Casper Agent Installed when?

vwebb
New Contributor

Is there any way to report on the date that a computer made it's first connection to Casper after having the agent installed? I'm basically trying to see when a computer first checked in and compare it to their last check in. Am I making sense? I haven't had coffee yet this morning..

2 REPLIES 2

Lotusshaney
Contributor II

The only way currently is to look in the SQL database back end in the table called COMPUTERS and there is an entry called data added

I have made a request for this to be accessible from the GUI

mm2270
Legendary Contributor III

There are a few possibilities though I'm not sure if there is any accurate way to pull the actual date of first contact to your JSS. Still, take a look at these and see if one fits the bill.

1- If any of your Macs get managed using the new web enrollment process introduced with 8.6, the Computer Enrollment section would hgave a record of that, including the date it got enrolled. Again, it may not be the date it actually contacted your JSS, but since the enrollment does connect the Mac to the JSS, that may be sufficient.

2- I'm assuming though, that you may need to pull this from Macs enrolled prior to 8.6, or maybe you enrolled them all with a QuickAdd package.
If so, you may be able to pull the date from the QuickAdd.pkg located in the /Library/Receipts folder. I'm not really sure if that date is the date the actual QuickAdd was created or the date the receipt was dropped on the Mac though. I haven't really tested that out.

3- If that isn't accurate, another way would be to pull up a Mac in your JSS and under Details > Hardware, look at the View Hardware/Software History with the link in that tab. Going down to the bottom should show when the machine received its first packages and such, so that would be a good approximate date.

4- One final way I can think of is, if you create a new Casper only management account when the Macs are enrolled that never gets touched or modified in any way (i.e, the password doesn't get spun periodically), you may be able to pull the password time date with dscl.
In my case, something like this works, but you'd have to try it out and make any adjustments-

dscl . -read /Users/casperadmin | awk '/passwordTime/{ getline; print $0 }' | sed -e 's/<date>//;s/</date>//'

Where "casperadmin" is the short name of the management account. That pulls a date string in format YYYY-MM-DDT:HH:MM:SSZ. That could further "massaged" to get it into a more Casper supported date string such as YYYY-MM-DD HH:MM:SS

Hope one of those helps.