Inventory and rationalization: we manage software assets of large companies. Experience using Microsoft Assessment and Planning Toolkit
Recently on Habré there was an overview article about Microsoft MAPT tools . The program is designed to conduct an inventory of IT infrastructure, help in migrating machines to the new OS version, estimating server load, consolidating them on the Hyper-V platform, etc. We decided to talk about the real experience of using this tool to solve real business problems.
The task that our company faced was to conduct an accurate and accurate inventory of all software on users' workstations with its subsequent rationalization. The latter is based on the creation of the so-called MAL, or a list of standard software, which will be allowed for use in the company. The main idea is to manage the software , namely, to reduce the number of software, standardizing on versions, editions and languages where it is possible, as well as taking into account the functionality of applications and some licensing issues. By reducing the number of allowed software , we not only save on licenses , but also reduce the cost of supporting custom applications .
The main advantage of MAPT over other inventory tools is that the solution is free, the relative ease of use, and the architecture of the solution without the use of agent software installed on client workstations.
It is these advantages that tipped the scales in favor of the MAPT tools when choosing a technical tool for solving the set task. In the article we will tell you what solutions when working with MAPT are offered and implemented by our company as part of the company 's comprehensive examination program. Its goal is to estimate the costs of transforming, standardizing and optimizing IT processes at Customer’s geographically distributed sites and the subsequent outsourcing of certain processes.
')
Of course, MAPT, being a free solution, is not without serious flaws. Among them: the limited collection of inventory data, reports that are ready out of the box, the ability to easily configure inventory and reporting parameters using the GUI interface. Also a serious limitation is the ability of MAPT to update data on the software and configuration of those workstations and servers that have already been inventoried once.
Therefore, we will talk about what we are proposing specifically to cope with some of the problems mentioned. As part of the publication, only issues of the inventory of MAPT users' workplaces will be considered, however, an inventory of Windows / Unix and SQL servers is also possible.
Introductory information :
The customer is a global manufacturing company.
In support of ICL Services are:
In production locations, the IT infrastructure is unique, poorly integrated with processes in office centers, and software is not standardized, and, as a result, such a model is not sufficiently effective in terms of economy, manageability and cost of support. It was these locations that we needed to prepare for future standardization based on centralized standards and processes.
Initial data:
Tasks:
In this article we will touch on the first 4 points, since MAPT was used to perform these tasks. Due to the time constraints on the implementation of the task and the strengths of local IT professionals in the locations, as well as the expected large amounts of data, the solution had to be simple, installed quickly and minimally interact with the user. The choice fell on MAPT, as a free solution that does not use client software - agents.
However, in addition to the benefits, the MAPT solution needed to be refined to achieve its goals.
For example, the reports generated by MAPT were far from “ideal,” namely, they did not contain information about the software installed on each specific machine and all users of a specific workstation. We decided to modify the MAPT functionality, the benefit is that all the possibilities for this are available without the need for complex programming of add-ons, plug-ins or individual utilities. It turned out that the program can be “completed” by adding its xml templates and stored procedures to the SQL database. Spending some time trying to figure out the internal architecture of MAPT, we added an inventory of folders in the root of the C: drive, folders in% Program Files%, application shortcuts, got a list of users who ever logged on to the workstation, the list of addons Microsoft Office and Internet Explorer and a number of other supporting data that made it easier for us to collect and analyze data. The changes made it possible to make the data on the installed software more accurate, reliable and complete.
We will look at how the utility works with Windows machines on a specific script, show you how to figure out what is actually going, where to find the logs and configuration files. We expect that the reader, at a minimum, has heard of WMI and has basic knowledge of MS SQL. Much of what is described below is not in the documentation and is the result of our analysis of how MAPT works.
Unfortunately, through the GUI interface it will not be possible to specifically specify the data that needs to be collected from the machines. But it turned out that MAPT is a very flexible tool, if you go a little deeper into the interface part. The utility can execute queries on remote WMI machines, PowerShell scripts, send commands via SSH and receive SQL query results for Oracle and MS SQL DBMS. Almost all the logic of work is described in xml files. They indicate what to do with the machines in a particular inventory scenario. If you wish, you can create your own scripts or tailor them to your needs. This will allow, for example, to reduce the amount of traffic transmitted over the network, or add something that is not enough out of the box.
