Using Ruby & WMI to gather Software Metering Data

I have been working on SCCM Software Metering recently and diving quite a bit into the metering data retained in the SCCM database. I am not very experienced with the SCCM data model, and wasn’t 100% sure if the records in the Recently_Used_Apps view corresponds to everything retained in WMI on the clients themselves. So, I wrote a short ruby script to connect to the root\\ccm\SoftwareMeteringAgent namespace and check the local CCM_RecentlyUsedApps data. I want to cross-reference this against what I am seeing for some machines in the corresponding SCCM view.

Anyways, the script is pretty straightforward – just uses ‘win32ole’ to provide the WMI connection capabilities and ‘date’ to do some date conversion. The script pumps out the recently used applications to a csv file, as that seems like a sensible place to sort the LastUsedDates and Company Names, etc.

require 'win32ole'
require 'date'

puts "Enter hostname to scan"
host = gets.chomp

objWMI = WIN32OLE.new("WbemScripting.SWbemLocator")

connection = objWMI.ConnectServer("#{host}", "root\\ccm\\SoftwareMeteringAgent")

recently_used = connection.ExecQuery("select * from CCM_RecentlyUsedApps")

csv_output = ""
csv_output << "CompanyName,ExplorerFileName,FileDescription,LastUsedTime,LastUserName,LaunchCount\n"

for app in recently_used do
 csv_output << "#{app.CompanyName.gsub(",", "-")},#{app.ExplorerFileName.gsub(",", "-")},#{app.FileDescription.gsub(",", "-")},#{Date.parse(app.LastUsedTime.slice(0,8))},#{app.LastUserName.gsub(",", "-")},#{app.LaunchCount}\n"
 end
filename = "#{host}_#{Time.now.to_s.slice(0,10)}.csv"
out_file = File.new(filename,"w")
out_file << csv_output
out_file.close
puts "Query executed successfully. Check the current directory for #{filename}."
Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

w

Connecting to %s