Стаття
07/27/2015

How to Create Windows Configuration Items for Compliance Settings in Configuration Manager

Updated: May 14, 2015

Applies To: System Center 2012 Configuration Manager, System Center 2012 Configuration Manager SP1, System Center 2012 Configuration Manager SP2, System Center 2012 R2 Configuration Manager, System Center 2012 R2 Configuration Manager SP1

Create configuration items in System Center 2012 Configuration Manager to define configurations that you want to manage and assess for compliance on devices.

There are different types of configuration items:

Application configuration item

Used to determine compliance for an application. This can include whether the application is installed and details about its configuration.
Operating system configuration item

Used to determine compliance for settings that relate to the operating system and its configuration.
Software updates configuration item

Automatically created when you download software updates with Configuration Manager.

You do not create or see these configuration items in the Compliance Settings node, but you can select them when you define configuration baselines.
General configuration item

Used to determine compliance for mobile devices.

For more information about creating configuration items for mobile devices, see How to Create Mobile Device Configuration Items for Compliance Settings in Configuration Manager.

Use one the following four different methods to create a configuration item in the Configuration Manager console.

Method	Description	More information
Create a new configuration item	Use the Create Configuration Item Wizard to create the configuration item. Use this method to create a configuration item when you want to configure all properties, or you have no existing configuration item from which you can create a duplicate or a child configuration item.	For more information about how to create a configuration item by using the wizard, see the steps and supplemental procedures in this topic. Note For more information about how to create mobile device configuration items, see How to Create Mobile Device Configuration Items for Compliance Settings in Configuration Manager.
Create a child configuration item	Create a child configuration item from the Configuration Items node. Use this method to create a configuration item when you want a configuration item that continues to inherit the properties of an existing configuration item, but refines them with more detailed configuration. You cannot create child configuration items for mobile devices.	For more information about how to create a child configuration item, see How to Create Child Configuration Items in Configuration Manager.
Import	Import configuration data from a file. Use this method to create configuration items when they have been defined outside the Configuration Manager hierarchy. For example, you created them in a test environment and now want to use them on the production network, or you want to import best practices from a Configuration Pack that vendors provided.	For more information, see How to Import Configuration Data in Configuration Manager.
Duplicate	Create a duplicate configuration item from the Configuration Items node. Use this method to create a configuration item when you want an exact copy of an existing configuration item to use as your starting point, but you want to modify it to create an independent configuration item from the original.	To create a duplicate of a configuration item, select a configuration item in the Configuration Items node and then, on the Home tab, in the Configuration Item group, click Copy. Important When you create a duplicate configuration baseline or configuration item, the duplicate does not retain a relationship to the original configuration data. Therefore, if the original configuration data is upgraded, any revisions are not passed to the duplicate configuration baseline or configuration item.

Warning

Do not configure configuration items with identical settings that evaluate different values and assign them to the same devices. When devices evaluate configuration items that have conflicting values, the order in which they are evaluated is nondeterministic.

Use the following steps and the supplemental procedures for when you want to create a new configuration item for Windows-based computers.

Steps to Create a New Configuration Item for Client Computers

Use the following required steps to create a configuration item by using the Create Configuration Item Wizard.

