How to Create Windows Configuration Items for Compliance Settings in Configuration Manager

On the General page of the Create Configuration Item Wizard, specify the following information:

- **Name:** Enter a unique name for the configuration item. You can use a maximum of 256 characters.

- **Description:** Provide a description that gives an overview of the configuration item and other relevant information that helps to identify it in the Configuration Manager console. You can use a maximum of 256 characters.

In the Specify type of configuration item that you want to create list, select Windows.

If this configuration item is used to assess the compliance of an application, and you want to use a detection method to detect whether the application is present, select This configuration item contains application settings.

On the Detection Methods page of the Create Configuration Item Wizard, select the Use Windows Installer detection check box.

Click Open, browse to the Windows Installer (.msi) file that you want to detect, and then click Open.

The Version box is automatically populated with the version number of the Windows Installer file that you selected. You can enter a new version number in this box if the displayed value is incorrect.

Select the This application is installed for one or more users check box if you want to detect each user profile on the computer.

On the Detection Methods page of the Create Configuration Item Wizard, select the Use a custom script to detect this application check box.

In the list, select the language of the script you want to open. Choose from the following scripts:

- **VBScript**

- **JScript**

- **PowerShell**

Click Open, browse to the script that you want to use, and then click Open.

On the Settings page of the Create Configuration Item Wizard, click New.

On the General tab of the Create Setting dialog box, provide the following information:

- **Name:** Enter a unique name for the setting. You can use a maximum of 256 characters.

- **Description:** Enter a description for the setting. You can use a maximum of 256 characters.

- **Setting type:** In the list, choose one of the following setting types to use for this setting:

  <table>
  <colgroup>
  <col style="width: 50%" />
  <col style="width: 50%" />
  </colgroup>
  <thead>
  <tr class="header">
  <th><p>Setting type</p></th>
  <th><p>More information</p></th>
  </tr>
  </thead>
  <tbody>
  <tr class="odd">
  <td><p>Active Directory query</p></td>
  <td><p>Configure the following for this setting type:</p>
  <ul>
  <li><p><strong>LDAP prefix</strong> - Specify a valid prefix to the Active Directory Domain Services query to assess compliance on client computers. You can use either <strong>LDAP://</strong> for a or <strong>GC://</strong> to perform a global catalog search..</p></li>
  <li><p><strong>Distinguished Name (DN)</strong> - Specify the distinguished name of the Active Directory Domain Services object that is assessed for compliance on client computers.</p>
  <p>For example, if you want to evaluate a value related to a user named John Smith in the corp.contoso.com domain, enter the following:</p>
  <p><strong>CN=John Smith, CN=Users, DC=corp, DC=Contoso, DC=com</strong></p></li>
  <li><p><strong>Search filter</strong> - Specify an optional LDAP filter to refine the results from the Active Directory Domain Services query to assess compliance on client computers.</p>
  <p>To return all results from the query, enter <strong>(objectclass=*)</strong>.</p></li>
  <li><p><strong>Search scope</strong> - Specify the search scope in Active Directory Domain Services:</p>
  <ul>
  <li><p><strong>Base</strong> - Queries only the object that is specified.</p></li>
  <li><p><strong>One Level</strong> - This option is not used in this version of Configuration Manager.</p></li>
  <li><p><strong>Subtree</strong> - Queries the object that is specified and its complete subtree in the directory.</p></li>
  </ul></li>
  <li><p><strong>Property</strong> - Specify the property of the Active Directory Domain Services object that is used to assess compliance on client computers.</p>
  <p>For example, if you want to query the Active Directory property <strong>badPwdCount</strong>, which stores the number of times a user incorrectly enters a password, enter <strong>badPwdCount</strong> in this field.</p></li>
  <li><p><strong>Query</strong> - Displays the query constructed from the entries in <strong>LDAP prefix</strong>, <strong>Distinguished name (DN)</strong>, <strong>Search Filter</strong> (if specified), and <strong>Property</strong>, which are used to assess compliance on client computers.</p></li>
  </ul>
  <p>For more information about constructing LDAP queries, see your Windows Server documentation.</p></td>
  </tr>
  <tr class="even">
  <td><p>Assembly</p></td>
  <td><p>Configure the following for this setting type:</p>
  <ul>
  <li><p><strong>Assembly name:</strong> Specifies the name of the assembly object that you want to search for. The name cannot be the same as other assembly objects of the same type and must be registered in the Global Assembly Cache. The assembly name can be up to 256 characters long.</p></li>
  </ul>
  <div class="alert">

  > [!NOTE]
  > <P>An assembly is a piece of code that can be shared between applications. Assemblies can have the file name extension .dll or .exe. The Global Assembly Cache is a folder named <EM>%systemroot%\Assembly</EM> on client computers where all shared assemblies are stored.</P>

