Log an Event when an Advertisement with a Mandatory Assignment is Modified

One of our clients needed to be alerted when an advertisement with a mandatory assignment was modified.  They needed to make sure that no advertisement targeted systems during business hours.  A solution was developed where an event is logged in the application log if an advertisement with a mandatory assignment is modified.  The event description contains advertisement, collection and the start time of the scheduled assignment.  The event can be then watched by System Center Operations Manager to alert the appropriate group.

The solution is based on creating a status filter rule that runs a program.  The rule watches for message ID 30007, which is the message ID for the status message that gets created when an advertisement is modified.

For action, the rule runs a VB script that we developed.

The key for this to work is that the status filter rule passes to the script the advertisement ID.  This is done by passing one argument to the script: %msgdesc

The script uses the advertisement ID to query the SCCM database and determine if it has a mandatory assignment.  If it does, then an event is logged with a description that includes the following:

  • User who modified the advertisement
  • Advertisement ID
  • Advertisement Name
  • SCCM Program referenced by the advertisement
  • Collection ID being targeted
  • Collection name
  • Start time of scheduled assignment (if there is one)

System Center Operations Manager can then monitor the site server for this specific event and take appropriate action.

Share:

Facebook
Twitter
LinkedIn
Picture of Matt Tinney

Matt Tinney

Professional IT executive & business leader having decades of experience with Microsoft technologies delivering modern-day cloud & security solutions.

Contact Us

=
On Key

More Posts

WME Cybersecurity Briefings No. 024
Cyber Security

WME Security Briefing 28 August 2024

GhostWrite Vulnerability in T-Head CPUs Exposes Devices to Unrestricted Access Overview A critical architectural flaw in T-Head’s XuanTie C910 and C920 RISC-V CPUs was uncovered by recent research from the CISPA Helmholtz Center for Information Security. Dubbed GhostWrite, the vulnerability

Click Here to Read Full Article »
Be assured of everything

Get WME Services

Stay ahead of the competition with our Professional IT offerings.

=