Step	Details	More information
Step 1: Start the Create Configuration Item Wizard.	Start the wizard in the Assets and Compliance workspace in the Compliance Settings node.	See the Step 1: Start the Create Configuration Item Wizard section in this topic
Step 2: Provide general information about the configuration item.	Specify a Windows configuration item and a detection method if this configuration item assesses the compliance of an application.	See Step 2: Provide General Information about the Configuration Item.
Step 3: Provide detection method information for the configuration item.	A detection method contains rules that detect whether an application is installed on a client device before it is assessed for compliance. Note Detection methods apply only to application configuration items (you have selected This configuration item contains application settings on the General page of the wizard).	See the Step 3: Provide Detection Method Information for the Configuration Item section in this topic.
Step 4: Configure settings for the configuration item.	A setting represents the business or technical conditions to be used to assess compliance on client devices. You can configure a new setting or browse to an existing setting on a reference computer.	See the Step 4: Configure Settings for the Configuration Item section in this topic.
Step 5: Configure compliance rules for the configuration item.	Compliance rules specify the conditions that define the compliance of a configuration item. Some settings let you remediate values that are found to be noncompliant. You can also create new rules by browsing to existing settings in any configuration item and creating rules against them.	See the Step 5: Configure Compliance Rules for the Configuration Item section in this topic.
Step 6: Specify supported platforms for the configuration item.	Supported platforms are the operating systems on which a configuration item is assessed for compliance.	See the Step 6: Specify Supported Platforms for the Configuration Item section in this topic.
Step 7: Complete the wizard.	Complete the wizard to create the new configuration item.	No additional information.

Supplemental Procedures to Create a New Configuration Item for Client Computers

Use the following information when the steps in the preceding table require supplemental procedures.

Step 1: Start the Create Configuration Item Wizard

Use this procedure to start the Create Configuration Item Wizard.

To start the Create Configuration Item Wizard

In the Configuration Manager console, click Assets and Compliance.
In the Assets and Compliance workspace, expand Compliance Settings, and then click Configuration Items.
On the Home tab, in the Create group, click Create Configuration Item.

Step 2: Provide General Information about the Configuration Item

Use this procedure to provide general information about the configuration item.

To provide general information about the configuration item

On the General page of the Create Configuration Item Wizard, specify the following information:

- **Name:** Enter a unique name for the configuration item. You can use a maximum of 256 characters.

- **Description:** Provide a description that gives an overview of the configuration item and other relevant information that helps to identify it in the Configuration Manager console. You can use a maximum of 256 characters.

In the Specify type of configuration item that you want to create list, select Windows.

Note

If you want to create a configuration item for a mobile device, see How to Create Mobile Device Configuration Items for Compliance Settings in Configuration Manager.
If this configuration item is used to assess the compliance of an application, and you want to use a detection method to detect whether the application is present, select This configuration item contains application settings.

Step 3: Provide Detection Method Information for the Configuration Item

Use this procedure to provide detection method information for the configuration item.

Note

Applies only if you selected This configuration item contains application settings on the General page of the wizard.

A detection method in Configuration Manager contains rules that are used to detect whether an application is installed on a computer. This detection occurs before the configuration item is assessed for compliance. To detect whether an application is installed, you can detect the presence of a Windows Installer file for the application, use a custom script, or select Always assume application is installed to assess the configuration item for compliance regardless of whether the application is installed.

Use these procedures to configure detection methods in System Center 2012 Configuration Manager.

To detect an application installation by using the Windows Installer File

On the Detection Methods page of the Create Configuration Item Wizard, select the Use Windows Installer detection check box.
Click Open, browse to the Windows Installer (.msi) file that you want to detect, and then click Open.
The Version box is automatically populated with the version number of the Windows Installer file that you selected. You can enter a new version number in this box if the displayed value is incorrect.
Select the This application is installed for one or more users check box if you want to detect each user profile on the computer.

To detect an application installation by using a custom script

On the Detection Methods page of the Create Configuration Item Wizard, select the Use a custom script to detect this application check box.
In the list, select the language of the script you want to open. Choose from the following scripts:
```
- **VBScript**

- **JScript**

- **PowerShell**
```
Click Open, browse to the script that you want to use, and then click Open.

Step 4: Configure Settings for the Configuration Item

Use this procedure to configure the settings in the configuration item.

Settings represent the business or technical conditions that are used to assess compliance on client devices. You can configure a new setting or browse to an existing setting on a reference computer.

To create a setting

On the Settings page of the Create Configuration Item Wizard, click New.

On the General tab of the Create Setting dialog box, provide the following information:

- **Name:** Enter a unique name for the setting. You can use a maximum of 256 characters.

