Share via

Query Windows version - not returning all clients

GonWild 426 Reputation points
2021-12-16T11:00:35.38+00:00

Hi,
Having an issue with building a collection/query, finding all clients with build 19042 (Win10 v 20H2). It's not getting all of them.¨

Using the query builder "operating system.Build Number equal to..." yields 922 results
Using "system.Build equal to.." yields 947 results...
(Combining them using OR, select distinct, yields 925 results)

And some clients are only present in the query getting the fewer results, but missing from the query with the most results.

This query stuff seems very sensitive, almost random. How to go about troubleshooting, and knowing what source to trust?

Microsoft Security | Intune | Configuration Manager | Other
0 comments No comments

Answer accepted by question author

Garth Jones 1,366 Reputation points
2021-12-16T15:04:26.19+00:00

If your heartbeat discovery dates are 2 months back you have unhealthy clients and you need to look at first. Start by forcing all of you client to send update heartbeat discovery data.

Was this answer helpful?

0 comments No comments

5 additional answers

Sort by: Most helpful
  1. Amandayou-MSFT 11,166 Reputation points
    2021-12-17T09:23:24.907+00:00

    Hi @GonWild ,

    We could check the tab of Heatbeat DDR in the console of SCCM server. If the client could be found by heatbeat, the date could be shown on it. Please check them on the console and the result of query.

    158539-12171.png

    Besides, about heatbeat discovery, we could check InventoryAgent.log and InventoryProvider.log, they record activities of hardware inventory, software inventory, and heartbeat discovery actions on the client.


    If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    Was this answer helpful?

    0 comments No comments

  2. Garth Jones 1,366 Reputation points
    2021-12-16T13:53:49+00:00

    The first query uses Hardware inventory. Have you confirm that it is showing the details correctly within Resource Explorer?
    The second query uses Heartbeat discovery, Have you confirmed that it is showing correctly for the device properties?

    Was this answer helpful?


  3. GonWild 426 Reputation points
    2021-12-16T13:49:30.027+00:00

    generated from the query builder:

    1. select distinct SMS_R_System.Name, SMS_R_System.Client from SMS_R_System inner join SMS_G_System_OPERATING_SYSTEM on SMS_G_System_OPERATING_SYSTEM.ResourceId = SMS_R_System.ResourceId where SMS_G_System_OPERATING_SYSTEM.BuildNumber = "19042"
    2. select distinct SMS_R_System.Name, SMS_R_System.Client from SMS_R_System where SMS_R_System.Build = "10.0.19042"

    Was this answer helpful?

    0 comments No comments

  4. Garth 5,806 Reputation points
    2021-12-16T12:16:00.253+00:00

    Without your query everyone will be guessing as to the problem. Please post your query.

    Was this answer helpful?

    0 comments No comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.