Installation
You can install MAPT both on the client (Windows 7 SP1, Windows 8) and on the server OS (Windows Server 2008 R2, Windows Server 2012). The program installs SQL Server 2012 Express LocalDB by default. But we will need SMSS (SQL Server Management Studio) to work directly with the database, so before installing the MAP Toolkit itself, I recommend to install SQL Express 2012 With Tools (SQLEXPRWT_x64_ENU.exe). Please note that SQL must be installed before installing the MAP Toolkit on the same machine, and the SQL instance must be called MAPS. Only in this case the MAPT installer will find SQL Instance, configure it and will not install SQL Server 2012 Express LocalDB. Detailed system requirements for installing MAPT can be found on the download page .
MAPT performs machine manipulations using remote access via the network. Installing agents on the machines is not required, but you need to configure firewalls and take into account the network load during the inventory. If you believe Microsoft , then each machine will generate up to 1 MB of traffic. In the case of low network bandwidth, try reducing the number of machines that are simultaneously undergoing inventory by editing the MapToolkit.exe.config file, as indicated here .
Before making an inventory on live machines, you can try MAPT with the demo database, which is located on the MAPT Training Kit download page . There are also examples of Excel reports (MAP_sample_Documents).
MAP Toolkit is installed in the “C: \ Program Files \ Microsoft Assessment and Planning Toolkit” folder
The Metadata folder contains xml templates that are responsible for the logic of the inventory. When MAPT starts, it automatically picks up all the xml files from this folder and tries to process them. We will refer to them in the future.
Run the program, create a clean database on demand and click on the “Perform An Inventory” button, MAPT will offer to choose one of the inventory scenarios:
The scripts available from the box are listed in the DisplayedScenarios.xml file:
In parentheses are those technologies that are used in each scenario.
Script Windows Computers
Consider the work of the program on the example of the script Windows Computers.
DisplayedScenarios.xml from the Metadata folder indicates that the Windows Computers script depends on the AllGMI DataGroup:
DataGroups and their dependencies are described in the DataGroups.xml file:
The groups on which AllWMI depends also have their own dependencies. Based on this, an order is drawn up in which the inventory should take place on each machine.
The name DataGroup, in turn, is referenced by the inventory classes, which are described in DataGroup files * .xml.
On each of the machines we are inventorying, a WMI query "SELECT * FROM Win32_PageFileSetting" will be executed. After the WMI query is executed, the Win_Inventory.InsupdDevicesWin32_PageFileSetting stored procedure from the database will be called. As a parameter, it will receive the MaximumSize value and add in turn records to the required database tables.
This query will be executed for each script that has a GroupName named Base in the dependencies.
Now we will start SQL Server Management Studio and connect to the local MAPS instance.
The collector_id, dns_host_name, device_number parameters are passed to all stored procedures during the inventory. The value of the maximum_size parameter is obtained from the remote machine by the WMI request described above. This procedure updates the entries in the Core_Inventory.Devices table, which contains all the devices found during the inventory. Each device in the database is identified by the DeviceNumber field. This field is the primary key in the Core_Inventory.Devices table.
It is worth remembering that MAPT does not inventory the same device twice. If the data about the car has already entered the database, then the next time MAPT will simply ignore it. Therefore, strictly speaking, MAPT will be useful only in cases of the need for a one-time inventory, and for software asset management processes it is better to use more appropriate means for this. This logic allows you to run MAPT repeatedly on the same collection of machines and collect information only about new machines available on the network. But in order to collect fresh data, you will have to either create a new database or delete an entry from the Core_Inventory.Devices table. Cascade delete will destroy device entries in other tables. Of course, you should make copies before making changes to the database manually.
Similarly, you can follow the logic of the entire script and see if the data you need may be included in the inventory.
