Microsoft Baseline Security Analyzer
Folder
/Microsoft Operations Manager Reporting/Microsoft Baseline Security Analyzer
Security Summary
Report
/Microsoft Operations Manager Reporting/Microsoft Baseline Security Analyzer/Security Summary
0.05in1in60.5625in4.5in50.5625in4.5inSecurity Summary40.5625in0.25in=Globals.ExecutionTime4.5in31.375in0.125intrue= Parameters!Computer.Value3in31.25in0.125intrue= Parameters!CompGroup.Value3in21.375in0.125in3intrueComputer :21.25in0.125in3intrueComputer Group :10.8125intrue0.375intextboxDescriptionHeading_tmptruetrue= "This report displays all Security Updates that the MOM agent monitored servers require and Vulnerabilities that have been discovered." & VbCrLf & "" & VbCrLf & "" & VbCrLf & "For this report to function properly, the following steps are required:" & VbCrLf & "" & VbCrLf & "– Microsoft Baseline Security Analyzer Management Pack needs to be installed" & VbCrLf & "– Microsoft Baseline Security Analyzer\Baseline Security Analyzer 1.2\MOM Agent\Run vulnerability and security patch scan rule needs to be enabled" & VbCrLf & "" 0.5625in0.25in4.5intrueDescription1.75in1.25in11= "No missing patches were detected. This could be due to the fact that all systems are up to date, or that security scan information has not been collected. Refer to the report description above to make sure that MOM has been configured properly to obtain the necessary information for this report." SecurityUpdateSummary0.30045in1.07445in1.069in4.0561in=Fields!Severity.Value10=Fields!Severity.Valuetruetrue2textbox339="Total Computers Affected (" & CountDistinct(Fields!Computer.Value) & ")"true20.25in8true7="Bulletin ID"truetextbox246="Computers Affected"true5="Bulletin Title"true0.25intextbox64=Fields!BulletinTitle.Value4true3= Fields!BulletinID.Valuetruetextbox312=CountDistinct(Fields!Computer.Value)true=Fields!BulletinURL.Value1=Fields!BulletinTitle.Valuetrue0.25intextbox640.5in4.6in0.6in1.125in1.375in1.5in=Fields!BulletinID.Value5true4="Computer Name"true23true0.25in2trueSecurity Updates and Vulnerabilities=Parameters!CompGroup.Value=Fields!Computer.Value1=Fields!Computer.Valuetrue2true0.25in=Fields!Computer.Value
40.5intruetextbox70
3.125in1.25in10= "No missing Service Packs were detected. This could be due to the fact that all systems are up to date, or that security scan information has not been collected. Refer to the report description above to make sure that MOM has been configured properly to obtain the necessary information for this report." ServicePackSummary0.29677in0.80657in0.6627in0.6627in1.00849in3.06277in=Fields!Severity.Value10=Fields!Severity.Valuetruetrue4textbox349="Total Computers Affected (" & CountDistinct(Fields!Computer.Value) & ")"true20.25in8true7="Product"true3textbox326="Computers Affected"truetextbox25="Service Pack"true0.25intextbox1=Fields!BulletinTitle.Value + Fields!ProductName.Value4true3= Fields!ProductName.Valuetrue3textbox52=CountDistinct(Fields!Computer.Value)true1=Fields!BulletinTitle.Valuetrue0.25intextbox10.5in4.6in0.6in1.125in1.375in1.5in=Fields!BulletinID.Value5true4="Computer Name"true23true0.25in2trueSecurity Updates and Vulnerabilities=Parameters!CompGroup.Value=Fields!Computer.Value1=Fields!Computer.Valuetrue2true0.25in=Fields!Computer.Value
60.5intruetextbox7
