BigFix Enterprise Suite Retrieved Properties

Retrieved properties are system attributes that are reported from the BigFix Client to the BigFix Server. Virtually any information or attribute about a computer can be viewed using retrieved properties. The retrieved properties will show up in the computer lists and the Computer Status dialog. Retrieved properties can also be used in the BigFix Web Reports. Listed below are some commonly requested retrieved properties. For assistance in creating more detailed or customized retrieved properties, contact BigFix Support.

Click here for more information about how to define additional custom retrieved properties for BigFix.

Important Note: In BigFix 5.0 and above, many of the most common properties were moved to the "Analyses" tab. Please view the Analyses in the BigFix Console to activate these groups of properties.

Notes on additional retrieved properties

• Many of these properties are specifically designed to work on Microsoft Windows
• Some properties will not work on certain versions of Microsoft Windows and will return "<error>"
• Some properties will return "<multiple results>" if more than one result is returned for a property (all the results can be viewed in the Computer Status > Properties dialog in the BigFix Console)
• These properties can be customized modifying the relevance expression - contact your support technician for more information

Types of Properties

• Application
• Virus Scanning Products
• Network
• Operating System
• Hardware
• File
• User
• Misc
• Input Required Properties

Application

Get This Property	Property Name	Description	Example Return Value	Additional Notes
	Registered Applications	The name, version, vendor, etc. for all registered applications on the given computer.	"BESClient.exe" "4.0.3.1" "BigFix BESClient Application" "4, 0, 3, 1" "BigFix Inc." …	Not all applications register themselves with the OS
	Running Applications	The name, version, vendor, etc. for each running application	"iexplore.exe" "6.0.2800.1106" "Internet Explorer" "6.00.2800.1106 (xpsp1.020828-1920)" "Microsoft Corporation" …
	Recent Applications	The name, version, vendor, etc. for each application that has been started recently	"iexplore.exe" "6.0.2800.1106" "Internet Explorer" "6.00.2800.1106 (xpsp1.020828-1920)" "Microsoft Corporation" …	The recent applications are applications that have been started (or are running) since the BigFix Client service started
	Running Services	The service name, display name, and state of each running service	"Norton AntiVirus Server" "Norton AntiVirus Client" "Running"
	BigFix Client version	Version of the BigFix Client	4.1.3.33
	BigFix Client Installation Time	The time the BigFix Client was first installed.	Tue, 10 Jun 2003 09:13:11 -0700	This not be reset if the BigFix Client is uninstalled then reinstalled unless the __BESData folder in the BigFix Client folder is removed.
	Installed Applications	Lists all application names in the Add/Remove Programs list	WinZip BigFix Enterprise Client …	Not all applications register themselves with the Add/Remove Programs
	Running Office Applications	Lists the executable names of running Microsoft Office applications	WINWORD.EXE / OUTLOOK.EXE …	Detects PowerPoint, Excel, Word, Outlook, Publisher, Access, FrontPage, InfoPath, OneNote, Project, and Visio.
	Office Version	Version of Microsoft Office	Microsoft Office XP Small Business - 10.0.4330.0	This property will return each Office version if multiple Office versions are installed

