premium version and active scanning

[wsaxon]

We are evaluating the Premium version of this product, and have enabled Active scanning of one domain with 2 OU filters.

There should be 31 machines found, but Lansweeper is only finding 22 machines after well over 24 hours. Triggering a scan with lstrigger on a machine still does not make it show up.

Lansweeper did find 2 machines with WMI problems that prevented full scans, so I expect machines to show up regardless of whether a scan can complete or not.

How can we tell if there are specific errors preventing a scan? What would cause a machine to not be found/scanned automatically by Lansweeper?

[Hemoco]

Please contact us by e-mail about this.

[mrmcfu]

Okay thanks - if that is the case then the expected time in which a machine would be scanned would be 9 to 14 days since that is how often machines register themselves. (Assuming LastLogonTimeStamp attribute is used to compare this)

http://blogs.technet.com/askds/archive/2009/04/15/the-lastlogontimestamp-attribute-what-it-was-designed-for-and-how-it-works.aspx

I was under the impression event logs were being scanned rather than the time stamp on AD objects. If possible, I would appreicate a more technical breakdown of how this occurs so I can understand the expected behavior a bit better. My company has purchased the premium edition if that helps.

[Hemoco]

Lansweeper check all domain controller from the domain (in all sites) and looks for the highest date from all dc's in active directory (computer object)

[mrmcfu]

Out of curiosity, what event IDs is lansweeper checking for? Does it only check servers in its own site or everywhere it can?

[wsaxon]

One I am sure of is a fileserver. I don't see any errors in its event log. People access fileshares on this host all day long, but it is rarely/ever logged into directly.

The other I noticed is an XP machine that is used only to build software, and stays logged-in with the same user at all times. The only authentication event would be if the workstation is logged out and then logged back in (or maybe unlocked). I did that earlier today (unlocked, then logged off/logged back on), and that machine showed up in lansweeper shortly afterwards. Its status page says it was last seen at the time I did this, i.e. its status has not been updated since this morning.

[Hemoco]

Are the not picked up machines servers or workstations?

[wsaxon]

Also, nothing in the Service\errorlog.txt except some database connection errors from when we rebooted the database server.

[wsaxon]

I think at this point we've picked up everything, but it took more like 36 hours. We are still missing 2-3 machines.

It seems to me that a machine that does not participate in a domain authentication event would not be picked up at all. Is this true?

I assumed since we were filtering by OU that Lansweeper was just enumerating hosts from AD and was using that as its list. Would it be possible in a future version to populate the scanning list this way? This would make it much easier to see exactly which machines should be scanned but are not due to problems or inactivity.

[Hemoco]

wsaxon wrote:
It seems to me that a machine that does not participate in a domain authentication event would not be picked up at all. Is this true?

All machines do this (if they belong to a domain) to exchange kerberos tokens

Next version will also have a "scan this entire OU now" function.
The downside is that your database will get populated with "garbage" computers in this OU which are not used anymore.