Tracking each time a policy is run on a system

Reporting
1

I have some policies which look for some software installs and after business hours it automatically uninstalls the software.

The action is published to run whenever it is relevant, and some of my users are persistent at installing the bad software, so it triggers and uninstalls each time.

Is there any way to report on how many times and when an action has run against each of the systems it lists? Ideally as a list not having to drill into the console action per server.

Generically the open action just lists 9 systems, and the start and end time when viewed through console is just the last time it was run. It does however have a count but not when it was for the pervious runs.

2

No, instead you could update your action to generate a log file of its own.

3

Thank you - i actually created another policy to detect and send an email notification but it seemed a little excessive.

Do you know if the Compliance module for bigfix would be able to handle this any better?
Preventing or uninstalling the bad software ?

4

BigFix Inventory would probably be a better choice for identifying and alerting on new / unauthorized software.

BigFix Compliance can help with auditing your security policy against CIS, USGCB, DISA STIG, or custom checklists; for example audit your Administrators groups match your policy; verify you have removed this user’s account from Administrators and disabled the account.

1 Like