- **Description:** Enter a description for the setting. You can use a maximum of 256 characters.

- **Setting type:** In the list, choose one of the following setting types to use for this setting:

  <table>
  <colgroup>
  <col style="width: 50%" />
  <col style="width: 50%" />
  </colgroup>
  <thead>
  <tr class="header">
  <th><p>Setting type</p></th>
  <th><p>More information</p></th>
  </tr>
  </thead>
  <tbody>
  <tr class="odd">
  <td><p>Active Directory query</p></td>
  <td><p>Configure the following for this setting type:</p>
  <ul>
  <li><p><strong>LDAP prefix</strong> - Specify a valid prefix to the Active Directory Domain Services query to assess compliance on client computers. You can use either <strong>LDAP://</strong> for a or <strong>GC://</strong> to perform a global catalog search..</p></li>
  <li><p><strong>Distinguished Name (DN)</strong> - Specify the distinguished name of the Active Directory Domain Services object that is assessed for compliance on client computers.</p>
  <p>For example, if you want to evaluate a value related to a user named John Smith in the corp.contoso.com domain, enter the following:</p>
  <p><strong>CN=John Smith, CN=Users, DC=corp, DC=Contoso, DC=com</strong></p></li>
  <li><p><strong>Search filter</strong> - Specify an optional LDAP filter to refine the results from the Active Directory Domain Services query to assess compliance on client computers.</p>
  <p>To return all results from the query, enter <strong>(objectclass=*)</strong>.</p></li>
  <li><p><strong>Search scope</strong> - Specify the search scope in Active Directory Domain Services:</p>
  <ul>
  <li><p><strong>Base</strong> - Queries only the object that is specified.</p></li>
  <li><p><strong>One Level</strong> - This option is not used in this version of Configuration Manager.</p></li>
  <li><p><strong>Subtree</strong> - Queries the object that is specified and its complete subtree in the directory.</p></li>
  </ul></li>
  <li><p><strong>Property</strong> - Specify the property of the Active Directory Domain Services object that is used to assess compliance on client computers.</p>
  <p>For example, if you want to query the Active Directory property <strong>badPwdCount</strong>, which stores the number of times a user incorrectly enters a password, enter <strong>badPwdCount</strong> in this field.</p></li>
  <li><p><strong>Query</strong> - Displays the query constructed from the entries in <strong>LDAP prefix</strong>, <strong>Distinguished name (DN)</strong>, <strong>Search Filter</strong> (if specified), and <strong>Property</strong>, which are used to assess compliance on client computers.</p></li>
  </ul>
  <p>For more information about constructing LDAP queries, see your Windows Server documentation.</p></td>
  </tr>
  <tr class="even">
  <td><p>Assembly</p></td>
  <td><p>Configure the following for this setting type:</p>
  <ul>
  <li><p><strong>Assembly name:</strong> Specifies the name of the assembly object that you want to search for. The name cannot be the same as other assembly objects of the same type and must be registered in the Global Assembly Cache. The assembly name can be up to 256 characters long.</p></li>
  </ul>
  <div class="alert">

  > [!NOTE]
  > <P>An assembly is a piece of code that can be shared between applications. Assemblies can have the file name extension .dll or .exe. The Global Assembly Cache is a folder named <EM>%systemroot%\Assembly</EM> on client computers where all shared assemblies are stored.</P>

  </div></td>
  </tr>
  <tr class="odd">
  <td><p>File system</p></td>
  <td><p>Configure the following for this setting type:</p>
  <ul>
  <li><p><strong>Type</strong> – In the list, select whether you want to search for a <strong>File</strong> or a <strong>Folder</strong>.</p></li>
  <li><p><strong>Path</strong> - Specify the path of the specified file or folder on client computers. You can specify system environment variables and the <em>%USERPROFILE%</em> environment variable in the path.</p>
  <div class="alert">

