Friday, April 10, 2015

Report on File System Shares

Go to \Microsoft Configuration Manager\Inboxes\clifiles.src\hinv\SMS_DEF.mof , edit accordingly :
[ SMS_Report     (TRUE),
  SMS_Group_Name ("Shares"),
  SMS_Class_ID   ("MICROSOFT|SHARE|1.0") ]

class Win32_Share : SMS_Class_Template
{
    [SMS_Report (TRUE), SMS_Units("DecimalString")]
        uint32     AccessMask;
    [SMS_Report (TRUE)     ]
        boolean    AllowMaximum;
    [SMS_Report (TRUE)     ]
        string     Caption;
    [SMS_Report (TRUE)     ]
        string     Description;
    [SMS_Report (TRUE)     ]
        datetime   InstallDate;
    [SMS_Report (TRUE)     ]
        uint32     MaximumAllowed;
    [SMS_Report (TRUE), key]
        string     Name;
    [SMS_Report (TRUE)     ]
        string     Path;
    [SMS_Report (TRUE)     ]
        string     Status;
    [SMS_Report (TRUE), SMS_Units("DecimalString")]
        uint32     Type;
};
 Ps.: Only change to TRUE the string that you want to use.

Add SQL query as below :

SELECT     dbo.v_R_System.Name0 AS 'Computer', dbo.v_GS_SHARE.Path0 AS 'Path', dbo.v_GS_SHARE.Name0 AS 'Name',
                    dbo.v_GS_SHARE.Caption0 AS 'Caption', dbo.v_GS_SHARE.Status0 AS 'Status'
FROM         dbo.v_GS_SHARE INNER JOIN
                      dbo.v_R_System ON dbo.v_GS_SHARE.ResourceID = dbo.v_R_System.ResourceID
ORDER BY 'Computer'


Or you can use some filter to disable administrative shares

SELECT TOP (100) PERCENT dbo.v_GS_SHARE.ResourceID, dbo.v_R_System.Name0 AS Hostname, dbo.v_GS_SHARE.Name0 AS ShareName,
dbo.v_GS_SHARE.Path0 AS Path
FROM dbo.v_GS_SHARE INNER JOIN
dbo.v_R_System ON dbo.v_GS_SHARE.ResourceID = dbo.v_R_System.ResourceID
WHERE (dbo.v_GS_SHARE.Name0 NOT LIKE ‘_$’) AND (dbo.v_GS_SHARE.Name0 <> ‘admin$’) AND (dbo.v_GS_SHARE.Name0 <> ‘ipc$’)


Ps.: This is a simple query that shows all shares for all computers.
Download the attached MOF file and import this in your SCCM to have a complete report.
SCCM_Report_Network_Shares.zip

No comments:

Post a Comment