Windows: Chassis Intrusion detected (Built-in)

[Daniel_B]

Old name: Chassis: Intrusion detected (Built-in)

The report below gives back a list of computers in abnormal boot up state.

The report will only list assets that meet all of the following criteria:

• The computer's state is set to "active".
  
• The computer has been successfully scanned at least once.
  
• The asset is a Windows computer.
  
• Boot up state one of Warning, Critical, Non-recoverable.

Select Top 1000000 tblAssets.AssetID,
  tblAssets.AssetName,
  tblAssets.Domain,
  tblAssets.Username,
  tblAssets.Userdomain,
  Coalesce(tsysOS.Image, tsysAssetTypes.AssetTypeIcon10) As icon,
  tblAssets.IPAddress,
  tsysIPLocations.IPLocation,
  tblAssetCustom.Manufacturer,
  tblAssetCustom.Model,
  tsysOS.OSname As OS,
  tblAssets.SP,
  tblAssets.Lastseen,
  tblAssets.Lasttried,
  Case tblComputersystem.ChassisBootupState When 4 Then 'Warning'
    When 5 Then 'Critical' When 6 Then 'Nonrecoverable' Else 'Other'
  End As ChassisBootupState
From tblAssets
  Inner Join tblComputersystem On tblAssets.AssetID = tblComputersystem.AssetID
  Inner Join tblAssetCustom On tblAssets.AssetID = tblAssetCustom.AssetID
  Inner Join tsysAssetTypes On tsysAssetTypes.AssetType = tblAssets.Assettype
  Inner Join tsysIPLocations On tsysIPLocations.LocationID =
    tblAssets.LocationID
  Inner Join tblState On tblState.State = tblAssetCustom.State
  Left Join tsysOS On tsysOS.OScode = tblAssets.OScode
Where (Case tblComputersystem.ChassisBootupState When 4 Then 'Warning'
      When 5 Then 'Critical' When 6 Then 'Nonrecoverable' Else 'Other'
    End = 'Warning' Or Case tblComputersystem.ChassisBootupState
      When 4 Then 'Warning' When 5 Then 'Critical' When 6 Then 'Nonrecoverable'
      Else 'Other' End = 'Critical' Or Case tblComputersystem.ChassisBootupState
      When 4 Then 'Warning' When 5 Then 'Critical' When 6 Then 'Nonrecoverable'
      Else 'Other' End = 'Nonrecoverable') And tblState.Statename = 'Active'
Order By tblAssets.Domain, tblAssets.AssetName