cancel
Showing results for 
Search instead for 
Did you mean: 

Query when Agent was installed

We are running ePO 4.6.5 and are in progress of migrating a number of clients on multiple sites.  We have AD sync enabled, so this starts out with a large number of Unmanaged clients.  Is there any way to query when the agent was installed on a client?  We are trying to setup a report that would show the clients that changed from Unmanaged to Managed on a specific day.  Is this possible?

3 Replies
apoling
Level 14
Report Inappropriate Content
Message 2 of 4

Re: Query when Agent was installed

Hi,

I'm afraid this is directly not possible. There is no database field - to my knowledge at least -  that would contain a static entry regarding agent installation date.

You can however do some tricks that might serve this information for you, such as setting the ASCI a large value so the Last Update field holds the first ASCI value long enough to make reports. (The first contact always occurs within 10 minutes filling the Last Update field, then the agent policy is downloaded setting the ASCI a large value on the client so the first contact value is preserved for some time in this field)

You can use the Last Update field value to fill the CustomField field for the clients and later you query this field for agent initial installation date.

Attila

Message was edited by: apoling on 12/04/13 08:08:40 CEST

Re: Query when Agent was installed

this is wrong - there is a database field; please try this statement:

select top 100 ln.nodename as 'Name', ln.NodeCreatedDate , cp.IPAddress , cp.domainname ,AH.ComputerNAME as 'AgentHandler' from epoleafnode as ln, epocomputerproperties as cp, EPOAGENTHANDLERS as AH where cp.parentid=ln.autoid and ln.nodename like '*%*' and ln.lastupdate<>'' and ah.autoid=cp.LastAgentHandler order by ln.NodeCreatedDate desc

the field NodeCreatedDate isn't available in ePO - but why?

Regards

Ralf

Highlighted

Re: Query when Agent was installed

Thanks.  I've also considered using the NodeCreatedDate, but unfortunately, this records the date the device first showed up in ePO, regardless of whether it is managed or unmanaged.  Since we are using AD sync, the devices will show up as unmanaged for some time before the migration is performed and they become "Managed". 

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community