Classify and Discover iTunes running on a Window Server

Govindarajan · ‎07-14-2020

SCENARIO:

Cloud Dimensions needs to identify iTunes applications running on Windows systems. In order to create a list of approved/unauthorized applications, it is necessary to be able to classify applications successfully during the discovery process.

REQUIREMENT:

As the Cloud Dimensions Discovery administrator, you are tasked with classifying iTunes and successfully discovering the application running on your Windows MID server.

Verify iTunes is running on your MID Server by launching iTunes64Setup.exe under C:\TrainingResources

Create a Process Classification for iTunes (itunes)
Run Discovery against your MID server and verify iTunes was classified successfully.

i need solution for this stimulator task.

thanks

Steele Smith · ‎07-15-2020

Okay, I just restarted the simulator so I could try instead of from memory. I was able to complete both section 6 and section 10. I'll post my screenshots of what I did.

Essentially completing step 10 definitely will do this. Note: I did restart the mid server as a just in case. Can't say if it would be required but since I did it, I'd recommend it.

First I setup the Process Classification, (you can't add the Pattern to the HorizonalDiscoveryProbe yet, but remember you need to go back to add it in.

Then create a pattern called 'iTunes'

Standard pattern, I just made sure the OS was Windows and the entry points were entered as listed. Make sure Enforce Process Classification is checked.

Going into the Identification section I did the following. To keep it easy I didn't do anything fancy and just opted for simple set parameters after the initial WMI query.

Here's what I did within each of the other steps.

Hit Save and Publish

I went back to the process Classifier and added the iTunes pattern to the horizontal pattern.

Then I jumped to MidServers and synched the pattern. Once that finished (less than a second) I just preemptively restarted the MidServer.

Then I went to Discovery Schedules and ran a quick discovery agains my mid server.

If everything was correct, you should see it running the pattern for iTunes.

I checked the Application table searching for iTunes to make sure it was created, then I opened the computer system record and checked that the app was related to the server.

I validated Step 10, then jumped back to Step 6 and validate it.

Hope this helps to get Step 6 validated.

View solution in original post

Luciana3 · ‎01-08-2024

Hi Steele, Could you please help with how to fill this part? in your screenshot is already updated with extra fields showing but how do you get there?

Oya Orhan · ‎08-23-2020

Thanks Steele,

It was really helpful.

Vivektietsood · ‎11-09-2020

I had the same problem. I tried to complete Step 6 by trying several combinations of process classifier but in the end the problem seemed to be that the classifier was not getting invoked properly and in the end following worked:

I dont know the reason of this, but I tried

- Parameters is iTunes.exe

- Parameters ends with iTunes.exe

- Parameters is one of iTunes.exe

All of these did not work apart from the one mentioned below:

Pasting the screenshot with the hope that it helps anyone who faces same problem

Nidhi25 · ‎06-25-2021

Hi ,

I am getting below error:

WMI query on host 198.51.100.176 failed. query: SELECT Caption,Version FROM Win32_Product WHERECaption LIKE 'iTunes' error: Invalid query

Saeed Musa · ‎05-30-2023

If you go to the process classification table for the itunes record that you created you need to go to the applications tab and change the running process from ituneshelper.exe to itunes.exe to allow itunes.exe. If you follow the steps in the lab it should work and you should be able to continue the course.