Good way to target (with relevance) all the windows servers?

(imported topic written by rharmer91)

(string value of select “Name from Win32_OperatingSystem” of wmi contains “Server”)

Or is there a downside to doing this?

Rich

(imported comment written by jessewk)

We try to avoid WMI whenever possible. This should do what you want without WMI:

value “ProductType” of key “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions” of registry != “WinNT”

See this post for more info: http://forum.bigfix.com/viewtopic.php?id=111

(imported comment written by chenbr91)

or you use…

value “ProductType” of key “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions” of registry = “ServerNT” OR value “ProductType” of key “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions” of registry = “LanmanNT” )

Too many ways to slice this orange…

(imported comment written by rharmer91)

I actually want to include all servers from NT4 to 2003 R2… We still have 8 NT4 servers. I’ll read the article you mentioned.

I need to exclude all Windows desktops, and the Windows 2000 desktops can be tough to exclude.

Looks like I asked this question before by the link you sent :slight_smile:

I wasn’t aware that WMI was to be avoided… I’m curious about that.

Rich

(imported comment written by SystemAdmin)

There is nothing incorrect about using the WMI but we heavily favor using inspectors over the wmi when both are available because of the performance advantage of inspectors. For example, in this case I get the following evaluation times for these two queries in QnA:

q: value 
"ProductType" of key 
"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions" of registry = 
"ServerNT" OR value 
"ProductType" of key 
"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions" of registry = 
"LanmanNT" A: False T: 0.286 ms I: singular 

boolean   q: (string value of select 
"Name from Win32_OperatingSystem" of wmi contains 
"Server") A: False T: 323.886 ms I: singular 

boolean

This shows that the BigFix inspectors are over 1000 times faster than using the WMI. Think of how many Fixlets you could evaluate in that time period just by using relevance instead of WMI, also think about the real time nature of BES. For a property like this that will get used frequently (console operators will take lots of actions targeting Servers/Workstations using this property) you get multiple copies of the relevance expression in each action. So, if you use WMI you might have 50-100 copies of the relevance expression spread throughout properties and actions. If you use the relevance only version, you could evaluate all 50 copies in less time than it takes to evaluate 1 copy of the wmi version.

Using the WMI won’t cause problems for the BES Client but I think you can see a clear advantage to using our inspectors whenever possible. The client will still be plenty fast if you use WMI, so you don’t need to take the above argument too far and think you should never use WMI at all. In many cases it makes sense or is the only way to get data you are looking for.

(imported comment written by SystemAdmin)

Here’s another way that’s

even faster

:

(it is nt server product type or it is nt domain controller product type) of product type of operating system

Alternatively, you can check that it’s not a workstation:

product type of operating system != nt workstation product type

(imported comment written by rharmer91)

Thanks for the detailed answer(s)! It’ll help us all the way around.

Rich