Inventory classes
Above, we gave an example for only one of the inventory classes - WmiClass. All available classes can be found in the xml schema, which is “hidden” inside the file “c: \ Program Files \ Microsoft Assessment and Planning Toolkit \ bin \ Microsoft.AssessmentPlatform.InventoryCommon.dll”. Open the file with a text editor, find the line “xs: schema” and save the found text piece to a new file with the xsd or xml extension.
The following classes are available:
ADClass - allows you to inventory objects in Active Directory using LDAP queries.
In the example above, an LDAP query is executed (objectClass = user) and some of the received attributes are stored in the database. Note that before the LDAP query, a SQL query (PreprocessingQuery) is executed, the results of which are used in the $ domainDN and $ NetBIOSDomain variables.
PerfmonClass - allows you to use performance counters.
RegistryClass - allows you to get values from the registry. Remote Registry service must be running on the remote machine.
Example from DataGroup64BitWindows.xml:
This class will be called for each of the first-level subkeys from the HKLM \ Software \ Wow6432Node \ Microsoft \ Windows \ CurrentVersion \ Uninstall branch (due to the use of the * symbol in the ClassName attribute). The value of the variable $ 0 will be replaced with the name of the key during the call to the stored procedure.
SchemaGenClass - the source from which the class receives data is not clear. A call to this class is not bound to a DataGroup.
SqlClass - allows you to perform SQL queries.
SshClass - allows you to execute commands using the SSH protocol. Used to inventory Linux machines.
VmwareClass - allows you to collect information about VMWare ESX hosts and host machines using the VMWare API.
WmiClass - allows you to perform WMI requests.
Example from DataGroupBase.xml:
PowerShellClass - allows you to run PowerShell scripts.
Reports
At the output, the MAP Toolkit provides a report in xlsx format for Microsoft Office Excel. The DocumentTemplate folder contains the Template.xlsx file that is used to generate reports. , MS Excel. xml XMLLibrary. , «Windows 7 Readiness» Windows7Assessment.xml.
, xlsx , , ..
SELECT, Excel .
MS Excel,
Logging
, : %LOCALAPPDATA%\Microsoft\MAP\MapToolkit.log. , Logging.cfg, . AppConfigInfo.xml, . , , MAPT 5 .
, XML , , , , «» , ( ), , , . , , , ..
. – Software Recognition, . , .
, , MAL (Master Application List). 100% , , - , ..
MAL, , , SAM. ( ).
, , «» « – ». , 7-Zip 9.20.
MAPT , 8500 (-) 300 , , .
, MAPT. WMI, Active Directory, , , VmWare, SQL. , , Powershell, . – . , MAPT .
ShamRous ignatyev
The task that our company faced was to conduct an accurate and accurate inventory of all software on users' workstations with its subsequent rationalization. The latter is based on the creation of the so-called MAL, or a list of standard software, which will be allowed for use in the company. The main idea is to manage the software , namely, to reduce the number of software, standardizing on versions, editions and languages where it is possible, as well as taking into account the functionality of applications and some licensing issues. By reducing the number of allowed software , we not only save on licenses , but also reduce the cost of supporting custom applications .
The main advantage of MAPT over other inventory tools is that the solution is free, the relative ease of use, and the architecture of the solution without the use of agent software installed on client workstations.
It is these advantages that tipped the scales in favor of the MAPT tools when choosing a technical tool for solving the set task. In the article we will tell you what solutions when working with MAPT are offered and implemented by our company as part of the company 's comprehensive examination program. Its goal is to estimate the costs of transforming, standardizing and optimizing IT processes at Customer’s geographically distributed sites and the subsequent outsourcing of certain processes.
')
Of course, MAPT, being a free solution, is not without serious flaws. Among them: the limited collection of inventory data, reports that are ready out of the box, the ability to easily configure inventory and reporting parameters using the GUI interface. Also a serious limitation is the ability of MAPT to update data on the software and configuration of those workstations and servers that have already been inventoried once.
Therefore, we will talk about what we are proposing specifically to cope with some of the problems mentioned. As part of the publication, only issues of the inventory of MAPT users' workplaces will be considered, however, an inventory of Windows / Unix and SQL servers is also possible.