  </div></td>
  </tr>
  <tr class="odd">
  <td><p>File system</p></td>
  <td><p>Configure the following for this setting type:</p>
  <ul>
  <li><p><strong>Type</strong> – In the list, select whether you want to search for a <strong>File</strong> or a <strong>Folder</strong>.</p></li>
  <li><p><strong>Path</strong> - Specify the path of the specified file or folder on client computers. You can specify system environment variables and the <em>%USERPROFILE%</em> environment variable in the path.</p>
  <div class="alert">

  > [!NOTE]
  > <P>If you use the <EM>%USERPROFILE%</EM> environment variable in the <STRONG>Path</STRONG> or <STRONG>File or folder name</STRONG> boxes, all user profiles on the client computer are searched, which could result in multiple instances of the file or folder that is found.</P>
  > <P>If compliance settings do not have access to the specified path, a discovery error is generated. Additionally, if the file you are searching for is currently in use, a discovery error is generated.</P>

  </div></li>
  <li><p><strong>File or folder name</strong> - Specify the name of the file or folder object to search for. You can specify system environment variables and the <em>%USERPROFILE%</em> environment variable in the file or folder name. You can also use the wildcards * and ? in the file name.</p>
  <div class="alert">

  > [!NOTE]
  > <P>If you specify a file or folder name and use wildcards, this combination might produce a high numbers of results and could result in high resource use on the client computer and high network traffic when reporting results to Configuration Manager.</P>

  </div></li>
  <li><p><strong>Include subfolders</strong> – Enable this option if you also want to search any subfolders under the specified path.</p></li>
  <li><p><strong>This file or folder is associated with a 64-bit application</strong> - If enabled, only 64-bit file locations (such as <em>%ProgramFiles%</em>) will be checked on 64-bit computers. If this option is not enabled, both 32-bit (such as <em>%ProgramFiles(x86)%</em>) and 64-bit locations will be checked.</p>
  <div class="alert">

  > [!NOTE]
  > <P>If the same file or folder exists in both the 64-bit and 32-bit system file locations on the same 64-bit computer, multiple files are discovered by the global condition.</P>

  </div></li>
  </ul>
  <p>The <strong>File system</strong> setting type does not support specifying a UNC path to a network share in the <strong>Path</strong> box.</p></td>
  </tr>
  <tr class="even">
  <td><p>IIS metabase</p></td>
  <td><p>Configure the following for this setting type:</p>
  <ul>
  <li><p><strong>Metabase path</strong> - Specify a valid path to the Internet Information Services (IIS) Metabase.</p></li>
  <li><p><strong>Property ID</strong> - Specify the numeric property of the IIS Metabase setting.</p></li>
  </ul></td>
  </tr>
  <tr class="odd">
  <td><p>Registry key</p></td>
  <td><p>Configure the following for this setting type:</p>
  <ul>
  <li><p><strong>Hive</strong> – In the list, select the registry hive that you want to search in.</p></li>
  <li><p><strong>Key</strong> - Specify the registry key name that you want to search for. Use the format <em>key\subkey</em>.</p></li>
  <li><p><strong>This registry key is associated with a 64-bit application</strong> - Specifies whether the 64-bit registry keys should be searched in addition to the 32-bit registry keys on clients that are running a 64-bit version of Windows.</p>
  <div class="alert">

  > [!NOTE]
  > <P>If the same registry key exists in both the 64-bit and 32-bit registry locations on the same 64-bit computer, both registry keys are discovered by the global condition.</P>

  </div></li>
  </ul></td>
  </tr>
  <tr class="even">
  <td><p>Registry value</p></td>
  <td><p>Configure the following for this setting type:</p>
  <ul>
  <li><p><strong>Hive</strong> - In the list, select the registry hive that you want to search in.</p></li>
  <li><p><strong>Key</strong> - Specify the registry key name that you want to search for. Use the format <em>key\subkey</em>.</p></li>
  <li><p><strong>Value</strong> – Specify the value that must be contained within the specified registry key.</p></li>
  <li><p><strong>This registry key is associated with a 64-bit application</strong> - Specifies whether the 64-bit registry keys should be searched in addition to the 32-bit registry keys on clients that are running a 64-bit version of Windows.</p>
  <div class="alert">

  > [!NOTE]
  > <P>If the same registry key exists in both the 64-bit and 32-bit registry locations on the same 64-bit computer, both registry keys are discovered by the global condition.</P>

  </div></li>
  </ul>
  <p>You can also click <strong>Browse</strong> to browse to a registry location on the computer or on a remote computer. To browse a remote computer, you must have administrator rights on the remote computer and the remote computer must be running the remote registry service.</p></td>
  </tr>
  <tr class="odd">
  <td><p>Script</p></td>
  <td><p>Configure the following for this setting type:</p>
  <ul>
  <li><p><strong>Discovery script</strong> – Click <strong>Add</strong> to enter, or browse to the script you want to use. You can use Windows PowerShell, VBScript, or Microsoft JScript scripts.</p></li>
  <li><p><strong>Run scripts by using the logged on user credentials</strong> – If you enable this option, the script runs on client computers that use the credentials of the logged-on users.</p>
  <div class="alert">

