Windows: Autorun ctfmon.exe (Built-in)

[Daniel_B]

Old name: Autorun: Ctfmon.exe (Built-in)

The report below gives back a list of computers which automatically start ctfmon.exe after logon.
ctfmon.exe is used for activating Alternative User Input and the Office Language bar.

The report will only list assets that meet all of the following criteria:

• The assets state is set to 'Active'
  
• The asset has been successfully scanned at least once
  
• The asset is a Windows computer
  
• The computers autorun contains ctfmon.exe

Select Top 1000000 tblAssets.AssetID,
  tblAssets.AssetName,
  tblAssets.Domain,
  tblAssets.Username,
  tblAssets.Userdomain,
  Coalesce(tsysOS.Image, tsysAssetTypes.AssetTypeIcon10) As icon,
  tblAssets.IPAddress,
  tsysIPLocations.IPLocation,
  tblAssetCustom.Manufacturer,
  tblAssetCustom.Model,
  tsysOS.OSname As OS,
  tblAssets.SP,
  tblAssets.Lastseen,
  tblAssets.Lasttried,
  tblAutorunUni.Caption,
  tblAutorun.Lastchanged
From tblAssets
  Inner Join tblAutorun On tblAssets.AssetID = tblAutorun.AssetID
  Inner Join tblAutorunUni On tblAutorun.AutorunUNI = tblAutorunUni.AutorunUNI
  Inner Join tblAssetCustom On tblAssets.AssetID = tblAssetCustom.AssetID
  Inner Join tsysAssetTypes On tsysAssetTypes.AssetType = tblAssets.Assettype
  Inner Join tsysIPLocations On tsysIPLocations.LocationID =
    tblAssets.LocationID
  Inner Join tblState On tblState.State = tblAssetCustom.State
  Left Join tsysOS On tsysOS.OScode = tblAssets.OScode
Where tblAutorunUni.Caption Like N'ctfmon.exe' And tblState.Statename = 'Active'
Order By tblAssets.Domain,
  tblAssets.AssetName,
  tblAutorunUni.Caption