Introductory information :
The customer is a global manufacturing company.
In support of ICL Services are:
- main components of the data center server infrastructure;
- office jobs in 11 locations in 9 European countries;
- user workplace infrastructure is standardized;
- only standard software is used;
- All major ITSM processes are implemented.
In production locations, the IT infrastructure is unique, poorly integrated with processes in office centers, and software is not standardized, and, as a result, such a model is not sufficiently effective in terms of economy, manageability and cost of support. It was these locations that we needed to prepare for future standardization based on centralized standards and processes.
Initial data:
- 11 production facilities
- More than 2000 users
- Not standardized software
- Lack of accurate data on installed software
- Lack of software installation automation processes
- Lack of accurate data on the number of users
- The lack of reliable data on the exact number of workstations and servers
- Short time
Tasks:
- in a short time to conduct a software inventory with the aim of further estimating the cost of conversion;
- get accurate data on the number of workstations and users;
- obtain reliable and accurate data on the software used;
- rationalize the inventory of software in order to obtain the so-called MAL (Master Application List, list of standard applications);
- optimize MAL based on data about applications that we already have in our portfolio.
In this article we will touch on the first 4 points, since MAPT was used to perform these tasks. Due to the time constraints on the implementation of the task and the strengths of local IT professionals in the locations, as well as the expected large amounts of data, the solution had to be simple, installed quickly and minimally interact with the user. The choice fell on MAPT, as a free solution that does not use client software - agents.
However, in addition to the benefits, the MAPT solution needed to be refined to achieve its goals.
For example, the reports generated by MAPT were far from “ideal,” namely, they did not contain information about the software installed on each specific machine and all users of a specific workstation. We decided to modify the MAPT functionality, the benefit is that all the possibilities for this are available without the need for complex programming of add-ons, plug-ins or individual utilities. It turned out that the program can be “completed” by adding its xml templates and stored procedures to the SQL database. Spending some time trying to figure out the internal architecture of MAPT, we added an inventory of folders in the root of the C: drive, folders in% Program Files%, application shortcuts, got a list of users who ever logged on to the workstation, the list of addons Microsoft Office and Internet Explorer and a number of other supporting data that made it easier for us to collect and analyze data. The changes made it possible to make the data on the installed software more accurate, reliable and complete.
We will look at how the utility works with Windows machines on a specific script, show you how to figure out what is actually going, where to find the logs and configuration files. We expect that the reader, at a minimum, has heard of WMI and has basic knowledge of MS SQL. Much of what is described below is not in the documentation and is the result of our analysis of how MAPT works.
Unfortunately, through the GUI interface it will not be possible to specifically specify the data that needs to be collected from the machines. But it turned out that MAPT is a very flexible tool, if you go a little deeper into the interface part. The utility can execute queries on remote WMI machines, PowerShell scripts, send commands via SSH and receive SQL query results for Oracle and MS SQL DBMS. Almost all the logic of work is described in xml files. They indicate what to do with the machines in a particular inventory scenario. If you wish, you can create your own scripts or tailor them to your needs. This will allow, for example, to reduce the amount of traffic transmitted over the network, or add something that is not enough out of the box.
Installation
You can install MAPT both on the client (Windows 7 SP1, Windows 8) and on the server OS (Windows Server 2008 R2, Windows Server 2012). The program installs SQL Server 2012 Express LocalDB by default. But we will need SMSS (SQL Server Management Studio) to work directly with the database, so before installing the MAP Toolkit itself, I recommend to install SQL Express 2012 With Tools (SQLEXPRWT_x64_ENU.exe). Please note that SQL must be installed before installing the MAP Toolkit on the same machine, and the SQL instance must be called MAPS. Only in this case the MAPT installer will find SQL Instance, configure it and will not install SQL Server 2012 Express LocalDB. Detailed system requirements for installing MAPT can be found on the download page .
