need to have the following scripts translated for webreports analyses
Directory
Export
Directory Export
CSVDE is a Microsoft-developed Management tool for Windows that can export data from Active Directory to a comma-separated value (CSV) format
Use the syntax at right to generate an export file & send to Micro Focus
Command Syntax
c:>
CSVDE -f adexport.csv -r objectClass=computer -u -l cn,objectClass,lastLogonTimestamp,pwdLastSet,userAccountControl,operatingSystem,DN
https://technet.microsoft.com/en-us/library/cc732101(v=ws.11).aspx
SAM Tool Check-In (Inventoried Machines) - SQL
Vendor/Version SQL Query Syntax
SELECT DISTINCT C.DISPLAYNAME, OS.OSTYPE, C.HWLASTSCANDATE, C.SWLASTSCANDATE
FROM Computer C (nolock) LEFT OUTER JOIN Operating_System OS (nolock) ON C.Computer_Idn = OS.Computer_Idn
WHERE (C.DISPLAYNAME IS NOT NULL)
ORDER BY C.DISPLAYNAME
SELECT C.Name, C.[OS Name], MAX(I.[Collection Time]) AS LastInventory, null AS Placeholder
FROM Inv_Inventory_Results I RIGHT JOIN vComputer C ON I.[_ResourceGuid] = C.Guid
WHERE (((C.IsManaged)=1))
GROUP BY C.Name, C.[OS Name]
ORDER BY C.Name, LastInventory
2007
SELECT DISTINCT S.Netbios_Name0, S.Operating_System_Name_and0, HW.LastHWScan, SW.LastScanDate
FROM v_R_System S LEFT JOIN v_GS_LastSoftwareScan SW on S.ResourceID = SW.ResourceID
LEFT JOIN v_GS_WORKSTATION_STATUS HW on S.ResourceID = HW.ResourceID
ORDER BY S.Netbios_Name0
2012R1
SELECT DISTINCT S.NetbiosName, S.OperatingSystemNameandVersion, HW.LastHardwareScan, SW.LastScanDate
FROM SMS_R_System S LEFT JOIN SMS_G_System_WORKSTATION_STATUS SW on SW.ResourceID = S.ResourceId
LEFT JOIN SMS_G_System_LastSoftwareScan HW on HW.ResourceID = S.ResourceId
ORDER BY S.NetbiosName
2012R2
SELECT DISTINCT S.Netbios_Name0, S.Operating_System_Name_and0, HW.LastHWScan, SW.LastScanDate, SW.ResourceID
FROM vSMS_R_System S LEFT JOIN v_GS_WORKSTATION_STATUS HW ON HW.ResourceID = S.ItemKey
LEFT JOIN v_GS_LastSoftwareScan SW ON SW.ResourceID = HW.ResourceID
ORDER BY S.Netbios_Name0
SAM Tool Check-In
Add/Remove Program Entries (ARP Scan) - SQL
Vendor/Version
SQL Query Syntax
SELECT A0.DISPLAYNAME, A1.SUITENAME, A1.VERSION, A1.INSTALLDATE
FROM Computer A0 (nolock) LEFT OUTER JOIN AppSoftwareSuites A1 (nolock) ON A0.Computer_Idn = A1.Computer_Idn LEFT OUTER JOIN Operating_System A2 (nolock) ON A0.Computer_Idn = A2.Computer_Idn
WHERE (A0.DEVICENAME IS NOT NULL AND (A1.SUITENAME LIKE ‘%Attachmate%’ OR A1.SUITENAME LIKE ‘%DATABridge%’ OR A1.SUITENAME LIKE ‘%Extra%’ A1.SUITENAME LIKE ‘%Infoconnect%’ OR A1.SUITENAME LIKE ‘%Kea%’ OR A1.SUITENAME LIKE ‘%Micro%focus%’ OR A1.SUITENAME LIKE ‘%Netmanage%’ OR A1.SUITENAME LIKE ‘%Onweb%’ OR A1.SUITENAME LIKE ‘%Reflection%’ OR A1.SUITENAME LIKE ‘%Rumba%’ OR A1.SUITENAME LIKE ‘%Verastream%’ OR A1.SUITENAME LIKE ‘%ViewNow%’ OR A1.SUITENAME LIKE ‘%WallData%’ OR A1.SUITENAME LIKE ‘%Web%to%Host%’ OR A1.SUITENAME LIKE ‘%WRQ%’ ))
SELECT C.Name, P.DisplayName, P.DisplayVersion, I.InstallDate
FROM vComputer C LEFT JOIN Inv_AddRemoveProgram P ON C.GUID = P._ResourceGUID LEFT JOIN Inv_InstalledSoftware I ON P._ResourceGuid = I._ResourceGuid AND P._SoftwareComponentGuid = I._SoftwareComponentGuid
