BigFix Enterprise Suite Retrieved Properties

Retrieved properties are system attributes that are reported from the BigFix Client to the BigFix Server. Virtually any information or attribute about a computer can be viewed using retrieved properties. The retrieved properties will show up in the computer lists and the Computer Status dialog. Retrieved properties can also be used in the BigFix Web Reports. Listed below are some commonly requested retrieved properties. For assistance in creating more detailed or customized retrieved properties, contact BigFix Support.

Click here for more information about how to define additional custom retrieved properties for BigFix.

Important Note: In BigFix 5.0 and above, many of the most common properties were moved to the "Analyses" tab. Please view the Analyses in the BigFix Console to activate these groups of properties.

Notes on additional retrieved properties

  • Many of these properties are specifically designed to work on Microsoft Windows
  • Some properties will not work on certain versions of Microsoft Windows and will return "<error>"
  • Some properties will return "<multiple results>" if more than one result is returned for a property (all the results can be viewed in the Computer Status > Properties dialog in the BigFix Console)
  • These properties can be customized modifying the relevance expression - contact your support technician for more information

Types of Properties

ApplicationTOP

Get This Property Property Name Description Example Return Value Additional Notes
Registered Applications The name, version, vendor, etc. for all registered applications on the given computer. "BESClient.exe" "4.0.3.1" "BigFix BESClient Application" "4, 0, 3, 1" "BigFix Inc."
Not all applications register themselves with the OS
Running Applications The name, version, vendor, etc. for each running application "iexplore.exe" "6.0.2800.1106" "Internet Explorer" "6.00.2800.1106 (xpsp1.020828-1920)" "Microsoft Corporation"
 
Recent Applications The name, version, vendor, etc. for each application that has been started recently "iexplore.exe" "6.0.2800.1106" "Internet Explorer" "6.00.2800.1106 (xpsp1.020828-1920)" "Microsoft Corporation"
The recent applications are applications that have been started (or are running) since the BigFix Client service started
Running Services The service name, display name, and state of each running service "Norton AntiVirus Server" "Norton AntiVirus Client" "Running"  
BigFix Client version Version of the BigFix Client 4.1.3.33  
BigFix Client Installation Time The time the BigFix Client was first installed. Tue, 10 Jun 2003 09:13:11 -0700 This not be reset if the BigFix Client is uninstalled then reinstalled unless the __BESData folder in the BigFix Client folder is removed.
Installed Applications Lists all application names in the Add/Remove Programs list WinZip
BigFix Enterprise Client
Not all applications register themselves with the Add/Remove Programs
Running Office Applications Lists the executable names of running Microsoft Office applications WINWORD.EXE / OUTLOOK.EXE … Detects PowerPoint, Excel, Word, Outlook, Publisher, Access, FrontPage, InfoPath, OneNote, Project, and Visio.
Office Version Version of Microsoft Office Microsoft Office XP Small Business - 10.0.4330.0 This property will return each Office version if multiple Office versions are installed