MAPT performs machine manipulations using remote access via the network. Installing agents on the machines is not required, but you need to configure firewalls and take into account the network load during the inventory. If you believe Microsoft , then each machine will generate up to 1 MB of traffic. In the case of low network bandwidth, try reducing the number of machines that are simultaneously undergoing inventory by editing the MapToolkit.exe.config file, as indicated here .
Before making an inventory on live machines, you can try MAPT with the demo database, which is located on the MAPT Training Kit download page . There are also examples of Excel reports (MAP_sample_Documents).
MAP Toolkit is installed in the “C: \ Program Files \ Microsoft Assessment and Planning Toolkit” folder
The Metadata folder contains xml templates that are responsible for the logic of the inventory. When MAPT starts, it automatically picks up all the xml files from this folder and tries to process them. We will refer to them in the future.
Run the program, create a clean database on demand and click on the “Perform An Inventory” button, MAPT will offer to choose one of the inventory scenarios:
The scripts available from the box are listed in the DisplayedScenarios.xml file:
- Windows Computers (WMI)
- Linux / UNIX computers (SSH)
- VMware computers (VMWare)
- Active Devices and Users (WMI, AD)
- Exchange Server (WMI, AD, PowerShell)
- Forefront Endpoint Protection Server (WMI, PowerShell)
- Lync Server (PowerShell, SQL Windows, SQL Native, WMI)
- SWID tagging (WMI, PowerShell)
- SQL Server Inventory (aka SQL Light) (WMI)
- SQL Server with Database Details (WMI, SQL Windows, SQL Native)
- Windows Azure Platform Migration (WMI, SQL Windows, SQL Native)
- Oracle (WMI, SSH, Oracle)
- Windows OEM Licensing compliance (WMI, PowerShell)
- Client Access Tracking for Windows Server 2012 (WMI)
- Client Access Tracking for SQL Server 2012 (WMI)
- Client Access Tracking for Configuration Manager (WMI)
- Client Access Tracking for SharePoint Server 2013 (WMI)
- Client Access Tracking for Remote Desktop Services (WMI, PowerShell)
In parentheses are those technologies that are used in each scenario.
Script Windows Computers
Consider the work of the program on the example of the script Windows Computers.
DisplayedScenarios.xml from the Metadata folder indicates that the Windows Computers script depends on the AllGMI DataGroup:
<Scenarios> <!-- Windows Computers (WMI)--> <Scenario Name="Windows computers" DisplayOrder="0"> <Description Name="Description_1"> InventoryAssessmentWizard.TechnologyPickerPage.DescriptionLabel.WindowsComputers.Text </Description> <DependsOn> <DataGroup Name="AllWMI" /> </DependsOn> </Scenario> DataGroups and their dependencies are described in the DataGroups.xml file:
<DataGroup Name="AllWMI" > <DependsOn> <DataGroup Name="Base" /> <DataGroup Name="Client" /> <DataGroup Name="Server" /> <DataGroup Name="BrowserTier1" /> <DataGroup Name="BrowserTier2" /> <DataGroup Name="BrowserTier3" /> <DataGroup Name="BrowserTier4" /> <DataGroup Name="FailoverCluster" /> <DataGroup Name="GuestHostHyperVTier0" /> <DataGroup Name="IISTier0" /> <DataGroup Name="IISTier1" /> <DataGroup Name="IISTier2" /> <DataGroup Name="SCCMServerTier1" /> <DataGroup Name="SCCMServerTier2" /> <DataGroup Name="SQLTier0" /> <DataGroup Name="WindowsServicesFiles" /> <DataGroup Name="64BitWindows" /> <DataGroup Name="LyncTier1" /> <DataGroup Name="SharePoint" /> </DependsOn> </DataGroup> The groups on which AllWMI depends also have their own dependencies. Based on this, an order is drawn up in which the inventory should take place on each machine.
The name DataGroup, in turn, is referenced by the inventory classes, which are described in DataGroup files * .xml.