WHERE (P.DisplayName LIKE ‘%Attachmate%’) OR (P.DisplayName LIKE ‘%DATABridge%’) OR (P.DisplayName LIKE ‘%Extra%’) OR (P.DisplayName LIKE ‘%Infoconnect%’) OR (P.DisplayName LIKE ‘%Kea%’) OR (P.DisplayName LIKE ‘%Micro%focus%’) OR (P.DisplayName LIKE ‘%Netmanage’) OR (P.DisplayName LIKE ‘%Onweb%’) OR (P.DisplayName LIKE ‘%Reflection%’) OR (P.DisplayName LIKE ‘%Rumba%’) OR (P.DisplayName LIKE ‘%Verastream%’) OR (P.DisplayName LIKE ‘%ViewNow%’) OR (P.DisplayName LIKE ‘%WallData%’) OR (P.DisplayName LIKE ‘%Web%to%Host%’) OR (P.DisplayName LIKE ‘%WRQ%’)
2007
SELECT S.Netbios_Name0, P.DisplayName0, P.Version0, P.InstallDate0
FROM v_R_System S LEFT JOIN v_GS_ADD_REMOVE_PROGRAMS P ON P.ResourceID = S.ResourceID
WHERE (P.DisplayName0 LIKE ‘%Attachmate%’) OR (P.DisplayName0 LIKE ‘%DATABridge%’) OR (P.DisplayName0 LIKE ‘%Extra%’) OR (P.DisplayName0 LIKE ‘%Infoconnect%’) OR (P.DisplayName0 LIKE ‘%Kea%’) OR (P.DisplayName0 LIKE ‘%Micro%focus%’) OR (P.DisplayName0 LIKE ‘%Netmanage’) OR (P.DisplayName0 LIKE ‘%Onweb%’) OR (P.DisplayName0 LIKE ‘%Reflection%’) OR (P.DisplayName0 LIKE ‘%Rumba%’) OR (P.DisplayName0 LIKE ‘%Verastream%’) OR (P.DisplayName0 LIKE ‘%ViewNow%’) OR (P.DisplayName0 LIKE ‘%WallData%’) OR (P.DisplayName0 LIKE ‘%Web%to%Host%’) OR (P.DisplayName0 LIKE ‘%WRQ%’)
2012R1
SELECT S.NetbiosName, P.DisplayName, P.Version, P.InstallDate
FROM SMS_R_System S LEFT JOIN SMS_G_System_ADD_REMOVE_PROGRAMS P on P.ResourceID = S.ResourceId
WHERE (P.DisplayName LIKE ‘%Attachmate%’) OR (P.DisplayName LIKE ‘%DATABridge%’) OR (P.DisplayName LIKE ‘%Extra%’) OR (P.DisplayName LIKE ‘%Infoconnect%’) OR (P.DisplayName LIKE ‘%Kea%’) OR (P.DisplayName LIKE ‘%Micro%focus%’) OR (P.DisplayName LIKE ‘%Netmanage’) OR (P.DisplayName LIKE ‘%Onweb%’) OR (P.DisplayName LIKE ‘%Reflection%’) OR (P.DisplayName LIKE ‘%Rumba%’) OR (P.DisplayName LIKE ‘%Verastream%’) OR (P.DisplayName LIKE ‘%ViewNow%’) OR (P.DisplayName LIKE ‘%WallData%’) OR (P.DisplayName LIKE ‘%Web%to%Host%’) OR (P.DisplayName LIKE ‘%WRQ%’)
2012R2
SELECT S.Netbios_Name0, P.DisplayName0, P.Version0, P.InstallDate0
FROM vSMS_R_System S LEFT JOIN v_ADD_REMOVE_PROGRAMS P on P.ResourceID = S.ItemKey
WHERE (P.DisplayName0 LIKE ‘%Attachmate%’) OR (P.DisplayName0 LIKE ‘%DATABridge%’) OR (P.DisplayName0 LIKE ‘%Extra%’) OR (P.DisplayName0 LIKE ‘%Infoconnect’) OR (P.DisplayName0 LIKE ‘%Kea%’) OR (P.DisplayName0 LIKE ‘%Micro%focus%’) OR (P.DisplayName0 LIKE ‘%Netmanage’) OR (P.DisplayName0 LIKE ‘%Onweb%’) OR (P.DisplayName0 LIKE ‘%Reflection%’) OR (P.DisplayName0 LIKE ‘%Rumba%’) OR (P.DisplayName0 LIKE ‘%Verastream%’) OR (P.DisplayName0 LIKE ‘%ViewNow%’) OR (P.DisplayName0 LIKE ‘%WallData%’) OR (P.DisplayName0 LIKE ‘%Web%to%Host%’) OR (P.DisplayName0 LIKE ‘%WRQ%’)
Add/Remove
Program
Known EXE Scan – SQL (Altiris & LANDesk)
Vendor/Version
SQL Query Syntax
SELECT C.DISPLAYNAME, F.FILENAME, null, F.VERSION, F.FILESIZE, C.SWLASTSCANDATE, F.PATH,
FROM Computer C (nolock) LEFT JOIN AppSoftware A1 (nolock) ON C.Computer_Idn = F.Computer_Idn
