Asset discovery reporting

(imported topic written by mcalvi91)

when we run an local subnet scan, we have several failures on the task where they all seem to fail at the same point in the task (see below).

In addition we have a few systems reporting in as unmanaged assets which are infact managed. We can find the system in the bigfix console as having recently reported. We were wondering what the Asset discovery system utilitizes to determine that an asset is unmanaged?

===================

The action has been run 1 time, and will not be run again.

The action failed.

Completed: delete __appendfile

Completed: delete folder.bat

Completed: appendfile @ECHO OFF

Completed: appendfile mkdir “{pathname of windows folder & “\temp\nmap”}” > NUL 2>NUL

Completed: appendfile del “{pathname of windows folder & “\temp\nmap\nmap*.xml”}” > NUL 2>NUL

Completed: move __appendfile folder.bat

Completed: wait “{pathname of client folder of site “BESSupport” & “\RunQuiet.exe”}” folder.bat

Completed: // run nmap with default parameters

Completed: regset "

HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\EnterpriseClient\BESScanner-NMAP

" “LastScanStartTime”="{now}"

Completed: delete nmapquiet.bat

Completed: // create a batch file so that the NMAP scan will be silent

Completed: delete __appendfile

Completed: delete nmapquiet.bat

Completed: appendfile @ECHO OFF

Completed: appendfile “{pathname of client folder of site “BESSupport” & “\RunQuiet.exe”}” “{pathname of folder “BESScanner-NMAP\NMAP” of parent folder of regapp “BESClient.exe”}\nmap.exe” -sV -sS -sU -p T:22,T:23,T:80,T:135,T:139,T:445,T:235,T:61616,U:{value “ListenPort” of key “HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions” of registry} --exclude “{concatenation “,” of (addresses whose (it as string != “0.0.0.0”) of ip interfaces whose (loopback of it = false) of network as string)}” {if (exists key “HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\EnterpriseClient\BESScanner-NMAP” whose (value “NmapVersion” of it as string as version >= “4.20”) of registry) then " -O1 --osscan-guess" else " -O --osscan-guess"} -T 4 { (unique value of (subnet addresses whose (it as string != “0.0.0.0”) of ip interfaces whose (loopback of it = false) of network as string) as string) & “/” & (number of bits (0;1;2;3;4;5;6;7) whose (it) of ( it as integer ) of ( if it contains “.” then preceding text of first “.” of it else it ) of ( it; following texts of substrings “.” of it ) of ( unique value of (subnet masks of ip interfaces whose (loopback of it = false) of network as string ) as string) as string) } -oX “{pathname of windows folder}\temp\nmap\nmap-{computer name}-{(now - “01 Jan 1970 00:00:00” as local time)/second}.xml” >NUL 2>NUL

Completed: move __appendfile nmapquiet.bat

Completed: // run nmap scan

Completed: wait “{pathname of client folder of site “BESSupport” & “\RunQuiet.exe”}” nmapquiet.bat

Completed: // update reg statistics

Completed: regset "

HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\EnterpriseClient\BESScanner-NMAP

" “LastScanFinishTime”="{now}"

Failed: regset "

HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\EnterpriseClient\BESScanner-NMAP

" “NumberOfScansRun”="{value “NumberOfScansRun” of key “HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\EnterpriseClient\BESScanner-NMAP” of registry as integer + 1}"

(imported comment written by BenKus)

Hi mcalvi,

I am guessing that the reason that line fails is because that registry value does not exist or it is not a number (which is not supposed to happen normally)… You can probably fix it by creating the value “NumberOfScansRun” and setting it to “1”.

For your second question, the NMAP scanner looks to see if the computer is listening on port 52311 UDP (or whatever BigFix port you are using). If the UDP scan is blocked for some reason, it could lead to the scanner thinking the agent is not installed. Can you confirm if these computers have a personal firewall enabled?

Also, one of the Asset Discovery columns should say something like “possible BES Client”, which attempts to guess if the computer has the agent installed based on agent info in the console.

Ben

(imported comment written by SystemAdmin)

To solve the problem of personal firewalls, look for the task called

“Windows Firewall is Blocking BES Traffic - BES Client”

and / or

“Windows Firewall is Blocking BES Traffic - Windows Vista / Windows 2008 / Windows 7 / Windows 2008R2 - BES Client >= 7.0”

These two tasks become relevant if there are any firewall issues. These tasks will configure the client to poke a hole thru the clients firewall and allow proper communications.

Once this is performed then my asset scan worked properly.