Virus Scanning Products

	Norton Running	Checks if the Norton AntiVirus services are currently running	Running/Stopped/Not Installed	Looks for the Norton and Symantec AntiVirus services (Client or Server) and reports the current state of a service if found. Returns "Not Installed" if a service for Norton is not found. Warning: This property only works on NT based versions of Windows (not Windows 9x).
	McAfee Running	Checks if the McAfee VirusScan executables are currently running	True/False/Not Installed	Looks specifically for the running applications "vshwin32.exe" or "mcshield.exe"; returns "Not Installed" if the services or registry keys for McAfee VirusScan are not detected.
	TrendMicro Running	Checks if the TrendMicro executables or services are currently running	True/False/Not Installed	Looks specifically for the running application "pccwin97.exe" or the running services "SpntSvc", "ntrtscan", or "tmlisten"; returns "Not Installed" if the registry keys for TrendMicro are not detected.
	eTrust Running	Checks if the eTrust executables or services are currently running	True/False/Not Installed	Looks specifically the running services "InoRPC", "InoTask", or "InoRT"; returns "Not Installed" if the registry keys for eTrust are not detected.
	Norton AntiVirus Dat Version	Version of Norton AntiVirus virus definitions	20040324	Looks for the registry key of Norton Antivirus dat version (consumer and corporate editions) and returns the version number. Returns "Not Installed" if the key does not exist.
	McAfee Anti-Virus Dat Version	Version of McAfee Anti-Virus virus definitions	4.0.4343	Looks for the registry key of McAfee Anti-Virus dat version and returns the version number. Returns "Not Installed" if the key does not exist.
	TrendMicro Dat Version	Version of Trend Micro Office Scan Client virus definitions	844	Looks for the registry key of Trend Micro Office Scan dat version and returns the version number. Returns "Not Installed" if the key does not exist.
	Trend Micro Office Scan Server Pattern Version	Version of Trend Micro Office Scan Server virus definitions	844	Looks for the registry key of Trend Micro Office Scan dat version and returns the version number. Returns "Not Installed" if the key does not exist.
	eTrust Dat Version	Version of eTrust virus definitions	Mon, 14 Apr 2003 22:02:18 -0500	Looks for the registry key of eTrust dat version and returns the version number. Returns "Not Installed" if the key does not exist.

Network

Get This Property	Property Name	Description	Example Return Value	Additional Notes
	MAC Address	MAC address of network adapter(s)	02-06-7b-34-bf-02
	IP Address	IP address(es) of computer	192.168.100.101
	Using DHCP?	Returns true if the network adapter is using DHCP	True/False
	Network Adapter Description	Returns a hardware description of the network adapter	3Com 3C920 Integrated Fast Ethernet Controller (3C905C-TX Compatible) - Packet Scheduler Miniport
	Using Dialup?	Returns true if a network adapter is using the PPP protocol (indicating that they are using a dialup connection)	True/False	Although most dial up connections use PPP, a PPP connection does not necessary mean the user is using a dial-up connection
	Using LAN Connection?	Returns true if the network adapter is not using the PPP protocol (indicating that they are not using a dialup connection)	True/False	Although most LAN connections don't use PPP, the lack of a PPP connection does not necessary mean the user is using a LAN connection
	Subnet Masks	Returns the subnet mask of the network adapters	255.255.255.0
	Subnet Address	Subnet address(es) of computer	192.168.100.0	Returns the ip address masked with the subnet mask (i.e., IP address 192.168.100.123 and subnet mask 255.255.255.0 will return the subnet address of 192.168.100.0).

