Alert when users install software

[janpol]

Hi everyone, we are thinking about deploying SCCM in our organization, and one of the main needs is to get software inventory from all the workstations in the corporate network (we are also going to use it to manage patches). I know we can get software inventories from SCCM, but we also need to get an alert from the server when new software is installed on workstations (preferably via email). I've been searching around and I can't find a way to do this, is it possible to get alerts from SCCM when new software is installed on workstations? or should we use another software for this?

 

Thanks in advance

[Trevor Sullivan]

Hello,

 

Thanks for your inquiry. First off, almost anything is possible

 

For your particular question, it depends on what your definition of "installed software" is. If you want, you can write a report that sorts ALL the inventoried items (from hardware inventory) in Add/Remove Programs, and you can filter for items installed on a daily basis. The query is simple, and would look something like the below query.

 

This query returns software that was installed on the 1st day of "this" month.

 

select

[sys].[AD_Site_Name0]

, [sys].[Name0]

, [arp].[Publisher0]

, [arp].[DisplayName0]

, [arp].[installDate0]

 

from [v_R_System] [sys]

 

join [v_GS_ADD_REMOVE_PROGRAMS] [arp] on [sys].[ResourceID] = [arp].[ResourceID]

 

where

[arp].[installDate0] is not null

and LEN([arp].[installDate0]) = 8

and CONVERT(int, SUBSTRING([arp].[installDate0], 5, 2)) = DATEPART(m, GETDATE())

and CONVERT(int, SUBSTRING([arp].[installDate0], 1, 4)) = DATEPART(YYYY, GETDATE())

and CONVERT(int, SUBSTRING([arp].[installDate0], 7, 2)) = 1

 

order by

[arp].[installDate0] desc

 

Cheers,

Trevor Sullivan

http://trevorsullivan.net

http://twitter.com/pcgeek86

[janpol]

Hi, thanks a lot for your response, so, the way to do it would be with a script that runs for example, on a monthly basis, reporting which software was installed this month or something like that. So, if we would want to get alerts on real time, maybe we could set an INSERT trigger on that table right? (or run a script that checks the installation date on a daily or even hourly basis)

 

Knowing when a program appears on Add/Remove Programs would be enough, extra things like detecting new exe's on a workstation would be nice also, but my main concern is how the server would alert the sysadmins. There isn't an alert system built into SCCM? I'm OK with using a script, but I know managers would prefer to see something that can be configured using the tools SCCM provides.

 

Regards

[Trevor Sullivan]

I think this particular request is going to take some customization (scripting, etc.).

 

You mentioned using an INSERT trigger ... I don't know SQL Server very well, however this sounds like a good idea.

 

If it helps, since SCCM is based on Windows Management Instrumentation (WMI), you can also use the built-in WMI eventing model to respond to these events. You could fire off a PowerShell script in response to an event. Back in November 2010, I wrote a PowerShell module that assists with building these event models. This solution would be similar to your SQL trigger idea, only using WMI's event model instead -- to be honest, it will probably perform slightly less optimally than the SQL solution, but I doubt there would be any major performance issues with implementing it this way either.

 

http://powerevents.codeplex.com

 

Let me know if you would like help using it -- there's plenty of documentation and examples in there to start you off.

 

Cheers,

Trevor Sullivan

http://trevorsullivan.net

http://twitter.com/pcgeek86

[Peter Barnett]

You might want to check Action1 Endpoint Security - https://www.action1.com - they give you a lot of real-time information about your endpoints, including installed software, running processes, configuration settings and so on. You can also setup an alert when software installed/removed. And it is free for up to 100 endpoints.

Edited February 1, 2018 by Peter Barnett