  > [!NOTE]
  > <P>The value returned by the script is used to assess the compliance of the global condition. For example, when using VBScript, you could use the command <STRONG>WScript.Echo Result</STRONG> to return the <EM>Result</EM> variable value to the global condition.</P>

  </div></li>
  </ul></td>
  </tr>
  <tr class="even">
  <td><p>SQL query</p></td>
  <td><p>Configure the following for this setting type:</p>
  <ul>
  <li><p><strong>SQL Server instance</strong> – Choose whether you want the SQL query to run on the default instance, all instances, or a specified database instance name.</p>
  <div class="alert">

  > [!NOTE]
  > <P>The instance name must refer to a local instance of SQL Server. To refer to a clustered SQL server instance, you should use a script setting.</P>

  </div></li>
  <li><p><strong>Database</strong> - Specify the name of the Microsoft SQL Server database against which you want to run the SQL query.</p></li>
  <li><p><strong>Column</strong> - Specify the column name returned by the Transact-SQL statement that is used to assess the compliance of the global condition.</p></li>
  <li><p><strong>Transact-SQL statement</strong> – Specify the full SQL query you want to use for the global condition. You can also click <strong>Open</strong> to open an existing SQL query.</p>
  <div class="alert">

  > [!IMPORTANT]
  > <P>SQL Query settings do not support any SQL commands that modify the database. You can only use SQL commands that read information from the database.</P>

  </div></li>
  </ul></td>
  </tr>
  <tr class="odd">
  <td><p>WQL query</p></td>
  <td><p>Configure the following for this setting type:</p>
  <ul>
  <li><p><strong>Namespace</strong> - Specify the Windows Management Instrumentation (WMI) namespace which is used to build a WQL query that is assessed for compliance on client computers. The default value is Root\cimv2.</p></li>
  <li><p><strong>Class</strong> - Specifies the WMI class which is used to build a WQL query that is assessed for compliance on client computers.</p></li>
  <li><p><strong>Property</strong> - Specifies the WMI property which is used to build a WQL query that is assessed for compliance on client computers.</p></li>
  <li><p><strong>WQL query WHERE clause</strong> - You can use the <strong>WQL query WHERE clause</strong> item to specify a WHERE clause to be applied to the specified namespace, class, and property on client computers.</p></li>
  </ul></td>
  </tr>
  <tr class="even">
  <td><p>XPath query</p></td>
  <td><p>Configure the following for this setting type:</p>
  <ul>
  <li><p><strong>Path</strong> - Specify the path of the .xml file on client computers that is used to assess compliance. Configuration Manager supports the use of all Windows system environment variables and the <em>%USERPROFILE%</em> user variable in the path name.</p></li>
  <li><p><strong>XML file name</strong> - Specify the file name containing the XML query that is used to assess compliance on client computers.</p></li>
  <li><p><strong>Include subfolders</strong> - Enable this option if you also want to search any subfolders under the specified path.</p></li>
  <li><p><strong>This file is associated with a 64-bit application</strong> - Choose whether the 64-bit system file location (<em>%windir%</em>\System32) should be searched in addition to the 32-bit system file location (<em>%windir%</em>\Syswow64) on Configuration Manager clients that are running a 64-bit version of Windows.</p></li>
  <li><p><strong>XPath query</strong> - Specify a valid full XML path language (XPath) query that is used to assess compliance on client computers.</p></li>
  <li><p><strong>Namespaces</strong> - Opens the <strong>XML Namespaces</strong> dialog box to identify namespaces and prefixes to be used during the XPath query.</p></li>
  </ul>
  <div class="alert">

  > [!IMPORTANT]
  > <P>If you attempt to discover an encrypted .xml file, compliance settings find the file, but the XPath query produces no results, and no error is generated.</P>

  </div>
  <div class="alert">

  > [!NOTE]
  > <P>If the XPath query is not valid, the setting is evaluated as noncompliant on client computers.</P>

  </div></td>
  </tr>
  </tbody>
  </table>

- **Data type:** In the list, choose the format in which the condition returns the data before it is used to assess the setting. The **Data type** list is not displayed for all setting types.

  <div class="alert">


  > [!NOTE]
  > <P>The <STRONG>Floating point</STRONG> data type supports only 3 digits after the decimal point.</P>


  </div>

Configure additional details about this setting under the Setting type list. The items you can configure vary depending on the setting type you have selected.

Click OK to save the setting and close the Create Setting dialog box.

