Answered by:
Registry Key change tracking by SCCM

Question
-
Dear Experts,
Is it possible to track registry changes on Workstations/Servers by SCCM. For eg: when a new registry key is created because of installation on any new hardware of software, is the information being tracked and collected by SCCM and stored in the database?
If yes, I need to know the table or view name from where I can extract the details. Please guide.
Thanks!
Uttam Kumar SahooMonday, October 17, 2011 8:40 AM
Answers
-
See, the below blog
You can use DCM for Registry compliance
http://systemcentercentral.com/Details/tabid/147/IndexID/19568/Default.aspx
Anoop C Nair - Twitter @anoopmannur
MY BLOG: http://anoopmannur.wordpress.com
This posting is provided AS-IS with no warranties/guarantees and confers no rights.
- Marked as answer by MSSQL-DB Tuesday, October 18, 2011 12:39 PM
Monday, October 17, 2011 9:08 AM
All replies
-
See, the below blog
You can use DCM for Registry compliance
http://systemcentercentral.com/Details/tabid/147/IndexID/19568/Default.aspx
Anoop C Nair - Twitter @anoopmannur
MY BLOG: http://anoopmannur.wordpress.com
This posting is provided AS-IS with no warranties/guarantees and confers no rights.
- Marked as answer by MSSQL-DB Tuesday, October 18, 2011 12:39 PM
Monday, October 17, 2011 9:08 AM -
when a new registry key is created because of installation on any new hardware of software, is the information being tracked and collected by SCCM and stored in the database?
If yes, I need to know the table or view name from where I can extract the details. Please guide.
Thanks!
Uttam Kumar SahooIt is not possible to get the registry changes information from clients automatically whenever it is changed.. However as An00p said you can monitor specific registry keys for the Values modifications... also You can get the registry key values from desired registry location example you want to monitor Antivirus registrykeys ...
It is not possible that ""You install xyz application and XYZ changes some registry and you want automatically SCCM to report"" this is not possible.
For report or a table : When you create a SMS_def.MOF modification then based on your MOF calss Name SCCM will create a table/view and stores the Data for your reporting Purpose. (The Name would start with your MOF Class Name).
Also read An00p provided links for better understanding
This posting is provided "AS IS" with no warranties or guarantees, and confers no rights. |Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.- Proposed as answer by Garth JonesMVP Monday, October 17, 2011 12:34 PM
Monday, October 17, 2011 11:01 AM -
In spirit, I agree with Anoop and Paddy. However, with the right techniques and skill, you cold pull this off if you wanted. Using WMI eventing, you could montior for changes in the regsitry value and then trigger an immediate HW inventory when a change is detected (assuming you've modified smsdef.mof to include the registry value). If your collection updates often enough, you could then respond to the change. Reports and queries would reflect the change immediately though so it depends on what you want to monitor the change for.
Jason | http://myitforum.com/cs2/blogs/jsandys | Twitter @JasonSandysMonday, October 17, 2011 1:17 PM -
Thansk a lot Jason, Anoop and paddy for your suggestions..i may get back to u incase I face difficulties in implementing :)
Uttam Kumar SahooTuesday, October 18, 2011 12:39 PM