4.5in1.25in= "No vulnerabilities were detected. This could be due to the fact that all systems are up to date, or that security scan information has not been collected. Refer to the report description above to make sure that MOM has been configured properly to obtain the necessary information for this report." VulnerabilitiesSummary0.33382in0.26003in1.39952in4.50663intextbox368="Vulnerabilities"truetrue3textbox397="Total Computers Affected (" & CountDistinct(Fields!Computer.Value) & ")"true0.25intrue=Fields!Category.Value6true5=Fields!Category.Valuetrue24="Total Computers Affected (" & CountDistinct(Fields!Computer.Value) & ")"true0.25intextbox36=Fields!Vulnerability_Name.Value3true2truetextbox351= Fields!Vulnerability_Name.Valuetrue20.25intruetextbox200.5in5.875inVulnerabilitiesSummary0.875in1.125in2.375in1.5in=Fields!Category.Value5true4="Computer Name"true23true0.25in2trueSecurity Updates and Vulnerabilities=Parameters!CompGroup.Value=Fields!Computer.Value1=Fields!Computer.Valuetrue2true0.25in=Fields!Computer.Value
40.5intruetextbox35
11in0.25in1infb44cba7-75a7-4314-b2a5-1fce44701d23SCDWpublic function CurrentTimeZone() as string
CurrentTimeZone = System.TimeZone.CurrentTimeZone.StandardName
end function
public function FormatNumber(fieldValue, formatString) as string
if (fieldValue is Nothing)
FormatNumber = "Not Available"
else
FormatNumber = Format(fieldValue,formatString)
end if
end function
6.5inComputerSystem.StringSCDWSELECT Computer
FROM fn_GetComputersInGroup(@CompGroup) fn_GetComputersInGroup
UNION
SELECT '<ALL>'
order by Computer=Parameters!CompGroup.Value0trueMostRecentPatchScanSystem.DateTimeComputerSystem.StringSeveritySystem.StringBulletinIDSystem.StringBulletinTitleSystem.StringLocalDateTimeGeneratedSystem.DateTimeBulletinURLSystem.StringSCDWselect MostRecentPatchScan,
Computer = FullComputerName,
Severity = 'Missing Patches',
BulletinID,
BulletinTitle,
LocalDateTimeGenerated,
BulletinURL
from
(
select smc_instanceid,
FullComputerName,max(MostRecentPatchScan) as MostRecentPatchScan,
LocalDateTimeGenerated = MAX(LocalDateTimeGenerated),
BulletinID = MAX(BulletinID),
BulletinTitle = MAX([BulletinTitle]),
ItemType = MAX([ItemType]),
ItemClass = MAX([ItemClass]),
BulletinURL = MAX([BulletinURL])
FROM
(
select ef.smc_instanceid,MostRecentPatchScan,
ef.LocalDateTimeGenerated,
[FullComputerName] = cd.FullComputerName,
[Position] = epf.Position,
[BulletinID] = CASE WHEN (epf.Position = 4) THEN epf.EventParameterValue ELSE '' END,
[BulletinTitle] = CASE WHEN (epf.Position = 5) THEN epf.EventParameterValue ELSE '' END,
[ItemType] = CASE WHEN (epf.Position = 11) THEN epf.EventParameterValue ELSE '' END,
[ItemClass] = CASE WHEN (epf.Position = 3) THEN epf.EventParameterValue ELSE '' END,
[BulletinURL] = CASE WHEN (epf.Position = 7) THEN epf.EventParameterValue ELSE '' END
from
sc_eventfact_view ef
inner JOIN sc_eventparameterfact_view epf ON epf.EventID = ef.EventID
inner JOIN sc_computerdimension_view cd ON cd.SMC_InstanceID = ef.Computer_FK
inner join
(Select ef.Computer_FK,
max(ef.LocalDateTimeGenerated)as MostRecentPatchScan from sc_eventfact_view ef
where ef.EventDetail_FK =(select smc_instanceID from sc_eventdetaildimension_view where EventID_PK = 22754 )
and ef.computer_FK in (SELECT ComputerID
FROM dbo.[fn_GetComputerIDsInGroup](@CompGroup) fn_GetComputerIDsInGroup)
group by ef.Computer_FK)d
ON d.Computer_FK = ef.Computer_FK
WHERE d.MostRecentPatchScan < ef.LocalDateTimeGenerated and