Virus Scanning Products TOP

Norton Running Checks if the Norton AntiVirus services are currently running Running/Stopped/Not Installed Looks for the Norton and Symantec AntiVirus services (Client or Server) and reports the current state of a service if found. Returns "Not Installed" if a service for Norton is not found. Warning: This property only works on NT based versions of Windows (not Windows 9x).
McAfee Running Checks if the McAfee VirusScan executables are currently running True/False/Not Installed Looks specifically for the running applications "vshwin32.exe" or "mcshield.exe"; returns "Not Installed" if the services or registry keys for McAfee VirusScan are not detected.
TrendMicro Running Checks if the TrendMicro executables or services are currently running True/False/Not Installed Looks specifically for the running application "pccwin97.exe" or the running services "SpntSvc", "ntrtscan", or "tmlisten"; returns "Not Installed" if the registry keys for TrendMicro are not detected.
eTrust Running Checks if the eTrust executables or services are currently running True/False/Not Installed Looks specifically the running services "InoRPC", "InoTask", or "InoRT"; returns "Not Installed" if the registry keys for eTrust are not detected.
Norton AntiVirus Dat Version Version of Norton AntiVirus virus definitions 20040324 Looks for the registry key of Norton Antivirus dat version (consumer and corporate editions) and returns the version number. Returns "Not Installed" if the key does not exist.
McAfee Anti-Virus Dat Version Version of McAfee Anti-Virus virus definitions 4.0.4343 Looks for the registry key of McAfee Anti-Virus dat version and returns the version number. Returns "Not Installed" if the key does not exist.
TrendMicro Dat Version Version of Trend Micro Office Scan Client virus definitions 844 Looks for the registry key of Trend Micro Office Scan dat version and returns the version number. Returns "Not Installed" if the key does not exist.
Trend Micro Office Scan Server Pattern Version Version of Trend Micro Office Scan Server virus definitions 844 Looks for the registry key of Trend Micro Office Scan dat version and returns the version number. Returns "Not Installed" if the key does not exist.
eTrust Dat Version Version of eTrust virus definitions Mon, 14 Apr 2003 22:02:18 -0500 Looks for the registry key of eTrust dat version and returns the version number. Returns "Not Installed" if the key does not exist.



Network TOP

Get This Property Property Name Description Example Return Value Additional Notes
MAC Address MAC address of network adapter(s) 02-06-7b-34-bf-02  
IP Address IP address(es) of computer 192.168.100.101  
Using DHCP? Returns true if the network adapter is using DHCP True/False  
Network Adapter Description Returns a hardware description of the network adapter 3Com 3C920 Integrated Fast Ethernet Controller (3C905C-TX Compatible) - Packet Scheduler Miniport  
Using Dialup? Returns true if a network adapter is using the PPP protocol (indicating that they are using a dialup connection) True/False Although most dial up connections use PPP, a PPP connection does not necessary mean the user is using a dial-up connection
Using LAN Connection? Returns true if the network adapter is not using the PPP protocol (indicating that they are not using a dialup connection) True/False Although most LAN connections don't use PPP, the lack of a PPP connection does not necessary mean the user is using a LAN connection
Subnet Masks Returns the subnet mask of the network adapters 255.255.255.0  
Subnet Address Subnet address(es) of computer 192.168.100.0 Returns the ip address masked with the subnet mask (i.e., IP address 192.168.100.123 and subnet mask 255.255.255.0 will return the subnet address of 192.168.100.0).


Operating System TOP

Get This Property Property Name Description Example Return Value Additional Notes
Boot Time of OS Time the computer last started Tue, 10 Jun 2003 09:13:11 -0700 Time zone is included in time
Uptime Amount of time since the computer last started (uptime) 13 days, 09:37:43.543 This will give you uptime to nearest millisecond
Uptime (days) Number of days since the computer last started (without "days" description) 13 This will give you uptime to nearest day, which makes it easy to use when comparing numbers (i.e., restart the computer only if uptime > 15)
Uptime (days) Number of days since the computer last started (without "days" description) 13 days Same as above with the string "days" added to the end
Time zone Local time zone on the BigFix Client computer -0700  
BigFix Client time Local time on the BigFix Client computer Tue, 24 Jun 2003 09:48:02 -0700  
System language Language of the system English (United States) This value is configurable from the Control Panel.
User language Language of the default user English (United States) This value is configurable from the Control Panel.
Language of the OS Language of the OS English (United States) Language of the original OS installation. This value determines which language the patches need to be to correctly apply.
OS Service Pack Level The csd version of the Operating System (current Service Pack) Service Pack 1 The return value of varies by OS
OS Serial Number Microsoft OS serial number 44712-OEM-0024810-00403  
Full OS Name Complete Microsoft OS name Microsoft Windows XP Professional  
Full OS Name and Service Pack Level Complete Microsoft OS name along with the service pack version Microsoft Windows XP Professional Service Pack 1  
Domain/Workgroup Domain or workgroup that the computer is a member of bigfix.com  
Startup Applications Applications that are set to run each time the computer starts C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\NavNT\vptray.exe
The applications will run on startup if they are in the "startup" folder sfor the system or for the user or if they are in the "HKCU\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run" key or the "HKLM\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run" key
Open Shares Shares that are open on the computer (not including the default or admin shares) MP3 Share
Shared Docs
 
