Help for PDQ Inventory > Computer Window > Computer Window Data Sources

Where the data on the Computer (Overview) page of the Computer window comes from. See Computer Window Data Sources for how to read the Source column, and for the other pages of the Computer window.

The Overview page is assembled from several scanners plus values the PDQ Inventory server tracks itself. Most of it comes from the Computer scanner, which is part of the Standard scan profile.

NOTE: When Allow Scan is set to No, most of the fields on this page become editable so you can maintain them by hand. Scans no longer overwrite them because the computer is no longer scanned.

General

Field	Source	Derivation / Notes
Name	Scanner: Computer	The computer name the target reports for itself. Computers added from Active Directory start out with the AD object name. You can rename the record in the console without changing the target.
Description	Registry	HKLM\SYSTEM\CurrentControlSet\services\LanmanServer\Parameters\srvcomment - the computer description set in Windows. This is not the Active Directory description.
Host Name	Scanner: Computer	The name PDQ Inventory connects to. Determined on the target, falling back to the computer name.
Added	Not scanned	The date and time the computer record was created in PDQ Inventory.
Online	Not scanned	Tracked by the PDQ Inventory server heartbeat, which resolves the host name and pings it on a schedule. It does not require a scan.
Uptime	Calculated	Current time minus Boot Time. Blank when the computer is offline or Boot Time is unknown.
Boot Time	Event Log / WMI	The most recent event ID 27 from the Microsoft-Windows-Kernel-Boot provider in the System log, counting only events whose BootType is 0 or 1 - a real boot rather than a resume from hibernation. Falls back to Win32_OperatingSystem.LastBootUpTime, which fast startup can make inaccurate. Stored in UTC.
Current User	Scanner: Computer	Win32_ComputerSystem.UserName. If that is empty, an NT AUTHORITY account, or does not match a live session, the scanner instead picks the highest-priority interactive or Remote Desktop logon session - active first, then locked, then disconnected - and appends (locked) or (disconnected).
Display Name	Active Directory	The Active Directory display name of the account shown in Current User, not of the computer. Blank when the account cannot be looked up in AD.
IP Address	Not scanned	The first address returned when the server resolves the host name during the heartbeat. It does not come from the NICs scan, so it can differ from the addresses on the NICs page.
MAC Address	Scanner: Network Adapters	The MAC address of the first adapter reported as Connected. See the NICs page for every adapter.
Time Zone	Scanner: Computer	The Windows time zone ID configured on the target.

Operating System

Field	Source	Derivation / Notes
O/S	Calculated	A friendly name the server maps from the scanned Name below, so that editions and builds group together in collections and reports.
Name	WMI	Win32_OperatingSystem.Name, trimmed at the first \| character.
Version	WMI + Registry	Win32_OperatingSystem.Version. On Windows 10 and later the update build revision from HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\UBR is appended, giving the full four-part build number.
SP / Release	WMI + Registry	Win32_OperatingSystem.ServicePackMajorVersion. On Windows 10 and later this is replaced by the feature update release - DisplayVersion (for example 24H2), or ReleaseId on builds predating it - from HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion.
Installed	WMI	Win32_OperatingSystem.InstallDate. In-place upgrades reset this, so it is not always the date the machine was first built.
Serial Number	WMI	Win32_OperatingSystem.SerialNumber - the Windows product ID. The hardware serial number is under System.
System Drive	Scanner: Computer	The drive letter from the SystemDrive environment variable on the target, stored without the colon - C, not C:. Match on the bare letter when you write a collection filter against it.
PowerShell Version	Registry	HKLM\SOFTWARE\Microsoft\PowerShell\3\PowerShellEngine\PowerShellVersion, falling back to the \1\ key. This is Windows PowerShell only; PowerShell 7 installs are reported on the Applications page instead.
SMBv1 Server Enabled	WMI + Registry	On Windows 8 and Windows Server 2012 and later, EnableSMB1Protocol from MSFT_SmbServerConfiguration in the ROOT\Microsoft\Windows\SMB namespace. If that reports enabled, it is confirmed against HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\SMB1, where a missing value means enabled.
SMBv1 Client Enabled	WMI + Registry	Win32_OptionalFeature where Name is SMB1Protocol. If the feature is not reported as disabled, the driver start type at HKLM\SYSTEM\CurrentControlSet\services\mrxsmb10\Start decides (4 means disabled).
IE Version	Registry	HKLM\SOFTWARE\Microsoft\Internet Explorer\svcVersion, then Version, then Version Vector\IE.
Architecture	Scanner: Computer	The bitness of the installed operating system, as Windows itself reports it rather than parsed out of the OS name. ARM64 machines report 64-bit here; the processor family is on the CPU page.
.NET Versions	Registry	The .NET Framework versions and service pack levels installed under HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP, plus the Active Setup entry that records .NET 1.0. Versions from 4.5 on all share the v4\Full key, so the exact one is worked out from that key's Release number against a lookup table - which is why 4.6, 4.7, and 4.8 appear alongside a 4.0 Full entry. .NET Core and .NET 5 and later are not reported here; they appear on the Applications page.
Deep Freeze Status	WMI (Enterprise)	DFStatus from the DeepFreeze class in the ROOT\Faronics namespace, decoded to text - Frozen, Frozen and Locked, Frozen in Maintenance, Thawed, Thawed and Locked, Thawed in Maintenance, Thawed Period, Thawed - License expired, Seed, Uninstalled, or Error. A status code with no mapping is reported as Unknown Status 0x... with the raw value. Blank when Faronics Deep Freeze is not installed.
Needs Reboot	Calculated	Yes when any of three pending-reboot markers is found in the registry: the ...\WindowsUpdate\Auto Update\RebootRequired key contains at least one value; PendingFileRenameOperations under Session Manager lists a file; or Flags under SOFTWARE\Microsoft\Updates\UpdateExeVolatile is 1, 2, or 3. Click Yes to save the detailed reasons to a text file.