Operating System

Get This Property	Property Name	Description	Example Return Value	Additional Notes
	Boot Time of OS	Time the computer last started	Tue, 10 Jun 2003 09:13:11 -0700	Time zone is included in time
	Uptime	Amount of time since the computer last started (uptime)	13 days, 09:37:43.543	This will give you uptime to nearest millisecond
	Uptime (days)	Number of days since the computer last started (without "days" description)	13	This will give you uptime to nearest day, which makes it easy to use when comparing numbers (i.e., restart the computer only if uptime > 15)
	Uptime (days)	Number of days since the computer last started (without "days" description)	13 days	Same as above with the string "days" added to the end
	Time zone	Local time zone on the BigFix Client computer	-0700
	BigFix Client time	Local time on the BigFix Client computer	Tue, 24 Jun 2003 09:48:02 -0700
	System language	Language of the system	English (United States)	This value is configurable from the Control Panel.
	User language	Language of the default user	English (United States)	This value is configurable from the Control Panel.
	Language of the OS	Language of the OS	English (United States)	Language of the original OS installation. This value determines which language the patches need to be to correctly apply.
	OS Service Pack Level	The csd version of the Operating System (current Service Pack)	Service Pack 1	The return value of varies by OS
	OS Serial Number	Microsoft OS serial number	44712-OEM-0024810-00403
	Full OS Name	Complete Microsoft OS name	Microsoft Windows XP Professional
	Full OS Name and Service Pack Level	Complete Microsoft OS name along with the service pack version	Microsoft Windows XP Professional Service Pack 1
	Domain/Workgroup	Domain or workgroup that the computer is a member of	bigfix.com
	Startup Applications	Applications that are set to run each time the computer starts	C:\Program Files\Common Files\Dell\EUSW\Support.exe C:\Program Files\NavNT\vptray.exe …	The applications will run on startup if they are in the "startup" folder sfor the system or for the user or if they are in the "HKCU\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run" key or the "HKLM\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run" key
	Open Shares	Shares that are open on the computer (not including the default or admin shares)	MP3 Share Shared Docs …
	OS Type	Returns if a computer is a workstation or a server class operating system	Server/Workstation	All Win9x computers are considered to be workstations
	Firewall Status (Domain)	Returns information on the state of Windows XP Internet Connection Firewall. Only reports on the Firewall state for the Domain profile. Users may actively be using either the Domain or the Standard Profile.	Disabled on all connections	Firewall settings can be different for each profile but only one profile will currently be in use.
	Firewall Status (Standard)	Returns information on the state of Windows XP Internet Connection Firewall. Only reports on the Firewall state for the Standard profile. Users may actively be using either the Domain or the Standard Profile.	Enabled and disabled connections exist	Firewall settings can be different for each profile but only one profile will currently be in use.
	Connections with Firewall Disabled (Domain)	Returns a description of the connections that have Windows XP Internet Connection Firewall disabled. Only reports on the Firewall settings for the Domain profile. Users may actively be using either the Domain or the Standard Profile.	Intel(R) PRO/Wireless 2200BG Network Connection - Packet Scheduler Miniport	Firewall settings can be different for each profile but only one profile will currently be in use.
	Connections with Firewall Disabled (Standard)	Returns a description of the connections that have Windows XP Internet Connection Firewall disabled. Only reports on the Firewall settings for the Standard profile. Users may actively be using either the Domain or the Standard Profile.	VMware Virtual Ethernet Adapter for VMnet1	Firewall settings can be different for each profile but only one profile will currently be in use.
	Simple File Sharing Enabled	This property will only detect simple file sharing for Windows XP.	Enabled Disabled	Note:If the value does not exist or does not equal 1, it is considered disabled.
	Local Administrators	Returns a list of the Administrators on the computer.	SYSTEM\Administrator SYSTEM\Domain Admins SYSTEM\john_smith	Note: please also see KB article http://support.bigfix.com/cgi-bin/kbdirect.pl?id=326
	x64 OS?	Returns TRUE if the current operating system is 64-bits.	True/False

Hardware

Get This Property	Property Name	Description	Example Return Value	Additional Notes
	Number of processors	Number of processors	1
	Number of Drives	Number of drives of all types	5	Includes removable drives, network drives, fixed drives, etc.
	CDROM drive installed?	Returns true if a CD ROM drive is installed	True/False
	Number of Mapped Network Drives	Number of mapped network drives	8
	Computer Manufacturer	Computer Manufacturer	Dell Computer Corporation	This information is provided by the computer manufacturer and stored in the wmi
	Computer Model	Computer Model	Inspiron 8200	This information is provided by the computer manufacturer and stored in the wmi
	Video Card	Video Card Information	NVIDIA GeForce2 MX/MX 400	This information is provided by the computer manufacturer and stored in the wmi
	Sound Card	Sound Card Information	Crystal WDM Audio Codec	This information is provided by the computer manufacturer and stored in the wmi
	Monitor	Monitor information	Dell M991	This information is provided by the computer manufacturer and stored in the wmi
	CD Rom drive	CD Rom drive information	HL-DT-ST RW/DVD GCC-4240N	This information is provided by the computer manufacturer and stored in the wmi
	Screen resolution	Screen resolution	1600 x 1200	This information is provided by the computer manufacturer and stored in the wmi
	Computer serial number or service tag	Computer serial number or service tag	8GYB012	This information is provided by the computer manufacturer and stored in the wmi (or dmi)
	Brand String of CPU	Processor information from vendor	Mobile Intel(R) Pentium(R) 4 - M CPU 1.70GHz
	Active Devices	List of objects corresponding to the active devices on the machine, e.g., modems, graphics cards, printers, etc.	3Com 3C920 Integrated Fast Ethernet Controller (3C905C-TX Compatible) Actiontec MD56ORD V92 MDC Modem …	Only works on NT based computers

