Group Machines that have Violated Restricted Software

m_higgins
Contributor

Is it possible to make a smart group of machines that have violated a piece of Restricted Software

5 REPLIES 5

davidacland
Honored Contributor II
Honored Contributor II

I've just had a look and it doesn't seem to be in the smart group criteria options.

You can use the "has xxxxx application installed" option, but there may be a delay before the info updates if inventory updates are weekly.

m_higgins
Contributor

Yeah I was going to use this, the problem is, we have a particular piece of software that gets removed on Violation. Which then means the smart group doesn't work because they don't have it.

It doesn't even appear in the event logs!!

dpertschi
Valued Contributor

As I recall restricted software actions are logged in the JSS server log if that helps you at all.

m_higgins
Contributor

I will have to try and have a look. Not sure where the server logs are though

PhillyPhoto
Valued Contributor

A lazy man's way to do this would be emailed on violation, if you don't have direct access to the server log. It would be a lot more labor intensive to translate it all from email to static computer groups, but it is possible. Although a script and the API might work...