none
SCCM 2012 - Endpoint Protection Reporting only using static end date

    Question

  • I have created a subscription to the Endpoint Protection/Antimalware Activity Report built into SCCM2012/Endpoint Protection.

    My problem is that I am having trouble getting the dates to work correctly.  I want to have the report automaticlly emailed out every monday morning with the status from the last 7 days (i.e. since the last monday report). 

    However the subscription seems to want a static end date.  That is, every monday when the report runs it gives me a status report from the exact same 7 days.  Not the most recent 7 days. 

    How do I go about changing this so it is useful and that every monday it runs, the report it creates/sends is from the the last 7 days?

    Monday, December 10, 2012 2:36 PM

Answers

All replies

  • Did you set a custom report span or did you leave it set to "week"? If you leave it set to week, it should dynamically pull the last week's data each time the subscription runs.
    Monday, December 10, 2012 4:02 PM
  • Hi,

    Thank you for the post.

    You can create a custom report to list last 7 days: http://blogs.technet.com/b/configmgrteam/archive/2012/03/28/building-custom-endpoint-protection-reports-in-system-center-2012-configuration-manager.aspx

    Regards,


    Nick Gu - MSFT

    Wednesday, December 12, 2012 4:59 PM
    Moderator
  • I hope this helps (I am still testing it) but I did this by:-

    "Editing" the default report such as "Antimalware activity report".

    To avoid corrupting this default report before you change anything select SaveAs and call it something like "Antimalware activity report for the last 7 days".

    Open Datasets, StartEndDates and replace the query with this for the last 7 days

    "select DATEADD(day,datediff(day,0,GetDate())- 7,0) as StartDate, DATEADD(day,datediff(day,0,GetDate()),0) as EndDate"

    Then open Parameters, StartDate and under General change it to "Hidden".

    Then open Parameters, EndDate and under General change it to "Hidden".

    Save and test




    Friday, April 12, 2013 4:37 AM
  • Don't know if this was ever resolved, but with the help of this thread I was able to figure it out. I documented it all on my blog:

    http://www.dmitribobko.com/2013/05/sccm-2012-endpoint-protection-reporting.html 

    Sunday, May 19, 2013 8:24 PM
  • With the help of this topic, and taking into account Dmitri's post, I have been able to customize the parameters for this report :

    - I first deleted the @StartDate and @EndDate parameters, along with the StartEndDates dataset

    - I then edited the 3 subreports properties, replacing the parameters values with the following ones :

    StartDate : =DateAdd("d",-7,Globals!ExecutionTime)

    EndDate : =Globals!ExecutionTime

    My subscription now works fine, sending the report for the last 7 days.


    • Edited by LillonelC Tuesday, July 02, 2013 9:41 AM wrong spelling..
    Tuesday, July 02, 2013 9:39 AM
  • Using SCCM 2012 R2, I tried all methods without success.

    My subscriptions are still running with the date computed when I created the subscriptions! Not the date when the subscriptions run!

    Any help?

    Friday, December 06, 2013 1:45 PM
  • I hope this helps (I am still testing it) but I did this by:-

    "Editing" the default report such as "Antimalware activity report".

    To avoid corrupting this default report before you change anything select SaveAs and call it something like "Antimalware activity report for the last 7 days".

    Open Datasets, StartEndDates and replace the query with this for the last 7 days

    "select DATEADD(day,datediff(day,0,GetDate())- 7,0) as StartDate, DATEADD(day,datediff(day,0,GetDate()),0) as EndDate"

    Then open Parameters, StartDate and under General change it to "Hidden".

    Then open Parameters, EndDate and under General change it to "Hidden".

    Save and test

    I had to set the "default value" on each parameter, per Lillonel:

    StartDate : =DateAdd("d",-7,Globals!ExecutionTime)
    EndDate : =Globals!ExecutionTime

    It looks like it is using a 7 day window now.
    Friday, January 02, 2015 9:27 PM
  • I know this post is 5 years old, but it is still so relevant. Thank you very much for this. It has been a life saver.
    Friday, March 16, 2018 3:11 PM