Microsoft System Center Configuration Manager (SCCM)

About Microsoft System Center Configuration Manager (SCCM)

Microsoft System Center Configuration Manager (SCCM) now renamed Microsoft Endpoint Configuration Manager (MECM), is a systems management software product for managing large groups of computers running Windows NT, Windows Embedded, macOS (OS X), Linux or UNIX, as well as Windows Phone, Symbian, iOS and Android mobile operating systems.

Use cases the adapter solves

SCCM is a powerful endpoint management solution that provides a robust inventory of our managed devices in Axonius. Even more importantly, by combining SCCM with network/infrastructure data coming from additional adapters, we can identify unmanaged or even rogue devices on the network.

Data retrieved by SCCM

Axonius collects common device information such as the hostname, IPs, MAC address, and serial number. The adapter connects directly to the SCCM MSSQL database to pull additional device information such as installed software, patches, and collection data.

Enforcements
Axonius can add assets to SCCM collections directly in the Enforcement Center.
Related enforcement actions: Microsoft System Center Configuration Manager (SCCM) - Add or Remove Assets to Collection .

Types of Assets Fetched

This adapter fetches the following types of assets:

• Devices

Parameters

1. SCCM/MSSQL Server (required) - The DNS / IP Address of the Microsoft SQL Server your SCCM instance is using.
   • To use a specific named instance, the value supplied should be in the following format: {server_host}\{instance_name}.
   • If no instance is supplied, the default instance will be used.
2. Port (optional, default: 1433) - The port used for the connection.
3. Database (required) - The name of the database inside the SQL Server (Usually starts with "CM_").
4. User Name (required) - A user name with read-only permissions .
   Important Notes:
   • The best practice is to create a dedicated SQL local user for Axonius usage. For details, see Creating a Local Read-Only User for Microsoft SQL Server.
   • If you are using a domain user, specify the domain and the user name in the following format: domain\username.
5. Password (required) - The user's password. The password must not include ";".
6. Do not fetch devices without 'Last Seen' - Select whether to fetch devices without a Last Seen date.
   • If enabled, this adapter connection will not fetch devices if they do not have a Last Seen indication.
   • If disabled, this adapter conenction will fetch devices even if they do not have a Last Seen indication.
7. Only include Devices where Client Installed is True - Select whether to only include devices when the ClientInstalled option in SCCM is 'True'.
   • If enabled, this adapter connection will only fetch devices if they have a ClientInstalled indication.
   • If disabled, this adapter connection will fetch devices even if they do not have a ClientInstalled indication.
8. To learn more about common adapter connection parameters and buttons, see Adding a New Adapter Connection.

Advanced Settings

1. Exclude IPv6 addresses - Select whether to fetch IPv6 addresses. If cleared, the connections for this adapter will fetch both IPv4 and IPv6 addresses.

2. SQL pagination (required, default: 1000) - Set the number of results per page received for a given SQL query, to gain better control of the performance of all connections of for this adapter.

3. Machine domain Include list (optional) - Specify a comma-separated list of SCCM domains. If empty, the connections for this adapter will collect devices from any domain.

4. Fetch v_GS_ADD_REMOVE_PROGRAMS software legacy table - Select whether to fetch installed software information from v_GS_ADD_REMOVE_PROGRAMS software legacy table.

5. Fetch files path table (required, default: true) - Select whether to fetch installed software path from the files path table. If cleared, the fetch process for this adapter will be faster.

6. Find software independent files in the system (matching Regex) - Enter a regex expression to search for and fetch files in the device’s software table that usually would not be retrieved because they are ‘independent’ (i.e. executables or other script files not related to any specific software). The data fetched here is displayed in the ‘Software Independent Files’ field. You can only use this option if you enabled ‘Fetch files path table’.

7. Fetch v_GS_INSTALLED_SOFTWARE table (required, default: true) - Select whether to fetch installed software from the v_GS_INSTALLED_SOFTWARE table. If cleared, the fetch process for this adapter will be faster.

8. Fetch vSMS_SUMDeploymentStatusPerAsset table (default: false) - Select this option to fetch data from the 'vSMS_SUMDeploymentStatusPerAsset' table for each asset.

9. Fetch services information (required, default: true) - Select whether to fetch services information for each device. If cleared, the fetch process for this adapter will be faster.

10. Fetch v_GS_SOFTWAREPRODUCT software table (required, default: true) - Select whether to fetch installed software from the v_GS_SOFTWAREPRODUCT table. If cleared, the fetch process for this adapter will be faster.

11. Fetch EP_AntimalwareHealthStatus Windows Defender AV definition table (optional) - Select whether to fetch Windows Defender Health Status from the EP_AntimalwareHealthStatus.

12. Fetch devices from the following additional tables (optional) - Enter a comma- separated list of SQL tables from which additional device information is fetched. If parameter is empty, no additional device information will be fetched for this connection.

13. Fetch online data table (required, default: true) - Select whether to fetch fields from the v_CollectionMemberClientBaselineStatus SCCM table. When you select this parameter, Axonius fetches online data from the following fields: CNIsOnline, CNLastOnlineTime, CNLastOfflineTime, CNIsOnInternet, CNAccessMP

14. MSSQL Connection Timeout (required, default: 30) - Specify the number of minutes that elapse before the MSSQL connection times out.

15. Populate Installed Software: Last Used On for software used within the past number of days, greater than 0. (optional, default: 90) -

    • When the number entered is greater than 0, the SCCM adapter will fetch results from the Installed Software: Last Used On field in SCCM if the installed software was used within the specified number of days.
    • If the field value is zero or empty, Installed Software: Last Used On information won’t be retrieved and the SCCM adapter will have a faster fetch.

16. Custom Admin Data Table Name (optional) - Enter a table name with the following columns: ResourceID, User0, Domain0, SID0, Category0, Type0, Enabled0, name0, Timestamp

    • The table must be in the same database as defined in the adapter connection.
    • This configuration should only be set if the customer is missing Local Admin Data in their SCCM device records.

17. Fetch licenses (default false)- Select this option to fetch SCCM licenses.

Required Ports

Axonius must be able to communicate with the MSSQL Server via one of the following ports:

• Microsoft SQL Server discovery port - 1433 (default for non SA users) 1434 (default for SA - SuperAdmin - users).
• The specific port for the supplied named instance, if relevant.
• Note that the port appended into the adapter configuration needs to match the global listening port of the SCCM database.

Troubleshooting

• "Login failed" - If you are using a domain user, in the User Name field, specify the domain and the user name in the following format: domain\username.