  > [!NOTE]
  > <P>If you use the <EM>%USERPROFILE%</EM> environment variable in the <STRONG>Path</STRONG> or <STRONG>File or folder name</STRONG> boxes, all user profiles on the client computer are searched, which could result in multiple instances of the file or folder that is found.</P>
  > <P>If compliance settings do not have access to the specified path, a discovery error is generated. Additionally, if the file you are searching for is currently in use, a discovery error is generated.</P>

  </div></li>
  <li><p><strong>File or folder name</strong> - Specify the name of the file or folder object to search for. You can specify system environment variables and the <em>%USERPROFILE%</em> environment variable in the file or folder name. You can also use the wildcards * and ? in the file name.</p>
  <div class="alert">

  > [!NOTE]
  > <P>If you specify a file or folder name and use wildcards, this combination might produce a high numbers of results and could result in high resource use on the client computer and high network traffic when reporting results to Configuration Manager.</P>

  </div></li>
  <li><p><strong>Include subfolders</strong> – Enable this option if you also want to search any subfolders under the specified path.</p></li>
  <li><p><strong>This file or folder is associated with a 64-bit application</strong> - If enabled, only 64-bit file locations (such as <em>%ProgramFiles%</em>) will be checked on 64-bit computers. If this option is not enabled, both 32-bit (such as <em>%ProgramFiles(x86)%</em>) and 64-bit locations will be checked.</p>
  <div class="alert">

  > [!NOTE]
  > <P>If the same file or folder exists in both the 64-bit and 32-bit system file locations on the same 64-bit computer, multiple files are discovered by the global condition.</P>

  </div></li>
  </ul>
  <p>The <strong>File system</strong> setting type does not support specifying a UNC path to a network share in the <strong>Path</strong> box.</p></td>
  </tr>
  <tr class="even">
  <td><p>IIS metabase</p></td>
  <td><p>Configure the following for this setting type:</p>
  <ul>
  <li><p><strong>Metabase path</strong> - Specify a valid path to the Internet Information Services (IIS) Metabase.</p></li>
  <li><p><strong>Property ID</strong> - Specify the numeric property of the IIS Metabase setting.</p></li>
  </ul></td>
  </tr>
  <tr class="odd">
  <td><p>Registry key</p></td>
  <td><p>Configure the following for this setting type:</p>
  <ul>
  <li><p><strong>Hive</strong> – In the list, select the registry hive that you want to search in.</p></li>
  <li><p><strong>Key</strong> - Specify the registry key name that you want to search for. Use the format <em>key\subkey</em>.</p></li>
  <li><p><strong>This registry key is associated with a 64-bit application</strong> - Specifies whether the 64-bit registry keys should be searched in addition to the 32-bit registry keys on clients that are running a 64-bit version of Windows.</p>
  <div class="alert">

  > [!NOTE]
  > <P>If the same registry key exists in both the 64-bit and 32-bit registry locations on the same 64-bit computer, both registry keys are discovered by the global condition.</P>

  </div></li>
  </ul></td>
  </tr>
  <tr class="even">
  <td><p>Registry value</p></td>
  <td><p>Configure the following for this setting type:</p>
  <ul>
  <li><p><strong>Hive</strong> - In the list, select the registry hive that you want to search in.</p></li>
  <li><p><strong>Key</strong> - Specify the registry key name that you want to search for. Use the format <em>key\subkey</em>.</p></li>
  <li><p><strong>Value</strong> – Specify the value that must be contained within the specified registry key.</p></li>
  <li><p><strong>This registry key is associated with a 64-bit application</strong> - Specifies whether the 64-bit registry keys should be searched in addition to the 32-bit registry keys on clients that are running a 64-bit version of Windows.</p>
  <div class="alert">

  > [!NOTE]
  > <P>If the same registry key exists in both the 64-bit and 32-bit registry locations on the same 64-bit computer, both registry keys are discovered by the global condition.</P>