ef.EventDetail_FK =(select smc_instanceID from sc_eventdetaildimension_view where EventID_PK = 22760 )
and
(CD.SMC_InstanceID IN (SELECT ComputerID
FROM dbo.[fn_GetComputerIDsInGroup](@CompGroup) fn_GetComputerIDsInGroup))
and (@Computer='<ALL>' or CD.FullComputerName = @Computer)
) a
GROUP BY smc_instanceid, FullComputerName
) b
WHERE (ItemClass = 'Patch') and (ItemType = 'Missing')
GROUP BY FullComputerName, MostRecentPatchScan, BulletinID, BulletinTitle, ItemType, ItemClass, LocalDateTimeGenerated, BulletinURL
ORDER BY BulletinID=Parameters!CompGroup.Value=Parameters!Computer.Value300000trueCompGroupSystem.StringSCDWSELECT *
FROM fn_ListComputerGroups() fn_ListComputerGroups_1
order by compgroup300000trueGradeSystem.StringTypeSystem.StringCat2System.StringVulnerability NameSystem.StringSeveritySystem.StringComputerSystem.StringCategorySystem.StringAdviceSystem.StringSCDWselect Grade, Type,Cat2, [Vulnerability Name] = [Advice],
Severity = 'Vulnerabilities',
Computer ,
Category =
CASE WHEN (Type in ('1')) THEN 'Windows' ELSE
CASE WHEN (Category in ('118', '177', '176')) THEN 'Internet Explorer' ELSE
CASE WHEN (Type in ('3')) THEN 'Internet Information Services' ELSE
CASE WHEN (Type in ('2')) THEN 'SQL' ELSE 'Other'
END
END
END
END,
Advice
from
(
select smc_instanceid,
Computer=FullComputerName,max(MostRecentPatchScan) as MostRecentScan,
LocalDateTimeGenerated = MAX(LocalDateTimeGenerated),
Category = MAX([Category]),
Type = MAX([Type]),
[Name] = MAX([Name]),
Advice = MAX([Advice]),
Grade = MAX([Grade]),
cat2 = max(cat2)
FROM
(
select ef.smc_instanceid,MostRecentPatchScan,
ef.LocalDateTimeGenerated,
[FullComputerName] = cd.FullComputerName,
[Position] = epf.Position,
[Category] = CASE WHEN (epf.Position = 2) THEN epf.EventParameterValue ELSE '' END,
[Type] = CASE WHEN (epf.Position = 4) THEN epf.EventParameterValue ELSE '' END,
[Name] = CASE WHEN (epf.Position = 7) THEN epf.EventParameterValue ELSE '' END,
[Advice] = CASE WHEN (epf.Position = 8) THEN epf.EventParameterValue ELSE '' END,
[Grade] = CASE WHEN (epf.Position = 3) THEN epf.EventParameterValue ELSE '' END,
[Cat2] = CASE WHEN (epf.Position = 5) THEN epf.EventParameterValue ELSE '' END
from
sc_eventfact_view ef
inner JOIN sc_eventparameterfact_view epf ON epf.EventID = ef.EventID
inner JOIN sc_computerdimension_view cd ON cd.SMC_InstanceID = ef.Computer_FK
inner join
(Select ef.Computer_FK,
max(ef.LocalDateTimeGenerated)as MostRecentPatchScan from sc_eventfact_view ef
where ef.EventDetail_FK =(select smc_instanceID from sc_eventdetaildimension_view where EventID_PK = 22753 )
and ef.computer_FK in (SELECT ComputerID
FROM dbo.[fn_GetComputerIDsInGroup](@CompGroup) fn_GetComputerIDsInGroup)
group by ef.Computer_FK)d
ON d.Computer_FK = ef.Computer_FK
WHERE d.MostRecentPatchScan < ef.LocalDateTimeGenerated and
ef.EventDetail_FK =(select smc_instanceID from sc_eventdetaildimension_view where EventID_PK = 22759 )
and
(CD.SMC_InstanceID IN (SELECT ComputerID
FROM dbo.[fn_GetComputerIDsInGroup](@CompGroup) fn_GetComputerIDsInGroup))
and (@Computer='<ALL>' or CD.FullComputerName = @Computer)
) a
GROUP BY smc_instanceid, FullComputerName
) b
where ((Type in ('1', '2', '3')) or (Category in ('118', '177', '176'))) and
(
((cat2 = '1') and (grade in ('1', '2', '3', '6'))) or
((cat2 = '2') and (grade in ('2', '4', '6')))
)