NOTE: Both SMBv1 fields fall back to Enabled, not Unknown, when the target cannot be read: Windows treats a missing configuration value as SMBv1 being on, and the scanner does the same. Unknown appears only where PDQ Inventory has no SMBv1 result at all - typically a computer whose last successful scan predates these fields. Confirm an unexpected Enabled against the target before treating it as real exposure.

NOTE: Needs Reboot ignores a few known-noisy pending file renames - print spooler files, Logitech files, and Avast upgrade files - because those linger without a reboot ever being needed. A target can therefore show a PendingFileRenameOperations value and still report No.

Active Directory

These fields describe the computer's Active Directory object. They come from the Active Directory scanner and from AD sync, not from a scan of the target's own configuration.

Field	Source	Derivation / Notes
Parent Path	Active Directory	The container or OU that holds the computer object.
Description	Active Directory	The description attribute of the AD computer object. This is separate from the Description under General, which is the local Windows description.
Domain	Active Directory	Derived from the object's distinguished name.
Domain Controller	Scanner: Active Directory	The domain controller the target is using, from nltest /dsgetdc: run on the target.
Location	Active Directory	The location attribute of the AD computer object.
Last Logon	Active Directory	The lastLogonTimeStamp attribute. Active Directory only replicates this value periodically, so it can lag real logon activity by up to two weeks.
Created	Active Directory	The whenCreated attribute.

System

Field	Source	Derivation / Notes
Manufacturer	WMI	Win32_ComputerSystem.Manufacturer.
Model	WMI	Win32_ComputerSystem.Model.
Memory	WMI	The sum of Capacity across every Win32_PhysicalMemory module. When no modules are returned - common on virtual machines - Win32_ComputerSystem.TotalPhysicalMemory is used instead, which reports slightly less than the installed total.
Processor	WMI	A summary of Win32_Processor. See the CPU page for the detail.
Chassis	Calculated	Win32_SystemEnclosure.ChassisTypes decoded to text such as Desktop, Laptop, Notebook, or Virtual. Enclosures that report more than one type are joined with commas.
Serial Number	WMI	Win32_BIOS.SerialNumber when it is plain ASCII. When it is not, Win32_BaseBoard.SerialNumber is used instead if that value is present and ASCII; if both are non-ASCII, whichever is longer wins. Firmware that reports padding or placeholder text is the usual reason this field looks odd.
BIOS Version	WMI	Win32_BIOS.SMBIOSBIOSVersion.
BIOS Manufacturer	WMI	Win32_BIOS.Manufacturer.
BIOS Asset Tag	WMI	Win32_SystemEnclosure.SMBIOSAssetTag. Blank unless the value has been written into firmware, which most manufacturers leave to the customer.
Family	WMI	MS_SystemInformation.SystemFamily in the root\wmi namespace.
Version	WMI	MS_SystemInformation.SystemVersion in the root\wmi namespace - the manufacturer's hardware version, not the OS version.
SKU	WMI	MS_SystemInformation.SystemSku in the root\wmi namespace.

Scanning

Field	Source	Derivation / Notes
Allow Scan	Not scanned	A per-computer console setting. When set to No the computer is left out of all scans and most Overview fields become editable.
Successful Scan	Not scanned	How long ago the most recent successful scan finished, from the scan history the server keeps. See the Scans page.
Last Scan Profile	Not scanned	The name of the scan profile used by that most recent successful scan.
Scan User	Not scanned	The credentials assigned to this computer for scanning. Set in the console; blank means the default scan credentials are used.

PDQ Connect

Field	Source	Derivation / Notes
Agent Running	Scanner: Computer	Yes when a Windows service named PDQConnectAgent exists on the target and is running.
Agent Version	Scanner: Computer	The file version of C:\Program Files\PDQ\PDQConnectAgent\pdq-connect-agent.exe, falling back to its product version. Blank when the agent is not installed at that path.

Computer (Overview) Data Sources