Software name and vers

[DennisZhao]

I currently have both xp and 2000 workstations on my network, all should be running mccafee virus scan.

It is easy to run a report on which workstation has virus scan and the version, but what is the best way to list all the workstation without virus scan?

Any suggestions?

 

[tbrennans]

Well if your up to a SMS_DEF>mof mod:

This does McAfee and if you use EPO, there is some info on that also.



//=============================================================================

// - McAfee EPO Agent reporting. This gets the version from the registry

// - and reports in SMS.

//=============================================================================

#pragma namespace("\\\\.\\root\\cimv2")

#pragma deleteclass("McAfeeEPOAgent", NOFAIL)



[DYNPROPS]

class McAfeeEPOAgent

{

[key] string KeyName="";

string szPluginPath;

string szSoftwareID;

string szVersion;

string szAgentGUID;

};







//=================================================================

// Instance of McAfee EPO Agent Added by Mike Linkey

//=================================================================



[DYNPROPS]

instance of McAfeeEPOAgent

{

KeyName="McAfee EPO Agent";

[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Network Associates\\ePolicy Orchestrator\\Application Plugins\\EPOAGENT3000|Plugin Path"),

Dynamic, Provider("RegPropProv")] szPluginPath;

[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Network Associates\\ePolicy Orchestrator\\Application Plugins\\EPOAGENT3000|Software ID"),

Dynamic, Provider("RegPropProv")] szSoftwareID;

[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Network Associates\\ePolicy Orchestrator\\Application Plugins\\EPOAGENT3000|Version"),

Dynamic, Provider("RegPropProv")] szVersion;

[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Network Associates\\ePolicy Orchestrator\\Agent|AgentGUID"),

Dynamic, Provider("RegPropProv")] szAgentGUID;



};



//===================

//Reporting Class

//===================

#pragma namespace("\\\\.\\root\\cimv2\\SMS")

#pragma deleteclass("McAfeeEPOAgent", NOFAIL)



[SMS_Report(TRUE), SMS_Group_Name("McAfee EPO Agent"), SMS_Class_ID("MICROSOFT|McAfeeEPOAgent|1.0")]

class McAfeeEPOAgent : SMS_Class_Template

{

[SMS_Report(TRUE),key] string KeyName;

[SMS_Report(TRUE) ] string szPluginPath;

[SMS_Report(TRUE) ] string szSoftwareID;

[SMS_Report(TRUE) ] string szVersion;

[SMS_Report(TRUE) ] string szAgentGuid;

};



//`'`*._.*`'`*-

// Note: This class uses the registry property provider, which requires the class to be

// "removed" via the deleteclass command prior to changing the class structure.

// Note: This class contains multiple instances. This allows data for legacy, 4.5, and

// NetShield McAfee versions to report in a single class.

//`'`*._.*`'`*-



//`'`*._.*`'`*-

// McAfee Data Class

//`'`*._.*`'`*-



#pragma namespace("\\\\.\\root\\cimv2")

#pragma deleteclass("McAfee", NOFAIL)



[DYNPROPS]

class McAfee

{

[key] string KeyName="";

string szCurrentVersionNumber;

string szDatVersion;

string szEngineVer;

string szDatDate;

};



//`'`*._.*`'`*-

// Instance of McAfee for Version 4.5

//`'`*._.*`'`*-



[DYNPROPS]

instance of McAfee

{

KeyName="McAfee 4.5";

[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Network Associates\\TVD\\VirusScan|szCurrentVersionNumber"),

Dynamic, Provider("RegPropProv")] szCurrentVersionNumber;

[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Network Associates\\TVD\\Shared Components\\VirusScan Engine\\4.0.xx|szDatVersion"),

Dynamic, Provider("RegPropProv")] szDatVersion;

[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Network Associates\\TVD\\Shared Components\\VirusScan Engine\\4.0.xx|szEngineVer"),

Dynamic, Provider("RegPropProv")] szEngineVer;

[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Network Associates\\TVD\\Shared Components\\VirusScan Engine\\4.0.xx|szDatDate"),

Dynamic, Provider("RegPropProv")] szDatDate;

};



//`'`*._.*`'`*-

// Instance of McAfee for Version 7.0 Added by Mike Linkey

//`'`*._.*`'`*-



[DYNPROPS]

instance of McAfee

{

KeyName="McAfee Enterprise 7.0";

[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Network Associates\\TVD\\VirusScan Enterprise\\CurrentVersion|szProductVer"),

Dynamic, Provider("RegPropProv")] szCurrentVersionNumber;

[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Network Associates\\TVD\\VirusScan Enterprise\\CurrentVersion|szVirDefVer"),

Dynamic, Provider("RegPropProv")] szDatVersion;

[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Network Associates\\TVD\\VirusScan Enterprise\\CurrentVersion|szEngineVer"),

Dynamic, Provider("RegPropProv")] szEngineVer;

[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Network Associates\\TVD\\VirusScan Enterprise\\CurrentVersion|szVirDefDate"),

Dynamic, Provider("RegPropProv")] szDatDate;

};



//`'`*._.*`'`*-

// Instance of McAfee for Version 4.03 and older...