and (len(category) <= 3)=Parameters!CompGroup.Value=Parameters!Computer.Value300000trueMostRecentPatchScanSystem.DateTimeComputerSystem.StringSeveritySystem.StringBulletinIDSystem.StringBulletinTitleSystem.StringLocalDateTimeGeneratedSystem.DateTimeProductNameSystem.StringBulletinURLSystem.StringSCDWselect MostRecentPatchScan,
Computer = FullComputerName,
Severity = CASE WHEN ItemClass = 'ServicePack' THEN 'Missing Service Packs' END,
BulletinID,
BulletinTitle,
LocalDateTimeGenerated,
ProductName,
BulletinURL
from
(
select smc_instanceid,
FullComputerName,max(MostRecentPatchScan) as MostRecentPatchScan,
LocalDateTimeGenerated = MAX(LocalDateTimeGenerated),
BulletinID = MAX(BulletinID),
BulletinTitle = MAX([BulletinTitle]),
ItemType = MAX([ItemType]),
ItemClass = MAX([ItemClass]),
ProductName = MAX([ProductName]),
BulletinURL = MAX([BulletinURL])
FROM
(
select ef.smc_instanceid,MostRecentPatchScan,
ef.LocalDateTimeGenerated,
[FullComputerName] = cd.FullComputerName,
[Position] = epf.Position,
[BulletinID] = CASE WHEN (epf.Position = 4) THEN epf.EventParameterValue ELSE '' END,
[BulletinTitle] = CASE WHEN (epf.Position = 5) THEN epf.EventParameterValue ELSE '' END,
[ItemType] = CASE WHEN (epf.Position = 11) THEN epf.EventParameterValue ELSE '' END,
[ItemClass] = CASE WHEN (epf.Position = 3) THEN epf.EventParameterValue ELSE '' END,
[BulletinURL] = CASE WHEN (epf.Position = 7) THEN epf.EventParameterValue ELSE '' END,
[ProductName] = CASE WHEN (epf.Position = 1) THEN epf.EventParameterValue ELSE '' END
from
sc_eventfact_view ef
inner JOIN sc_eventparameterfact_view epf ON epf.EventID = ef.EventID
inner JOIN sc_computerdimension_view cd ON cd.SMC_InstanceID = ef.Computer_FK
inner join
(Select ef.Computer_FK,
max(ef.LocalDateTimeGenerated)as MostRecentPatchScan from sc_eventfact_view ef
where ef.EventDetail_FK =(select smc_instanceID from sc_eventdetaildimension_view where EventID_PK = 22754 )
and ef.computer_FK in (SELECT ComputerID
FROM dbo.[fn_GetComputerIDsInGroup](@CompGroup) fn_GetComputerIDsInGroup)
group by ef.Computer_FK)d
ON d.Computer_FK = ef.Computer_FK
WHERE d.MostRecentPatchScan < ef.LocalDateTimeGenerated and
ef.EventDetail_FK =(select smc_instanceID from sc_eventdetaildimension_view where EventID_PK = 22760 )
and
(CD.SMC_InstanceID IN (SELECT ComputerID
FROM dbo.[fn_GetComputerIDsInGroup](@CompGroup) fn_GetComputerIDsInGroup))
and (@Computer='<ALL>' or CD.FullComputerName = @Computer)
) a
GROUP BY smc_instanceid, FullComputerName
) b
WHERE (ItemClass = 'ServicePack') and (ItemType = 'Warning')
GROUP BY FullComputerName, MostRecentPatchScan, BulletinID, BulletinTitle, ItemType, ItemClass, LocalDateTimeGenerated, BulletinURL,ProductName
ORDER BY BulletinID=Parameters!CompGroup.Value=Parameters!Computer.Value300000true1intruetrue212d782b-9718-4b8d-a1c1-2bd72afd7b8210.25in0.25in="Page " & Globals.PageNumber & "/" & Globals.TotalPages4in0.25in0.25in4in="All dates and times shown in " & Code.CurrentTimeZone()truetrue0.55in1inStringtrueComputer GroupCompGroupCompGroupCompGroupStringComputerListComputerComputerComputerListComputerComputer]]>
Security Updates and Vulnerabilities
Report
/Microsoft Operations Manager Reporting/Microsoft Baseline Security Analyzer/Security Updates and Vulnerabilities
