Microsoft System Center Configuration Manager (SCCM)

About Microsoft System Center Configuration Manager (SCCM)

Microsoft System Center Configuration Manager (SCCM) now renamed Microsoft Endpoint Configuration Manager (MECM), is a systems management software product for managing large groups of computers running Windows NT, Windows Embedded, macOS (OS X), Linux or UNIX, as well as Windows Phone, Symbian, iOS and Android mobile operating systems.

Use cases the adapter solves

SCCM is a powerful endpoint management solution that provides a robust inventory of our managed devices in Axonius. Even more importantly, by combining SCCM with network/infrastructure data coming from additional adapters, we can identify unmanaged or even rogue devices on the network.

Data retrieved by SCCM

Axonius will collect common device information such as the hostname, IPs, MAC address, and serial number. The adapter connects directly to the SCCM MSSQL database to pull additional device information such as installed software, patches, and collection data.

Enforcements
Axonius can add assets to SCCM collections directly in the Enforcement Center.

Types of Assets Fetched

This adapter fetches the following types of assets:

• Devices

Parameters

1. SCCM/MSSQL Server (required) - The DNS / IP Address of the Microsoft SQL Server your SCCM instance is using.
   • To use a specific named instance, the value supplied should be in the following format: {server_host}\{instance_name}.
   • If no instance is supplied, the default instance will be used.
2. Port (optional, default: 1433) - The port used for the connection.
3. Database (required) - The name of the database inside the SQL Server (Usually starts with "CM_").
4. User Name (required) - A user name with read-only permissions .
   Important Notes:
   • The best practice is to create a dedicated SQL local user for Axonius usage. For details, see Creating a Local Read-Only User for Microsoft SQL Server.
   • If you are using a domain user, specify the domain and the user name in the following format: domain\username.
5. Password (required) - The user's password. The password must not include ";".
6. Do not fetch devices without 'Last Seen' - Select whether to fetch devices without a Last Seen date.
   • If enabled, this adapter connection will not fetch devices if they do not have a Last Seen indication.
   • If disabled, this adapter conenction will fetch devices even if they do not have a Last Seen indication.
7. Only include Devices where Client Installed is True - Select whether to only include devices when the ClientInstalled option in SCCM is 'True'.
   • If enabled, this adapter connection will only fetch devices if they have a ClientInstalled indication.
   • If disabled, this adapter connection will fetch devices even if they do not have a ClientInstalled indication.
8. To learn more about common adapter connection parameters and buttons, see Adding a New Adapter Connection.

Advanced Settings

1. Exclude IPv6 addresses - Select whether to fetch IPv6 addresses. If cleared, the connections for this adapter will fetch both IPv4 and IPv6 addresses.

2. SQL pagination (required, default: 1000) - Set the number of results per page received for a given SQL query, to gain better control of the performance of all connections of for this adapter.

3. Machine domain Include list (optional) - Specify a comma-separated list of SCCM domains. If empty, the connections for this adapter will collect devices from any domain.

4. Fetch v_GS_ADD_REMOVE_PROGRAMS software legacy table - Select whether to fetch installed software information from v_GS_ADD_REMOVE_PROGRAMS software legacy table.

5. Fetch files path table (required, default: true) - Select whether to fetch installed software path from the files path table. If cleared, the fetch process for this adapter will be faster.

6. Fetch v_GS_INSTALLED_SOFTWARE table (required, default: true) - Select whether to fetch installed software from the v_GS_INSTALLED_SOFTWARE table. If cleared, the fetch process for this adapter will be faster.

7. Fetch services information (required, default: true) - Select whether to fetch services information for each device. If cleared, the fetch process for this adapter will be faster.

8. Fetch v_GS_SOFTWAREPRODUCT software table (required, default: true) - Select whether to fetch installed software from the v_GS_SOFTWAREPRODUCT table. If cleared, the fetch process for this adapter will be faster.

9. Fetch EP_AntimalwareHealthStatus Windows Defender AV definition table (optional) - Select whether to fetch Windows Defender Health Status from the EP_AntimalwareHealthStatus.

10. Fetch devices from the following additional tables (optional) - Enter a comma- separated list of SQL tables from which additional device information is fetched. If parameter is empty, no additional device information will be fetched for this connection.

11. Fetch online data table (required, default: true) - Select whether to fetch fields from the v_CollectionMemberClientBaselineStatus SCCM table. When you select this parameter, Axonius fetches online data from the following fields: CNIsOnline, CNLastOnlineTime, CNLastOfflineTime, CNIsOnInternet, CNAccessMP

12. MSSQL Connection Timeout (required, default: 30) - Specify the number of minutes that elapse before the MSSQL connection times out.

13. Populate Installed Software: Last Used On for software used within the past number number of days, greater than 0. Enter 0 to disable. (required, default: 90) -

    • When the number entered is greater than 0, the SCCM adapter will fetch results from the Installed Software: Last Used On field in SCCM if the installed software was used within the specified number of days.
    • When ‘0’ is entered, Installed Software: Last Used On information won’t be retrieved and the SCCM adapter will have a faster fetch.

Required Ports

Axonius must be able to communicate with the MSSQL Server via one of the following ports:

• Microsoft SQL Server discovery port - 1433 (default for non SA users) 1434 (default for SA - SuperAdmin - users).
• The specific port for the supplied named instance, if relevant.
• Note that the port appended into the adapter configuration needs to match the global listening port of the SCCM database.

Troubleshooting

• "Login failed" - If you are using a domain user, in the User Name field, specify the domain and the user name in the following format: domain\username.