Best practice for disabling windows desktop/laptop in discovery.

[Jordan Rhude]

So in our instance we are ingesting the bulk of our computer and some server records from an SCCM , and then use discovery to pull in some server and mostly Network , printer CI's. Recently running discovery has found some PC's while running , and hits it with a pattern/ probe that runs a PowerShell script that is ringing alarm bells for the security team. 

So here is the question is it best practice to disable the Windows computer from the discovery configuration console or disable the probe/pattern?
We would like to keep SCCM as the primary source for windows desktop/laptops, while retaining functionality via IRE, SAM, and HAM. Just only pulling the computers via SCCM and not via discovery. 

any help is appreciated. 

[AJ-TechTrek]

Hi @Jordan Rhude 

Why you required to triggered the Power-shell scripts if you are doing discovering the windows Device, As i mentioned you can use behaviour discovery and remove the WindowsCI IP from Discovery Schedule, This will also help.

Please appreciate the efforts of community contributors by marking appropriate response as Mark my Answer Helpful or Accept Solution this may help other community users to follow correct solution in future.

Thanks

AJ

Linkedin Profile:- https://www.linkedin.com/in/ajay-kumar-66a91385/

[AJ-TechTrek]

Hi @Jordan Rhude 

Why you required to triggered the Power-shell scripts if you are doing discovering the windows Device, As i mentioned you can use behaviour discovery and remove the WindowsCI IP from Discovery Schedule, This will also help.

Please appreciate the efforts of community contributors by marking appropriate response as Mark my Answer Helpful or Accept Solution this may help other community users to follow correct solution in future.

Thanks

AJ

Linkedin Profile:- https://www.linkedin.com/in/ajay-kumar-66a91385/