0.05in1in60.5625in4.5in50.5625in4.5inSecurity Updates and Vulnerabilities40.5625in0.25in=Globals.ExecutionTime4.5in31.25in0.125intrue= Parameters!Computer.Value3in21.25in0.125in3intrueComputer :10.8125intrue0.375intextboxDescriptionHeading_tmptruetrue= "This report displays all Security Updates and Vulnerabilities that have been discovered by the Microsoft Baseline Security Analyzer Management Pack." & VbCrLf & "" & VbCrLf & "" & VbCrLf & "For this report to function properly, the following steps are required:" & VbCrLf & "" & VbCrLf & "– Microsoft Baseline Security Analyzer Management Pack needs to be installed" & VbCrLf & "– Microsoft Baseline Security Analyzer\Baseline Security Analyzer 1.2\MOM Agent\Run vulnerability and security patch scan rule needs to be enabled" & VbCrLf & "" 0.5625in0.25in4.5intrueDescription1.625in0.25in10="Last Patch Scan (" & First(Fields!MostRecentPatchScan.Value, "MostRecentPatchScan") & ")"true1.875in0.75in6= "No missing patches were detected. This could be due to the fact that the system is up to date, or that security scan information has not been collected. Refer to the report description above to make sure that MOM has been configured properly to obtain the necessary information for this report." SecurityUpdates0.33333in0.41667in0.91667in4.83333intextbox17="Missing Patches"true3textbox156="Total Security Updates (" & CountDistinct(Fields!BulletinID.Value) & ")"true0.25intextbox55truetextbox114="Bulletin ID"true2textbox173="Bulletin Title"true0.25intruetextbox1true=Fields!BulletinID.Valuetextbox42truetextbox61= Fields!BulletinID.Valuetrue2=Fields!BulletinURL.Valuetextbox10=Fields!BulletinTitle.Valuetrue0.25intruetextbox1=Fields!BulletinTitle.Value
2.75in0.25in11="Last Service Pack Scan (" & First(Fields!MostRecentPatchScan.Value, "MostRecentPatchScan") & ")"true3in0.75in= "No missing Service Packs were detected. This could be due to the fact that the system is up to date, or that security scan information has not been collected. Refer to the report description above to make sure that MOM has been configured properly to obtain the necessary information for this report." ServicePacks0.36581in0.25818in2.8196in3.05641in7="Missing Service Packs"true36="Total Security Updates (" & CountDistinct(Fields!BulletinID.Value + Fields!ProductName.Value) & ")"true0.25in5true4="Product"true23="Service Pack"true0.25intruetextbox19=Fields!BulletinTitle.Value + Fields!ProductName.Value2true1= Fields!ProductName.Valuetrue2=Fields!BulletinTitle.Valuetrue0.25intruetextbox19=Fields!BulletinTitle.Value
3.875in0.25in12= "Last Vulnerability Scan (" & First(Fields!MostRecentScan.Value, "MostRecentVulnerabilityScan") & ")"true4.125in1in7= "No vulnerabilities were detected. This could be due to the fact that the system is up to date, or that security scan information has not been collected. Refer to the report description above to make sure that MOM has been configured properly to obtain the necessary information for this report." VulnerabilityAssessment0.36964in0.34597in2.04789in3.7365intextbox310="Vulnerability Assessment"true3textbox169="Total Vulnerabilities (" & CountDistinct(Fields!Vulnerability_Name.Value) & ")"truetrue0.25in=Fields!Category.Value8true7= Fields!Category.Valuetrue26="Total Vulnerabilities (" & CountDistinct(Fields!Vulnerability_Name.Value) & ")"truetrue0.25intruetextbox35true4true3="Vulnerability Name"true20.25intruetextbox232true1true=Fields!Vulnerability_Name.Valuetrue20.25intruetextbox23=Fields!Vulnerability_Name.Value
