Defender for Endpoint - Device Inventory - Windows LTSC devices
MDE Windows 10 LTSC Inventory
Query
let ltscdevices = DeviceTvmInfoGathering
| summarize arg_max(Timestamp, *) by DeviceId
| extend LtscDeviceId = DeviceId
| extend LtscDeviceName = DeviceName
| extend AF = parse_json(AdditionalFields)
| evaluate bag_unpack(AF)
| where IsWindowsLtscVersionRunning == "true"
| project LtscDeviceId, LtscDeviceName, IsWindowsLtscVersionRunning;
DeviceInfo
| where isnotempty(OSArchitecture)
| summarize arg_max(Timestamp, *) by DeviceId
| where OnboardingStatus == 'Onboarded'
| where OSPlatform == @"Windows10"
| join kind=leftouter (ltscdevices)
on $left.DeviceId == $right.LtscDeviceId
| extend IsLtsc = iff(IsWindowsLtscVersionRunning == "true", "true", "false")
| project Timestamp, DeviceId, DeviceName, IsLtsc, OSArchitecture, OSPlatform, OSBuild, OSVersionInfo, OSVersion,
JoinType, MachineGroup
//| summarize count() by IsLtsc
//| render piechartAbout this query
Defender for Endpoint - Device Inventory - Windows LTSC devices
Query Information
Description
Use the below queries to identify Windows 10 LTSC devices within your MDE inventory
References
Defender 365
We now have information within the DeviceTvmInfoGathering table about ltsc
DeviceTvmInfoGathering
| extend AF = parse_json(AdditionalFields)
| evaluate bag_unpack(AF)
| where IsWindowsLtscVersionRunning == @"true"
All Windows 10 devices running ltsc and sac, filter on IsLtsc true/false when you just want to see the ltsc/sac devices.
Explanation
The query is used to identify Windows 10 LTSC (Long-Term Servicing Channel) devices within the MDE (Microsoft Defender for Endpoint) inventory. It retrieves information from the DeviceTvmInfoGathering and DeviceInfo tables and filters the results based on the IsWindowsLtscVersionRunning field. The query also includes additional fields such as DeviceId, DeviceName, OSArchitecture, OSPlatform, OSBuild, OSVersionInfo, OSVersion, JoinType, and MachineGroup.
Details
Alex Verboon
Released: June 4, 2023
Tables
Keywords
Operators