File

Get This Property	Property Name	Description	Example Return Value	Additional Notes
	File System of C:	File system of drive "C:"	NTFS
	File System of drives	File system of each of the drives	C: - NTFS E: - FAT32
	Percent free space on C:	Percentage of free space on C:	26
	Percent free space on C:	Percentage of free space on C:	26 percent free
	Free space of drives	Free space on each fixed drive	C: - 4137 MB E: - 5386 MB
	Total space of drives	Total space on each fixed drive	C: - 15726 MB E: - 14224 MB
	Free and Total space of drives	Free space and total space of each fixed drive	C: - 4137 MB free of 15726 MB total E: - 5386 MB free of 14224 MB total
	Percent free of drives	Percentage of free space on each fixed drive	C: - 26 percent free E: - 37 percent free
	Type of drives	Type of each drive	A: - DRIVE_REMOVABLE C: - DRIVE_FIXED D: - DRIVE_CDROM	Possible types of drives are "DRIVE_REMOVABLE", "DRIVE_FIXED", "DRIVE_CDROM", "DRIVE_REMOTE"

User

Get This Property	Property Name	Description	Example Return Value	Additional Notes
	Local user information	Information about local username, user comments, account disabled info, administrative privileges, password disabled, password expired, password age, and last logon	Administrator -- Built-in account for administering the computer/domain -- Admin -- Last Logon: Sat, 15 Mar 2003 02:01:53 -0700 -- Password Age: 160 days Guest -- Built-in account for guest access to the computer/domain -- Account Disabled: Yes -- Password Age: 0 days ...	Local users only refer to computers defined on the local computer (domain users are not included)
	Disabled local users?	Returns username and a True/False value indicating that the user is disabled	Administrator - False Guest - True …
	Admin local users?	Returns username and a True/False value indicating that the user is an administrator	Administrator - True Guest - False …
	Last logon of local users	Returns username and a time indicating when the user last logged in	Administrator - Sat, 15 Mar 2003 02:01:53 -0700 …
	Password age of local users	Returns username and a time indicating the time since the password was last changed	Administrator - 160 days, 20:00:19 Guest - 00:00:00 …
	No password required for local users?	Returns username and a True/False value indicating that no password is required for the user	Administrator - False Guest - False …
	Password expired for local users?	Returns username and a True/False value indicating that user's password has expired	Administrator - False Guest - False …
	Bad password account for local users	Returns username and the number of times the user has attempted to log in with an incorrect password	Administrator - 0 Guest - 0 …
	Number of times logged in for local users	Returns username and the number of times the user has logged in to this computer	Administrator - 27 Guest - 0 …
	Full username	Fully qualified logged in username with domain info	BIGFIX\user_name	Will return "No User Logged In" if there isn't a current user

Misc

Get This Property	Property Name	Description	Example Return Value	Additional Notes
	Is Laptop?	Returns true if a the computer has a battery (indicating it is a laptop)	True/False	If a laptop doesn't have a battery, it will return False for this property
	BigFix License Expiration	Returns the expiration date of the BigFix license	Tue, 24 Jun 2003 15:09:51 -0700	All BigFix Clients should return the same value
	BigFix Client License State	The license state of the BigFix Client along its license number out of the total licenses allowed	Unrestricted - 12304/40000	This property will allow you to see how many licenses are actually being used in your BigFix deployment

Input Required Properties

In addition to the pre-defined properties above, you can create custom properties to look at specific applications, services, variables, etc.

Get This Property	Field Input (Default Values Are Examples)	Property Name	Description	Example Return Value
	Valuename Keyname	Registry Value "[valuename]"	Retrieve a registry value	TestValue
	Application filename	exists regapp “[application filename]”	Returns true if specified registered application exists	True/False
	Application filename	exists running application “[application filename]”	Returns true if specified running application exists	True/False
	Application filename	exists recent application “[application filename]”	Returns true if specified application was run recently	True/False
	Service name	exists running service “[service name]”	Returns true if the specified service is running	True/False
	Service name	state of service “[service name]”	Returns state of the specified service (use the "Service name" and not the "Display name")	Running, Stopped, Stopping, Starting
	Variable name	environment variable “[variable name]”	Returns the specified environment variable	[environment variable name]=[environment variable value]