How to track if a machine is changing OS version

Products

• IT Management Suite

Issue/Introduction

The customer noticed that some client machines are changing the OS version. For example, from "Windows Server 2019" to "Unknown Windows" and then back to "Microsoft Server 2019".

This caused issues where filters or targets based on specific OS versions will not contain the right set of machines.

Is there a way to track such OS version changes?

Environment

ITMS 8.5, 8.6

Cause

Network Discovery, Connector Solution Import, and AD Import may cause overwriting of the current OS version.

Resolution

We base this information from "Inv_Aex_AC_Identification" table. For example, the default "Windows Servers" uses a query like this:

SELECT    cr.[Guid]                 AS [_ResourceGuid]
    FROM  vComputerResource         AS cr
    JOIN  Inv_AeX_AC_Identification AS id ON id._ResourceGuid = cr.[Guid]
    CROSS APPLY dbo.fnSysMask_IsWindowsServerAsTable(id.[OS System Mask], 18, 36, 0) tt  -- Win, Server 2000-2022 (with Hyper-V)
    WHERE cr.IsManaged = 1
     

1. To track such types of changes, you will need to enable "Resource History" for the "Inv_Aex_AC_Identification" table.
   Go to SMP Console > Settings > All Settings > Notification Server > Resource and Data Class Settings > Resource History > Resource Data History tab.
   Under Notification Server, select "Aex_AC_Identification" and depending on how active your environment is or how frequently this happens, you may need to increase the default "1 000 000" row to something a little bit higher.
   
   
   
   
   
2. After this "Aex_AC_Identification" data history is turned on and the issue happens again, you can use the following query to find out when this happened and use that time/date for looking at your NS logs and Scheduled Tasks that could be running around that time:
   
   SELECT 
    i.Name, cast (MAX (i.InventoryDate) as nvarchar(110)) as 'Change Date', cast (c.CreatedDate as nvarchar(110)) 'Created Date'
   FROM InvHIST_Aex_AC_Identification i
   JOIN vRM_Computer_Item c on c.Guid = i._ResourceGuid
   WHERE i._ResourceGuid IN
    (SELECT i2._ResourceGuid FROM Invhist_AeX_AC_Identification i2 WHERE i2.[OS Name] = 'Unknown windows')
    and i.InventoryDate > GETDATE ()-1
    and c.CreatedDate < GETDATE () - 1
   GROUP BY i._ResourceGuid, i.Name, c.CreatedDate
   HAVING COUNT (DISTINCT i.[OS Name]) > 1
    
3. You can also use the query above in step #2 as your base query to create an automation Policy that can email you a report that shows this information when it happens.