WHERE C.DEVICENAME IS NOT NULL AND ( F.FileName LIKE ‘%.chf’ OR F.FileName LIKE ‘%.ser’ OR F.FileName LIKE ‘%CoreServices.exe%’ OR F.FileName LIKE ‘%MCSServiceAgent.exe%’ OR F.FileName LIKE ‘%PresentationDesigner.exe%’ OR F.FileName LIKE ‘%SNDS.exe%’ OR F.FileName LIKE ‘%VigilEntAgent.exe%’ OR F.FileName LIKE ‘%vsoc.exe%’ OR F.FileName LIKE ‘%WINSTALA.exe%’ OR F.FileName LIKE ‘%WINSTLU32.exe%’ OR F.FileName LIKE ‘%WINSTU32.exe%’ OR F.FileName LIKE ‘ACCMGR32.EXE’ OR F.FileName LIKE ‘ACPMGR.EXE’ OR F.FileName LIKE ‘ACT6530X.OCX’ OR F.FileName LIKE ‘AS400FTX.EXE’ OR F.FileName LIKE ‘ATERM.OCX’ OR F.FileName LIKE ‘ATM_RM_R.exe’ OR F.FileName LIKE ‘ATMFRAME.EXE’ OR F.FileName LIKE ‘bdes.dll’ OR F.FileName LIKE ‘C4CONF32.EXE’ OR F.FileName LIKE ‘CGI2NOVA.EXE’ OR F.FileName LIKE ‘DBEnterprise.exe’ OR F.FileName LIKE ‘DBUtility.exe’ OR F.FileName LIKE ‘DemoHost.Exe’ OR F.FileName LIKE ‘Discover.exe’ OR F.FileName LIKE ‘EASYVIEW.EXE’ OR F.FileName LIKE ‘EHNCFG32.EXE’ OR F.FileName LIKE ‘EHNTES32.EXE’ OR F.FileName LIKE ‘EMU.EXE’ OR F.FileName LIKE ‘EXTRA!.EXE’ OR F.FileName LIKE ‘EXTRA.EXE’ OR F.FileName LIKE ‘fsshclient.exe’ OR F.FileName LIKE ‘fsshd2.exe’ OR F.FileName LIKE ‘GRAPHX32.EXE’ OR F.FileName LIKE ‘Idrive.sys’ OR F.FileName LIKE ‘IMPORT.exe’ OR F.FileName LIKE ‘KEAHP.EXE’ OR F.FileName LIKE ‘KEAVT.EXE’ OR F.FileName LIKE ‘mnfserv.exe’ OR F.FileName LIKE ‘mwm.exe’ OR F.FileName LIKE ‘nfsgwapp.exe’ OR F.FileName LIKE ‘nmAppc.dll’ OR F.FileName LIKE ‘nmssh.exe’ OR F.FileName LIKE ‘nmsshfwd.exe’ OR F.FileName LIKE ‘NOF.exe’ OR F.FileName LIKE ‘NOVA.EXE’ OR F.FileName LIKE ‘NOVATRC.EXE’ OR F.FileName LIKE ‘NWLatSrv.exe’ OR F.FileName LIKE ‘PTR32.EXE’ OR F.FileName LIKE ‘QAPDEV32.EXE’ OR F.FileName LIKE ‘R.exe’ OR F.FileName LIKE ‘r1.exe’ OR F.FileName LIKE ‘r1win.exe’ OR F.FileName LIKE ‘r2.exe’ OR F.FileName LIKE ‘r2macsngl41.sea’ OR F.FileName LIKE ‘r2win.exe’ OR F.FileName LIKE ‘r3win.exe’ OR F.FileName LIKE ‘r4.exe’ OR F.FileName LIKE ‘r4macsngl42.sea’ OR F.FileName LIKE ‘r4win.exe’ OR F.FileName LIKE ‘r7.exe’ OR F.FileName LIKE ‘r8.exe’ OR F.FileName LIKE ‘r8win.exe’ OR F.FileName LIKE ‘rdeploy.exe’ OR F.FileName LIKE ‘rftp.exe’ OR F.FileName LIKE ‘rftpc.exe’ OR F.FileName LIKE ‘rlat.dll’ OR F.FileName LIKE ‘rnnfsadm.exe’ OR F.FileName LIKE ‘rnnfserv.exe’ OR F.FileName LIKE ‘rsshd.exe’ OR F.FileName LIKE ‘RumbaPage.exe’ OR F.FileName LIKE ‘RumbaTrc.exe’ OR F.FileName LIKE ‘Rumbavt.Exe’ OR F.FileName LIKE ‘rumbawsf’ OR F.FileName LIKE ‘Rumbawsf.Exe’ OR F.FileName LIKE ‘rvd.EXE’ OR F.FileName LIKE ‘Rx.exe’ OR F.FileName LIKE ‘Rx2008.jar’ OR F.FileName LIKE ‘rxmgr.exe’ OR F.FileName LIKE ‘SMTBF.DLL’ OR F.FileName LIKE ‘SMTBF32.DLL’ OR F.FileName LIKE ‘SNPI.EXE’ OR F.FileName LIKE ‘SNWINPA.EXE’ OR F.FileName LIKE ‘TCP2PDIS.EXE’ OR F.FileName LIKE ‘UpdRgfs.EXE’ OR F.FileName LIKE ‘wddsppag.exe’ OR F.FileName LIKE ‘wdehn.exe’ OR F.FileName LIKE ‘Wdmicomm.exe’ OR F.FileName LIKE ‘WDRPCMGR.EXE’ OR F.FileName LIKE ‘WICONSOLE.EXE’ OR F.FileName LIKE ‘WIMASvc.exe’ OR F.FileName LIKE ‘WINFTP32.DLL’ OR F.FileName LIKE ‘WINSTALL.exe’ OR F.FileName LIKE ‘WRQNFS.EXE’ OR F.FileName LIKE ‘WRQTCP.EXE’ OR F.FileName LIKE ‘X.EXE’ OR F.FileName LIKE ‘xcp.exe’ OR F.FileName LIKE ‘xfwXMI.dll’ OR F.FileName LIKE ‘xstartup.exe’ OR F.FileName LIKE 'XTALK30.EXE’
v7+
SELECT C.Name, F.* FROM vComputer C LEFT JOIN Inv_Installed_File_Details F on C.guid = F._resourceguid
