Reports, filters, and SQL queries to identify computers using Cloud-enabled Management

Products

Client Management Suite IT Management Suite

Issue/Introduction

How can you identify computers that are configured for Cloud-enabled Management (CEM), currently communicating over the Internet, or associated with a specific gateway?

Environment

ITMS 8.7.x, 8.8.x

Cause

ITMS (IT Management Suite) provides several ways to track computers that use Cloud-enabled Management. The built-in reports and filters are the quickest starting point for most administrators. For more specific reporting needs, you can also query CEM-related inventory data such as Inv_AeX_AC_Network_Zone. The report most customers look for first is the Computers by gateway report.

Question	Best data point
Which clients are currently connecting over the Internet?	`Inv_AeX_AC_Network_Zone.IsOnInternet = 1`
Which clients are configured for CEM?	`Inv_AeX_AC_Network_Zone.InternetModeSupported = 1` and typically `AppliedPolicyCount > 0`

The Cloud-enabled Management Settings policy is what targets the computers that you want to manage over the Internet, which aligns with using policy/application-related fields to determine whether CEM is enabled on a client.

Resolution

The question is typically how to locate the correct report, filter, or data source for the specific CEM view that is needed, such as:

Computers currently on the Internet
Computers configured for CEM
Computers connecting through a specific gateway
Managed clients that meet stricter HTTPS and agent-version requirements

Need	Recommended method
All clients currently connecting through CEM gateway	`IsOnInternet = 1` or Computers by gateway
All clients configured for CEM	`InternetModeSupported = 1 AND AppliedPolicyCount > 0`
Tightest “managed CEM clients” count	Use the longer `vRM_Computer_Item` / `Inv_AeX_AC_Client_Agent` query

Use the following built-in options first:

Option	Path / Object	Purpose
Report set	Reports > Notification Server Management > Cloud-enabled Management > Agent	Includes reports such as Agents Distribution by Connection Type
Gateway report	Reports > All Reports > Notification Server Management > Cloud-enabled Management > Gateway > Computers by gateway	Common starting point to review computers associated with a gateway
Data class	`Inv_AeX_AC_Network_Zone.[IsOnInternet]`	Indicates whether the computer is currently on the Internet
Filter	Manage > Filters > Computer Filters > All Computers Currently on the Internet	Shows computers currently reporting as Internet-connected
Filter	Manage > Filters > Computer Filters > All Computers operating over HTTP	Helps distinguish HTTP-based communication scenarios

Recommended report

For most requests, start with:

Reports > All Reports > Notification Server Management > Cloud-enabled Management > Gateway > Computers by gateway

This is usually the quickest built-in report to review gateway usage.

Custom SQL queries

When built-in reports do not provide the exact view that you need, you can use the following SQL queries.

Note: Review queries in a test or reporting context before broad production use.

1) All computers configured for CEM

This query identifies managed computers that have been provisioned with at least one CEM policy and support Internet-based communication.

SELECT DISTINCT 
    vc.[Guid], 
    vc.[Name] AS [Computer Name],
    nz.[AppliedPolicyCount] AS [CEM Policies Applied],
    nz.[HTTPSMode]
FROM vComputer vc
INNER JOIN Inv_AeX_AC_Network_Zone nz ON vc.[Guid] = nz.[_ResourceGuid]
WHERE nz.[InternetModeSupported] = 1
  AND nz.[AppliedPolicyCount] > 0
  AND vc.[IsManaged] = 1

2) CEM status

This query returns managed computers and their CEM readiness or status.

SELECT 
    vc.[Name] AS [Computer Name],
    vc.[User] AS [Primary User],
    nz.[IsOnInternet] AS [Currently on Internet],
    nz.[InternetModeSupported] AS [CEM Configured],
    nz.[AppliedPolicyCount] AS [CEM Policies],
    nz.[HTTPSMode],
    nz.[TLS]
FROM vComputer vc
JOIN Inv_AeX_AC_Network_Zone nz ON vc.[Guid] = nz.[_ResourceGuid]
WHERE vc.[IsManaged] = 1
ORDER BY nz.[IsOnInternet] DESC, vc.[Name] ASC

3) Clients connecting to SMP Server over cloud in CEM mode

This query helps identify clients that are actively connecting externally.

SELECT c.Name
FROM Inv_AeX_AC_Network_Zone z
JOIN vComputer c ON c.Guid = z._ResourceGuid
WHERE z.IsOnInternet = 1

4) Stricter managed-client view

Use this version when you need to exclude:

unmanaged resources
deleted resources
non-Altiris Agent records
older agent versions
non-HTTPS clients

SELECT cr.[Guid], cr.Name
FROM vRM_Computer_Item cr
JOIN ServerSettingGuids ss
ON ss.Name = 'OwnerNSGuid'
AND ss.Value = cr.OwnerNSGuid
LEFT JOIN ResourceAssociation ra
ON ra.ParentResourceGuid = cr.[Guid]
AND ra.ResourceAssociationTypeGuid = '3028166F-C0D6-41D8-9CB7-F64852E0FD01'
JOIN Inv_AeX_AC_Client_Agent ca
ON ca._ResourceGuid = cr.[Guid]
AND ca.[Agent Name] = N'Altiris Agent'
JOIN Inv_AeX_AC_Network_Zone nz
ON nz._ResourceGuid = cr.[Guid]
WHERE cr.IsManaged = 1
AND cr.ResourceItemDeleted = 0
AND (ra.ChildResourceGuid IS NULL
OR ra.ChildResourceGuid = '0A0203A5-D2B6-49f1-A53B-5EC31A89437C')
AND nz.HTTPSMode = 1
AND dbo.fnVersionCompare2(
ca.[Product Version],
dbo.fnGetComparableVersion('8.5')
) >= 0

How to interpret the key fields

Field	Meaning
`IsOnInternet`	The computer is currently identified as communicating over the Internet
`InternetModeSupported`	The computer supports Internet-based communication for CEM
`AppliedPolicyCount`	Number of CEM-related policies applied to the client
`HTTPSMode`	Indicates HTTPS-based communication mode
`TLS`	Indicates TLS-related reporting state returned by the data class

Validation

After running a report or query, verify the following:

The computer appears as managed.
The IsOnInternet value matches the client’s expected connection state.
The InternetModeSupported value is enabled for CEM-capable systems.
The AppliedPolicyCount is greater than 0 for systems expected to be provisioned for CEM.
If required, confirm the client appears in the gateway-based report.