Reviews

Roger Zanders "SMS Client Spy" - English Documentation released

Rob — Tue, 27 May 2008 16:18:00 GMT

Great news!

Roger Zander's SMS2003 Client tools utility called "SMS Client Spy" now has english documentation.

Myself and Sherry Kissinger put some time in to translating, so as to help describe the tools powerful features, and clarify some of the more obscure.

If you haven't looked at this tool, then follow this link to install it from the web, or here to download the binary. The tool is laid out quite well, and packed with features covering the SMS2003 Clients features.

Some of the things it can do:

Show you the state of all SMS related services, and allows you to interact with them
Provides execution history as well as monitoring of current executions,
Access advertisement information, and manipulate them
Display the Inventory data, and allows you to initiate any of the inventory related processes
A customizable event monitor that shows you sms related events taking place.
A fully-documented automation DLL that exposes the tools features to scripting\programming languages
All packed in to one easy to use application (or web-based) GUI!

It offers so much more, it's definately worth checking out!

I think Roger is about to change the tools name, so that it does not collide with the SMS ToolKit 2 utility CliSpy.exe.

SMS 2003 Recipes by Greg Ramsey and Warren Byle

Rob — Tue, 27 May 2008 16:13:48 GMT

As always, a long way behind the rest of pack on this one. The books been out for several months but I just picked it up, and thought i'd write up a quick review here.

Each chapter is neatly devoted to a particular function of SMS.

The chapters are:

Getting Started
SMS Site Administration
Collections
Packages\Programs
Advertisements
Software Metering
Reporting, Queries
Software Inventory
Hardware Inventory
Remote Tools and Remote Assistance
Software Distribution
Software Updates
SMS Status Messages and Logs
SMS Advanced Client
Building a Virtual SMS lab
Additional SMS Tools.

As you can see, the chapters pretty much cover the entire product.

The first chapter gets you in to the swing with scripting, the tools required (notepad & a CMD prompt!) some info on Packaging (SMS Installer, Macrovisions AdminStudio) and external resources (books, newsgroups, Online communities, et al). All very handy information for those new to the world of SMS, or those that have pretty much supported SMS in isolation, and haven't fully reached out and discovered all the resources that are out there on the WWW.

I really like this book. It gets very technical where needs be, with overviews, explanations, then dives straight in to how to do the work using either GUI's or via scripting methods. The source code examples are good examples of how to get the job done the right way, and are perfect examples to grow you're skills from. And, the authors have gone to great lengths to explain each subject touched upon, in easy to digest parcels of knowledge. Very unlike most of the Microsoft documentation, which can be a nightmare to comprehend, and usually bloated to several paragraphs when one will do!). Good job guys.

For me, I personally will use this book as a scripting reference.

By Apress (www.apress.com) ISBN 1-59059-712-5

If you are going to start scripting, you can just use notepad and go from there. But if you need to debug then it can become quite an effort, relying on WScript.Echo's everywhere to track process flow. Go take a look at Script Debugger IDE, its on a 30day eval but gives you a taste of an IDE for VBscript (akin to Visual Studio). Once you go beyond using the source code from the book (which is also online at the apress website), you'll really benefit from having a debugger. Google the subject, lots of debuggers out there, always eval them, rather than falling for the websites\authors claims, as a lot fall short.

I'll go buy some more books, and do more reviews. There is one guy I know, who is obsessed with collecting ANY SMS book .. our resident SMS guru David Scambler. I might try and pry some of his prized possessions off him for more reviews.

Snow Software Inventory Manager

Rob — Tue, 27 May 2008 15:36:18 GMT

Snow Software Inventory Manager

Rob — Tue, 27 May 2008 15:24:58 GMT

Managing, and collecting Asset information is a very important process for any business, small or large. And to get that job done, there are quite a few tools to choose from. Here I’m focusing on a product from Snow Software called Snow Inventory Manager to do the job. It’s quite a configurable asset information collection tool, but that’s not it’s only purpose in life. Using the software metering and application presence information from Snow Inventory, it can be used to under-pin another Snow Software tool called License Manager, to give you rich licensing management capabilities. The Snow License Manager I’ll review another day, but now let’s get on with the review of Snow Inventory.

The whitepaper is probably the definitive place to source from. And it essentially says that this is an enterprise class tool that allows you to communicate with a desktop client in agent or agent-less modes , and using configuration policies and scheduling it can retrieve system information, perform software metering and restrict application execution. While all the data communications are done in an encrypted form. Bit of a mouth full, but essentially it covers a broad range of duties. All of this is easily managed in a console, which can be secured with a role-based design for the various levels of usage required in your environment.