WHERE F.Name LIKE ‘%.chf’ OR F.Name LIKE ‘%.ser’ OR F.Name LIKE ‘%CoreServices.exe%’ OR F.Name LIKE ‘%MCSServiceAgent.exe%’ OR F.Name LIKE ‘%PresentationDesigner.exe%’ OR F.Name LIKE ‘%SNDS.exe%’ OR F.Name LIKE ‘%VigilEntAgent.exe%’ OR F.Name LIKE ‘%vsoc.exe%’ OR F.Name LIKE ‘%WINSTALA.exe%’ OR F.Name LIKE ‘%WINSTLU32.exe%’ OR F.Name LIKE ‘%WINSTU32.exe%’ OR F.Name LIKE ‘ACCMGR32.EXE’ OR F.Name LIKE ‘ACPMGR.EXE’ OR F.Name LIKE ‘ACT6530X.OCX’ OR F.Name LIKE ‘AS400FTX.EXE’ OR F.Name LIKE ‘ATERM.OCX’ OR F.Name LIKE ‘ATM_RM_R.exe’ OR F.Name LIKE ‘ATMFRAME.EXE’ OR F.Name LIKE ‘bdes.dll’ OR F.Name LIKE ‘C4CONF32.EXE’ OR F.Name LIKE ‘CGI2NOVA.EXE’ OR F.Name LIKE ‘DBEnterprise.exe’ OR F.Name LIKE ‘DBUtility.exe’ OR F.Name LIKE ‘DemoHost.Exe’ OR F.Name LIKE ‘Discover.exe’ OR F.Name LIKE ‘EASYVIEW.EXE’ OR F.Name LIKE ‘EHNCFG32.EXE’ OR F.Name LIKE ‘EHNTES32.EXE’ OR F.Name LIKE ‘EMU.EXE’ OR F.Name LIKE ‘EXTRA!.EXE’ OR F.Name LIKE ‘EXTRA.EXE’ OR F.Name LIKE ‘fsshclient.exe’ OR F.Name LIKE ‘fsshd2.exe’ OR F.Name LIKE ‘GRAPHX32.EXE’ OR F.Name LIKE ‘Idrive.sys’ OR F.Name LIKE ‘IMPORT.exe’ OR F.Name LIKE ‘KEAHP.EXE’ OR F.Name LIKE ‘KEAVT.EXE’ OR F.Name LIKE ‘mnfserv.exe’ OR F.Name LIKE ‘mwm.exe’ OR F.Name LIKE ‘nfsgwapp.exe’ OR F.Name LIKE ‘nmAppc.dll’ OR F.Name LIKE ‘nmssh.exe’ OR F.Name LIKE ‘nmsshfwd.exe’ OR F.Name LIKE ‘NOF.exe’ OR F.Name LIKE ‘NOVA.EXE’ OR F.Name LIKE ‘NOVATRC.EXE’ OR F.Name LIKE ‘NWLatSrv.exe’ OR F.Name LIKE ‘PTR32.EXE’ OR F.Name LIKE ‘QAPDEV32.EXE’ OR F.Name LIKE ‘R.exe’ OR F.Name LIKE ‘r1.exe’ OR F.Name LIKE ‘r1win.exe’ OR F.Name LIKE ‘r2.exe’ OR F.Name LIKE ‘r2macsngl41.sea’ OR F.Name LIKE ‘r2win.exe’ OR F.Name LIKE ‘r3win.exe’ OR F.Name LIKE ‘r4.exe’ OR F.Name LIKE ‘r4macsngl42.sea’ OR F.Name LIKE ‘r4win.exe’ OR F.Name LIKE ‘r7.exe’ OR F.Name LIKE ‘r8.exe’ OR F.Name LIKE ‘r8win.exe’ OR F.Name LIKE ‘rdeploy.exe’ OR F.Name LIKE ‘rftp.exe’ OR F.Name LIKE ‘rftpc.exe’ OR F.Name LIKE ‘rlat.dll’ OR F.Name LIKE ‘rnnfsadm.exe’ OR F.Name LIKE ‘rnnfserv.exe’ OR F.Name LIKE ‘rsshd.exe’ OR F.Name LIKE ‘RumbaPage.exe’ OR F.Name LIKE ‘RumbaTrc.exe’ OR F.Name LIKE ‘Rumbavt.Exe’ OR F.Name LIKE ‘rumbawsf’ OR F.Name LIKE ‘Rumbawsf.Exe’ OR F.Name LIKE ‘rvd.EXE’ OR F.Name LIKE ‘Rx.exe’ OR F.Name LIKE ‘Rx2008.jar’ OR F.Name LIKE ‘rxmgr.exe’ OR F.Name LIKE ‘SMTBF.DLL’ OR F.Name LIKE ‘SMTBF32.DLL’ OR F.Name LIKE ‘SNPI.EXE’ OR F.Name LIKE ‘SNWINPA.EXE’ OR F.Name LIKE ‘TCP2PDIS.EXE’ OR F.Name LIKE ‘UpdRgfs.EXE’ OR F.Name LIKE ‘wddsppag.exe’ OR F.Name LIKE ‘wdehn.exe’ OR F.Name LIKE ‘Wdmicomm.exe’ OR F.Name LIKE ‘WDRPCMGR.EXE’ OR F.Name LIKE ‘WICONSOLE.EXE’ OR F.Name LIKE ‘WIMASvc.exe’ OR F.Name LIKE ‘WINFTP32.DLL’ OR F.Name LIKE ‘WINSTALL.exe’ OR F.Name LIKE ‘WRQNFS.EXE’ OR F.Name LIKE ‘WRQTCP.EXE’ OR F.Name LIKE ‘X.EXE’ OR F.Name LIKE ‘xcp.exe’ OR F.Name LIKE ‘xfwXMI.dll’ OR F.Name LIKE ‘xstartup.exe’ OR F.Name LIKE ‘XTALK30.EXE’
<v7
SELECT C.Name, F.* FROM vComputer C LEFT JOIN Inv_AeX_SW_Audit_software F on C.guid = F._resourceguid
WHERE F.[File Name] LIKE ‘%.chf’ OR F.[File Name] LIKE ‘%.ser’ OR F.[File Name] LIKE ‘%CoreServices.exe%’ OR F.[File Name] LIKE ‘%MCSServiceAgent.exe%’ OR F.[File Name] LIKE ‘%PresentationDesigner.exe%’ OR F.[File Name] LIKE ‘%SNDS.exe%’ OR F.[File Name] LIKE ‘%VigilEntAgent.exe%’ OR F.[File Name] LIKE ‘%vsoc.exe%’ OR F.[File Name] LIKE ‘%WINSTALA.exe%’ OR F.[File Name] LIKE ‘%WINSTLU32.exe%’ OR F.[File Name] LIKE ‘%WINSTU32.exe%’ OR F.[File Name] LIKE ‘ACCMGR32.EXE’ OR F.[File Name] LIKE ‘ACPMGR.EXE’ OR F.[File Name] LIKE ‘ACT6530X.OCX’ OR F.[File Name] LIKE ‘AS400FTX.EXE’ OR F.[File Name] LIKE ‘ATERM.OCX’ OR F.[File Name] LIKE ‘ATM_RM_R.exe’ OR F.[File Name] LIKE ‘ATMFRAME.EXE’ OR F.[File Name] LIKE ‘bdes.dll’ OR F.[File Name] LIKE ‘C4CONF32.EXE’ OR F.