Support  ·  Inventory add-on

Find equipment on your network

The on-site agent looks for computers, printers, and network gear, and you add what it finds.

This guide is for the inventory add-on, which is extra on any plan.

The on-site agent can look around your network and list what answers: computers, printers, switches, access points, phones, cameras. You decide what goes in the inventory. Nothing is added on its own.

What the scan does

For each address in the ranges you pick, the agent checks whether anything is there (a ping, and a knock on a few common ports). For whatever answers, it asks for:

• its name, from DNS and from Windows,
• its hardware (MAC) address, when it’s on the same part of the network as the agent, and who made its network card,
• for printers and network gear, its make, model, and serial number over SNMP, read-only.

It never signs in to anything and never changes anything. The SNMP community it asks with goes to every address in your ranges, so use a read-only one (that’s what “public” is on most gear). Some security tools notice scans, so tell whoever watches your firewall before the first one.

Setting it up (Super Admins)

1. Install the agent on a Windows computer that’s always on. It’s the same agent that does Active Directory sign-in: get it, and a key, under Settings, System, Active Directory. If you don’t use Active Directory, install it on any always-on PC; on a computer that isn’t joined to a domain it only scans.
2. Open Inventory, Found devices, then Settings (or Settings, Inventory, Scans and device sync).
3. Add a range for each part of the network: like 10.1.2.0/24 for a whole subnet, or 10.1.2.10-10.1.2.60 for part of one. Pick the location it’s at, so what’s found there gets that location. With agents at more than one site, pick the agent at each one.
4. Pick when it scans: every day, once a week, or only when someone clicks Scan now. Overnight is best.
5. If your printers and switches use an SNMP community other than “public”, put it in. It’s stored encrypted here, but SNMP itself sends it as plain text to each address scanned, so only use a read-only community.

Only private addresses can be scanned (10.x.x.x, 172.16.x.x to 172.31.x.x, and 192.168.x.x), up to 8,192 addresses in all. Only Super Admins can change the ranges, and every Super Admin gets an email whenever they change.

Whoever installs the agent can also limit it on that computer: -ScanWithin 10.10.0.0/16 keeps it inside those addresses whatever the helpdesk asks, and -NoScan turns scanning off there.

The deep scan of Windows PCs

A Windows PC that answers on the network can tell the scan a lot more about itself: its make, model, and serial number from the BIOS, its Windows version, memory, disk, and who’s signed in. To read that, the agent needs a domain account that’s allowed to read PCs’ details (WMI), usually through a group that’s a local administrator on workstations.

1. Make a domain account for it, like svc-inventory, that’s a local administrator on the PCs you want read (Group Policy can add a group to each PC’s local Administrators). Don’t use your own account.
2. On the agent’s computer, run the installer again with -DeepScanAccount EXAMPLE\svc-inventory. It asks for the password, checks it with the domain once, and seals it to that computer. It never comes to the helpdesk.
3. On Settings, tick Read details from Windows PCs and save.

The agent only signs in to a PC by its full name in your domain, with Kerberos, and only when that name points back to the same address. A machine pretending to be a PC gets nothing it can reuse. If you want Windows itself to back that up, the Group Policy setting “Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers” can be set on the agent’s computer.

If the password changes or the account gets locked, the deep scan stops at the first PC that says so, rather than trying every PC, and the scan’s result says why. Run the installer with -DeepScanAccount again to put the new password in. To stop the deep scan, untick the box, or run the installer with -NoDeepScan.

Working the list

Found devices has three lists, with what the network scan, Intune, and Google found (pick one with Found any way):

• Not in the inventory: everything that isn’t tied to an item and isn’t ignored. Newest finds first.
• In the inventory: found things tied to an item.
• Ignored: things you said to leave out, like guests’ phones.

For each one:

• Add opens the add form filled in from what the scan learned: the type it looks like, its name, make, model, serial number, and location. Check it, add a tag if it has one, and save. It’s tied to the new item.
• It’s already in ties it to an item that’s already there. Type its tag or name.
• Ignore takes it off the list. Bring back on the Ignored list puts it back.

When something new turns up with the same serial number or the same name as exactly one item, it’s tied to that item on its own, and the item’s history says how. If that’s wrong, use Not this one on the item’s page; it won’t be tied to that item again.

On an item’s page

Items tied to something the scan found show On the network: the address it was at, its hardware address, and when it was last seen. Something that hasn’t answered in a month says Not seen since and the date on the list, which can mean it’s turned off, moved, or gone.

When the scan finds nothing

• No on-site agent is connected. Check the agent’s service is running on its computer, and look under Settings, System, Active Directory, On-site agents.
• The agent needs updating. Agents from before this version can’t scan. Download it again and run the installer; it keeps its key.
• Turned off on that computer. It was installed with -NoScan. Run the installer again without it.
• Only some things show up. Devices on another subnet than the agent don’t give their hardware address, and firewalls on PCs often ignore pings. Windows computers usually still answer by name. A switch or printer with SNMP turned off shows its address only.