Let’s start with what’s given to you, and what’s needed:

The installation documentation covers all the bases, and helps describe the installation from start to finish in good enough detail.

The Back-end requirements

Database: SQL2000 SP4, SWL 2005 Std Edition or MSDE (bundled)

If installed, then SQL needs to be running in Mixed Mode

Server: Windows Server 2000 SP4 or Windows Server 2003 SP1

Admin Console: Windows 2003, XP or 2000

Agent Client OS: Windows 95 to Windows Vista

Client can operate in Agent and Agent-less modes

It also says that currently the agent is unable to retrieve some inventory information on Windows Vista. However the vendor is about to release (within weeks) a patch to resolve this issue.

Installing the product

Snows Inventory Installation on the server is straight forward, with a very flexible requirements list. The only issue you’ll probably have is the need to add firewall rules to allow 19730 (to server) and 19732 (to client) port usage by clients and the Inventory server if portions of your IP network are segmented by firewalls. The port that the clients listen on can be changed, from within the console, but the port that the server listens on needs to be changed in a configuration file outside of the console.

The built-in help documentation is quite clear, and offers up a lot of detail.

If you’ve already installed SQL, then during setup you can choose to use the local instance. Alternatively, and giving you some flexibility, if SQL is not available locally then a remote instance can be specified, or, as a fallback MSDE 2000 will be installed locally.

Once the SQL wizard has been completed, the rest of the installation begins with the usual line up of questions such as Serial, Installation Path, and a prompt to enter a unique Snow Inventory Administrator login password (SQL Login). Finally, at the tail end of the installation you’re asked if you want to install the Inventory Agent on this machine.

The installation wizard defaults to using the SQL SA login credentials, but I’d say it’s not really a good idea to put a dependency on the SA login account . Depends on how twitchy you are to using known account names. I’m always trying to remove dependencies and not introduce them in an environment. So, I created a new SQL account (for example called Snowsoft) and granted it the same rights as SA then installed under those credentials. Ideally this new SQL login shouldn’t need that level of access, but there is no mention of what rights are required; And, to continue with the review I just cloned the permissions. From what I’m told by the vendor, they use SA because of the advanced tasks Snow Inventory performs on the database, but this should be securable. Maybe nudge Snow Software for some documentation on how to do it if you don’t want to use SA and, want to tighten a new accounts permissions.

Ok, the products installed, and first time use fires off a wizard that creates two shares on the server called SOFTINV and SOFTINV$ to hold client and configuration data. The wizard brings up the File System MMC snap-in and requires you to manually set the permissions of these two shares so that Everyone has full control on both the Share permission and the NTFS permissions.

Client installation options

Management of the Inventory Agent client is done well using a built-in deployment solution. Casting the Inventory Agent out in to the environment as agent or agent-less is straight-forward and easy to do, with updates to the Agent or the configuration files all managed very easily. You can either use your currently logged in account, or specify a domain account that has local administrator permissions on the target to be able to deploy the client.

You can install the agent manually, through logon scripts or via the Snow Inventory Administrator Console. Manual installation of the client reveals how well thought out it is. You tell the agent using start-up parameters to Install, Uninstall, Update, Scan, Stop and Start. There are more options available, allowing you to perform an agent-less inventory without an installation, but this pretty much covers the installation methods and how to control the client once it’s installed on the target.

As I said above, you don’t actually need to install the Inventory Agent on the target machine to get an inventory report back, which is a nice feature. But, using the Inventory Agent in agent-less mode limits what can be done. So you get the most value from installing the Inventory Agent on the target as a service.

Using the Snow Inventory console, you can scan for machines and install the client with not much effort. Scanning can be performed on all domains, a single domain or via an IP Range. The results returned can then be used to deploy the client. I am quite impressed with the management of the agent on target machines. To clean up, you can remove a computer from the database, using the Delete button, but I didn’t see this uninstall the agent on the chosen machine. I would have loved to have seen this process de-install or schedule a de-installation of the agent to complete the client lifecycle process. It’s certainly by no means a show-stopper. But currently, you’d have to manipulate the computer outside of the Inventory console to achieve this.