On the Compliance Rules page of the Create Configuration Item Wizard, click New.

In the Create Rule dialog box, provide the following information:

- **Name:** Enter a name for the compliance rule.

- **Description:** Enter a description for the compliance rule.

- **Selected setting:** Click **Browse** to open the **Select Setting** dialog box. Select the setting that you want to define a rule for, or click **New Setting**. When you are finished, click **Select**.

  <div class="alert">


  > [!NOTE]
  > <P>You can also click <STRONG>Properties</STRONG> to view information about the currently selected setting.</P>


  </div>

- **Rule type:** Select the type of compliance rule that you want to use:

    - **Value** Create a rule that compares the value returned by the configuration item against a value that you specify.

    - **Existential** Create a rule that evaluates the setting depending on whether it exists on a client device or on the number of times it is found.

- For a rule type of **Value**, specify the following information:

    - **The setting must comply with the following rule** – Select an operator and a value which is assessed for compliance with the selected setting. You can use the following operators:

      <table>
      <colgroup>
      <col style="width: 50%" />
      <col style="width: 50%" />
      </colgroup>
      <thead>
      <tr class="header">
      <th><p>Operator</p></th>
      <th><p>More information</p></th>
      </tr>
      </thead>
      <tbody>
      <tr class="odd">
      <td><p>Equals</p></td>
      <td><p>No additional information</p></td>
      </tr>
      <tr class="even">
      <td><p>Not equal to</p></td>
      <td><p>No additional information</p></td>
      </tr>
      <tr class="odd">
      <td><p>Greater than</p></td>
      <td><p>No additional information</p></td>
      </tr>
      <tr class="even">
      <td><p>Less than</p></td>
      <td><p>No additional information</p></td>
      </tr>
      <tr class="odd">
      <td><p>Between</p></td>
      <td><p>No additional information</p></td>
      </tr>
      <tr class="even">
      <td><p>Greater than or equal to</p></td>
      <td><p>No additional information</p></td>
      </tr>
      <tr class="odd">
      <td><p>Less than or equal to</p></td>
      <td><p>No additional information</p></td>
      </tr>
      <tr class="even">
      <td><p>One of</p></td>
      <td><p>In the text box, specify one entry on each line.</p></td>
      </tr>
      <tr class="odd">
      <td><p>None of</p></td>
      <td><p>In the text box, specify one entry on each line.</p></td>
      </tr>
      </tbody>
      </table>

    - **Remediate noncompliant rules when supported** – Select this option if you want Configuration Manager to automatically remediate noncompliant rules. Configuration Manager can automatically remediate the following rule types:

        - **Registry value** – The registry value is remediated if it is noncompliant, and created if it does not exist.

        - **Script** (by automatically running a remediation script).

        - **WQL Query**

      <div class="alert">


      > [!IMPORTANT]
      > <P>You can only remediate noncompliant rules when the rule operator is set to <STRONG>Equals</STRONG>.</P>


      </div>

    - **Report noncompliance if this setting instance is not found** – The configuration item reports noncompliance if this setting is not found on client computers.

    - **Noncompliance severity for reports:** Specify the severity level that is reported if this compliance rule fails. The available severity levels are the following:

        - **None** Computers that fail this compliance rule do not report a failure severity for Configuration Manager reports.

        - **Information** Computers that fail this compliance rule report a failure severity of **Information** for Configuration Manager reports.

        - **Warning** Computers that fail this compliance rule report a failure severity of **Warning** for Configuration Manager reports.

        - **Critical** Computers that fail this compliance rule report a failure severity of **Critical** for Configuration Manager reports.

        - **Critical with event** Computers that fail this compliance rule report a failure severity of **Critical** for Configuration Manager reports. This severity level is also be logged as a Windows event in the application event log.

    - For a rule type of **Existential**, specify the following information:

      <div class="alert">


      > [!NOTE]
      > <P>The options shown might vary depending on the setting type you are configuring a rule for.</P>


      </div>

        - **The setting must exist on client devices**

        - **The setting must not exist on client devices**

        - **The setting occurs the following number of times:**

    - **Noncompliance severity for reports:** Specify the severity level that is reported if this compliance rule fails. The available severity levels are the following:

        - **None** Computers that fail this compliance rule do not report a failure severity for Configuration Manager reports.

        - **Information** Computers that fail this compliance rule report a failure severity of **Information** for Configuration Manager reports.

        - **Warning** Computers that fail this compliance rule report a failure severity of **Warning** for Configuration Manager reports.

        - **Critical** Computers that fail this compliance rule report a failure severity of **Critical** for Configuration Manager reports.

        - **Critical with event** Computers that fail this compliance rule report a failure severity of **Critical** for Configuration Manager reports. This severity level is also logged as a Windows event in the application event log.

Click OK to close the Create Rule dialog box.