Let's look, for example, in the DataGroupBase.xml file:
<WmiClass Namespace="root\CIMV2" ClassName="Win32_PageFileSetting" Guid="DAD0DF3F-44A5-4184-9E2B-225EF2B9176B"> <DataGroup Name="Base" /> <Query>SELECT * FROM Win32_PageFileSetting</Query> <StoredProcedure Name="[Win_Inventory].[InsupdDevicesWin32_PageFileSetting]" /> <Attribute Source="MaximumSize" Destination="@maximum_size" /> </WmiClass> On each of the machines we are inventorying, a WMI query "SELECT * FROM Win32_PageFileSetting" will be executed. After the WMI query is executed, the Win_Inventory.InsupdDevicesWin32_PageFileSetting stored procedure from the database will be called. As a parameter, it will receive the MaximumSize value and add in turn records to the required database tables.
This query will be executed for each script that has a GroupName named Base in the dependencies.
Now we will start SQL Server Management Studio and connect to the local MAPS instance.
Find the Win_Inventory.InsupdDevicesWin32_PageFileSetting stored procedure and see its contents:
ALTER PROCEDURE [Win_Inventory].[InsupdDevicesWin32_PageFileSetting] ( ----------These Are The Required Parameters------------- @collector_id int, @dns_host_name nvarchar(256), @device_number uniqueidentifier, -------------------------------------------------------- @maximum_size bigint = NULL ) AS SET NOCOUNT ON DECLARE @err_code INT /* ********************************************************************* * Update An Existing Row In [dbo].[devices] Table ********************************************************************* */ BEGIN UPDATE [Core_Inventory].[Devices] SET [MaximumSize] = COALESCE(@maximum_size, [MaximumSize]), [UpdateCollectorId] = @collector_id, [UpdateDatetime] = GETUTCDATE(), [WmiDatetime] = GETUTCDATE() WHERE [DeviceNumber] = @device_number SET @err_code = @@ERROR END RETURN @err_code The collector_id, dns_host_name, device_number parameters are passed to all stored procedures during the inventory. The value of the maximum_size parameter is obtained from the remote machine by the WMI request described above. This procedure updates the entries in the Core_Inventory.Devices table, which contains all the devices found during the inventory. Each device in the database is identified by the DeviceNumber field. This field is the primary key in the Core_Inventory.Devices table.
It is worth remembering that MAPT does not inventory the same device twice. If the data about the car has already entered the database, then the next time MAPT will simply ignore it. Therefore, strictly speaking, MAPT will be useful only in cases of the need for a one-time inventory, and for software asset management processes it is better to use more appropriate means for this. This logic allows you to run MAPT repeatedly on the same collection of machines and collect information only about new machines available on the network. But in order to collect fresh data, you will have to either create a new database or delete an entry from the Core_Inventory.Devices table. Cascade delete will destroy device entries in other tables. Of course, you should make copies before making changes to the database manually.
Similarly, you can follow the logic of the entire script and see if the data you need may be included in the inventory.
Inventory classes
Above, we gave an example for only one of the inventory classes - WmiClass. All available classes can be found in the xml schema, which is “hidden” inside the file “c: \ Program Files \ Microsoft Assessment and Planning Toolkit \ bin \ Microsoft.AssessmentPlatform.InventoryCommon.dll”. Open the file with a text editor, find the line “xs: schema” and save the found text piece to a new file with the xsd or xml extension.
The following classes are available:
ADClass - allows you to inventory objects in Active Directory using LDAP queries.
