query question

myITforum.com Community Forum

Home Forums Blogs Live Support chat Search Articles Wiki FAQ Email Lists Register Login My Profile Inbox Address Book My Subscription My Forums

Photo Gallery Member List Search Calendars FAQ Ticket List Log Out

All Forums RSS Feed Subscription:

query question

View related threads: (in this forum | in all forums)

Logged in as: Guest

Printable Version

All Forums >> [Management Products] >> System Center Products >> System Center Configuration Manager >> query question

Page: [1]

Message

<< Older Topic Newer Topic >>

query question - 4/7/2008 3:54:47 PM

pappatoad

Posts: 61
Score: 0
Joined: 2/26/2007
Status: offline

Does anyone have a good way to querry the computers to see which users have local admin rights? I think I am just over looking it.

Post #: 1

RE: query question - 4/8/2008 8:16:55 AM

mcarriere893

Posts: 3618
Score: 300
Joined: 4/12/2002
From: Manitoba, Canada
Status: offline

That info is not collected by default. Check out Ward's article: http://www.myitforum.com/articles/8/view.asp?id=9735 for extending the mof.

Note, Server 2K3, Vista (and probably 2K8) require the "builtin" to be changed to the computer name. You can easily add the reporting portion to the sms_def.mof, and just create a package/program/advert for clients to edit the the mof (change builtin to computename) and compile it.

_____________________________

Mark Carriere
Microsoft MVP-SMS
www.SMSUG.ca

(in reply to pappatoad)

Post #: 2

RE: query question - 4/11/2008 12:21:29 PM

pappatoad

Posts: 61
Score: 0
Joined: 2/26/2007
Status: offline

do you know it this will work in SCCM? I can see the MOF file modified on the local client.....but dont see the class added on the server in the mentioned root location.

(in reply to mcarriere893)

Post #: 3

RE: query question - 4/11/2008 12:41:16 PM

mcarriere893

Posts: 3618
Score: 300
Joined: 4/12/2002
From: Manitoba, Canada
Status: offline

Sure it works in ConfigMgr. The reporting portion goes into the sms_def.mof (on the site server(s).

_____________________________

Mark Carriere
Microsoft MVP-SMS
www.SMSUG.ca

(in reply to pappatoad)

Post #: 4

RE: query question - 4/11/2008 1:05:11 PM

pappatoad

Posts: 61
Score: 0
Joined: 2/26/2007
Status: offline

I have that done....but when I am using WMITools to view the information on the server it tells me the class Win32_LocalAdmins is not created....so I am not sure where to look for the files here is the file from the dataldr.log after running the LocalAdmins.mof file on the local machine......If I am reading it correctly ..the data has been collected ....but using WMITools I can not find the class to gather the information from....

Begin transaction: Machine=3TF8541(GUID:07597C1B-EED8-457F-8399-728C9F6B62DC) $$<SMS_INVENTORY_DATA_LOADER><Fri Apr 11 10:35:41.334 2008 Mountain Daylight Time><thread=11128 (0x2B78)>
Commit transaction: Machine=3TF8541(GUID:07597C1B-EED8-457F-8399-728C9F6B62DC) $$<SMS_INVENTORY_DATA_LOADER><Fri Apr 11 10:35:44.287 2008 Mountain Daylight Time><thread=11128 (0x2B78)>
Thread 11128 releasing exclusive access from SetJobCompleted. $$<SMS_INVENTORY_DATA_LOADER><Fri Apr 11 10:35:44.287 2008 Mountain Daylight Time><thread=11128 (0x2B78)>
Done blocking until completion. $$<SMS_INVENTORY_DATA_LOADER><Fri Apr 11 10:35:44.303 2008 Mountain Daylight Time><thread=7476 (0x1D34)>
~No more machine MIFs to be processed, terminating thread $$<SMS_INVENTORY_DATA_LOADER><Fri Apr 11 10:35:44.303 2008 Mountain Daylight Time><thread=7476 (0x1D34)>
Shutting down Machine Writer. $$<SMS_INVENTORY_DATA_LOADER><Fri Apr 11 10:35:44.303 2008 Mountain Daylight Time><thread=7476 (0x1D34)>
Done: Machine=3TF8541(GUID:07597C1B-EED8-457F-8399-728C9F6B62DC) code=0 (423 stored procs in XHIEHRYT6.MIF) $$<SMS_INVENTORY_DATA_LOADER><Fri Apr 11 10:35:44.303 2008 Mountain Daylight Time><thread=11128 (0x2B78)>
Worker thread 11128 halting execution. $$<SMS_INVENTORY_DATA_LOADER><Fri Apr 11 10:35:44.334 2008 Mountain Daylight Time><thread=11128 (0x2B78)>
Finished processing 1 MIFs $$<SMS_INVENTORY_DATA_LOADER><Fri Apr 11 10:35:49.318 2008 Mountain Daylight Time><thread=7476 (0x1D34)>

(in reply to mcarriere893)

Post #: 5

RE: query question - 4/11/2008 1:25:36 PM

mcarriere893

Posts: 3618
Score: 300
Joined: 4/12/2002
From: Manitoba, Canada
Status: offline

When you add the localadmins reporting portion (stuff that goes to site_ server\root\cimv2\sms) to the sms_def.mof, dataldr.log will show that the mof has changed (all this is on your site server).

You need to manually comile the client portion mof on clients (stuff that goes into client\root\cimv2)

Like with SMS 2003, after I ever make changes to the sms_def.mof, I force test systems to do several policy evaluations before even attempting to do a hardware inventory on them. (all this done in a lab of course so I can speed things up instead of waiting cor client to do it on their own schedule).

