Currently any Windows host discovered in 7.x via the slave will have a DeviceInfo.last_access_method of ‘RCMD’. Don’t forget there is also DeviceInfo.last_adslave that will report which AD Slave was used.
You’re correct that back in the older 6.x line this was set to ‘WMI’, essential just the text of the value has changed.
If you want a quick summary of current access for Windows devices try this query.
SEARCH DiscoveryAccess WHERE _last_marker
TRAVERSE DiscoveryAccess:DiscoveryAccessResult:DiscoveryResult:DeviceInfo WHERE os_class='Windows'
ORDER BY #DiscoveryResult:DiscoveryAccessResult:DiscoveryAccess:DiscoveryAccess.starttime DESC
SHOW whenWasThat(#DiscoveryResult:DiscoveryAccessResult:DiscoveryAccess:DiscoveryAccess.starttime) AS 'When',
( ( ( (last_access_method = 'rcmd') AND (last_adslave OR 'Credential Slave') ) OR (probed_os AND 'Probe') ) OR last_access_method) AS 'Current Windows Access',
hostname, os
This should list the current slave, or access method or flag it as an external probe for the latest scan of all devices believed to be Windows
I’ll explain on Monday how it works if anyone is interested!
RSS
Atom