  </div></li>
  </ul>
  <p>You can also click <strong>Browse</strong> to browse to a registry location on the computer or on a remote computer. To browse a remote computer, you must have administrator rights on the remote computer and the remote computer must be running the remote registry service.</p></td>
  </tr>
  <tr class="odd">
  <td><p>Script</p></td>
  <td><p>Configure the following for this setting type:</p>
  <ul>
  <li><p><strong>Discovery script</strong> – Click <strong>Add</strong> to enter, or browse to the script you want to use. You can use Windows PowerShell, VBScript, or Microsoft JScript scripts.</p></li>
  <li><p><strong>Run scripts by using the logged on user credentials</strong> – If you enable this option, the script runs on client computers that use the credentials of the logged-on users.</p>
  <div class="alert">

  > [!NOTE]
  > <P>The value returned by the script is used to assess the compliance of the global condition. For example, when using VBScript, you could use the command <STRONG>WScript.Echo Result</STRONG> to return the <EM>Result</EM> variable value to the global condition.</P>

  </div></li>
  </ul></td>
  </tr>
  <tr class="even">
  <td><p>SQL query</p></td>
  <td><p>Configure the following for this setting type:</p>
  <ul>
  <li><p><strong>SQL Server instance</strong> – Choose whether you want the SQL query to run on the default instance, all instances, or a specified database instance name.</p>
  <div class="alert">

  > [!NOTE]
  > <P>The instance name must refer to a local instance of SQL Server. To refer to a clustered SQL server instance, you should use a script setting.</P>

  </div></li>
  <li><p><strong>Database</strong> - Specify the name of the Microsoft SQL Server database against which you want to run the SQL query.</p></li>
  <li><p><strong>Column</strong> - Specify the column name returned by the Transact-SQL statement that is used to assess the compliance of the global condition.</p></li>
  <li><p><strong>Transact-SQL statement</strong> – Specify the full SQL query you want to use for the global condition. You can also click <strong>Open</strong> to open an existing SQL query.</p>
  <div class="alert">

  > [!IMPORTANT]
  > <P>SQL Query settings do not support any SQL commands that modify the database. You can only use SQL commands that read information from the database.</P>

  </div></li>
  </ul></td>
  </tr>
  <tr class="odd">
  <td><p>WQL query</p></td>
  <td><p>Configure the following for this setting type:</p>
  <ul>
  <li><p><strong>Namespace</strong> - Specify the Windows Management Instrumentation (WMI) namespace which is used to build a WQL query that is assessed for compliance on client computers. The default value is Root\cimv2.</p></li>
  <li><p><strong>Class</strong> - Specifies the WMI class which is used to build a WQL query that is assessed for compliance on client computers.</p></li>
  <li><p><strong>Property</strong> - Specifies the WMI property which is used to build a WQL query that is assessed for compliance on client computers.</p></li>
  <li><p><strong>WQL query WHERE clause</strong> - You can use the <strong>WQL query WHERE clause</strong> item to specify a WHERE clause to be applied to the specified namespace, class, and property on client computers.</p></li>
  </ul></td>
  </tr>
  <tr class="even">
  <td><p>XPath query</p></td>
  <td><p>Configure the following for this setting type:</p>
  <ul>
  <li><p><strong>Path</strong> - Specify the path of the .xml file on client computers that is used to assess compliance. Configuration Manager supports the use of all Windows system environment variables and the <em>%USERPROFILE%</em> user variable in the path name.</p></li>
  <li><p><strong>XML file name</strong> - Specify the file name containing the XML query that is used to assess compliance on client computers.</p></li>
  <li><p><strong>Include subfolders</strong> - Enable this option if you also want to search any subfolders under the specified path.</p></li>
  <li><p><strong>This file is associated with a 64-bit application</strong> - Choose whether the 64-bit system file location (<em>%windir%</em>\System32) should be searched in addition to the 32-bit system file location (<em>%windir%</em>\Syswow64) on Configuration Manager clients that are running a 64-bit version of Windows.</p></li>
  <li><p><strong>XPath query</strong> - Specify a valid full XML path language (XPath) query that is used to assess compliance on client computers.</p></li>
  <li><p><strong>Namespaces</strong> - Opens the <strong>XML Namespaces</strong> dialog box to identify namespaces and prefixes to be used during the XPath query.</p></li>
  </ul>
  <div class="alert">