Example from DataGroupActiveDevicesTier1.xml:
<ADClass ClassName="ADUserAccounts" Guid="94574F36-8024-4377-A72D-43FFB7ED60B2" Namespace="LDAP://$domainDN"> <DataGroup Name="ActiveDevicesTier1"/> <!-- == The Exchange usage tracking scenario already set up the necessary structure for == identifying the device used as the "victim" for collecting the user mailbox information. == We're reusing this logic and using the same machine to collect general user information == for the Active Devices scenario. --> <CollectIf Expr="ShouldCollectExchangeADMailboxItems"/> <PreprocessingQuery SubstitutionTargets="Namespace AttributeDefault"> <Variable Name="domainDN"/> <Variable Name="NetBIOSDomain"/> <Sql> SELECT eafd.[NCName] AS [domainDN], eafd.[NETBIOsName] AS [NetBIOSDomain] FROM [UT_Exchange_Inventory].[AdForestDomains] eafd WHERE eafd.[DeviceNumber] = @device_number </Sql> </PreprocessingQuery> <Query> (objectClass=user) </Query> <StoredProcedure Name="[ZZGenerated].[InsupdAdDiscoveredUsers]" Table="[UT_ActiveDaU_Inventory].[AdDiscoveredUsers]"/> <Attribute Source="objectSid" Destination="@ObjectSid" DestinationType="Sid" IsKeyField="true"/> <Attribute Source="accountExpires" Destination="@AccountExpires" SourceType="DateTicksSince1601" DestinationType="DateTime"/> <Attribute Source="cn" Destination="@Cn" /> <Attribute Source="displayName" Destination="@DisplayName" /> <Attribute Source="distinguishedName" Destination="@DistinguishedName" /> <Attribute Source="givenName" Destination="@GivenName" /> <Attribute Source="lastLogon" Destination="@LastLogon" SourceType="DateTicksSince1601" DestinationType="DateTime" /> <Attribute Source="lastLogonTimestamp" Destination="@LastLogonTimestamp" SourceType="DateTicksSince1601" DestinationType="DateTime" /> <Attribute Source="logonCount" Destination="@LogonCount" /> <Attribute Source="middleName" Destination="@MiddleName" /> <Attribute Source="name" Destination="@Name" /> <Attribute Default="$NetBIOSDomain" Destination="@NetBIOsDomain"/> <Attribute Source="objectGuid" Destination="@ObjectGuid" DestinationType="Guid" /> <Attribute Source="primaryGroupID" Destination="@PrimaryGroupID" /> <Attribute Source="pwdLastSet" Destination="@PwdLastSet" SourceType="DateTicksSince1601" DestinationType="DateTime" /> <Attribute Source="sAMAccountName" Destination="@SAMAccountName" /> <Attribute Source="sAMAccountType" Destination="@SAMAccountType" /> <Attribute Source="sn" Destination="@Sn" /> <Attribute Source="userAccountControl" Destination="@UserAccountControl" /> <Attribute Source="whenChanged" Destination="@WhenChanged" SourceType="DateTicksSince1601" DestinationType="DateTime" /> <Attribute Source="whenCreated" Destination="@WhenCreated" SourceType="DateTicksSince1601" DestinationType="DateTime" /> </ADClass> In the example above, an LDAP query is executed (objectClass = user) and some of the received attributes are stored in the database. Note that before the LDAP query, a SQL query (PreprocessingQuery) is executed, the results of which are used in the $ domainDN and $ NetBIOSDomain variables.
PerfmonClass - allows you to use performance counters.
RegistryClass - allows you to get values from the registry. Remote Registry service must be running on the remote machine.
Example from DataGroup64BitWindows.xml:
<RegistryClass Namespace="HKEY_LOCAL_MACHINE" ClassName="Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" Guid="B4FAED2A-1402-4209-8A77-FF52417E0E0F"> <DataGroup Name="64BitWindows" /> <StoredProcedure Name="[ZZGenerated].[InsupdProductsUninstall]" /> <Attribute Source="$0" Destination="@ProductCode" IsKeyField="true" /> <Attribute Source="DisplayName" SourceType="String" /> <Attribute Source="DisplayVersion" SourceType="String" /> <Attribute Source="InstallDate" SourceType="String" /> <Attribute Source="InstallLocation" SourceType="String" /> <Attribute Source="ParentDisplayName" SourceType="String" /> <Attribute Source="ParentKeyName" SourceType="String" /> <Attribute Source="Publisher" SourceType="String" /> <Attribute Source="SystemComponent" SourceType="DWord String" DestinationType="long" /> <Attribute Source="VersionMajor" SourceType="DWord String" DestinationType="long" /> <Attribute Source="VersionMinor" SourceType="DWord String" DestinationType="long" /> </RegistryClass> This class will be called for each of the first-level subkeys from the HKLM \ Software \ Wow6432Node \ Microsoft \ Windows \ CurrentVersion \ Uninstall branch (due to the use of the * symbol in the ClassName attribute). The value of the variable $ 0 will be replaced with the name of the key during the call to the stored procedure.
