Analyses and Multiple Results

Content Authoring
1

(imported topic written by jr6591)

I am creating an analysis to give me the accounts that are members of the local administrator group and the names local accounts with admin privileges, but the results show as multiple results. Is there any way to have the data displayed in multiple columns or something more legible?

2

(imported comment written by BenKus)

Hey JR,

Have you tried the different “Properties Reports” to display the data? If those don’t work for you, you can put the data into a simple custom report that can do the data parsing for you…

What is your preferred format?

Ben

3

(imported comment written by jr6591)

The Properties reports does not display as I want it. I’m just looking for a report that will list all results ina separate tab. For example. if I want to list a report of PC’s and their IP addresses, I would like to see the PC’s or Servers with multiple IP’s have a column for each IP.

PC Name — IP Address 1 - IP Address 2 - IP Address 3

I am trying to list the members of local group “Administrators” and have each account show in its own column

4

(imported comment written by BenKus)

Hey jr,

That is a tough report because of the variable number of columns… You could do it, but it would look funny because you would have to have a large number of empty cells because each computer would have different numbers of results.

How about a report where the computers are listed multiple times if they have multiple results?

Something like this:

<?relevance trs of (td of item 0 of it & (td of item 1 of it)) of (name of it, values of results (bes property "IP address", it)) of bes computers whose (exists name of it)?>
Computer Name IP Address

Which will produce a table that looks something like this:

Computer Name IP Address

COMPUTER1 192.168.1.101

COMPUTER1 192.168.11.100

COMPUTER2 169.254.11.164

COMPUTER3 192.168.1.167

Does that work for you?

Ben

5

(imported comment written by jr6591)

Looks good for me but I’m trying to figure out how this will help me as I need to have multiple columns based on a property called “Local Admin Group Members” which is based on this property “members of local group “Administrators””

Q: members of local group “Administrators”

A: PC1\Administrator

A: OurDomain\Domain Admins

A: OurDomain\OurDomain\DomainGroup-1

A: OurDomain\OurDomain\DomainGroup-2

6

(imported comment written by BenKus)

Does this work?

<?relevance trs of (td of item 0 of it & (td of item 1 of it)) of (name of it, values of results (bes property "Local Admin Group Members", it)) of bes computers whose (exists name of it)?>
Computer Name IP Address

Ben

7

(imported comment written by jr6591)

Not quite. I am looking for Columns as opposed to a listing for each PC.

PC Name Entry1 Entry2 Entry3

8

(imported comment written by BenKus)

Hey jr,

What would you want to do if some computers have 2 admins and some have 20 admins? Just empty columns?

Ben

9

(imported comment written by jr6591)

Empty columns are fine.

I tend to run across reporting that needs this functionality. It would be nice if BES could display it properly in columns as opposed to multiple results. I find the multiple results not effective in analysis or reporting. I will be doing some other reports and they are also in this format.

I have one where I am reporting Java Versions based on this:

q:

if (exists keys of keys “HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Runtime Environment” of registry)then (concatenation ", " of names of keys of keys “HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Runtime Environment” of registry)else (“Not Installed”)

This also shows as multiple results and not a great report to show upper management.

Future enhancement??

10

(imported comment written by donduke91)

One way I did this is to use BES Web Reports. It didn’t create a seperate column for each member of the administrators group, but instead combined them in one column seperated by semicolons.

Create an Analysis with Property:

members of local group “Administrators” as string

The results will come out as in the console. Go into BES Web Reports and create a report choosing “All Analysis” and click on the Analysis that you made in the Console. Click on “View Computers” link and this should create a list similar to what’s in the Console.

Export this as CSV and open in EXCEL. This should have the 2 columns:

Computername1 Computername1\Administrator;“Domain\Admin2”;“Domain\Admin3”;“etc…”

Hope this helps out.

Don

11

(imported comment written by FITZPAW91)

Hi all

What would be the syntax if I wanted to write a web report showing only certain users that are assigned to the administrator group? Using BES Web Reports Version : 8.0.627.0

We occassionally assign users to the Administrator group, and ask them to tell us when they are finished. But often they “FORGET” to tell us, so I would like to create a web mail mailing report, that is generated daily to show if up to 10 specific users are part of the local admin group, on certain assigned servers.

I have created an analysis in BigFix that shows this information, but can’t seem to get it to output to WebReports.

Thanks

William

12

(imported comment written by FITZPAW91)

Got close, I can identify the computer names, but not the particular users that I am looking for

<?relevance trs of (td of item 0 of it & (td of item 1 of it)) of (name of it, values of results (bes property "Local Administrators", it)) of bes computers whose (name of it contains "BDOR")?>
Computer Name Local Administrators

Help please

William

13

(imported comment written by SystemAdmin)

Maybe just…

<?relevance trs of td of name of bes computers whose (name of it contains "BDOR")?>
Computer Name
14

(imported comment written by FITZPAW91)

Thanks Paul,

But I am looking for the name of the server, and everytime “adminBOB” or “adminDAVID” has been added as a local administrator, and forgotten to be removed, to be listed in a table.

The way I do it for my analysis is… and the relevance is by server name

if exists Folder “C:\Documents and Settings\Administrateur” then (if exists (member whose (following text of last “” of (it as string as lowercase) = “adminBOB”) of local group “Administrateurs”) then “adminBOB” else " ") ELSE (if exists(member whose (following text of last “” of (it as string as lowercase) = “adminBOB”) of local group “Administrators”) then “adminBOB” else " ")

William

15

(imported comment written by FITZPAW91)

Found mostly what I was looking for by disecting a different web report found in the Forum. Hope this helps someone out in the future.

<?Relevance trs of ( td of (tuple string item 0 of item 0 of it) & td of (tuple string item 1 of item 0 of it) & td of (item 1 of it) ) of ( (it, (multiplicity of it as string) )) of unique values of (((concatenation "," of (unique values of values of result (it, bes property "computer name") ) ), (concatenation "," of (unique values of values of result (it, bes property "Local Administrators") ) whose (it as lowercase contains "domain\admin")) ) as string ) of bes computers whose (exists (value of result (it, bes property "Local Administrators")) whose (it as lowercase contains "domain\admin") AND exists (value of result (it, bes property "computer name")) whose (it as lowercase contains "nameofcomputer")) ?>
Serveur Local Administrators

Thanks

William

16

(imported comment written by bdagar)

Hi William,

I need exactly what you have given above, can we add ip address to this ? I tried a lot but not good at relevance yet. please help.

Beena

17

(imported comment written by bdagar)

ok i got the ip address , but i am getting some extra value if you can look at it. i have attached screenshot.

<?Relevance trs of ( td of (tuple string item 0 of item 0 of it) & td of (tuple string item 1 of item 0 of it) & td of (tuple string item 2 of item 0 of it) & td of (item 1 of it) ) of ( (it, (multiplicity of it as string) )) of unique values of (((concatenation "," of (unique values of values of result (it, bes property "computer name") ) ), ( concatenation "," of (ip addresses of it as string) )of ( bes computers whose ( (name of it as lowercase contains "htems"))), (concatenation "," of (unique values of values of result (it, bes property "ExpNotification") ) whose (it as lowercase contains "root")) ) as string ) of bes computers whose (exists (value of result (it, bes property "ExpNotification")) whose (it as lowercase contains "root") AND exists (value of result (it, bes property "computer name")) whose (it as lowercase contains "htems")) ?>
Server IP Address UserID-DaysToExpire
18

concatenation "; " of (members of local group "Administrators" as string)

This is what I use now.

K