[File Name] LIKE ‘CGI2NOVA.EXE’ OR F.[File Name] LIKE ‘DBEnterprise.exe’ OR F.[File Name] LIKE ‘DBUtility.exe’ OR F.[File Name] LIKE ‘DemoHost.Exe’ OR F.[File Name] LIKE ‘Discover.exe’ OR F.[File Name] LIKE ‘EASYVIEW.EXE’ OR F.[File Name] LIKE ‘EHNCFG32.EXE’ OR F.[File Name] LIKE ‘EHNTES32.EXE’ OR F.[File Name] LIKE ‘EMU.EXE’ OR F.[File Name] LIKE ‘EXTRA!.EXE’ OR F.[File Name] LIKE ‘EXTRA.EXE’ OR F.[File Name] LIKE ‘fsshclient.exe’ OR F.[File Name] LIKE ‘fsshd2.exe’ OR F.[File Name] LIKE ‘GRAPHX32.EXE’ OR F.[File Name] LIKE ‘Idrive.sys’ OR F.[File Name] LIKE ‘IMPORT.exe’ OR F.[File Name] LIKE ‘KEAHP.EXE’ OR F.[File Name] LIKE ‘KEAVT.EXE’ OR F.[File Name] LIKE ‘mnfserv.exe’ OR F.[File Name] LIKE ‘mwm.exe’ OR F.[File Name] LIKE ‘nfsgwapp.exe’ OR F.[File Name] LIKE ‘nmAppc.dll’ OR F.[File Name] LIKE ‘nmssh.exe’ OR F.[File Name] LIKE ‘nmsshfwd.exe’ OR F.[File Name] LIKE ‘NOF.exe’ OR F.[File Name] LIKE ‘NOVA.EXE’ OR F.[File Name] LIKE ‘NOVATRC.EXE’ OR F.[File Name] LIKE ‘NWLatSrv.exe’ OR F.[File Name] LIKE ‘PTR32.EXE’ OR F.[File Name] LIKE ‘QAPDEV32.EXE’ OR F.[File Name] LIKE ‘R.exe’ OR F.[File Name] LIKE ‘r1.exe’ OR F.[File Name] LIKE ‘r1win.exe’ OR F.[File Name] LIKE ‘r2.exe’ OR F.[File Name] LIKE ‘r2macsngl41.sea’ OR F.[File Name] LIKE ‘r2win.exe’ OR F.[File Name] LIKE ‘r3win.exe’ OR F.[File Name] LIKE ‘r4.exe’ OR F.[File Name] LIKE ‘r4macsngl42.sea’ OR F.[File Name] LIKE ‘r4win.exe’ OR F.[File Name] LIKE ‘r7.exe’ OR F.[File Name] LIKE ‘r8.exe’ OR F.[File Name] LIKE ‘r8win.exe’ OR F.[File Name] LIKE ‘rdeploy.exe’ OR F.[File Name] LIKE ‘rftp.exe’ OR F.[File Name] LIKE ‘rftpc.exe’ OR F.[File Name] LIKE ‘rlat.dll’ OR F.[File Name] LIKE ‘rnnfsadm.exe’ OR F.[File Name] LIKE ‘rnnfserv.exe’ OR F.[File Name] LIKE ‘rsshd.exe’ OR F.[File Name] LIKE ‘RumbaPage.exe’ OR F.[File Name] LIKE ‘RumbaTrc.exe’ OR F.[File Name] LIKE ‘Rumbavt.Exe’ OR F.[File Name] LIKE ‘rumbawsf’ OR F.[File Name] LIKE ‘Rumbawsf.Exe’ OR F.[File Name] LIKE ‘rvd.EXE’ OR F.[File Name] LIKE ‘Rx.exe’ OR F.[File Name] LIKE ‘Rx2008.jar’ OR F.[File Name] LIKE ‘rxmgr.exe’ OR F.[File Name] LIKE ‘SMTBF.DLL’ OR F.[File Name] LIKE ‘SMTBF32.DLL’ OR F.[File Name] LIKE ‘SNPI.EXE’ OR F.[File Name] LIKE ‘SNWINPA.EXE’ OR F.[File Name] LIKE ‘TCP2PDIS.EXE’ OR F.[File Name] LIKE ‘UpdRgfs.EXE’ OR F.[File Name] LIKE ‘wddsppag.exe’ OR F.[File Name] LIKE ‘wdehn.exe’ OR F.[File Name] LIKE ‘Wdmicomm.exe’ OR F.[File Name] LIKE ‘WDRPCMGR.EXE’ OR F.[File Name] LIKE ‘WICONSOLE.EXE’ OR F.[File Name] LIKE ‘WIMASvc.exe’ OR F.[File Name] LIKE ‘WINFTP32.DLL’ OR F.[File Name] LIKE ‘WINSTALL.exe’ OR F.[File Name] LIKE ‘WRQNFS.EXE’ OR F.[File Name] LIKE ‘WRQTCP.EXE’ OR F.[File Name] LIKE ‘X.EXE’ OR F.[File Name] LIKE ‘xcp.exe’ OR F.[File Name] LIKE ‘xfwXMI.dll’ OR F.[File Name] LIKE ‘xstartup.exe’ OR F.[File Name] LIKE 'XTALK30.EXE’
EXE Scan
Known EXE Scan – SQL (SCCM)
Vendor/Version
SQL Query Syntax
2007
SELECT S.Netbios_Name0, F.FileName, F.FileDescription, F.FileVersion, F.FileSize, F.FileModifiedDate, F.FilePath FROM v_R_System S LEFT JOIN v_GS_SoftwareFile F ON S.ResourceID = F.ResourceID
