Censusby Steward IT

Documentation › Using Steward IT Census

Configuration Manager, Google Workspace, Workspace ONE, UniFi and Meraki

Steward IT Census can read the devices other management tools already know: computers managed by Microsoft Configuration Manager (SCCM, MECM, ConfigMgr), Chromebooks and mobile devices managed by Google Workspace, phones, tablets and computers enrolled in Omnissa Workspace ONE UEM (formerly VMware AirWatch), and the access points, switches, gateways and clients of UniFi and Cisco Meraki networks. Add them under Scanning › Hypervisors, cloud & MDM. Intune-managed devices come with the Entra ID sync.

Census only reads from these systems. It never changes anything in Configuration Manager, Google Workspace, Workspace ONE, UniFi or Meraki.

How their devices merge with other inventory#

A device that also has the Census agent, or a WinRM/SSH scan, keeps that as its main inventory, because it has more detail. The sync then only adds what was missing. Devices known only to one of these systems get a full asset from their data.

Census recognizes the same device by its serial number, then its MAC addresses. Configuration Manager computers also match by name and domain, and Workspace ONE's Windows PCs and Macs by computer name. Running a sync again updates the same assets; it doesn't create duplicates. Every new asset uses a license slot, like any other asset.

Configuration Manager (SCCM)#

Census reads every computer that has a ConfigMgr client, with:

  • name, domain, IP and MAC addresses, last logged-on user
  • manufacturer, model, serial number
  • operating system with build and update revision (so vulnerability matching works for them)
  • processor, memory, local disks
  • installed software, from ConfigMgr's software inventory (Installed Software)

Records without a client are left out. They come from Active Directory discovery, and the Active Directory sync already covers them.

Setup (ConfigMgr 1810 and later)#

Census reads the AdminService, the REST API of the SMS Provider, over HTTPS. It's on by default since ConfigMgr 1810.

  1. In the Configuration Manager console, give a domain account the security role Read-only Analyst, with the All Systems collection in its scope.
  2. Under Scanning › Credentials, add a Configuration Manager (SCCM) credential with that account (CORP\svc-census) and its password. Census signs in with Windows authentication (NTLM). The password is never sent in readable form.
  3. Under Scanning › Hypervisors, cloud & MDM › Configuration Manager, enter the SMS Provider server's name (usually the site server, e.g. cm01.corp.local), choose the credential and how often to sync.

The SMS Provider usually has a self-signed certificate. Census trusts the certificate it sees on the first sync and checks it from then on, like the hypervisor connections. If you replace the certificate, click Trust new certificate.

The sync status says how many computers were read, how many records without a client were left out, and which hardware inventory classes couldn't be read (for example when hardware inventory is turned off in the client settings).

Older Configuration Manager (before 1810): CSV import#

Older versions have no AdminService. Instead:

  1. Open Scanning › Hypervisors, cloud & MDM › Configuration Manager and expand SQL query under Older Configuration Manager.
  2. Run that query against the site database in SQL Server Management Studio, and save the result as CSV (Results to file, or right-click › Save Results As).
  3. Import the file there.

Only a Name column is required. The import also understands Domain, Manufacturer, Model, Serial Number, Operating System, OS Build, IP Address, MAC Addresses, Last User, Processor and Memory MB, in any order. It accepts files separated by commas, semicolons or tabs, in UTF-8 or UTF-16. Installed software isn't imported this way. Import the file again whenever you want fresher data.

Google Workspace (Chromebooks, mobile devices)#

Census reads:

  • Chromebooks and Chromeboxes as Chrome OS assets: serial number, model, ChromeOS version and platform version, firmware, MAC and IP addresses, memory, CPU, disk, organizational unit, most recent user, and the asset ID, location and user you entered in the Google Admin console.
  • Automatic update expiration (AUE): the date after which Google sends the device no more ChromeOS and security updates. It's on the asset's Summary tab and in the Chromebooks past or near the end of automatic updates report.
  • Mobile devices (optional): model, serial number, OS, Wi-Fi MAC address, user, status, encryption and compromise status. Only devices with a serial number or MAC address are added. Devices under basic mobile management have neither, so Census couldn't recognize them again at the next sync.

Deprovisioned Chromebooks are left out.

Setup#

Google needs a service account with domain-wide delegation, acting for an administrator:

  1. In the Google Cloud console, create a project (or use one), enable the Admin SDK API, then create a service account and a JSON key for it. Note the service account's client ID (a long number).
  2. In the Google Admin console, open Security › Access and data control › API controls › Manage domain-wide delegation and click Add new. Enter the client ID and the scope: https://www.googleapis.com/auth/admin.directory.device.chromeos.readonly To include phones and tablets, add a second scope, separated by a comma: https://www.googleapis.com/auth/admin.directory.device.mobile.readonly
  3. Under Scanning › Credentials, add a Google Workspace (service account) credential: the email of an administrator allowed to view devices (the service account acts for them), and paste the whole JSON key file.
  4. Under Scanning › Hypervisors, cloud & MDM › Google Workspace, choose the credential. Leave Customer ID empty to use the administrator's own Google Workspace account.

If the delegation is missing, the sync says so and names the client ID and scope to add. Without the mobile scope, Chromebooks are still read, and the status line says that mobile devices were skipped.