11in0.25in1infb44cba7-75a7-4314-b2a5-1fce44701d23SCDWpublic function CurrentTimeZone() as string
CurrentTimeZone = System.TimeZone.CurrentTimeZone.StandardName
end function
public function FormatNumber(fieldValue, formatString) as string
if (fieldValue is Nothing)
FormatNumber = "Not Available"
else
FormatNumber = Format(fieldValue,formatString)
end if
end function
6.5inMostRecentPatchScanSystem.DateTimeComputerSystem.StringSeveritySystem.StringBulletinIDSystem.StringBulletinTitleSystem.StringLocalDateTimeGeneratedSystem.DateTimeBulletinURLSystem.StringSCDWselect MostRecentPatchScan,
Computer = FullComputerName,
Severity = 'Missing Patches',
BulletinID,
BulletinTitle,
LocalDateTimeGenerated,
BulletinURL
from
(
select smc_instanceid,
FullComputerName,max(MostRecentPatchScan) as MostRecentPatchScan,
LocalDateTimeGenerated = MAX(LocalDateTimeGenerated),
BulletinID = MAX(BulletinID),
BulletinTitle = MAX([BulletinTitle]),
ItemType = MAX([ItemType]),
ItemClass = MAX([ItemClass]),
BulletinURL = MAX([BulletinURL])
FROM
(
select ef.smc_instanceid,MostRecentPatchScan,
ef.LocalDateTimeGenerated,
[FullComputerName] = cd.FullComputerName,
[Position] = epf.Position,
[BulletinID] = CASE WHEN (epf.Position = 4) THEN epf.EventParameterValue ELSE '' END,
[BulletinTitle] = CASE WHEN (epf.Position = 5) THEN epf.EventParameterValue ELSE '' END,
[ItemType] = CASE WHEN (epf.Position = 11) THEN epf.EventParameterValue ELSE '' END,
[ItemClass] = CASE WHEN (epf.Position = 3) THEN epf.EventParameterValue ELSE '' END,
[BulletinURL] = CASE WHEN (epf.Position = 7) THEN epf.EventParameterValue ELSE '' END
from
sc_eventfact_view ef
inner JOIN sc_eventparameterfact_view epf ON epf.EventID = ef.EventID
inner JOIN sc_computerdimension_view cd ON cd.SMC_InstanceID = ef.Computer_FK
inner join
(Select ef.Computer_FK,
max(ef.LocalDateTimeGenerated)as MostRecentPatchScan from sc_eventfact_view ef
where ef.EventDetail_FK =(select smc_instanceID from sc_eventdetaildimension_view where EventID_PK = 22754 )
and ef.computer_FK in (SELECT ComputerID
FROM dbo.[fn_GetComputerIDsInGroup](@CompGroup) fn_GetComputerIDsInGroup)
group by ef.Computer_FK)d
ON d.Computer_FK = ef.Computer_FK
WHERE d.MostRecentPatchScan < ef.LocalDateTimeGenerated and
ef.EventDetail_FK =(select smc_instanceID from sc_eventdetaildimension_view where EventID_PK = 22760 )
and
(CD.SMC_InstanceID IN (SELECT ComputerID
FROM dbo.[fn_GetComputerIDsInGroup](@CompGroup) fn_GetComputerIDsInGroup))
and (@Computer='<ALL>' or CD.FullComputerName = @Computer)
) a
GROUP BY smc_instanceid, FullComputerName
) b
WHERE (ItemClass = 'Patch') and (ItemType = 'Missing')
GROUP BY FullComputerName, MostRecentPatchScan, BulletinID, BulletinTitle, ItemType, ItemClass, LocalDateTimeGenerated, BulletinURL
ORDER BY BulletinID=Parameters!CompGroup.Value=Parameters!Computer.Value0trueMostRecentScanSystem.DateTimeTypeSystem.StringCat2System.StringComputerSystem.StringCategorySystem.StringVulnerability NameSystem.StringAdviceSystem.StringGradeSystem.StringSCDWselect MostRecentScan, Type,Cat2, Computer ,
Category =
CASE WHEN (Type in ('1')) THEN 'Windows' ELSE
CASE WHEN (Category in ('118', '177', '176')) THEN 'Internet Explorer' ELSE
CASE WHEN (Type in ('3')) THEN 'Internet Information Services' ELSE
CASE WHEN (Type in ('2')) THEN 'SQL' ELSE 'Other'
