Reporting Apps installed on managed devices

[Jim OHagan]

Hi

 

Is it possible to understand the scope of the Apps by Devices & User report in 10.4?

 

When we run the report it only reports apps deployed by MDM e.g. MDX apps.  Our customer is looking for a report of all apps so they can identify problem apps users may have installed through the play store directly.

 

The 10.3 handbook provides the following description which contradicts what we are seeing.  However, the description meets our requirement.  Is there something we need to do to see all the apps?  The formation is in the database as we can search facebook for example and see the apps when users log on to their personal portal.

 

• Apps by Devices & User - Lists all of the apps each user has on their device. You may want to

run this report to discover malicious apps, apps you don't want your users to have installed on

their devices, or to ensure that all of your users do have a certain app installed.

 

 

 

[Arnaud Pain]

Jim,

 

you can do it via SQL query:

 

SELECT "DEVICE_SEARCH"."device_id", "DEVICE_SEARCH"."managed_by_zdm", "DEVICE_SEARCH"."IMEI", "DEVICE_SEARCH"."SERIAL_NUMBER", "DEVICE_SEARCH"."LAST_INVENTORY_TIME", "DEVICE_SEARCH"."OS_FAMILY", "DEVICE_SEARCH"."LAST_USERNAME" , "SOFTWARE_INVENTORY"."NAME", "SOFTWARE_INVENTORY"."VERSION", "SOFTWARE_INVENTORY"."AUTHOR", "SOFTWARE_INVENTORY"."PACKAGE_INFO", "SOFTWARE_INVENTORY"."SIZE", "SOFTWARE_INVENTORY"."INSTALL_TIME" FROM "DEVICE_SEARCH" "DEVICE_SEARCH" INNER JOIN "SOFTWARE_INVENTORY" "SOFTWARE_INVENTORY" ON "DEVICE_SEARCH"."DEVICE_ID"="SOFTWARE_INVENTORY"."DEVICE_ID" ORDER BY "DEVICE_SEARCH"."DEVICE_ID"

 

 

 

After export the output in csv and make it fore friendly using Excel.

[Arnaud Pain]

Jim

 

Have you created and push a Policy for App Inventory on the Devices?

When you edit an enrolled device in Apps what do you see?

[David Egan1709157332]

Hi Jim, it sounds like you need an app inventory https://docs.citrix.com/en-us/xenmobile/10-4/policies/app-inventory-policy.html

This will fetch the details for devices so long as the devices are not MAM-only enrolled.

[Jim OHagan]

The app inventory policy is applied successfully, is there a configuration here that should be applied.   The options seem minimal?

[David Egan1709157332]

Hi Jim, the app inventory policy is indeed very minimal on the options offered (it's either off or on, per platform).

With this policy enabled and deployed, you should expect to see the following characteristics (all being well, that is!)...

 

Under XenMobile Console-->Manage-->Devices-->Edit a device-->Check under '#4 Assigned Policies'-->You should see that your 'App Inventory' policy is indeed applied successfully.

 

Once that step has been confirmed, move on to '#5 Apps' (it's in the same menu) and a list of all installed apps should be visible in the table.

 

Non-MDM apps should show up here as 'Personal' (under the 'Ownership' column).

 

Here's an example for you to check against...

 

Name

 

 

Ownership

 

 

Version

 

 

Author

 

 

Size

 

 

Installed

 

 

Identifier

 

 

Type

 

 

Google App

Personal

6.10.37.16.arm

google.com

 

01/30/2017 05:12:28 pm

com.google.android.googlequicksearchbox

 

 

Galaxy Apps

Personal

4.1.04-9

sec.com

21.52 MB

10/21/2016 09:20:32 am

com.sec.android.app.samsungapps

 

 

Google Play Newsstand

Personal

4.1.0

google.com

21.69 MB

02/01/2017 04:19:05 pm

com.google.android.apps.magazines

 

 

BlurbCheckout

Personal

1.0 (Build 204)

blurb.com

736.84 KB

10/21/2016 09:35:30 am

com.blurb.checkout

 

 

Hangouts

Personal

16.0.144731464

google.com

 

01/30/2017 05:02:08 pm

com.google.android.talk

 

 

Drive

Personal

2.7.012.19.30

google.com

 

02/02/2017 11:18:44 am

com.google.android.apps.docs

 

 

Google Play Store

Personal

7.4.12.L-all [0] [PR] 14447997

android.com

 

01/31/2017 04:06:54 pm

com.android.vending

 

 

Google Play services

Personal

10.0.84 (030-137749526)

google.com

51.44 MB

11/10/2016 04:06:42 am

com.google.android.gms

 

 

Dropbox

Personal

28.2.2

dropbox.com

 

01/30/2017 03:24:53 pm

com.dropbox.android

 

 

Google Play Games

Personal

3.9.08 (3448271-030)

google.com

23.56 MB

11/19/2016 11:27:04 am

com.google.android.play.games

[David Egan1709157332]

...the table above lost it's formatting (it's not a table anymore!) but this is the type of content you should expect to see...