Client Configuration options

The product comes with a pre-configured Client Configuration profile that acts as the default profile describing what should be inventoried, what features are enabled and a host of other things aside. This can easily be edited to your heart’s content, or you can start from scratch to easily make more configurations profiles. These profiles expose the really cool features this product has to offer, and, as with the rest of the product there are always a heck of a lot of options to choose from, to hone the configuration profile down to your needs. Whenever I open a dialog or click an option I’m constantly surprised and reminded at how much you can do, and how much can be controlled. Ultimately these profiles are assigned by the administrator to machine groups that you define using filtering methods within the console.

These configuration settings, I’ll try to whisk through what you can achieve with them.

The guts of the product is asset information collection, thus the core feature. A lot of information can be collected, and It’s collection can be configured for either machine start-up, with a time delay allowing the user or machine to stabilise before commencing the scan, or Daily, Weekly and Monthly. Scheduling can become quite granular, with the option to specify what time of the day for a daily scan, what time and day of the week for a weekly scan and which day of the month and what time for monthly scanning. On top of this you can also introduce random skew on start time by up to 1 hour. What’s more, before scanning begins, you can execute a command to perform any clean-up\prep work tasks. The information collected by the Inventory agent is sourced from places such as WMI, the registry and other providers of asset information. Well thought out.

What system information gets inventoried by the client is controlled by the inventory configuration, unselecting what you don’t want returned, or keeping everything selected. It also seems to handle Delta and Full reports from the client, including a full sync performed after a chosen amount of delta sync’s. The default is a Full report every 5th scan.

Software Metering is the next feature, and it’s activities can also be limited to a specific time window, with monitoring start and end times, and which days of the week the metering should be enabled. As you’d expect you can exclude drives, files and folders from monitoring by modifying the Metering filter. The metering data can be viewed from within the console via the Metering overview view.

Moving on, next up is Software scanning, which is given wider reach by allowing a full disk scan for either a delimited list of extensions or everything, rather than just scanning parts of the registry related to software installations or user profiles to pick up on what’s actually installed on the client.

The next feature gives you the ability to restrict application execution. You specify what folder the bad applications reside in, or the binary filename, or meta attributes from within the file (Product Name, Version, Manufacturer, Language) and the Inventory Agent will force the process “out of town” when the user or system attempts to start them. And, to stop any adventurous user who decides to rename the file or even strip out the versioning metadata you can specify the title of a window related to the application, which is usually difficult for a user to change, and have that forced out of town when it loads. You even get to customise the message displayed when this happens. That’s so neat.

Another novel feature is called Custom Forms. These allow you to produce a custom form which is presented to the user for location and asset related data retrieval. You can also collect custom data from the machines registry. This data is then exposed in the reports.

Client-side logging can be performed, and you can choose what kind of information is shown to the user, i.e. when the scan is running, error messages, restriction messages etc. So not only can the client be debugged via the logs, but you can get it to become verbose and display more information via the interface.

Finally you can specify when the client performs an agent file (hotfixes from vendor, new client version) or configuration file update (updated configuration), using granular scheduling identical to the scheduling available for Inventory Scanning. If you want the client to update immediately, then you are going to have to tell the agent to perform the update outside of the console. I’d like to see this as an option in the console, so I can force groups of clients to update their configuration settings or files, rather than waiting for their next update cycle to begin. But the reason you cannot do this inside the console is mostly to do with firewalls on the clients refusing an incoming connection. If you want to replace a configuration profile and get a report back on new information, you’re going to have to wait for the client update cycle to take place, or force the cycle by remotely telling the client(s) to perform an –update. Not a big deal really, once the products installed and setup, you won’t need to change too much. And change is usually planned, so you could probably accept that it could take a day or more for new information to trickle in.

Once the report has been generated by the client, it can be delivered back to the server via HTTP as the product has a built-in web server. But, beyond that you can, after satisfying certain requirements, get the inventory report to can be appended to a file, stored in a folder as a separate report or sent via Email. Very flexible methods for getting the data from the client back to the server. There are some caveats on what method you use, depending on the agent type being employed, due to how the client service runs as LOCAL SYSTEM and thus has no off-system rights to files\folders on a remote server. IIS is not used for HTTP, instead a custom web server is installed. Be nice to see integration with IIS in later revisions of this product.

Using Email to handle reports is quite a good idea. You can configure the Inventory server to contact the Mail server using POP or IMAP to collect the reports which are sent via SMTP from the clients.