WHERE F.FileName LIKE ‘%.chf’ OR F.FileName LIKE ‘%.ser’ OR F.FileName LIKE ‘%CoreServices.exe%’ OR F.FileName LIKE ‘%MCSServiceAgent.exe%’ OR F.FileName LIKE ‘%PresentationDesigner.exe%’ OR F.FileName LIKE ‘%SNDS.exe%’ OR F.FileName LIKE ‘%VigilEntAgent.exe%’ OR F.FileName LIKE ‘%vsoc.exe%’ OR F.FileName LIKE ‘%WINSTALA.exe%’ OR F.FileName LIKE ‘%WINSTLU32.exe%’ OR F.FileName LIKE ‘%WINSTU32.exe%’ OR F.FileName LIKE ‘ACCMGR32.EXE’ OR F.FileName LIKE ‘ACPMGR.EXE’ OR F.FileName LIKE ‘ACT6530X.OCX’ OR F.FileName LIKE ‘AS400FTX.EXE’ OR F.FileName LIKE ‘ATERM.OCX’ OR F.FileName LIKE ‘ATM_RM_R.exe’ OR F.FileName LIKE ‘ATMFRAME.EXE’ OR F.FileName LIKE ‘bdes.dll’ OR F.FileName LIKE ‘C4CONF32.EXE’ OR F.FileName LIKE ‘CGI2NOVA.EXE’ OR F.FileName LIKE ‘DBEnterprise.exe’ OR F.FileName LIKE ‘DBUtility.exe’ OR F.FileName LIKE ‘DemoHost.Exe’ OR F.FileName LIKE ‘Discover.exe’ OR F.FileName LIKE ‘EASYVIEW.EXE’ OR F.FileName LIKE ‘EHNCFG32.EXE’ OR F.FileName LIKE ‘EHNTES32.EXE’ OR F.FileName LIKE ‘EMU.EXE’ OR F.FileName LIKE ‘EXTRA!.EXE’ OR F.FileName LIKE ‘EXTRA.EXE’ OR F.FileName LIKE ‘fsshclient.exe’ OR F.FileName LIKE ‘fsshd2.exe’ OR F.FileName LIKE ‘GRAPHX32.EXE’ OR F.FileName LIKE ‘Idrive.sys’ OR F.FileName LIKE ‘IMPORT.exe’ OR F.FileName LIKE ‘KEAHP.EXE’ OR F.FileName LIKE ‘KEAVT.EXE’ OR F.FileName LIKE ‘mnfserv.exe’ OR F.FileName LIKE ‘mwm.exe’ OR F.FileName LIKE ‘nfsgwapp.exe’ OR F.FileName LIKE ‘nmAppc.dll’ OR F.FileName LIKE ‘nmssh.exe’ OR F.FileName LIKE ‘nmsshfwd.exe’ OR F.FileName LIKE ‘NOF.exe’ OR F.FileName LIKE ‘NOVA.EXE’ OR F.FileName LIKE ‘NOVATRC.EXE’ OR F.FileName LIKE ‘NWLatSrv.exe’ OR F.FileName LIKE ‘PTR32.EXE’ OR F.FileName LIKE ‘QAPDEV32.EXE’ OR F.FileName LIKE ‘R.exe’ OR F.FileName LIKE ‘r1.exe’ OR F.FileName LIKE ‘r1win.exe’ OR F.FileName LIKE ‘r2.exe’ OR F.FileName LIKE ‘r2macsngl41.sea’ OR F.FileName LIKE ‘r2win.exe’ OR F.FileName LIKE ‘r3win.exe’ OR F.FileName LIKE ‘r4.exe’ OR F.FileName LIKE ‘r4macsngl42.sea’ OR F.FileName LIKE ‘r4win.exe’ OR F.FileName LIKE ‘r7.exe’ OR F.FileName LIKE ‘r8.exe’ OR F.FileName LIKE ‘r8win.exe’ OR F.FileName LIKE ‘rdeploy.exe’ OR F.FileName LIKE ‘rftp.exe’ OR F.FileName LIKE ‘rftpc.exe’ OR F.FileName LIKE ‘rlat.dll’ OR F.FileName LIKE ‘rnnfsadm.exe’ OR F.FileName LIKE ‘rnnfserv.exe’ OR F.FileName LIKE ‘rsshd.exe’ OR F.FileName LIKE ‘RumbaPage.exe’ OR F.FileName LIKE ‘RumbaTrc.exe’ OR F.FileName LIKE ‘Rumbavt.Exe’ OR F.FileName LIKE ‘rumbawsf’ OR F.FileName LIKE ‘Rumbawsf.Exe’ OR F.FileName LIKE ‘rvd.EXE’ OR F.FileName LIKE ‘Rx.exe’ OR F.FileName LIKE ‘Rx2008.jar’ OR F.FileName LIKE ‘rxmgr.exe’ OR F.FileName LIKE ‘SMTBF.DLL’ OR F.FileName LIKE ‘SMTBF32.DLL’ OR F.FileName LIKE ‘SNPI.EXE’ OR F.FileName LIKE ‘SNWINPA.EXE’ OR F.FileName LIKE ‘TCP2PDIS.EXE’ OR F.FileName LIKE ‘UpdRgfs.EXE’ OR F.FileName LIKE ‘wddsppag.exe’ OR F.FileName LIKE ‘wdehn.exe’ OR F.FileName LIKE ‘Wdmicomm.exe’ OR F.FileName LIKE ‘WDRPCMGR.EXE’ OR F.FileName LIKE ‘WICONSOLE.EXE’ OR F.FileName LIKE ‘WIMASvc.exe’ OR F.FileName LIKE ‘WINFTP32.DLL’ OR F.FileName LIKE ‘WINSTALL.exe’ OR F.FileName LIKE ‘WRQNFS.EXE’ OR F.FileName LIKE ‘WRQTCP.EXE’ OR F.FileName LIKE ‘X.EXE’ OR F.FileName LIKE ‘xcp.exe’ OR F.FileName LIKE ‘xfwXMI.dll’ OR F.FileName LIKE ‘xstartup.exe’ OR F.FileName LIKE 'XTALK30.EXE’
2012R1
SELECT S.NetbiosName, F.FileName, F.FileDescription, F.FileVersion, F.FileSize, F.FileModifiedDate, F.FilePath FROM SMS_R_System S LEFT JOIN SMS_G_System_SoftwareFile F on F.ResourceID = S.ResourceId