SchemaGenClass - the source from which the class receives data is not clear. A call to this class is not bound to a DataGroup.
SqlClass - allows you to perform SQL queries.
SshClass - allows you to execute commands using the SSH protocol. Used to inventory Linux machines.
VmwareClass - allows you to collect information about VMWare ESX hosts and host machines using the VMWare API.
WmiClass - allows you to perform WMI requests.
Example from DataGroupBase.xml:
<WmiClass Namespace="root\CIMV2" ClassName="ComputerSystemProduct" Guid="110F25FB-ECF2-4397-BB2D-0B3D493167B0"> <DataGroup Name="Base" /> <Query>SELECT * FROM Win32_ComputerSystemProduct</Query> <StoredProcedure Name="[ZZGenerated].[InsupdComputerSystemProduct]" Table="[Win_Inventory].[ComputerSystemProduct]" /> <Attribute Source="Caption"/> <Attribute Source="Description"/> <Attribute Source="IdentifyingNumber"/> <Attribute Source="Name"/> <Attribute Source="SKUNumber"/> <Attribute Source="UUID" Destination="@UUiD"/> <Attribute Source="Vendor"/> <Attribute Source="Version"/> </WmiClass> PowerShellClass - allows you to run PowerShell scripts.
Reports
At the output, the MAP Toolkit provides a report in xlsx format for Microsoft Office Excel. The DocumentTemplate folder contains the Template.xlsx file that is used to generate reports. , MS Excel. xml XMLLibrary. , «Windows 7 Readiness» Windows7Assessment.xml.
<Worksheet Name="DiscoveredApplications" Template="Default"> <Constant Name="Title" Type="String">Discovered Applications</Constant> <Constant Name="Description" Type="String">This worksheet describes up to 60,000 applications discovered through the inventory process on client machines and provides a count of the number of times a particular version of the software was found. The data in this sheet is based solely upon computers where a successful inventory was performed.</Constant> <Table Name="Table" RetainHeader="false"> <Sql SkipFirstRow="false">EXEC [Win_Reporting].[GetDiscoveredApplications] 'en', 60000</Sql> </Table> </Worksheet> , xlsx , , ..
SELECT, Excel .
SQL:
CREATE PROCEDURE [Win_Reporting].[GetDiscoveredApplications] ( @culture_info nvarchar(25), @max_rows_to_return bigint = 0 ) AS BEGIN SET NOCOUNT ON SET ROWCOUNT @max_rows_to_return -- default value of 0 will -- return all rows. SELECT wis.[name] AS 'Application', wis.[version] AS 'Software Version', COUNT(wis.[name]) AS 'Number of Installed Copies' FROM [Win_Assessment].[WindowsInstalledSoftwareView] wis INNER JOIN [Win_Assessment].[HardwareAssessmentClientsIncludeVmView] haciv -- only client devices applications are returned ON (wis.[DeviceNumber] = haciv.[DeviceNumber]) WHERE wis.[InstallState] = 5 -- WMI App Installed AND wis.[name] IS NOT NULL GROUP BY [name], [version] ORDER BY COUNT([name]) DESC SET ROWCOUNT 0 -- reset ROWCOUNT to not affect other queries END MS Excel,
Logging
, : %LOCALAPPDATA%\Microsoft\MAP\MapToolkit.log. , Logging.cfg, . AppConfigInfo.xml, . , , MAPT 5 .
, XML , , , , «» , ( ), , , . , , , ..
. – Software Recognition, . , .
, , MAL (Master Application List). 100% , , - , ..
MAL, , , SAM. ( ).
, , «» « – ». , 7-Zip 9.20.
MAPT , 8500 (-) 300 , , .
, MAPT. WMI, Active Directory, , , VmWare, SQL. , , Powershell, . – . , MAPT .
ShamRous ignatyev
Source: https://habr.com/ru/post/258935/
All Articles