//`'`*._.*`'`*-



[DYNPROPS]

instance of McAfee

{

KeyName="McAfee Legacy";

[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\McAfee\\VirusScan|szProductVer"),

Dynamic, Provider("RegPropProv")] szCurrentVersionNumber;

[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\McAfee\\VirusScan|szVirDefVer"),

Dynamic, Provider("RegPropProv")] szDatVersion;

[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\McAfee\\VirusScan|szEngineVer"),

Dynamic, Provider("RegPropProv")] szEngineVer;

[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\McAfee\\VirusScan|szVirDefDate"),

Dynamic, Provider("RegPropProv")] szDatDate;

};



//`'`*._.*`'`*-

// Instance of McAfee for 4.5 Server (NetShield)

//`'`*._.*`'`*-



[DYNPROPS]

instance of McAfee

{

KeyName="McAfee Server (NetShield)";

[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Network Associates\\TVD\\NetShield NT\\CurrentVersion|szProductVer"),

Dynamic, Provider("RegPropProv")] szCurrentVersionNumber;

[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Network Associates\\TVD\\NetShield NT\\CurrentVersion|szVirDefVer"),

Dynamic, Provider("RegPropProv")] szDatVersion;

[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Network Associates\\TVD\\NetShield NT\\CurrentVersion|szEngineVer"),

Dynamic, Provider("RegPropProv")] szEngineVer;

[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Network Associates\\TVD\\NetShield NT\\CurrentVersion|szVirDefDate"),

Dynamic, Provider("RegPropProv")] szDatDate;

};



//`'`*._.*`'`*-

// Reporting Class for McAfee

//`'`*._.*`'`*-



#pragma namespace("\\\\.\\root\\cimv2\\SMS")

#pragma deleteclass("McAfee", NOFAIL)



[SMS_Report(TRUE), SMS_Group_Name("McAfee Virus Scan"), SMS_Class_ID("MICROSOFT|McAfee|1.0")]

class McAfee : SMS_Class_Template

{

[SMS_Report(TRUE),key] string KeyName;

[SMS_Report(TRUE) ] string szCurrentVersionNumber;

[SMS_Report(TRUE) ] string szDatVersion;

[SMS_Report(TRUE) ] string szEngineVer;

[SMS_Report(TRUE) ] string szDatDate;

};

 

[DennisZhao]

Would I be able to pull the verion of the virus scan definition file without making the mod?

 

[tbrennans]

Well, if you look at that example, it's pulling everything out of the registry, I dont have access to a mcafee install at the moment, but if you inventoried the dat file, it would probably do the trick, that said I think that file's name changes with every release, if that is the case it would make the task extremely hard as you would have to make a new name in the software inventory for everytime the file changed its name.

If it always stays the same but had a different version (which I dont think is the case) it would be fairly simple.

That is why extending the sms_def.mof file is the way to go.

Tim B

 

[DennisZhao]

Looks like I will go with your idea, since I haven't done any changes to the sms_def yet, I just have a few conerns:

1. There is a keyname="McAfee Enterprise 7.0", but if I am running version 8.0, shoould I change the keyname? or create a copy of that section, and then rename it.

2. After this mod, how do I run reports/queries on the systems? Will there be new fields I can search on?

Is there anything else I need to know before I make the changes?

 

[tbrennans]

Take a look at the edit mof guide:

http://www.smsexpert.com/mof/default.asp

and below is just waht you need.

From Jerry Dismukes,

I had to edit the McAfee portion of the mof. Looks like either 8.0 or the epo agent changed registry locations for a few things. I think I left all the legacy stuff in as well, but haven't had time to clean it up.