WHERE F.FileName LIKE ‘%.chf’ OR F.FileName LIKE ‘%.ser’ OR F.FileName LIKE ‘%CoreServices.exe%’ OR F.FileName LIKE ‘%MCSServiceAgent.exe%’ OR F.FileName LIKE ‘%PresentationDesigner.exe%’ OR F.FileName LIKE ‘%SNDS.exe%’ OR F.FileName LIKE ‘%VigilEntAgent.exe%’ OR F.FileName LIKE ‘%vsoc.exe%’ OR F.FileName LIKE ‘%WINSTALA.exe%’ OR F.FileName LIKE ‘%WINSTLU32.exe%’ OR F.FileName LIKE ‘%WINSTU32.exe%’ OR F.FileName LIKE ‘ACCMGR32.EXE’ OR F.FileName LIKE ‘ACPMGR.EXE’ OR F.FileName LIKE ‘ACT6530X.OCX’ OR F.FileName LIKE ‘AS400FTX.EXE’ OR F.FileName LIKE ‘ATERM.OCX’ OR F.FileName LIKE ‘ATM_RM_R.exe’ OR F.FileName LIKE ‘ATMFRAME.EXE’ OR F.FileName LIKE ‘bdes.dll’ OR F.FileName LIKE ‘C4CONF32.EXE’ OR F.FileName LIKE ‘CGI2NOVA.EXE’ OR F.FileName LIKE ‘DBEnterprise.exe’ OR F.FileName LIKE ‘DBUtility.exe’ OR F.FileName LIKE ‘DemoHost.Exe’ OR F.FileName LIKE ‘Discover.exe’ OR F.FileName LIKE ‘EASYVIEW.EXE’ OR F.FileName LIKE ‘EHNCFG32.EXE’ OR F.FileName LIKE ‘EHNTES32.EXE’ OR F.FileName LIKE ‘EMU.EXE’ OR F.FileName LIKE ‘EXTRA!.EXE’ OR F.FileName LIKE ‘EXTRA.EXE’ OR F.FileName LIKE ‘fsshclient.exe’ OR F.FileName LIKE ‘fsshd2.exe’ OR F.FileName LIKE ‘GRAPHX32.EXE’ OR F.FileName LIKE ‘Idrive.sys’ OR F.FileName LIKE ‘IMPORT.exe’ OR F.FileName LIKE ‘KEAHP.EXE’ OR F.FileName LIKE ‘KEAVT.EXE’ OR F.FileName LIKE ‘mnfserv.exe’ OR F.FileName LIKE ‘mwm.exe’ OR F.FileName LIKE ‘nfsgwapp.exe’ OR F.FileName LIKE ‘nmAppc.dll’ OR F.FileName LIKE ‘nmssh.exe’ OR F.FileName LIKE ‘nmsshfwd.exe’ OR F.FileName LIKE ‘NOF.exe’ OR F.FileName LIKE ‘NOVA.EXE’ OR F.FileName LIKE ‘NOVATRC.EXE’ OR F.FileName LIKE ‘NWLatSrv.exe’ OR F.FileName LIKE ‘PTR32.EXE’ OR F.FileName LIKE ‘QAPDEV32.EXE’ OR F.FileName LIKE ‘R.exe’ OR F.FileName LIKE ‘r1.exe’ OR F.FileName LIKE ‘r1win.exe’ OR F.FileName LIKE ‘r2.exe’ OR F.FileName LIKE ‘r2macsngl41.sea’ OR F.FileName LIKE ‘r2win.exe’ OR F.FileName LIKE ‘r3win.exe’ OR F.FileName LIKE ‘r4.exe’ OR F.FileName LIKE ‘r4macsngl42.sea’ OR F.FileName LIKE ‘r4win.exe’ OR F.FileName LIKE ‘r7.exe’ OR F.FileName LIKE ‘r8.exe’ OR F.FileName LIKE ‘r8win.exe’ OR F.FileName LIKE ‘rdeploy.exe’ OR F.FileName LIKE ‘rftp.exe’ OR F.FileName LIKE ‘rftpc.exe’ OR F.FileName LIKE ‘rlat.dll’ OR F.FileName LIKE ‘rnnfsadm.exe’ OR F.FileName LIKE ‘rnnfserv.exe’ OR F.FileName LIKE ‘rsshd.exe’ OR F.FileName LIKE ‘RumbaPage.exe’ OR F.FileName LIKE ‘RumbaTrc.exe’ OR F.FileName LIKE ‘Rumbavt.Exe’ OR F.FileName LIKE ‘rumbawsf’ OR F.FileName LIKE ‘Rumbawsf.Exe’ OR F.FileName LIKE ‘rvd.EXE’ OR F.FileName LIKE ‘Rx.exe’ OR F.FileName LIKE ‘Rx2008.jar’ OR F.FileName LIKE ‘rxmgr.exe’ OR F.FileName LIKE ‘SMTBF.DLL’ OR F.FileName LIKE ‘SMTBF32.DLL’ OR F.FileName LIKE ‘SNPI.EXE’ OR F.FileName LIKE ‘SNWINPA.EXE’ OR F.FileName LIKE ‘TCP2PDIS.EXE’ OR F.FileName LIKE ‘UpdRgfs.EXE’ OR F.FileName LIKE ‘wddsppag.exe’ OR F.FileName LIKE ‘wdehn.exe’ OR F.FileName LIKE ‘Wdmicomm.exe’ OR F.FileName LIKE ‘WDRPCMGR.EXE’ OR F.FileName LIKE ‘WICONSOLE.EXE’ OR F.FileName LIKE ‘WIMASvc.exe’ OR F.FileName LIKE ‘WINFTP32.DLL’ OR F.FileName LIKE ‘WINSTALL.exe’ OR F.FileName LIKE ‘WRQNFS.EXE’ OR F.FileName LIKE ‘WRQTCP.EXE’ OR F.FileName LIKE ‘X.EXE’ OR F.FileName LIKE ‘xcp.exe’ OR F.FileName LIKE ‘xfwXMI.dll’ OR F.FileName LIKE ‘xstartup.exe’ OR F.FileName LIKE 'XTALK30.EXE
2012R2
SELECT S.Netbios_Name0, F.FileName, F.FileDescription, F.FileVersion, F.FileSize, F.FileModifiedDate, F.FilePath FROM vSMS_R_System S LEFT JOIN v_GS_SoftwareFile F On F.ResourceID = S.ItemKey
