Automatic Group Relevance Help

Content Authoring
1

I need some help. I am attempting to automate the endpoints that are registering in BigFix. I created as many automatic groups that I can and have a relevance to move the computers from a "New Agents" group. This group are new endpoints that don't have a home yet.

I am trying to move any Domain Controller into a Automatic Domain Controller group. We have two domains and one of the domains I do not want those domain controllers to be moved into this automatic group. Here is what I have.

(product type of operating system = nt domain controller)
AND
not exists dns name whose (it as lowercase contains "xyz.com")

2

I think it needs to be nt domain controller product type ?

https://developer.bigfix.com/relevance/reference/operating-system-product-type.html

1 Like
3

So, something like this?

(product type of operating system = nt domain controller product type) AND (dns name as lowercase does not end with "xyz.com" as lowercase)

1 Like
4

I've always used this...

Servers

exists unique values whose(2 = it) of integer values of selects "DomainRole from Win32_ComputerSystem" of wmis
OR
exists unique values whose(3 = it) of integer values of selects "DomainRole from Win32_ComputerSystem" of wmis
OR
exists unique values whose(4 = it) of integer values of selects "DomainRole from Win32_ComputerSystem" of wmis
OR
exists unique values whose(5 = it) of integer values of selects "DomainRole from Win32_ComputerSystem" of wmis

Workstations

exists unique values whose(0 = it) of integer values of selects "DomainRole from Win32_ComputerSystem" of wmis
OR
exists unique values whose(1 = it) of integer values of selects "DomainRole from Win32_ComputerSystem" of wmis

Domain Controllers

exists unique values whose(4 = it) of integer values of selects "DomainRole from Win32_ComputerSystem" of wmis
OR
exists unique values whose(5 = it) of integer values of selects "DomainRole from Win32_ComputerSystem" of wmis

Product type of operating system = nt domain controller product type

image
image447×427 22.1 KB

image
image865×588 28.2 KB

2 Likes
5

I’ve been using a service check that only exists when AD role is installed. (exists service "NTDS")

Not as detailed as others I see here, but it worked for me when I was managing domain controllers. I no longer do in my primary environment, as our security team began to segment them for security reasons.