// <:[-<>>>>>>>>>>>>>>>>>>>>>-Network Associates/McAfee Anti-Virus-<<<<<<<<<<<<<<<<<<<>-]:>

//`'`*._.*`'`*-
// Note: This class uses the registry property provider, which requires the class to be // "removed" via the deleteclass command prior to changing the class structure.
// Note: This class contains multiple instances. This allows data for legacy, 4.5, and // NetShield McAfee versions to report in a single class.
//`'`*._.*`'`*-

//`'`*._.*`'`*-
// McAfee Data Class
//`'`*._.*`'`*-

#pragma namespace("\\\\.\\root\\cimv2")
#pragma deleteclass("McAfee", NOFAIL)

[DYNPROPS]
class McAfee
{
[key] string KeyName="";
string szCurrentVersionNumber;
string szDatVersion;
string szEngineVer;
string szDatDate;
};

//`'`*._.*`'`*-
// Instance of McAfee for Version 4.5
//`'`*._.*`'`*-

[DYNPROPS]
instance of McAfee
{
KeyName="McAfee 4.5";
[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Network Associates\\TVD\\VirusScan|szCurrentVersionNumber"),
Dynamic, Provider("RegPropProv")] szCurrentVersionNumber;
[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Network Associates\\TVD\\Shared Components\\VirusScan Engine\\4.0.xx|szDatVersion"),

Dynamic, Provider("RegPropProv")] szDatVersion;
[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Network Associates\\TVD\\Shared Components\\VirusScan Engine\\4.0.xx|szEngineVer"),
Dynamic, Provider("RegPropProv")] szEngineVer;
[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Network Associates\\TVD\\Shared Components\\VirusScan Engine\\4.0.xx|szDatDate"),
Dynamic, Provider("RegPropProv")] szDatDate;
};

//`'`*._.*`'`*-
// Instance of McAfee for Version 4.03 and older...
//`'`*._.*`'`*-

[DYNPROPS]
instance of McAfee
{
KeyName="McAfee Legacy";

[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\McAfee\\VirusScan|szProductVer"),
Dynamic, Provider("RegPropProv")] szCurrentVersionNumber;

[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\McAfee\\VirusScan|szVirDefVer"),
Dynamic, Provider("RegPropProv")] szDatVersion;

[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\McAfee\\VirusScan|szEngineVer"),
Dynamic, Provider("RegPropProv")] szEngineVer;

[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\McAfee\\VirusScan|szVirDefDate"),
Dynamic, Provider("RegPropProv")] szDatDate;
};

//`'`*._.*`'`*-
// Instance of McAfee for 4.5 Server (NetShield)
//`'`*._.*`'`*-

[DYNPROPS]
instance of McAfee
{
KeyName="McAfee Server (NetShield)";
[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Network Associates\\TVD\\NetShield NT\\CurrentVersion|szProductVer"),
Dynamic, Provider("RegPropProv")] szCurrentVersionNumber;
[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Network Associates\\TVD\\NetShield NT\\CurrentVersion|szVirDefVer"),
Dynamic, Provider("RegPropProv")] szDatVersion;
[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Network Associates\\TVD\\NetShield NT\\CurrentVersion|szEngineVer"),
Dynamic, Provider("RegPropProv")] szEngineVer;
[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Network Associates\\TVD\\NetShield NT\\CurrentVersion|szVirDefDate"),
Dynamic, Provider("RegPropProv")] szDatDate;
};

//`'`*._.*`'`*-
// Instance of McAfee for Enterprise 8.0
//`'`*._.*`'`*-

[DYNPROPS]
instance of McAfee
{
KeyName="McAfee Enterprise 8.0";
[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Network Associates\\TVD\\VirusScan Enterprise\\CurrentVersion|szProductVer"),
Dynamic, Provider("RegPropProv")] szCurrentVersionNumber;
[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Network Associates\\TVD\\VirusScan Enterprise\\CurrentVersion|szVirDefVer"),
Dynamic, Provider("RegPropProv")] szDatVersion;
[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Network Associates\\TVD\\VirusScan Enterprise\\CurrentVersion|szEngineVer"),
Dynamic, Provider("RegPropProv")] szEngineVer;
[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Network Associates\\TVD\\VirusScan Enterprise\\CurrentVersion|szVirDefDate"),
Dynamic, Provider("RegPropProv")] szDatDate;
};

//`'`*._.*`'`*-
// Reporting Class for McAfee
//`'`*._.*`'`*-

#pragma namespace("\\\\.\\root\\cimv2\\SMS")
#pragma deleteclass("McAfee", NOFAIL)

[SMS_Report(TRUE), SMS_Group_Name("McAfee Virus Scan"), SMS_Class_ID("MICROSOFT|McAfee|1.0")]
class McAfee : SMS_Class_Template
{
[SMS_Report(TRUE),key] string KeyName;
[SMS_Report(TRUE) ] string szCurrentVersionNumber;
[SMS_Report(TRUE) ] string szDatVersion;
[SMS_Report(TRUE) ] string szEngineVer;
[SMS_Report(TRUE) ] string szDatDate;
};

// <:[-<>>>>>>>>>>>>>>>>END>>-Network Associates/McAfee Anti-Virus-<<END<<<<<<<<<<<<<<>-]:>