OS Type Returns if a computer is a workstation or a server class operating system Server/Workstation All Win9x computers are considered to be workstations
Firewall Status (Domain) Returns information on the state of Windows XP Internet Connection Firewall. Only reports on the Firewall state for the Domain profile. Users may actively be using either the Domain or the Standard Profile. Disabled on all connections Firewall settings can be different for each profile but only one profile will currently be in use.
Firewall Status (Standard) Returns information on the state of Windows XP Internet Connection Firewall. Only reports on the Firewall state for the Standard profile. Users may actively be using either the Domain or the Standard Profile. Enabled and disabled connections exist Firewall settings can be different for each profile but only one profile will currently be in use.
Connections with Firewall Disabled (Domain) Returns a description of the connections that have Windows XP Internet Connection Firewall disabled. Only reports on the Firewall settings for the Domain profile. Users may actively be using either the Domain or the Standard Profile. Intel(R) PRO/Wireless 2200BG Network Connection - Packet Scheduler Miniport Firewall settings can be different for each profile but only one profile will currently be in use.
Connections with Firewall Disabled (Standard) Returns a description of the connections that have Windows XP Internet Connection Firewall disabled. Only reports on the Firewall settings for the Standard profile. Users may actively be using either the Domain or the Standard Profile. VMware Virtual Ethernet Adapter for VMnet1 Firewall settings can be different for each profile but only one profile will currently be in use.
Simple File Sharing Enabled This property will only detect simple file sharing for Windows XP. Enabled
Disabled
Note:If the value does not exist or does not equal 1, it is considered disabled. 
Local Administrators Returns a list of the Administrators on the computer. SYSTEM\Administrator
SYSTEM\Domain Admins
SYSTEM\john_smith
Note: please also see KB article http://support.bigfix.com/cgi-bin/kbdirect.pl?id=326 
x64 OS? Returns TRUE if the current operating system is 64-bits. True/False 


Hardware TOP

Get This Property Property Name Description Example Return Value Additional Notes
Number of processors Number of processors 1  
Number of Drives Number of drives of all types 5 Includes removable drives, network drives, fixed drives, etc.
CDROM drive installed? Returns true if a CD ROM drive is installed True/False  
Number of Mapped Network Drives Number of mapped network drives 8  
Computer Manufacturer Computer Manufacturer Dell Computer Corporation This information is provided by the computer manufacturer and stored in the wmi
Computer Model Computer Model Inspiron 8200 This information is provided by the computer manufacturer and stored in the wmi
Video Card Video Card Information NVIDIA GeForce2 MX/MX 400 This information is provided by the computer manufacturer and stored in the wmi
Sound Card Sound Card Information Crystal WDM Audio Codec This information is provided by the computer manufacturer and stored in the wmi
Monitor Monitor information Dell M991 This information is provided by the computer manufacturer and stored in the wmi
CD Rom drive CD Rom drive information HL-DT-ST RW/DVD GCC-4240N This information is provided by the computer manufacturer and stored in the wmi
Screen resolution Screen resolution 1600 x 1200 This information is provided by the computer manufacturer and stored in the wmi
Computer serial number or service tag Computer serial number or service tag 8GYB012 This information is provided by the computer manufacturer and stored in the wmi (or dmi)
Brand String of CPU Processor information from vendor Mobile Intel(R) Pentium(R) 4 - M CPU 1.70GHz  
Active Devices List of objects corresponding to the active devices on the machine, e.g., modems, graphics cards, printers, etc. 3Com 3C920 Integrated Fast Ethernet Controller (3C905C-TX Compatible)
Actiontec MD56ORD V92 MDC Modem
Only works on NT based computers


