This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
Greetings,
We have a collection that consists of computers that have the software 'Carbon Black' installed. The actual WQL is listed below.
We also have a collection of computers that DO NOT have the software 'Carbon Black' installed. This collection simply 'includes' all windows 10 clients and 'excludes' computers in the 'installed' collection.
What is weird is that there are a few computers that appear in the 'not installed' collection that clearly match the 'installed' query criteria. I have inspected the hardware inventory of those computers and they have the exact string being searched for in the correct attribute class.
What is weirder is that I have taken the WQL and simply converted it to T-SQL - e.g. changing SMS_R_SYSTEM to V_R_SYSTEM and changing attributes e.g. Name to Name0.
When I run that T-SQL query directly against the database it finds that computer that was in the 'not installed' collection.
IOW WQL does not find it but T-SQL does. How could this be?
WQL below:
select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_ADD_REMOVE_PROGRAMS on SMS_G_System_ADD_REMOVE_PROGRAMS.ResourceID = SMS_R_System.ResourceId inner join SMS_G_System_INSTALLED_SOFTWARE on SMS_G_System_INSTALLED_SOFTWARE.ResourceID = SMS_R_System.ResourceId where SMS_G_System_ADD_REMOVE_PROGRAMS.DisplayName = "Cb Protection Agent" or SMS_G_System_INSTALLED_SOFTWARE.ARPDisplayName = "Cb Protection Agent" or SMS_G_System_ADD_REMOVE_PROGRAMS.DisplayName like "Carbon Black%"
Here is an example of a computer that does NOT satisfy the query today.
For the computer above here is its resourceID:
and here is the SQL query which returns a record where WQL does not:
So i will look at this in the morning when i back at the office but why are you looking at installed sw within the queries? This is bound to cause problems mixing and matching inventory types.
Part of this weird problem is that some machines did not have the 'Installed Applications' node when looking at hardware inventory. They only had 'Installed Applications (x64) and 'Installed Software'. So I had to add Installed Software to my query.
Not having Installed Apps is a sign of a bigger problem. It means that your HW inventory is NOT fully working. As such I would spend time on that first before worrying about your query results.
Start by locating one of the computers without that class. Next force a FULL HW inventory on it, Make sure that the data is returned to the db.
Thanks. I get that. That's why I mentioned our troubleshooting involves simply re-installing the client. And it sometimes requires a few reinstalls before the machine behaves properly. And Ive checked WMI health and even rebuilt WMI on those machines. Just a weird thing that strikes a handful of computers.
Reinstalling the cm client doesn't always force a new inventory.
I would still try it, if that doesn't work then i would review the native wmi class to see if you are seeing results.
btw Running MEMCM 2006
This is just my past working experience talking, so take that for what it is worth.
Typically, I discourage people in my company from using "Installed Applications", and "Installed Applications 64", and instead 100% always use "Installed Software". Here's why...
Installed Apps/Apps64 is basically "what is in the registry keys, under the \Uninstall regkey branch, for 32-bit apps on a 64-bit machine, and 64-bit apps on a 64-bit machine".
Installed Software, is an Asset Intelligence class; and Presuming of course that you have enabled that (in hardware inventory) against your Default Client Settings, all clients will report "Installed Software", which will already include everything in the uninstall regkeys... as well as a few things which might not be listed THERE; but Microsoft's magical coding behind Asset Intelligence on the client (yeah, I have no clue how it really works) will also report a few additional things installed. Typically you can see the "other things" as an example when you look at v_gs_installed_software, and look for entries where ARPDisplayName0 = '' (nothing), but there is a ProductName0. Looking at one of my servers, for example, it shows "Microsoft Windows Server 2019 Standard" as "installed software", but you wouldn't see that in the ARP registry uninstall keys.
Anyway... saying all that... if it's in the uninstall regkeys... it'll be in the "Installed Software" inventory. The ONLY time people have to "use the installed applications" is when they are specifically looking for "is it 32-bit one... or the 64-bit flavor of <whatever application>". (Like Firefox and Chrome come in both 32bit and 64bit)
Sorry for the long explanation; but basically I'm saying don't mix InstalledApplications and InstalledSoftware; it's kind of messy. Just stick with InstalledSoftware unless you have a 32-bit/64-bit reason to split it out.
(off topic a bit, 2006 is a year old... might want to upgrade to the latest soon)