  > [!IMPORTANT]
  > <P>If you attempt to discover an encrypted .xml file, compliance settings find the file, but the XPath query produces no results, and no error is generated.</P>

  </div>
  <div class="alert">

  > [!NOTE]
  > <P>If the XPath query is not valid, the setting is evaluated as noncompliant on client computers.</P>

  </div></td>
  </tr>
  </tbody>
  </table>

- **Data type:** In the list, choose the format in which the condition returns the data before it is used to assess the setting. The **Data type** list is not displayed for all setting types.

  <div class="alert">


  > [!NOTE]
  > <P>The <STRONG>Floating point</STRONG> data type supports only 3 digits after the decimal point.</P>


  </div>

Configure additional details about this setting under the Setting type list. The items you can configure vary depending on the setting type you have selected.

Note

When you create settings of the type File system, Registry key, and Registry value, you can click Browse to configure the setting from values on a reference computer. To browse to a registry key or value on a remote computer, the remote computer must have the Remote Registry service enabled.
Click OK to save the setting and close the Create Setting dialog box.

Step 5: Configure Compliance Rules for the Configuration Item

Use the following procedure to configure compliance rules for the configuration item.

Compliance rules specify the conditions that define the compliance of a configuration item. Before a setting can be evaluated for compliance, it must have at least one compliance rule. WMI, registry, and script settings let you remediate values that are found to be noncompliant. You can create new rules or browse to an existing setting in any configuration item to select rules in it.

To create a compliance rule

On the Compliance Rules page of the Create Configuration Item Wizard, click New.

In the Create Rule dialog box, provide the following information:

- **Name:** Enter a name for the compliance rule.

- **Description:** Enter a description for the compliance rule.

- **Selected setting:** Click **Browse** to open the **Select Setting** dialog box. Select the setting that you want to define a rule for, or click **New Setting**. When you are finished, click **Select**.

  <div class="alert">


  > [!NOTE]
  > <P>You can also click <STRONG>Properties</STRONG> to view information about the currently selected setting.</P>


  </div>

- **Rule type:** Select the type of compliance rule that you want to use:

    - **Value** Create a rule that compares the value returned by the configuration item against a value that you specify.

    - **Existential** Create a rule that evaluates the setting depending on whether it exists on a client device or on the number of times it is found.

- For a rule type of **Value**, specify the following information:

    - **The setting must comply with the following rule** – Select an operator and a value which is assessed for compliance with the selected setting. You can use the following operators:

      <table>
      <colgroup>
      <col style="width: 50%" />
      <col style="width: 50%" />
      </colgroup>
      <thead>
      <tr class="header">
      <th><p>Operator</p></th>
      <th><p>More information</p></th>
      </tr>
      </thead>
      <tbody>
      <tr class="odd">
      <td><p>Equals</p></td>
      <td><p>No additional information</p></td>
      </tr>
      <tr class="even">
      <td><p>Not equal to</p></td>
      <td><p>No additional information</p></td>
      </tr>
      <tr class="odd">
      <td><p>Greater than</p></td>
      <td><p>No additional information</p></td>
      </tr>
      <tr class="even">
      <td><p>Less than</p></td>
      <td><p>No additional information</p></td>
      </tr>
      <tr class="odd">
      <td><p>Between</p></td>
      <td><p>No additional information</p></td>
      </tr>
      <tr class="even">
      <td><p>Greater than or equal to</p></td>
      <td><p>No additional information</p></td>
      </tr>
      <tr class="odd">
      <td><p>Less than or equal to</p></td>
      <td><p>No additional information</p></td>
      </tr>
      <tr class="even">
      <td><p>One of</p></td>
      <td><p>In the text box, specify one entry on each line.</p></td>
      </tr>
      <tr class="odd">
      <td><p>None of</p></td>
      <td><p>In the text box, specify one entry on each line.</p></td>
      </tr>
      </tbody>
      </table>

    - **Remediate noncompliant rules when supported** – Select this option if you want Configuration Manager to automatically remediate noncompliant rules. Configuration Manager can automatically remediate the following rule types:

        - **Registry value** – The registry value is remediated if it is noncompliant, and created if it does not exist.