WHERE F.FileName LIKE ‘%.chf’ OR F.FileName LIKE ‘%.ser’ OR F.FileName LIKE ‘%CoreServices.exe%’ OR F.FileName LIKE ‘%MCSServiceAgent.exe%’ OR F.FileName LIKE ‘%PresentationDesigner.exe%’ OR F.FileName LIKE ‘%SNDS.exe%’ OR F.FileName LIKE ‘%VigilEntAgent.exe%’ OR F.FileName LIKE ‘%vsoc.exe%’ OR F.FileName LIKE ‘%WINSTALA.exe%’ OR F.FileName LIKE ‘%WINSTLU32.exe%’ OR F.FileName LIKE ‘%WINSTU32.exe%’ OR F.FileName LIKE ‘ACCMGR32.EXE’ OR F.FileName LIKE ‘ACPMGR.EXE’ OR F.FileName LIKE ‘ACT6530X.OCX’ OR F.FileName LIKE ‘AS400FTX.EXE’ OR F.FileName LIKE ‘ATERM.OCX’ OR F.FileName LIKE ‘ATM_RM_R.exe’ OR F.FileName LIKE ‘ATMFRAME.EXE’ OR F.FileName LIKE ‘bdes.dll’ OR F.FileName LIKE ‘C4CONF32.EXE’ OR F.FileName LIKE ‘CGI2NOVA.EXE’ OR F.FileName LIKE ‘DBEnterprise.exe’ OR F.FileName LIKE ‘DBUtility.exe’ OR F.FileName LIKE ‘DemoHost.Exe’ OR F.FileName LIKE ‘Discover.exe’ OR F.FileName LIKE ‘EASYVIEW.EXE’ OR F.FileName LIKE ‘EHNCFG32.EXE’ OR F.FileName LIKE ‘EHNTES32.EXE’ OR F.FileName LIKE ‘EMU.EXE’ OR F.FileName LIKE ‘EXTRA!.EXE’ OR F.FileName LIKE ‘EXTRA.EXE’ OR F.FileName LIKE ‘fsshclient.exe’ OR F.FileName LIKE ‘fsshd2.exe’ OR F.FileName LIKE ‘GRAPHX32.EXE’ OR F.FileName LIKE ‘Idrive.sys’ OR F.FileName LIKE ‘IMPORT.exe’ OR F.FileName LIKE ‘KEAHP.EXE’ OR F.FileName LIKE ‘KEAVT.EXE’ OR F.FileName LIKE ‘mnfserv.exe’ OR F.FileName LIKE ‘mwm.exe’ OR F.FileName LIKE ‘nfsgwapp.exe’ OR F.FileName LIKE ‘nmAppc.dll’ OR F.FileName LIKE ‘nmssh.exe’ OR F.FileName LIKE ‘nmsshfwd.exe’ OR F.FileName LIKE ‘NOF.exe’ OR F.FileName LIKE ‘NOVA.EXE’ OR F.FileName LIKE ‘NOVATRC.EXE’ OR F.FileName LIKE ‘NWLatSrv.exe’ OR F.FileName LIKE ‘PTR32.EXE’ OR F.FileName LIKE ‘QAPDEV32.EXE’ OR F.FileName LIKE ‘R.exe’ OR F.FileName LIKE ‘r1.exe’ OR F.FileName LIKE ‘r1win.exe’ OR F.FileName LIKE ‘r2.exe’ OR F.FileName LIKE ‘r2macsngl41.sea’ OR F.FileName LIKE ‘r2win.exe’ OR F.FileName LIKE ‘r3win.exe’ OR F.FileName LIKE ‘r4.exe’ OR F.FileName LIKE ‘r4macsngl42.sea’ OR F.FileName LIKE ‘r4win.exe’ OR F.FileName LIKE ‘r7.exe’ OR F.FileName LIKE ‘r8.exe’ OR F.FileName LIKE ‘r8win.exe’ OR F.FileName LIKE ‘rdeploy.exe’ OR F.FileName LIKE ‘rftp.exe’ OR F.FileName LIKE ‘rftpc.exe’ OR F.FileName LIKE ‘rlat.dll’ OR F.FileName LIKE ‘rnnfsadm.exe’ OR F.FileName LIKE ‘rnnfserv.exe’ OR F.FileName LIKE ‘rsshd.exe’ OR F.FileName LIKE ‘RumbaPage.exe’ OR F.FileName LIKE ‘RumbaTrc.exe’ OR F.FileName LIKE ‘Rumbavt.Exe’ OR F.FileName LIKE ‘rumbawsf’ OR F.FileName LIKE ‘Rumbawsf.Exe’ OR F.FileName LIKE ‘rvd.EXE’ OR F.FileName LIKE ‘Rx.exe’ OR F.FileName LIKE ‘Rx2008.jar’ OR F.FileName LIKE ‘rxmgr.exe’ OR F.FileName LIKE ‘SMTBF.DLL’ OR F.FileName LIKE ‘SMTBF32.DLL’ OR F.FileName LIKE ‘SNPI.EXE’ OR F.FileName LIKE ‘SNWINPA.EXE’ OR F.FileName LIKE ‘TCP2PDIS.EXE’ OR F.FileName LIKE ‘UpdRgfs.EXE’ OR F.FileName LIKE ‘wddsppag.exe’ OR F.FileName LIKE ‘wdehn.exe’ OR F.FileName LIKE ‘Wdmicomm.exe’ OR F.FileName LIKE ‘WDRPCMGR.EXE’ OR F.FileName LIKE ‘WICONSOLE.EXE’ OR F.FileName LIKE ‘WIMASvc.exe’ OR F.FileName LIKE ‘WINFTP32.DLL’ OR F.FileName LIKE ‘WINSTALL.exe’ OR F.FileName LIKE ‘WRQNFS.EXE’ OR F.FileName LIKE ‘WRQTCP.EXE’ OR F.FileName LIKE ‘X.EXE’ OR F.FileName LIKE ‘xcp.exe’ OR F.FileName LIKE ‘xfwXMI.dll’ OR F.FileName LIKE ‘xstartup.exe’ OR F.FileName LIKE 'XTALK30.EXE’
EXE Scan
thank you for any help