SCCM Reporting

Hey Folks, just a quick one, our client has asked us to identify a solution to categorise a PC e.g. assigned to one user, shared, etc to assist with deployment of security controls as per below:
• Improved asset security – if our client moves to a more highly mobile EUC fleet (i.e. mostly laptops / hybrid tablets) then the current method of asset management would not be adequate to ensure that our client can effectively control its assets.
• Improved group policy options – by ensuring that all our clients devices have a category defined (e.g. individual, shared – meeting room, shared – contact centre, shared – border etc), /our client would have the ability to apply group policy to specific category of devices.
is this possible using SCCM?
Craig PaulsenSystems EngineerAsked:
Who is Participating?
 
Mike TConnect With a Mentor Leading EngineerCommented:
Hi - that's a far bigger problem and strictly outside of SCCM control! The only way to physically trace machines is by network port. This would then mean tracking MAC addresses and comparing what appears on each switch and knowing the switch 5, port 4 means Floor 2, desk 37.

Either that, or have someone walk around with a clipboard every day. I've seen that happen and am now observing the network method. SCCM can help with gathering the MAC addresses I guess but that's where it ends.
0
 
Mike TLeading EngineerCommented:
Hi,

This sounds more like a job for basic Group Policy and AD design. It certainly has nothing to do with SCCM reporting. Reporting can only tell you detail about a machine and what software or hardware it has.
You can also report on settings and fix them, which is by using Compliance.

This means for example you can check if the cache size is set to 10GB on machines that are in the "Graphic Designers" OU, and both report and fix it if not.

SCCM has nothing to do with Group Policy options by itself. It can report settings by looking at the registry keys, but no reporting is "live" - only giving a historic view.

If you need a bit more help please explain in more depth because it's slightly confusing what you wrote above.

Mike
0
 
Craig PaulsenSystems EngineerAuthor Commented:
thanks Mike T, Basically our client is wanting to bill bussiness units for the amount of assets (IE: workstations/laptops/tablets) etc they own
0
Increase Security & Decrease Risk with NSPM Tools

Analyst firm, Enterprise Management Associates (EMA) reveals significant benefits to enterprises when using Network Security Policy Management (NSPM) solutions, while organizations without, experienced issues including non standard security policies and failed cloud migrations

 
Mike TLeading EngineerCommented:
Hi,

OK, that's simple enough. You need to run hardware inventory and can then use one of the inbuilt reports to show the machine headcount. By default inventory (aka HWInv) runs every 7 days. For charging usage of PCs that's probably too long, so you will need to increase the inventory frequency. Do this by creating a new custom Client Settings policy, add Inventory and set the frequency to daily. This will be fine, network wise, as new scans are only deltas. You can make it more often than that if you really want to, but daily ought to be fine.

Mike
0
 
Craig PaulsenSystems EngineerAuthor Commented:
Thanks Mike, the issue now is identifying where these assets are in the environment at present?
Workstations are built, but we have no control whose desk they actually end up on
0
 
Mike TLeading EngineerCommented:
This problem is only partially solvable by IT. It's more a physical issue that requires asset management.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.