// And the epo

// <:[-<>>>>>>>>>>>>>>>>BEGIN-Network Associates/McAfee ePO Agent-<<END<<<<<<<<<<<<<<>-]:>
//`'`*._.*`'`*-
// McAfee ePO Agent Data Class
//`'`*._.*`'`*-
#pragma namespace("\\\\.\\root\\cimv2")
#pragma deleteclass("McAfee_ePO_Agent", NOFAIL)
[DYNPROPS]
class McAfee_ePO_Agent
{
[key] string KeyName="";
string szePOVersion;
string szePOName;
string szePOGUID;
string szePOInstallPath;
};
//`'`*._.*`'`*-
// Instance of McAfee ePO 3x
//`'`*._.*`'`*-
[DYNPROPS]
instance of McAfee_ePO_Agent
{
KeyName="McAfee ePO 3.x";
[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Network Associates\\ePolicy Orchestrator\\Agent|Installed Path"),
Dynamic, Provider("RegPropProv")] szePOInstallPath;
[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Network Associates\\ePolicy Orchestrator\\Application Plugins\\EPOAGENT3000|Version"),
Dynamic, Provider("RegPropProv")] szePOVersion;
[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Network Associates\\ePolicy Orchestrator\\Agent|ComputerName"),
Dynamic, Provider("RegPropProv")] szePOName;
[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Network Associates\\ePolicy Orchestrator\\Agent|AgentGUID"),
Dynamic, Provider("RegPropProv")] szePOGUID;
};
//`'`*._.*`'`*-
// Reporting Class for McAfee ePO Agent
//`'`*._.*`'`*-
#pragma namespace("\\\\.\\root\\cimv2\\SMS")
#pragma deleteclass("McAfee_ePO_Agent", NOFAIL)
[SMS_Report(TRUE), SMS_Group_Name("McAfee ePO Agent"), SMS_Class_ID("MICROSOFT|McAfee_ePO|1.0")]
class McAfee_ePO_Agent : SMS_Class_Template
{
[SMS_Report(TRUE),key] string KeyName;
[SMS_Report(TRUE) ] string szePOVersion;
[SMS_Report(TRUE) ] string szePOName;
[SMS_Report(TRUE) ] string szePOGUID;
[SMS_Report(TRUE) ] string szePOInstallPath;
};
// <:[-<>>>>>>>>>>>>>>>>END>>-Network Associates/McAfee ePO Agent-<<END<<<<<<<<<<<<<<>-]:>

 

[tbrennans]

oh so answer your question, it will create a attribute class in wmi that will show up like everything else does in the db.

so you would say, create a new query, and this would be in the system resource attribute tables, and you would have options like KeyName;
[SMS_Report(TRUE) ] string szePOVersion;
[SMS_Report(TRUE) ] string szePOName;
[SMS_Report(TRUE) ] string szePOGUID;
[SMS_Report(TRUE) ] string szePOInstallPath;

as seen in the last couple lines of the mof above.

 

[DennisZhao]

I extended the sms_def file, under c:/program file/inbox/clifiles.src/hinv, but when I run a new query, I do not see the new keynames under system resource.

On the link you sent me, it said to compile the MOF Class after modifying it. What does that requie me to do?

 

[ncotton]

c:\windows\system32\wbem\mofcomp.exe -N:root\cimv2 c:\sms\inboxes\clifiles.src\hinv\sms_def.mof

i think

Hope this Helps.

Neil J Cotton
njc Information Systems
Systems Consultant

 

[tbrennans]

Careful in there :-D Read this and it will go step by step on the proper procedure.

http://www.smsexpert.com/mof/guide.asp?id=2169

 

[ncotton]

Tim, has Jeff asked you to push that one? hehehe. I've recommended it to a few people too.

Hope this Helps.

Neil J Cotton
njc Information Systems
Systems Consultant

 

[ncotton]

btw, I also have a MOF Guide to modifying hardware inventory, nothing like Jeffs though, but you are welcome to have it. Contact me through the address
njcinfosys at btinternet dot com

Hope this Helps.

Neil J Cotton
njc Information Systems
Systems Consultant

 

[tbrennans]

Actually I think Mike Schultz (now at MS) made that (originally), But I think David Jaffe made changes when he took over the site...but I have no clue! I can't keep up with all this :-D

 

[ncotton]

The MOF guide was writen by Jeff Gilbert, from scratch, from SMSExp, who also went to Microsoft in December05\January this year as a tech-writter for SMS Dept.
He's been working ont he MOF guide for over a year, I saw an early draft of some of it.

Mike Shultz did do one a few years ago, but was more generic, and not as intense.

Hope this Helps.

Neil J Cotton
njc Information Systems
Systems Consultant

 

[tbrennans]

Thanks for the correction credit due where deserved!