Information whether computer is joined to domain or workgroup

Products

IT Management Suite

Issue/Introduction

You are interested in knowing if there is a way to tell from what the Symantec Management Agent (Altiris Agent) under Basic Inventory, whether a computer is joined to a domain or workgroup.

Environment

ITMS 8.7.3

Resolution

With our ITMS 8.7.3 Release (see Release Notes), now Basic Inventory provides information whether computer is joined to domain or workgroup.

A new c32 field flag has been added to the AeX AC Identification dataclass with 1 value meaning that computer is joined to domain and 0 value meaning that computer is a part of workgroup.

For example, if you want to review how this information looks like from the actual NSE been sent:

First, you will need to capture the NSE that the client machine send with the Basic Inventory information. See KB 180102 “Trapping NSEs on a Windows client”
From the captured NSE file, you should see something like this (in BOLD and some sections were removed for readability):

<?xml version="1.0"?>
<message>
<to>#####913-72F3-4c36-####-D###A21#####</to>
<priority>0</priority>
<msgId>{FEEFEBF7-80DF-4262-975F-CD184AD3E5F2}</msgId>
<time>20250401162559.826000+000</time>
<body>
<inventory>
<resources>
<resource typeGuid="{2C3CB3BB-FEE9-48DF-804F-90856198B600}" guid="{xxxxxxxx-AB90-4898-BF5A-xxxxxxxx}" name="CLIENT-###-###-01" ref="1">
<key name="fqdn" value="CLIENT-###-###.example.local"/>
<key name="name.domain" value="CLIENT-###-###-01.EXAMPLE"/>
<key name="name.domain" value="CLIENT-###-###-01.example.local"/>
<key name="uniqueid" value="xxxxxxxxxxxxxxx=="/>
<key name="uniqueid" value="xxxxxxxxxxxxxxx=="/>
</resource>
.....
<dataClass name="AeX AC Certificate">
.......
</dataClass>
<dataClass name="AeX AC Client Connectivity">
.......
</dataClass>
<dataClass name="AeX AC Location">
........
</dataClass>
<dataClass name="AeX AC Identification">
<data>
<resource partialUpdate="false" resourceRef="1">
<row c0="{xxxxxxxx-AB90-4898-BF5A-xxxxxxxx}" c1="CLIENT-###-###-01" c2="EXAMPLE" c3="Win64" c4="Windows 11 Enterprise" c5="Enterprise" c6="10.0" c7="" c8="smpservice" c9="EXAMPLE" c10="2025-04-01T16:26:00" c11="10" c12="0" c13="22000" c14="9" c15="1" c16="9" c17="1" c18="9" c19="1" c20="CLIENT-###-###-01.example.local" c21="F1D7A0D4-018A-5B31-4BA3-5C374B9BAD28" c22="0" c23="GoogleCloud-D4A0D7F18A01315B4BA35C374B9BAD28" c24="GoogleCloud-D4A0D7F18A01315B4BA35C374B9BAD28" c25="" c26="117656699715721483" c27="2814751208901820" c28="Windows 11" c31="21H2" c32="1"/>
</resource>
</data>
</dataClass>
<dataClass name="AeX AC NetFrameworkVersions">
.......
</dataClass>
<dataClass name="AeX AC Network Zone">
.......
</dataClass>
<dataClass name="AeX AC Client Agent">
.......
</dataClass>
<dataClass name="AeX AC Primary User">
.......
</dataClass>
<dataClass name="AeX AC Roles">
.......
</dataClass>
<dataClass name="AeX AC NT Services">
.......
</dataClass>
<dataClass name="AeX AC TCPIP">
......
</dataClass>
<dataClass name="AeX AC TCPIPv6">
......
</dataClass>
<dataClass name="AeX AC VirtualMachine">
.......
</dataClass>
<dataClass name="Client Data Recency">
.......
</dataClass>
</inventory>
</body>
</message>
From this line, c28="Windows 11" c31="21H2" c32="1", this client machine has set c32 to value of "1" which means it is joined to the domain.