END
END
END
END,
[Vulnerability Name] = [Advice],
Advice,Grade
from
(
select smc_instanceid,
Computer=FullComputerName,max(MostRecentPatchScan) as MostRecentScan,
LocalDateTimeGenerated = MAX(LocalDateTimeGenerated),
Category = MAX([Category]),
Type = MAX([Type]),
[Name] = MAX([Name]),
Advice = MAX([Advice]),
Grade = MAX([Grade]),
cat2 = max(cat2)
FROM
(
select ef.smc_instanceid,MostRecentPatchScan,
ef.LocalDateTimeGenerated,
[FullComputerName] = cd.FullComputerName,
[Position] = epf.Position,
[Category] = CASE WHEN (epf.Position = 2) THEN epf.EventParameterValue ELSE '' END,
[Type] = CASE WHEN (epf.Position = 4) THEN epf.EventParameterValue ELSE '' END,
[Name] = CASE WHEN (epf.Position = 7) THEN epf.EventParameterValue ELSE '' END,
[Advice] = CASE WHEN (epf.Position = 8) THEN epf.EventParameterValue ELSE '' END,
[Grade] = CASE WHEN (epf.Position = 3) THEN epf.EventParameterValue ELSE '' END,
[Cat2] = CASE WHEN (epf.Position = 5) THEN epf.EventParameterValue ELSE '' END
from
sc_eventfact_view ef
inner JOIN sc_eventparameterfact_view epf ON epf.EventID = ef.EventID
inner JOIN sc_computerdimension_view cd ON cd.SMC_InstanceID = ef.Computer_FK
inner join
(Select ef.Computer_FK,
max(ef.LocalDateTimeGenerated)as MostRecentPatchScan from sc_eventfact_view ef
where ef.EventDetail_FK =(select smc_instanceID from sc_eventdetaildimension_view where EventID_PK = 22753 )
and ef.computer_FK in (SELECT ComputerID
FROM dbo.[fn_GetComputerIDsInGroup](@CompGroup) fn_GetComputerIDsInGroup)
group by ef.Computer_FK)d
ON d.Computer_FK = ef.Computer_FK
WHERE d.MostRecentPatchScan < ef.LocalDateTimeGenerated and
ef.EventDetail_FK =(select smc_instanceID from sc_eventdetaildimension_view where EventID_PK = 22759 )
and
(CD.SMC_InstanceID IN (SELECT ComputerID
FROM dbo.[fn_GetComputerIDsInGroup](@CompGroup) fn_GetComputerIDsInGroup))
and (@Computer='<ALL>' or CD.FullComputerName = @Computer)
) a
GROUP BY smc_instanceid, FullComputerName
) b
where ((Type in ('1', '2', '3')) or (Category in ('118', '177', '176'))) and
(
((cat2 = '1') and (grade in ('1', '2', '3', '6'))) or
((cat2 = '2') and (grade in ('2', '4', '6')))
)
and (len(category) <= 3)
order by category=Parameters!CompGroup.Value=Parameters!Computer.Value300000trueCompGroupSystem.StringSCDWSELECT *
FROM fn_ListComputerGroups() fn_ListComputerGroups_1
order by CompGroup300000trueComputerSystem.StringSCDWSELECT Computer
FROM fn_GetComputersInGroup(@CompGroup) fn_GetComputersInGroup
UNION
SELECT '<ALL>'
order by Computer=Parameters!CompGroup.Value300000trueMostRecentPatchScanSystem.DateTimeComputerSystem.StringSeveritySystem.StringBulletinIDSystem.StringBulletinTitleSystem.StringLocalDateTimeGeneratedSystem.DateTimeProductNameSystem.StringBulletinURLSystem.StringSCDWselect MostRecentPatchScan,
Computer = FullComputerName,
Severity = CASE WHEN ItemClass = 'ServicePack' THEN 'Missing Service Packs' END,
BulletinID,
BulletinTitle,
LocalDateTimeGenerated,
ProductName,
BulletinURL
from
(
select smc_instanceid,
FullComputerName,max(MostRecentPatchScan) as MostRecentPatchScan,
LocalDateTimeGenerated = MAX(LocalDateTimeGenerated),
BulletinID = MAX(BulletinID),
BulletinTitle = MAX([BulletinTitle]),
ItemType = MAX([ItemType]),
ItemClass = MAX([ItemClass]),
ProductName = MAX([ProductName]),
BulletinURL = MAX([BulletinURL])
FROM
(
select ef.smc_instanceid,MostRecentPatchScan,
