORY.DESCRIPTION not like '%KB%'
and ASSET_HISTORY.DESCRIPTION not like '%reboot%'
and ASSET_HISTORY.DESCRIPTION not like '%mac%'
and ASSET_HISTORY.DESCRIPTION not like '%user%'
and ASSET_HISTORY.DESCRIPTION not like '%ip changed%'
and ASSET_HISTORY.DESCRIPTION not like '%video controller%'
and ASSET_HISTORY.DESCRIPTION not like '%domain changed%'
and ASSET_HISTORY.DESCRIPTION not like '%ram total changed%'
and ASSET_HISTORY.DESCRIPTION not like '%registry max size%'
and ASSET_HISTORY.DESCRIPTION not like '%name%')
and (ASSET_HISTORY.DESCRIPTION like 'Found%'
or ASSET_HISTORY.DESCRIPTION like '%remove%'
or ASSET_HISTORY.DESCRIPTION like '%change%')
order by TIME DESC
See this article:
http://www.itninja.com/blog/view/how-to-get-an-alert-in-case-of-inventory-changes-on-the-kace-k1000
Here is the SQL for the software changes report (You'd want to change the time interval to be however often you run the report, so if you run it once a day, I would suggest changing '60 DAY' to '24 HOUR'):
select ASSET_HISTORY.TIME, ASSET.NAME, ASSET_HISTORY.DESCRIPTION
from ASSET
left join ASSET_TYPE on ASSET.ASSET_TYPE_ID = ASSET_TYPE.ID
left join ASSET_HISTORY on ASSET.ID = ASSET_HISTORY.ASSET_ID
where (ASSET_TYPE.ID = 5
and NOW() < DATE_ADD(ASSET_HISTORY.TIME, INTERVAL 60 DAY)
and ASSET_HISTORY.DESCRIPTION not like '%KB%'
and ASSET_HISTORY.DESCRIPTION not like '%reboot%'
and ASSET_HISTORY.DESCRIPTION not like '%mac%'
and ASSET_HISTORY.DESCRIPTION not like '%user%'
and ASSET_HISTORY.DESCRIPTION not like '%ip changed%'
and ASSET_HISTORY.DESCRIPTION not like '%video controller%'
and ASSET_HISTORY.DESCRIPTION not like '%domain changed%'
and ASSET_HISTORY.DESCRIPTION not like '%ram total changed%'
and ASSET_HISTORY.DESCRIPTION not like '%registry max size%'
and ASSET_HISTORY.DESCRIPTION not like '%name%')
and (ASSET_HISTORY.DESCRIPTION like 'Found%'
or ASSET_HISTORY.DESCRIPTION like '%remove%'
or ASSET_HISTORY.DESCRIPTION like '%change%')
order by TIME DESC
Comments:
-
Perfect just what I was after works great.
Cheers - The Pope 12 years ago -
Is there an updated version for this? I tried copy pasting in SQL but got a bunch of errors. - sam240 7 years ago
-
Something like this might be useful:
SELECT ID, CREATED, DISPLAY_NAME, PUBLISHER, DISPLAY_VERSION FROM ORG1.SOFTWARE
where
NOW() < DATE_ADD(SOFTWARE.CREATED, INTERVAL 30 DAY)
AND IS_PATCH=0
AND IS_MANUAL=0 - cblake 7 years ago