Install Client on New OS vs First Seen Client

[manders500]

Hello,

We continue to add unmanaged assets in our environment but also add new OS builds and I want to create a baseline for only new OS builds. I am trying to use a combination of OS install date and first seen. The First seen is a property and does not allow me to use a less than function. The second issue is that the OS install date is not reporting properly. I found this relevance, the days since report but the automatic group of devices are not accurate.

((now - it) of unique value of (it * second + “01 Jan 1970 00:00:00” as local time) of (it as string as trimmed string as integer) whose(0 != it) of values “InstallDate” of keys “HKLM\Software\Microsoft\Windows NT\CurrentVersion” of (x64 registries;x32 registries)) < (10*day)

We are on 10.0.5 Compliance and Patch, no inventory

Thanks in advanced!

[Jared]

> ((creation time of data folder of client) - ((it) of unique value of (it * second + "01 Jan 1970 00:00:00" as local time) of (it as string as trimmed string as integer) of value "InstallDate" of key "HKLM\Software\Microsoft\Windows NT\CurrentVersion" of x64 registry)) < 10*day

Try this.

This will show you when the client was installed (or reset) less than 10 days after the OS was installed.

[manders500]

Thank you for the reply. I will test this.

[manders500]

It appears to show all assets that the client was installed within 10 days of OS. I need the first seen also restricted to the last 10 days of today.

[JasonWalker]

I think you need to detail a bit more about what you’re doing, I don’t think I understand it.

Unmanaged Assets are those devices without a BES Client - they won’t evaluate relevance and won’t become members of a group.

The “OS Install Date” property is read from the Registry - is it giving you the wrong value? I could see that being the case depending on how you are deploying or cloning your OS.

To detect “new to BigFix” clients, we usually use the BigFix site subscription times - like

(Now - minimum of subscribe times of sites) < 10 * day

Edit: ‘subscribe times’ not ‘subscription times’

[manders500]

Jason,

Thank you for your time. We are still discovering assets and if the asset is in production but new to BigFix, I cannot install software out of certain windows or with approval. We are now deploying Azure systems that the team is way behind on our standard software deployments. So what I am trying to do is auto install our base software on net new assets but schedule on production assets that may be new to BigFix during the scheduled window.

I did the relevance in my OP but I see a lot of OS install dates of many days/years old.

I hope that I made sense.

[trn]

Does the install date obtained by relevance differ from the date obtained by direct observation?

If so, you need to raise a support ticket. If not, the issue is with windows or your installation/cloning method.

[manders500]

TRN,

The install date looks fine from both registry and WMI, I even have days since OS install but the automatic group keeps including systems with greater than 10 days since OS install. I am wondering if since I had it wrong at first and had 20k systems in the group if I just need to be patient with the new relevance expressions to come update. It has been a few hours.

[trn]

Groups can be useful, but I would be inclined to put your “10 day” relevance clause to your be baseline instead of the “member of group” clause. Even if the client appears to be relevant for too long, the relevance will be re-evaluated immediately before running the baseline.