File TOP

Get This Property Property Name Description Example Return Value Additional Notes
File System of C: File system of drive "C:" NTFS  
File System of drives File system of each of the drives C: - NTFS
E: - FAT32
 
Percent free space on C: Percentage of free space on C: 26  
Percent free space on C: Percentage of free space on C: 26 percent free  
Free space of drives Free space on each fixed drive C: - 4137 MB
E: - 5386 MB
 
Total space of drives Total space on each fixed drive C: - 15726 MB
E: - 14224 MB
 
Free and Total space of drives Free space and total space of each fixed drive C: - 4137 MB free of 15726 MB total
E: - 5386 MB free of 14224 MB total
 
Percent free of drives Percentage of free space on each fixed drive C: - 26 percent free
E: - 37 percent free
 
Type of drives Type of each drive A: - DRIVE_REMOVABLE
C: - DRIVE_FIXED
D: - DRIVE_CDROM
Possible types of drives are "DRIVE_REMOVABLE", "DRIVE_FIXED", "DRIVE_CDROM", "DRIVE_REMOTE"


User TOP

Get This Property Property Name Description Example Return Value Additional Notes
Local user information Information about local username, user comments, account disabled info, administrative privileges, password disabled, password expired, password age, and last logon Administrator -- Built-in account for administering the computer/domain -- Admin -- Last Logon: Sat, 15 Mar 2003 02:01:53 -0700 -- Password Age: 160 days
Guest -- Built-in account for guest access to the computer/domain -- Account Disabled: Yes -- Password Age: 0 days
...
Local users only refer to computers defined on the local computer (domain users are not included)
Disabled local users? Returns username and a True/False value indicating that the user is disabled Administrator - False
Guest - True
 
Admin local users? Returns username and a True/False value indicating that the user is an administrator Administrator - True
Guest - False
 
Last logon of local users Returns username and a time indicating when the user last logged in Administrator - Sat, 15 Mar 2003 02:01:53 -0700
 
Password age of local users Returns username and a time indicating the time since the password was last changed Administrator - 160 days, 20:00:19
Guest - 00:00:00
 
No password required for local users? Returns username and a True/False value indicating that no password is required for the user Administrator - False
Guest - False
 
Password expired for local users? Returns username and a True/False value indicating that user's password has expired Administrator - False
Guest - False
 
Bad password account for local users Returns username and the number of times the user has attempted to log in with an incorrect password Administrator - 0
Guest - 0
 
Number of times logged in for local users Returns username and the number of times the user has logged in to this computer Administrator - 27
Guest - 0
 
Full username Fully qualified logged in username with domain info BIGFIX\user_name Will return "No User Logged In" if there isn't a current user


Misc TOP

Get This Property Property Name Description Example Return Value Additional Notes
Is Laptop? Returns true if a the computer has a battery (indicating it is a laptop) True/False If a laptop doesn't have a battery, it will return False for this property
BigFix License Expiration Returns the expiration date of the BigFix license Tue, 24 Jun 2003 15:09:51 -0700 All BigFix Clients should return the same value
BigFix Client License State The license state of the BigFix Client along its license number out of the total licenses allowed Unrestricted - 12304/40000 This property will allow you to see how many licenses are actually being used in your BigFix deployment


Input Required Properties TOP

In addition to the pre-defined properties above, you can create custom properties to look at specific applications, services, variables, etc.

Get This Property Field Input
(Default Values Are Examples)
Property Name Description Example Return Value
Valuename

Keyname
Registry Value "[valuename]" Retrieve a registry value TestValue
Application filename
exists regapp “[application filename]” Returns true if specified registered application exists True/False
Application filename
exists running application “[application filename]” Returns true if specified running application exists True/False
Application filename
exists recent application “[application filename]” Returns true if specified application was run recently True/False
Service name
exists running service “[service name]” Returns true if the specified service is running True/False
Service name
state of service “[service name]” Returns state of the specified service (use the "Service name" and not the "Display name") Running, Stopped, Stopping, Starting
Variable name
environment variable “[variable name]” Returns the specified environment variable [environment variable name]=[environment variable value]