ef.LocalDateTimeGenerated,
[FullComputerName] = cd.FullComputerName,
[Position] = epf.Position,
[BulletinID] = CASE WHEN (epf.Position = 4) THEN epf.EventParameterValue ELSE '' END,
[BulletinTitle] = CASE WHEN (epf.Position = 5) THEN epf.EventParameterValue ELSE '' END,
[ItemType] = CASE WHEN (epf.Position = 11) THEN epf.EventParameterValue ELSE '' END,
[ItemClass] = CASE WHEN (epf.Position = 3) THEN epf.EventParameterValue ELSE '' END,
[BulletinURL] = CASE WHEN (epf.Position = 7) THEN epf.EventParameterValue ELSE '' END,
[ProductName] = CASE WHEN (epf.Position = 1) THEN epf.EventParameterValue ELSE '' END
from
sc_eventfact_view ef
inner JOIN sc_eventparameterfact_view epf ON epf.EventID = ef.EventID
inner JOIN sc_computerdimension_view cd ON cd.SMC_InstanceID = ef.Computer_FK
inner join
(Select ef.Computer_FK,
max(ef.LocalDateTimeGenerated)as MostRecentPatchScan from sc_eventfact_view ef
where ef.EventDetail_FK =(select smc_instanceID from sc_eventdetaildimension_view where EventID_PK = 22754 )
and ef.computer_FK in (SELECT ComputerID
FROM dbo.[fn_GetComputerIDsInGroup](@CompGroup) fn_GetComputerIDsInGroup)
group by ef.Computer_FK)d
ON d.Computer_FK = ef.Computer_FK
WHERE d.MostRecentPatchScan < ef.LocalDateTimeGenerated and
ef.EventDetail_FK =(select smc_instanceID from sc_eventdetaildimension_view where EventID_PK = 22760 )
and
(CD.SMC_InstanceID IN (SELECT ComputerID
FROM dbo.[fn_GetComputerIDsInGroup](@CompGroup) fn_GetComputerIDsInGroup))
and (@Computer='<ALL>' or CD.FullComputerName = @Computer)
) a
GROUP BY smc_instanceid, FullComputerName
) b
WHERE (ItemClass = 'ServicePack') and (ItemType = 'Warning')
GROUP BY FullComputerName, MostRecentPatchScan, BulletinID, BulletinTitle, ItemType, ItemClass, LocalDateTimeGenerated, BulletinURL,ProductName
ORDER BY BulletinID=Parameters!CompGroup.Value=Parameters!Computer.Value300000trueMostRecentPatchScanSystem.StringSCDWSelect
CONVERT(nvarchar(20),max(ef.LocalDateTimeGenerated)) as MostRecentPatchScan from sc_eventfact_view ef
inner JOIN sc_computerdimension_view cd ON cd.SMC_InstanceID = ef.Computer_FK
where ef.EventDetail_FK =(select smc_instanceID from sc_eventdetaildimension_view where EventID_PK = 22754 )
and (@Computer = '<ALL>' or CD.FullComputerName = @Computer)
Union
select 'None' as MostRecentPatchScan=Parameters!Computer.Value300000trueMostRecentScanSystem.StringSCDWSelect
CONVERT(nvarchar(20),max(ef.LocalDateTimeGenerated)) as MostRecentScan from sc_eventfact_view ef
inner JOIN sc_computerdimension_view cd ON cd.SMC_InstanceID = ef.Computer_FK
where ef.EventDetail_FK =(select smc_instanceID from sc_eventdetaildimension_view where EventID_PK = 22753 )
and (@Computer = '<ALL>' or CD.FullComputerName = @Computer)
Union
select 'None' as MostRecentScan=Parameters!Computer.Value300000true1intruetrue212d782b-9718-4b8d-a1c1-2bd72afd7b8210.25in0.25in="Page " & Globals.PageNumber & "/" & Globals.TotalPages4in0.25in0.25in4in="All dates and times shown in " & Code.CurrentTimeZone()truetrue0.55in1inStringComputer GroupCompGroupCompGroupCompGroupStringComputerListComputertrueComputerComputerListComputerComputer]]>
SCDW
DataSource
/Microsoft Operations Manager Reporting/Microsoft Baseline Security Analyzer/SCDW
SQL
data source=.;initial catalog=SystemCenterReporting
Integrated
false
false
Enter a user name and password to access the data source:
true
]]>