You will see in the inventory.log (client) that the win32_localadmins (or whatever you call it) will be picked up when you run hw inventory (ohterwise do another policy refresh).
Once the inventory is shipped off to the site server, it'll create the approproate class, and sql tables

If you've done all the compiling of both mofs, then you may just need to either wait for clients to pick up the new policy, or have them force a policy refresh before forcing another hw inventory.

_____________________________

Mark Carriere
Microsoft MVP-SMS
www.SMSUG.ca

(in reply to pappatoad)

Post #: 6

RE: query question - 4/11/2008 2:56:46 PM

pappatoad

Posts: 61
Score: 0
Joined: 2/26/2007
Status: offline

we ll I am still trying t oget this to work out....I have retraced my steps and still not sure what is going on....both files were compiled on both the server and the test box....the dadaldr.log file from the last run shows the inventory group but mentions delet and deletes the group.....is that supposed to happen?

Thread: 1340 will use GUID GUID:07597C1B-EED8-457F-8399-728C9F6B62DC $$<SMS_INVENTORY_DATA_LOADER><Fri Apr 11 12:47:35.307 2008 Mountain Daylight Time><thread=1340 (0x53C)>
Processing Inventory for Machine: 3TF8541 Version 0.0 Generated: 04/11/2008 12:47:27 $$<SMS_INVENTORY_DATA_LOADER><Fri Apr 11 12:47:35.322 2008 Mountain Daylight Time><thread=1340 (0x53C)>
Pragma delete found in inventory group MICROSOFT|LOCALADMINS|1.0. Deleting group... $$<SMS_INVENTORY_DATA_LOADER><Fri Apr 11 12:47:35.400 2008 Mountain Daylight Time><thread=1340 (0x53C)>
Pragma delete found in inventory group MICROSOFT|LOCALADMINS|1.0. Deleting group... $$<SMS_INVENTORY_DATA_LOADER><Fri Apr 11 12:47:35.416 2008 Mountain Daylight Time><thread=1340 (0x53C)>
Pragma delete found in inventory group MICROSOFT|LOCALADMINS|1.0. Deleting group... $$<SMS_INVENTORY_DATA_LOADER><Fri Apr 11 12:47:35.416 2008 Mountain Daylight Time><thread=1340 (0x53C)>
Begin transaction: Machine=3TF8541(GUID:07597C1B-EED8-457F-8399-728C9F6B62DC) $$<SMS_INVENTORY_DATA_LOADER><Fri Apr 11 12:47:35.432 2008 Mountain Daylight Time><thread=1340 (0x53C)>
Commit transaction: Machine=3TF8541(GUID:07597C1B-EED8-457F-8399-728C9F6B62DC) $$<SMS_INVENTORY_DATA_LOADER><Fri Apr 11 12:47:35.619 2008 Mountain Daylight Time><thread=1340 (0x53C)>
Done: Machine=3TF8541(GUID:07597C1B-EED8-457F-8399-728C9F6B62DC) code=0 (6 stored procs in XHTC9FW9B.MIF) $$<SMS_INVENTORY_DATA_LOADER><Fri Apr 11 12:47:35.635 2008 Mountain Daylight Time><thread=1340 (0x53C)>
Done blocking until completion. $$<SMS_INVENTORY_DATA_LOADER><Fri Apr 11 12:47:35.635 2008 Mountain Daylight Time><thread=2400 (0x960)>

(in reply to mcarriere893)

Post #: 7

RE: query question - 4/11/2008 3:43:43 PM

mcarriere893

Posts: 3618
Score: 300
Joined: 4/12/2002
From: Manitoba, Canada
Status: offline

Might just be due because a delta inventory ocurred, and the data didn't exist yet, so a full needs to be done on the client (should happen automatically).

_____________________________

Mark Carriere
Microsoft MVP-SMS
www.SMSUG.ca

(in reply to pappatoad)

Post #: 8

RE: query question - 4/11/2008 4:38:35 PM

pappatoad

Posts: 61
Score: 0
Joined: 2/26/2007
Status: offline

it is still not reporting the class. If I run the mof file again on the client I am trying to pull the information from....then refresh policies...checked the log file and says same thing...deleted. Now my next question is since I checked the mof files over and over and also made sure that the "Builtin" reference in the mof was replaced by the server that is compiling the mof.....but I still can not get WMI Tools to even find the Win32_LocalAdmins class at all.

(in reply to mcarriere893)

Post #: 9

RE: query question - 4/14/2008 8:36:01 AM

mcarriere893

Posts: 3618
Score: 300
Joined: 4/12/2002
From: Manitoba, Canada
Status: offline

Just to make sure here...The client that you wish to collect local admin information from compiles the mof that you change the "builtin" to client name. (whether that is a workstation or server). Note that if it is W2K or XP, then you don't need to change builtin.

Once you compile that on the client, you should see win32_localadmins under root\cimv2 (you'll also see the data as well).

The reporting section gets added to your sms_def.mof on the site server. No compiling is required as the site sees a change and does what it needs to do.

Once the sms_def.mof has been modified, and the client has compiled it's mof, and done a policy refresh, and done a hw inventory, your site server should use the info to create the new SQL table and populate it.
You should then see the win32_localadmins class under root\cimv2\sms (on the site server).

The only times I see deleteclass in a log is if either a) new data in an inventory that didn't exist before, and so a full inventory must be taken, or b) you have a #pragma deleteclass XXX line in the sms_def.mof.

_____________________________

Mark Carriere
Microsoft MVP-SMS
www.SMSUG.ca

(in reply to pappatoad)

Post #: 10