        - **Script** (by automatically running a remediation script).

        - **WQL Query**

      <div class="alert">


      > [!IMPORTANT]
      > <P>You can only remediate noncompliant rules when the rule operator is set to <STRONG>Equals</STRONG>.</P>


      </div>

    - **Report noncompliance if this setting instance is not found** – The configuration item reports noncompliance if this setting is not found on client computers.

    - **Noncompliance severity for reports:** Specify the severity level that is reported if this compliance rule fails. The available severity levels are the following:

        - **None** Computers that fail this compliance rule do not report a failure severity for Configuration Manager reports.

        - **Information** Computers that fail this compliance rule report a failure severity of **Information** for Configuration Manager reports.

        - **Warning** Computers that fail this compliance rule report a failure severity of **Warning** for Configuration Manager reports.

        - **Critical** Computers that fail this compliance rule report a failure severity of **Critical** for Configuration Manager reports.

        - **Critical with event** Computers that fail this compliance rule report a failure severity of **Critical** for Configuration Manager reports. This severity level is also be logged as a Windows event in the application event log.

    - For a rule type of **Existential**, specify the following information:

      <div class="alert">


      > [!NOTE]
      > <P>The options shown might vary depending on the setting type you are configuring a rule for.</P>


      </div>

        - **The setting must exist on client devices**

        - **The setting must not exist on client devices**

        - **The setting occurs the following number of times:**

    - **Noncompliance severity for reports:** Specify the severity level that is reported if this compliance rule fails. The available severity levels are the following:

        - **None** Computers that fail this compliance rule do not report a failure severity for Configuration Manager reports.

        - **Information** Computers that fail this compliance rule report a failure severity of **Information** for Configuration Manager reports.

        - **Warning** Computers that fail this compliance rule report a failure severity of **Warning** for Configuration Manager reports.

        - **Critical** Computers that fail this compliance rule report a failure severity of **Critical** for Configuration Manager reports.

        - **Critical with event** Computers that fail this compliance rule report a failure severity of **Critical** for Configuration Manager reports. This severity level is also logged as a Windows event in the application event log.

Click OK to close the Create Rule dialog box.

Step 6: Specify Supported Platforms for the Configuration Item

Use the following procedure to specify the supported platforms for the configuration item.

Supported platforms are the operating systems on which a configuration item is assessed for compliance.

To specify supported platforms for the configuration item

On the Supported Platforms page of the Create Configuration Item Wizard, specify one of the following options:

- **Select the versions of Windows that will assess this configuration item for compliance:** In the list, select the Windows versions on which you want the configuration item to be assessed for compliance, or click **Select all**.

- **Specify the version of Windows manually:** Click **Edit** to open the **Specify Windows Version Manually** dialog box, and then provide the full version number of the version of Windows on which you want the configuration item to be assessed for compliance.

  <div class="alert">


  > [!NOTE]
  > <P>You can use the <STRONG>winver.exe</STRONG> command at a Windows command prompt to display the full Windows version.</P>


  </div>

Click OK to close the Specify Windows Version Manually dialog box.

Note

This option is not displayed if you have selected the This configuration item contains application settings check box on the General page of the Wizard.

Step 7: Complete the Wizard

On the Summary page of the Wizard, review the actions that will be taken, and then complete the wizard. The new configuration item is displayed in the Configuration Items node in the Assets and Compliance workspace.

Поділитися через