
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎10-20-2009 09:14 PM
I am using the following report to find computers that do not have sophos antivirus installed.
We are seeing false positives on computers that have other errors preventing service enumeration
(e.g. WMI errors, DNS problems)
Is there a good way to modify similar reports so that they won't return these false positives?
First thing that comes to mind would be to modify the where statement with a count > 1
SELECT Computername, Username, Lastseen
FROM dbo.tblComputers
WHERE (Computername NOT IN
(SELECT Computername
FROM dbo.tblServices
WHERE (Caption = 'Sophos Anti-Virus')))
We are seeing false positives on computers that have other errors preventing service enumeration
(e.g. WMI errors, DNS problems)
Is there a good way to modify similar reports so that they won't return these false positives?
First thing that comes to mind would be to modify the where statement with a count > 1
SELECT Computername, Username, Lastseen
FROM dbo.tblComputers
WHERE (Computername NOT IN
(SELECT Computername
FROM dbo.tblServices
WHERE (Caption = 'Sophos Anti-Virus')))
Labels:
- Labels:
-
Report Center
1 REPLY 1

Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎10-20-2009 10:01 PM
Here's what I came up with...
1st (for simplicity) create a new view called web30repErrors
SELECT Computername
FROM dbo.tblerrors
GROUP BY Computername
HAVING (COUNT(Computername) > 0)
Then append any reports having false positives with:
WHERE Computername NOT IN (SELECT Computername FROM dbo.web30repErrors)
1st (for simplicity) create a new view called web30repErrors
SELECT Computername
FROM dbo.tblerrors
GROUP BY Computername
HAVING (COUNT(Computername) > 0)
Then append any reports having false positives with:
WHERE Computername NOT IN (SELECT Computername FROM dbo.web30repErrors)
