Alerting on changes to a client's installed software?

Question

The retail company I work for is using SCCM (now on R2) to manage our point-of-sale terminals, which run Windows Embedded 7.  With all of the recent data breaches making headlines in the retail space, I have been asked by my superiors to evaluate the
use of SCCM to generate a baseline for the software configuration of one of these systems, and generate alerts upon any unauthorized changes. 
My initial reaction is to say that this would be impracticable at best in SCCM - that we would need to rely on the hardware inventory cycles, but would need to run some extensive custom scripting to actually do the comparison and generate the alerts, and
even if we made it work it wouldn't be real-time which would make it useless for this scenario, and that we'd be better off using SCOM to do this.  But I wanted to put the question out there and see if anyone with more experience had a different point
of view.
Any Thoughts?

Answer 1

Jeremy,
You are right that ConfigMgr is not designed to be a real time monitoring system, especially for these kinds of changes.  If the purpose of monitoring for changes is to improve security, you'll need to look to a software solution designed to do file
system monitoring (TripWire, Splunk, and BeyondTrust all of solutions like this).
However, if they really just want something that tells them if Add/Remove Programs changes from the baseline, you certainly could use ConfigMgr's Compliance to make the clients report often (every hour?) and email reports compliance reports on a schedule.
I hope that helps,
Nash
Nash Pherson, Senior Systems Consultant
Now Micro -
My Blog Posts
If you've found a bug or want the product worked differently,
share your feedback.
<-- If this post was helpful, please click "Vote as Helpful".