Workspace ONE UEM#

Census reads every enrolled device through the Workspace ONE REST API: phones and tablets (iOS, iPadOS, Android), Windows PCs, Macs and Chromebooks, with

  • name (the computer name for Windows PCs and Macs, the friendly name for other devices), serial number, model, manufacturer, OS and version, Wi-Fi MAC address
  • enrollment user, organization group, ownership (corporate or employee-owned), supervised, asset number, IMEI and phone number
  • compliance status and whether the device is compromised (jailbroken or rooted), on the asset's Summary tab and in the Workspace ONE: noncompliant or compromised devices report

Devices that are no longer enrolled are left out, and so are devices with neither a serial number nor a MAC address (Census couldn't recognize them again), except Windows PCs and Macs, which are recognized by their computer name.

Setup#

  1. In the Workspace ONE console, open Groups & Settings › Configurations › OAuth Client Management and Add a client at your top organization group with the role Read Only. Copy the client ID and secret. (Instead of an OAuth client you can use an admin account with that role; Omnissa recommends OAuth.)
  2. Copy the REST API key from Groups & Settings › All Settings › System › Advanced › API › REST API (an Admin key; add one if there is none).
  3. Under Scanning › Credentials, add a Workspace ONE UEM credential: choose OAuth client or admin account, the region of your OAuth token URL (North America, Europe, Asia Pacific, UAT, or Other to paste the token URL from the OAuth Client Management page), the client ID and secret (or the user name and password), and the REST API key. Secrets and the API key are stored encrypted.
  4. Under Scanning › Hypervisors, cloud & MDM › Workspace ONE UEM, enter the REST API server from Groups & Settings › All Settings › System › Advanced › Site URLs › REST API URL (for SaaS usually as1234.awmdm.com; just the host name), choose the credential and how often to sync.

Census connects over HTTPS and checks the server's certificate against the trusted certificate authorities. If the sync fails, its status says whether the sign-in, the API key or the role's rights were refused.

UniFi and Cisco Meraki#

A UniFi or Meraki controller knows its network devices and every client connected to them. Census reads both, on a schedule:

  • Access points, switches and gateways (and Meraki cameras and cellular gateways) become assets: name, type, model, serial number, firmware, IP and MAC address, and whether the controller sees them online. A device Census also scans by SNMP stays one asset (matched by serial number and MAC address).
  • Clients, wireless and wired: when a client is a known asset (matched by its MAC address), its Last seen time is kept current between scans, and its asset page shows Connected via: the access point with the network name (SSID), band and signal, or the switch and port, with the controller and when it was seen. This also works for phones and laptops that use a private (randomized) Wi-Fi address, as long as an asset carries that address.
  • Unknown clients are not added as assets unless you tick Add unknown clients as assets on the connection: each one would use a license slot. They are added like devices found by a network scan (name, IP address, MAC address and its manufacturer). Clients with a randomized (private) MAC address are skipped unless you also tick the second option, because one phone can show up under several addresses. Either way, every client is listed in the Network clients report.

An offline device keeps the time its controller last heard from it as its Last seen time.

UniFi setup#

Census reads a UniFi console (Dream Machine, Cloud Gateway, Cloud Key and other UniFi OS consoles) or a self-hosted UniFi Network server, with all of its sites. The console must be reachable from the Census server over HTTPS; remote scanners don't relay this connection.

  1. Choose how Census signs in:
    • API key (UniFi Network 9.0 or later): on the console, Settings › Control Plane › Integrations › Create API key.
    • Local account, for older versions: create an admin with the View Only role for the Network application (UniFi OS: Admins & Users › Add admin, restricted to local access). Census signs in with it and only reads; this way also lists each wireless client's network name, band and signal.
  2. Add a UniFi Network credential under Scanning › Credentials with the key or the account.
  3. Under Scanning › Hypervisors, cloud & MDM › UniFi Network, enter the console's address (for example unifi.corp.local; a self-hosted server usually needs its port, unifi.corp.local:8443), choose the credential and how often to sync.

UniFi consoles use self-signed certificates: Census trusts the certificate on the first sync and checks it from then on. If you replace the console's certificate, click Trust new certificate.

Cisco Meraki setup#

  1. In the Meraki Dashboard, turn on Organization › Settings › Dashboard API access.
  2. Sign in as an administrator with read-only access to the organization (create one if needed), and generate an API key under My profile › API access.
  3. Add a Cisco Meraki Dashboard credential under Scanning › Credentials with the key.
  4. Under Scanning › Hypervisors, cloud & MDM › Cisco Meraki, choose the credential and how often to sync. Leave the address empty for the usual dashboard (api.meraki.com); enter another API host only for a regional dashboard such as api.meraki.cn.

Census reads every organization the key can see, over HTTPS with the certificate checked against the trusted certificate authorities, and stays within Meraki's request limits. Clients are read for the last 24 hours. Organizations with API access turned off are listed in the sync status.

Reports#

  • Wireless clients per access point: clients seen in the last 24 hours, per access point and network name.
  • Network clients (UniFi, Meraki): every client seen in the last 30 days, where it was connected and whether it is a known asset.
  • Network devices offline (UniFi, Meraki): devices their controller reports as offline at the last sync.
  • Network device firmware per model (UniFi, Meraki): firmware versions per model, to spot devices left on an older version.
  • Chrome OS devices: every Chromebook with its organizational unit, version, last user and end of updates.
  • Chromebooks past or near the end of automatic updates: devices whose update end date has passed or is less than 6 months away.
  • Workspace ONE: noncompliant or compromised devices: devices that break a compliance policy or are jailbroken/rooted.
  • Configuration Manager computers without the Census agent: computers known only from ConfigMgr, which are candidates for the agent rollout.