.:: dotnetwork.com.br ::.

I’ve been helping a thread at the Brazilian TechNet forum. The thread started asking how to know which machine was not logged in for the past 60 days. After initial “how to”, I decided write this down, as the issue was not fixed by this time, and hopefully, it’s going to be helpful.

When adding any extra attribute to be discovered, the 1^st think to note is that the System required column says no. This is because SCCM knows which attribute is essential and which is not and can be deleted. See following screenshot:

When any change on this screen occur and the discovery happened, we can track it down from logs, site control files and also SQL database

<INSTALLATION LONDER>\logs\ad*.log

SMS_EXECUTIVE started SMS_AD_SYSTEM_DISCOVERY_AGENT as thread ID 3744 (0xEA0).

** Service Thread is starting **

Component setting of ACTIVE was specified in the site control file.

Removing redundant containers and validating them…

The Run Count value in the site control file is 2.

The Schedule token value in the site control file is 0001170000500008.

Optional attributes count = 2

!!!!Valid AD container 0: LDAP://OU=HEADQUARTERS,DC=DOTNETWORK,DC=INTRANET

!!!!Valid AD container 1: LDAP://OU=DOMAIN CONTROLLERS,DC=DOTNETWORK,DC=INTRANET

Current time is 20/03/2010 05:59:40 GMT Standard Time

Last Run time is 20/03/2010 05:55:42 GMT Standard Time

Next Run time is 21/03/2010 00:00:00 GMT Standard Time

The agent does not need to run now, therefore exit.

*** Shutting Down ************************

Site control file: <INSTALLATION LONDER>\inboxes\sitectrl.box\sitectrl.ct0

SITE CONTROL FILE [6221][4.0]

….

BEGIN_COMPONENT

<SMS_AD_SYSTEM_DISCOVERY_AGENT>

…

BEGIN_PROPERTY_LIST

<AD Attributes>

<lastLogontimeStamp>

<pwdLastSet>

END_PROPERTY_LIST

…

END_COMPONENT

When the discovery start, either by using Run discovery as soon as possible or when it’s scheduled:

<INSTALLATION LONDER>\logs\ad*.log

…

Starting the data discovery.

….

System SCCM01 is accessible. IP address is 10.0.0.3.

…

System SCCM01. AD Site Name Headquarters. Subnet 10.0.0.0/24

…

DDR was written for system ‘SCCM01′ – C:\Program Files\Microsoft Configuration Manager\inboxes\auth\ddm.box\ads5j61j.DDR at 3/20/2010 6:14:27.

…

AD Discovery under container LDAP://OU=HEADQUARTERS,DC=DOTNETWORK,DC=INTRANET found 7 objects

…

*** Shutting Down ************************

Discovery write down new .ddr for each discovered system (including updates). These files are stored at <INSTALLATION LONDER>\inboxes\auth\ddm.box\*.ddr

…

BEGIN_PROPERTY

<8><NetBIOS Name><11><32><SCCM01>

END_PROPERTY

…

BEGIN_PROPERTY

<0><pwdLastSet><20><32><129131299021562500>

END_PROPERTY

…

AGENTINFO<SMS_AD_SYSTEM_DISCOVERY_AGENT><001><03/20/2010 06:14:27>

…

<INSTALLATION LONDER>\logs\smsdbmon.log

RCV: INSERT on DiscPropertyDefs for DiscProps_Add_SMSProv [5 pwdLastSet ][12345655-0E7C-48B1-89E5-0F2C917B95B0]

SND: Sent 00000016DiscPropertyDefs0006insert000150010pwdLastSet0000 [12345655-0E7C-48B1-89E5-0F2C917B95B0]

<INSTALLATION LONDER>\logs\smsprov.log

[BDC][Sat 03/20/2010 06:16:30]:ReadFromSQLNamedPipe – Received Connect, examining data…

[BDC][Sat 03/20/2010 06:16:30]:ReadSQLNotification – buffer=:00000016DiscPropertyDefs0006insert000150010pwdLastSet0000

[BDC][Sat 03/20/2010 06:16:30]:ReadSQLNotification – table name:DiscPropertyDefs

[BDC][Sat 03/20/2010 06:16:30]:ReadSQLNotification – action:insert

[BDC][Sat 03/20/2010 06:16:30]:ReadSQLNotification – Key Value:5

[BDC][Sat 03/20/2010 06:16:30]:ReadSQLNotification – Key Value:pwdLastSet

[BDC][Sat 03/20/2010 06:16:30]:CSspClassManager::PushNotifyAction, addr = 29321280

[BDC][Sat 03/20/2010 06:16:30]:ReadFromSQLNamedPipe – Waiting on connect from SQL Monitor

[DB8][Sat 03/20/2010 06:16:30]:CSspNotificationThread WaitForSingleObject – Got Notify Event

[DB8][Sat 03/20/2010 06:16:30]:CSspClassManager::PopNotifyAction

[DB8][Sat 03/20/2010 06:16:30]:Action addr = 29321280

[DB8][Sat 03/20/2010 06:16:30]:CSspNotificationThread Calling Do action

[DB8][Sat 03/20/2010 06:16:30]:CSspNotifyAction :: DoAction

[DB8][Sat 03/20/2010 06:16:30]:CSspClassManager::ProcessSQLNotification…

[DB8][Sat 03/20/2010 06:16:30]:ProcessSQLNotification…calling Resource Manager Refreshj

[DB8][Sat 03/20/2010 06:16:30]:UpdateArchitectureGroup: ArchKey=5

[DB8][Sat 03/20/2010 06:16:30]:UpdateInventoryGroup: PropertyName=pwdLastSet

[DB8][Sat 03/20/2010 06:16:30]:Dynamic : SMS_R_System (SMS_Resource),addr=0×1b2ec68

[DB8][Sat 03/20/2010 06:16:30]:RegisterExtensionClass , using NULL wbem ctx ptr

[DB8][Sat 03/20/2010 06:16:30]:CSspClassManager::PopNotifyAction

[DB8][Sat 03/20/2010 06:16:30]:CSspNotificationThread::Run, waiting on NotifyEvent..

After the discovery is completed, we can check if everything is ok using SQL commands:

1. Checking if the attribute was inserted: select * from DiscPropertyDefs where PropertyName like ‘%pwdLastSet%’
   

1. Checking which table should have the attribute: select disa.* from DiscoveryArchitectures disA, DiscPropertyDefs disP where disP.PropertyName like ‘%pwdLastSet%’ and disa.DiscArchKey = disp.DiscArchKey
   

1. Checking if the attribute was inserted as new field: sp_help System_DISC
   

1. Checking if any data was inserted: select name0, pwdLastSet0 from System_DISC
   

1. Checking if the data is available through reports: select name0, pwdLastSet0 from v_R_System
   

1. At least, checking if SCCM Console can access it by collection and/or queries: select SMS_R_System.Name, SMS_R_System.pwdLastSet from SMS_R_System
   

Note: Some Active Directory (i.e. pwdLastset, lastlogontimeStamp) are saved as integers instead of date/time. To work around this, using SQL command, use: CAST((s.lastLogonTimestamp0 / 864000000000.0 – 109207) AS DATETIME)