uMon
https://sites.google.com/site/kimknight/umon/uMon.msi

Computer utilization monitoring for SCCM

uMon is a set of 2 compiled AutoIt scripts, that can be used in conjunction with SCCM Software Metering to monitor PC utilization.
https://sites.google.com/site/kimknight/umon/uMon-source.zip




It has been tested on Windows 7 and Windows XP.

How it works:
  • uMon package is installed to a computer.
  • When a user logs on, uMon.exe is launched.
  • uMon.exe spawns TimeSvc.exe.
  • When the user is inactive for 15 minutes, uMon.exe kills TimeSvc.exe.
  • When the user becomes active again, uMon.exe spawns TimeSvc.exe.
  • When the user logs off, uMon.exe and TimeSvc.exe are killed.
This means that whenever a user is active, TimeSvc.exe is running. When a user is idle for more than 15 minutes, it isn't running.

So we can create an SCCM Software Metering Rule to monitor TimeSvc.exe and we are effectively recording PC utilization.



Reporting:

We can use standard SCCM Software Metering reports to get stats on the Metering Rule.

I have created some custom reports to retrieve the information required by management.

  


Data retention:

Each SCCM client submits it's usage data to the SCCM database on a daily basis (by default).
SCCM records each application usage to a table in it's database.
SCCM will summarise the usage data to another table on a regular basis. The summarised data is retained for max 370 days.
The individual app usage table is purged on a regular basis by default (because it can grow very large).

Most built-in reports use the summarised data, not the individual app usage data.
It can however be useful to retain the individual app usage data if you want more detailed reporting on usage.
You can change how long app usage data is retained. In the SCCM console, go to:

Site Database > Site Management > [PRIMARY SITE] > Site Settings > Site Maintenance > Tasks

There are 2 tasks you can modify:
-Delete Aged Software Metering Data
-Delete Aged Software Metering Summary Data


Other notes:

If TimeSvc.exe is killed by the user, uMon will automatically respawn it - and vice-versa.
However, if both EXEs are killed simultaneously, they wont run again until next login.

If you wish to customise the scripts in any way, I have provided the source files.
They are AutoIt scripts in AU3 format. Things you might want to do:

-Change the EXE names to avoid detection.
-Change the idle time from 15 minutes to something else.