Explore Our MECM / SCCM Training →
Fixing SCCM Application Detection Method False Positives and Negatives
When authoring SCCM applications with detection rules, it’s essential to understand the reliability of common detection method types and best practices for each. In this post, we will explore various detection methods and provide solutions to common issues such as false positives and negatives.
Common Detection Method Types
SCCM offers several detection method types, including Registry, File, MSI Product Code, and more. Each method has its pros and cons, and understanding them can help you choose the most reliable option for your application.
Registry vs File vs MSI Product Code
Registry detection may seem like a straightforward choice, but it can be less reliable due to potential false positives. File detection based on existence alone can also lead to issues, particularly when dealing with multiple files. MSI Product Code, however, offers the most reliability for MSI installers.
PowerShell Custom Detection Scripts Best Practices
When using custom PowerShell scripts for detection, it’s crucial to ensure they write a non-empty string to STDOUT to indicate ‘Detected’. The exit code does not matter in this case. Test these scripts manually before deployment and consult the AppDiscovery.log for troubleshooting.
32-bit vs 64-bit Registry Redirection Issues
On 64-bit systems, registry keys may be redirected to WOW6432Node. This can cause issues with detection, so it’s essential to account for this redirection when writing your scripts.
Multiple File Detection with AND/OR Logic
When detecting applications that require multiple files, use AND or OR logic to ensure all necessary files are present before marking the application as installed.
Conclusion:
Understanding the reliability of various detection method types in SCCM applications and best practices for each can help you avoid false positives and negatives. Choose the most reliable method for your application, test your scripts before deployment, and consult the AppDiscovery.log for troubleshooting.
Take your SCCM skills to the next level: Learn more about managing and configuring SCCM in our Microsoft MECM Training
Explore Our MECM / SCCM Training →
Written by Mohammed Akhter
Founder of ITP Training. 50,000+ students trained across 30+ countries in Microsoft endpoint and cloud security. Learn more →