If you think about it, you could create profiles representing geographical or network locations, containing a close-by (in relation to the clients) SMTP server that the report should be sent back to, then assign it to a group of machines. This way, you could reduce the overhead of all these clients talking back to one server in one network\geographical location. So, using email is quite a cool feature, and allows the product to scale upwards, that is if you’ve deployed mail servers locally to your clients in terms of subnets\line speeds.

If you have machines you don’t want a full report from, or perhaps you want your configuration settings to differ from computer group to computer group, you could create new Configuration profiles then deploy them to select clients. Assigning these Configuration profiles can be done by hand by choosing machines, or by creating an Inventory Filter and filtering machines on any of the criteria being reported on, then assign the profile to those machines. It’s a very well thought out design, you are given a lot of control over what is being reported via these configuration profiles, and assigning these to machine groups is again a very easy task.

Snow Software Inventory Administration

You can delegate the functionality of the product via roles which can be assigned to users you create via the console. These users can be either Domain accounts or SQL logins. You create new roles and they cover enough options to give you your traditional Management\Helpdesk \Operator\Admin roles, by granting or denying access to the products features.

The console provides a rich focal point for performing the tasks required to get the job done on a day to day basis. It’s also supported by a help system that gives an overview of what your currently looking at in the console.

There is no built-in Remote Control, instead Remote control is implemented by falling back on and invoking from within the console a list of known remote control products such as PC-Anywhere, VNC, Microsoft Remote Desktop etc.

Data Management

Now let’s cover the information this product collects, how to manage it and what you can do with it.

You’re view of the data coming in from the Inventory agents is the Inventory overview, which is built-in to the console. The way to change the view is to create Inventory filters. These filters are the nuts and bolts on scoping and displaying Inventory information. The filter allows you to choose from any of the inventory data being reported back to the server, as columns that will be displayed in the Inventory overview view. That’s how to display information from the database, but to scope it you use a pretty advanced query builder, that’s dead easy to use. With it, you can build complex queries for the filter to use when you’re looking for data. These filters make flicking back and forth between views of information easy. And once you’ve honed down the data you’re after, you can then use it to display a group of machines that you can assign a configuration profile too, export for reports, or perform other tasks on.

On top of all of this, you also get an Historical view, so you can see a full audit trail of what’s been changed on a machine.

I like the Inventory filters. It’s a nice implementation of reporting on the information the product is collecting.

Summary

I’ve gone over the core and most important aspects of the product, but some stuff has been left on the editors chopping room floor. But what’s not covered here, like every option in every dialog, is in the user and installation manuals. I’ve touched on almost all the core and most interesting aspects and given you an insight in to how manageable this all is via the Administrative Console.

It’s important for a product to not make you work hard to get the best out it, and Snow Inventory makes managing and viewing asset information a breeze. The administrator Console is well thought out, exposing practically everything available. A lot of thought has gone in to making this product as complete as possible when it comes to surfacing and collecting asset information, from both machines and users, and as a result I could definitely recommend this for small to large businesses.

Not much pain to integrate, and has enough reach out in terms of functionality to justify its inclusion in the environment.

If you don’t have SMS\ConfigMgr in your environment, then this is a one-stop shop for Asset information. I’d definitely recommend it.

However, if you do have SMS\ConfigMgr, and want some of the features this product offers, then you can tell the Inventory server to index the computer records based on a custom index key. This is important, as you can generate this custom key by collecting information from INI files, amongst other methods. So, you could in theory collect the SMS GUID from the SMSCFG.INI file on a client (depending on if the SMS\ConfigMgr agent is installed of course, but a bit of VBScript\Powershell glue could figure that out and deal with it) and use it as the index for the client record going in to the Snow Inventory database. In theory this would pave the way to programmatically get at the data in the Snow Inventory database with an already existing union between the databases, making exporting from Snow Software Inventory Manager by building MIFs that reference an existing SMS\ConfigMgr client a possibility. That is one way I thought of for moving data around if you needed too. Which is usually an important design point one should consider, when bringing another repository in to the environment.

You can see a lot of time has gone in to getting the product to where it is. And, as a result it was a real pleasure to review, it’ll be a shame to power off the VM, but in a few moments time I’ll drop the snapshot and get things ready to begin reviewing Snow Inventory’s big brother, Snow Software License Manager. Snow License Manager can integrate in to SMS\ConfigMgr to get asset information, or use Snow Software Inventory Manager to do the same job. It’ll make for a great review!

You can find the Snow Software homepage here, to see the products and get hold of the PDF's.