SCCM 2012 - Group membership query

[RabbieBurns]

Im in the process of migrating away from sophos and onto Endpoint protection.

 

Im looking to create a collection which membership rules are 'has sophos but doesn't have endpoint protection'

 

How would I go about this please, the SCCM queries baffle me

[synaesthesia]

Without being by an SCCM console, I can't say precisely but like for collections & software deployment you can query by MSI code - or indeed by the presence of a file. So if sophos.exe exists in it's normal installation path, or the MSI GUID is present AND the MSEP is NOT present (again either by file or MSI code) - bob's your uncle. If you don't get an answer tonight I'll take a look in the morning for you.

[synaesthesia]

Argh I see what you mean. The query isn't quite the same as the ones used in software deployment to see if something already exists!

[RabbieBurns]

Im abandoning the idea, and instead just going to go after computers that have Sophos installed.

 

Ive got a remove_sophos.bat file from Sophos, which works great when run manually from an elevated command prompt, however I cannot seem to get it to work via SSCM.

 

Ive created the package with the .bat as the program, it seems to deploy and run but its not removing sophos

 

Anyone got a better method with SCCM to remove Sophos?

[Norphy]

Is Sophos installed with an MSI? If so, you'd be better adding Sophos as an application to SCCM and creating a deployment to remove said application to the Sophos collection that you created

[jaminben]

This probably isn't going to be much help to you but I did have success when using a package and .bat file to remove Sophos with SCCM so it does work.

 

IIRC all I did was to add the .bat file to the command line field in the package program and made sure 'Program can run: Whether or not a user is logged on' was selected.

 

Apart from that I don't think there was anything special about it.

 

EDIT

 

To obtain the list of computers I ran a report from SCCM looking for sophos.exe (or something similar) and used a find and replace to create the query in notepad++.

 

The query I used was a simple:

 

select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System where SMS_R_System.Name = "ComputerName" 
or SMS_R_System.Name = "ComputerName" 
or SMS_R_System.Name = "ComputerName" 
or SMS_R_System.Name = "ComputerName"

 

EDIT 2

 

Actually I just made a better query which finds chrome.exe but you could swap it out for sophos.exe or something similar:

 

select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_SoftwareFile on SMS_G_System_SoftwareFile.ResourceId = SMS_R_System.ResourceId where SMS_G_System_SoftwareFile.FileName = "chrome.exe"

Edited February 26, 2014 by jaminben