Set up a Analysis for Windows machines to pull serial numbers:
selects "SerialNumber from Win32_Bios" of wmi
The results show “No computers meet the filter criteria”
Not sure what I’m doing wrong.
Thanks,
Kevin
Are you creating a Filter or an Analysis?
@kstefanic
Yes!! The relevance you’re using is not correct.
You have to define SELECT which Specifies the properties that are used in WMI queries.
Hope, Below code will help you:
Q: (unique values of (string values of selects "SerialNumber from win32_BIOS" of wmi))
A: VMware-42 32 b4 26 3a 73 a5 13-36 ce 75 21 f1 13 3e 4f
T: 8.502 ms
Q: (string values of selects "SerialNumber from win32_BIOS" of wmi)
A: VMware-42 32 b4 26 3a 73 a5 13-36 ce 75 21 f1 13 3e 4f
T: 11.528 ms
Also specify OS Contains Windows in Filter criteria while creating Analyses.
Below screenshot for your referance:
1 Like
Couldn’t you use the built in “Identifying Number - Windows”? That pulls serial number.
1 Like
Thanks for the quick answers, but I’m still not seeing anything in the results. I’m kind of new to this so it could be something dumb that I am missing!!!
Here’s what I have:
(string values of selects “SerialNumber from win32_BIOS” of wmi)
Under relevance: Computers which match the condition below:
OS contains Win
Still getting "No computers meet the filter criteria:
Another thing I found in the client log when I did a refresh:
I took out the actual IP’s and replaced the actual server name with but they are correct.
I have no idea what opsite13 is!!!
Current Date: June 16, 2016
Client version 9.1.1117.0 built for Windows 5.0 i386 running on WinVer 6.0.6002
Current Balance Settings: Use CPU: True Entitlement: 0 WorkIdle: 10 SleepIdle: 480
ICU data directory: 'C:\Program Files\BigFix Enterprise\BES Client’
ICU init status: SUCCESS
ICU deployment character set: windows-1252
ICU local character set: windows-1252
ICU transcoding between deployment and local character sets: DISABLED
At 16:56:58 -0400 -
Starting client version 9.1.1117.0
FIPS mode disabled by default.
Cryptographic module initialized successfully.
Using crypto library libBEScrypto - OpenSSL 1.0.1h-fips 5 Jun 2014
Restricted mode
Initializing Site: BES Asset Discovery
Initializing Site: BES Inventory and License
Initializing Site: BES Support
Initializing Site: BigFix Labs
Initializing Site: Enterprise Security
At 16:56:59 -0400 -
Initializing Site: Patching Support
Initializing Site: mailboxsite
Initializing Site: opsite103
Beginning Relay Select
At 16:57:00 -0400 -
GetRelayInfo: checking 'http://127.0.0.1:52311/cgi-bin/bfenterprise/clientregister.exe?RequestType=Version’
GetRelayInfo: Valid Relay
RegisterOnce: Attempting secure registration with 'https://127.0.0.1:52311/cgi-bin/bfenterprise/clientregister.exe?RequestType=RegisterMe60&ClientVersion=9.1.1117.0&Body=16282929&SequenceNumber=769&MinRelayVersion=7.1.1.0&CanHandleMVPings=1&Root=http://%3a52311&AdapterInfo=00-11-25-a3-83-39_10.30.1.0%2f24_10.30.1.254_0’
At 16:57:01 -0400 -
Unrestricted mode
Configuring listener without wake-on-lan
Registered with url 'https://127.0.0.1:52311/cgi-bin/bfenterprise/clientregister.exe?RequestType=RegisterMe60&ClientVersion=9.1.1117.0&Body=16282929&SequenceNumber=769&MinRelayVersion=7.1.1.0&CanHandleMVPings=1&Root=http://%3a52311&AdapterInfo=00-11-25-a3-83-39_10.30.1.0%2f24_10.30.1.254_0’
Registration Server version 9.1.1117.0 , Relay version 9.1.1117.0
Relay does not require authentication.
Client has an AuthenticationCertificate
Using localhost. Parent Relay selected: . at: XX.XX.XX.XX:52311 on: IPV4
At 16:57:03 -0400 -
Entering service loop
At 16:57:04 -0400 -
Successful Synchronization with site ‘actionsite’ (version 9063) - 'http://:52311/cgi-bin/bfgather.exe/actionsite’
SetupListener success: IPV4/6
Site ‘mailboxsite’ is not yet available on selected relay. Awaiting notification of availability.
Successful Synchronization with site ‘mailboxsite’ (version 0) - 'http://:52311/cgi-bin/bfgather.exe/mailboxsite16282929’
At 16:57:05 -0400 -
Successful Synchronization with site ‘BES Asset Discovery’ (version 95) - 'http://sync.bigfix.com/cgi-bin/bfgather/assetdiscovery’
At 16:57:12 -0400 -
Successful Synchronization with site ‘BES Inventory and License’ (version 174) - 'http://sync.bigfix.com/cgi-bin/bfgather/besinventory’
Successful Synchronization with site ‘BES Support’ (version 1263) - 'http://sync.bigfix.com/cgi-bin/bfgather/bessupport’
Successful Synchronization with site ‘BigFix Labs’ (version 50) - 'http://sync.bigfix.com/cgi-bin/bfgather/bigfixlabs’
Successful Synchronization with site ‘Enterprise Security’ (version 2522) - 'http://sync.bigfix.com/cgi-bin/bfgather/bessecurity’
At 16:57:13 -0400 -
Successful Synchronization with site ‘Patching Support’ (version 571) - 'http://sync.bigfix.com/cgi-bin/bfgather/patchingsupport’
Successful Synchronization with site ‘opsite103’ (version 1725) - 'http://:52311/cgi-bin/bfgather.exe/opsite103’
ActiveDirectory: Refreshed Computer Information - Domain: (N/A)
User interface process started for user 'posluser’
At 16:57:20 -0400 -
Encryption: reports encrypted
At 16:57:34 -0400 -
Encrypted Report posted successfully
@kstefanic
I’m assuming that you are adding the code “(string values of selects “SerialNumber from win32_BIOS” of wmi)” into Property tab (Add Property).
Just for the testing purpose, You can try assigning “All Computer” in relevance tab and see if it works.
I was wondering if you could send screenshot of how exactly you’re creating Analysis So that we will have clear idea about it.
The “Identifying Number - Windows” analysis from Bes Inventory and License site:
if (exists wmi) then (string values of selects "IdentifyingNumber from Win32_ComputerSystemProduct" of wmi) else ("N/A")
To your comment about not knowing what opsite13 is, every operator of bigfix get’s it’s own site, so this is probably your user’s opsite. For example, anything I create in my site goes to opsite6 in my environment.
Try this analysis: https://bigfix.me/analysis/details/2994751
The SMBIOS inspector is mostly universal and lighter weight than WMI.
Using WMI in an analysis isn’t so bad if you lower the reporting interval, but you need to be careful with WMI in fixlets/tasks/groups and similar applicability relevance.
4 Likes
You’re awesome. That’s what I was looking for.
This is great, thank you
1 Like