[Jim OHagan]

Hi David

 

Yes, I can see all this information including personal apps, however when I go to Analyse > Reporting > Devices & APPs. I only see MDX apps in the list I don't see personal apps listed.

 

Jim

[David Egan1709157332]

Hi Jim,

 

The behaviour of the reporting tab which you are experiencing is by design.

 

You can only see MDM content under the reporting tab as full administrator rights are required on the device in order to decrypt the IMEI number, serial number of the device, etc (this statement is mostly true of Apple devices...but the other platform devices are treated in pretty much the same way in this particular console screen)

 

What that leaves us with is SecureHub to do all the tallying up for us.

On the one hand, SecureHub can indeed perform a full audit of all apps on any given device (this full report is as per my earlier instructions, under the 'Manage Devices' --> 'Edit Device' page, so long as you've pushed out the App Inventory policy).

 

Alternatively, we can also use SecureHub to install apps which are managed by MDM, it is only these specific apps which are the ones you will find included under the 'Reporting' tab.

 

I hope this helps to clear up confusion as to what is and isn't included in the reporting tab?

The missing information you are searching for should instead be obtained from the 'Manage Devices' page.

 

Let me know if this answers your query, I'm happy to offer more assistance!

 

Many thanks,

David

[Jim OHagan]

So when we go to Manage Devices are we looking into an encrypted part of the database?  we know the information is there, so should the reporting features not be tailored to extract it?

 

We can create customer scripts to pull this information from the database, but it seems overly completed and would suggest the following description from the 10.3 handbook is inaccurate as why would we publish malicious apps in the first place.

 

• Apps by Devices & User - Lists all of the apps each user has on their device. You may want to

run this report to discover malicious apps, apps you don't want your users to have installed on

their devices, or to ensure that all of your users do have a certain app installed.

 

 

Jim

[David Egan1709157332]

Hi Jim,

 

This content isn't encrypted in the database (other sensitive content like passwords and certificate keys are); rather, the details are encrypted on the device itself (SecureHub gets the required admin rights to read these details when it is installed).

 

SecureHub sends all the MDM details back to XenMobile (after all, anything MDM related is administered and managed by XenMobile Server and SecureHub). This is as far as XenMobile 10 'Reporting' gets. Just the MDM related details.

 

The other app information (such as personal apps and potentially malicious apps) only gets reported back by the 'App Inventory' policy (and, unfortunately, these details are not included in the MDM Reporitng details which I've referred to above). Instead, all of these goodies are kept on their own as an answer to the App Inventory request.

This information is only readily readable under 'Manage Devices'.

 

I'm going to raise a request internally to get the documentation updated as I suspect that the paragraph in question is perhaps more applicable to XenMobile 9.

XenMobile 10 has it's own implimentation of Reporting (as it is such an entirely different product to XenMobile 9).

 

Like you suggest, an SQL query on the database will get you the required details though it is a rather complex way to obtain it.

Another overly complex way to get this information would be by using our REST API as this can also retrieve pretty much any of the information which can be seen in any screen in the admin web console.

 

 

Thanks,

David

[David Egan1709157332]

Hi Jim, I'm hoping that one of the answers on this topic has helped with your query?

If so, please could I ask for you to mark this topic as answered?

This would be a very helpful step for our other community users.

 

Many thanks,

David

[James Selix]

On 2/8/2017 at 5:40 AM, Arnaud Pain said:

Jim,

 

you can do it via SQL query:

 

SELECT "DEVICE_SEARCH"."device_id", "DEVICE_SEARCH"."managed_by_zdm", "DEVICE_SEARCH"."IMEI", "DEVICE_SEARCH"."SERIAL_NUMBER", "DEVICE_SEARCH"."LAST_INVENTORY_TIME", "DEVICE_SEARCH"."OS_FAMILY", "DEVICE_SEARCH"."LAST_USERNAME" , "SOFTWARE_INVENTORY"."NAME", "SOFTWARE_INVENTORY"."VERSION", "SOFTWARE_INVENTORY"."AUTHOR", "SOFTWARE_INVENTORY"."PACKAGE_INFO", "SOFTWARE_INVENTORY"."SIZE", "SOFTWARE_INVENTORY"."INSTALL_TIME" FROM "DEVICE_SEARCH" "DEVICE_SEARCH" INNER JOIN "SOFTWARE_INVENTORY" "SOFTWARE_INVENTORY" ON "DEVICE_SEARCH"."DEVICE_ID"="SOFTWARE_INVENTORY"."DEVICE_ID" ORDER BY "DEVICE_SEARCH"."DEVICE_ID"

 

 

 

After export the output in csv and make it fore friendly using Excel.

 

this is exactly what i was looking for!! works great, just export to a spreadsheet. wish Citrix would add a similar report to the actual xenmobile console.  thanks apain757 for the query!!!!

[Arnaud Pain]

40 minutes ago, James Selix said:

 

this is exactly what i was looking for!! works great, just export to a spreadsheet. wish Citrix would add a similar report to the actual xenmobile console.  thanks apain757 for the query!!!!

 You're welcome!