Extending Windows Computer class from Registry Keys in SCOM


Years ago – I wrote a post on this, showing how to use registry keys to add properties to the “Windows Computer” class, to make creating custom groups much simpler.  You can read about the details of how and why here:  https://blogs.technet.microsoft.com/kevinholman/2009/06/10/creating-custom-dynamic-computer-groups-based-on-registry-keys-on-agents/\


This post is a simple updated example of that Management Pack, but written more “properly”.  You can use this example ad add/change your own registry keys for additional class properties.


In this example – we create a new class, "DemoReg.Windows.Computer.Extended.Class"

We use Microsoft.Windows.Computer as the base class, and we will add three example properties:  TIER, GROUPID, and OWNER.


<TypeDefinitions> <EntityTypes> <ClassTypes> <ClassType ID="DemoReg.Windows.Computer.Extended.Class" Accessibility="Public" Abstract="false" Base="Windows!Microsoft.Windows.Computer" Hosted="false" Singleton="false" Extension="false"> <Property ID="TIER" Type="string" AutoIncrement="false" Key="false" CaseSensitive="false" MaxLength="256" MinLength="0" Required="false" Scale="0" /> <Property ID="GROUPID" Type="string" AutoIncrement="false" Key="false" CaseSensitive="false" MaxLength="256" MinLength="0" Required="false" Scale="0" /> <Property ID="OWNER" Type="string" AutoIncrement="false" Key="false" CaseSensitive="false" MaxLength="256" MinLength="0" Required="false" Scale="0" /> </ClassType> </ClassTypes> </EntityTypes> </TypeDefinitions>


We will use a filtered registry discovery provider, where we filter the discovery based on finding the existence of “HKLM\SOFTWARE\Contoso” which would relate to your custom company RegKey.

In addition – this discovery will discover each custom class property you want, using the three examples above.  My registry looks like the following:




The discovery targets “Windows Server Operating System” this keeps it from creating duplicate discoveries based on clusters.  However, if you WANT to include cluster Windows Computer objects, you will need to change the target class to Microsoft.Windows.Computer (and remove the HOST from $Target/Host references in the discovery)

Here is the sample discovery:

<Monitoring> <Discoveries> <Discovery ID="DemoReg.Windows.Computer.Extended.Class.Discovery" Target="Windows!Microsoft.Windows.Server.OperatingSystem" Enabled="true" ConfirmDelivery="false" Remotable="false" Priority="Normal"> <Category>Discovery</Category> <DiscoveryTypes> <DiscoveryClass TypeID="DemoReg.Windows.Computer.Extended.Class"> <Property TypeID="DemoReg.Windows.Computer.Extended.Class" PropertyID="TIER" /> <Property TypeID="DemoReg.Windows.Computer.Extended.Class" PropertyID="GROUPID" /> <Property TypeID="DemoReg.Windows.Computer.Extended.Class" PropertyID="OWNER" /> </DiscoveryClass> </DiscoveryTypes> <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.FilteredRegistryDiscoveryProvider"> <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName> <RegistryAttributeDefinitions> <RegistryAttributeDefinition> <AttributeName>ContosoExists</AttributeName> <Path>SOFTWARE\Contoso</Path> <PathType>0</PathType> <AttributeType>0</AttributeType> </RegistryAttributeDefinition> <RegistryAttributeDefinition> <AttributeName>TIER</AttributeName> <Path>SOFTWARE\Contoso\TIER</Path> <PathType>1</PathType> <AttributeType>1</AttributeType> </RegistryAttributeDefinition> <RegistryAttributeDefinition> <AttributeName>GROUPID</AttributeName> <Path>SOFTWARE\Contoso\GROUPID</Path> <PathType>1</PathType> <AttributeType>1</AttributeType> </RegistryAttributeDefinition> <RegistryAttributeDefinition> <AttributeName>OWNER</AttributeName> <Path>SOFTWARE\Contoso\OWNER</Path> <PathType>1</PathType> <AttributeType>1</AttributeType> </RegistryAttributeDefinition> </RegistryAttributeDefinitions> <Frequency>86400</Frequency> <ClassId>$MPElement[Name="DemoReg.Windows.Computer.Extended.Class"]$</ClassId> <InstanceSettings> <Settings> <Setting> <Name>$MPElement[Name="Windows!Microsoft.Windows.Computer"]/PrincipalName$</Name> <Value>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/PrincipalName$</Value> </Setting> <Setting> <Name>$MPElement[Name="DemoReg.Windows.Computer.Extended.Class"]/TIER$</Name> <Value>$Data/Values/TIER$</Value> </Setting> <Setting> <Name>$MPElement[Name="DemoReg.Windows.Computer.Extended.Class"]/GROUPID$</Name> <Value>$Data/Values/GROUPID$</Value> </Setting> <Setting> <Name>$MPElement[Name="DemoReg.Windows.Computer.Extended.Class"]/OWNER$</Name> <Value>$Data/Values/OWNER$</Value> </Setting> </Settings> </InstanceSettings> <Expression> <SimpleExpression> <ValueExpression> <XPathQuery Type="Boolean">Values/ContosoExists</XPathQuery> </ValueExpression> <Operator>Equal</Operator> <ValueExpression> <Value Type="Boolean">true</Value> </ValueExpression> </SimpleExpression> </Expression> </DataSource> </Discovery> </Discoveries> </Monitoring>


When I review Discovered Inventory in the console for this class, I can see the properties:




I am attaching the sample MP file, along with the registry file, at the following location:



Comments (9)

  1. Stephen says:

    I recommend sealing the MP so that you can leverage this information in other MPs

    1. Kevin Holman says:

      Without question this should be sealed – I recommend placing the groups for this in this same MP and sealing it so those groups can be used for any other override MP.

  2. Orit says:

    Hi Kevin,

    What if the registry I want to add is under 32Bit node?
    for 32bit servers, it will appear under SOFTWARE\Contoso but on a 64bit servers it will appear under SOFTWARE\WOW6432Node\Contoso. Do I need to create 2 different entries?


      1. Orit says:

        Thanks, that helps!

  3. David Sjölund says:

    Hey Kevin, I’m a big fan of your blog!
    Thank you for a great post regarding extending a class.

    I have applied this in an MP and Everything works great except one thing:
    When I decommission a server and delete the agent from the console, the extended class instance for that server is not removed.
    It is still visible in the Discovered Inventory view.
    I am forced to remove it by running an unsupported SQL-Query or I’ll be left with many orphaned instances.

    I must have missed something, but what? 🙂

    Thanks again

    1. Kevin Holman says:

      I do not see this behavior.

      Are you sure you are using the Filtered Registry MP sample, and not the CSV or CMDB examples? I know those have some issues I need to resolve – but the filtered registry one is hosted by each agent, so these should clean up on their own without issue.

    1. Kevin Holman says:

      Absolutely. I am actually developing MP fragments right now based on those.

      They are VERY complex, unfortunately, and trying to make easy-breezy monitors out of them has proven difficult… but I am releasing one for a class discovery, and one for a shell command monitor today in my fragment library.

Skip to main content