Skip to main content

​
Overview

Gather comprehensive information about the SCCM site from local log files. This command performs automated analysis of SCCM client logs to extract configuration details, network paths, URLs, and other reconnaissance data.

​
Syntax

SharpSCCM local triage [options]

​
Parameters

This command requires no additional parameters beyond the standard debug and help options.

​
Examples

# Perform comprehensive log file analysis
SharpSCCM local triage

​
Analysis Categories

Examines the SCCM client cache directory:
  • Cache contents and file permissions
  • Application packages stored locally
  • Size and modification dates of cached content
  • Access permissions for the current user
Searches logs for Universal Naming Convention paths:
  • Distribution points and file shares
  • Administrative shares (C,ADMIN, ADMIN)
  • Application source paths
  • Network resource locations
Extracts URLs from log files:
  • Management point URLs and endpoints
  • Distribution point URLs
  • Web service endpoints
  • Internal application URLs

​
Log Files Analyzed

  • CcmExec.log - Main client executive service
  • CcmMessaging.log - Client-server communication
  • PolicyAgent.log - Policy processing and retrieval
  • LocationServices.log - Site assignment and discovery
  • AppEnforce.log - Application installation and enforcement
  • AppDiscovery.log - Application detection
  • DataTransferService.log - Content download operations
  • SoftwareCatalogUpdateEndpoint.log - Software catalog updates
  • ccmsetup.log - Client installation and setup
  • ClientLocation.log - Management point discovery
  • InternetProxy.log - Proxy configuration

​
Discovered Information Types

  • Management point servers and ports
  • Distribution point locations
  • Internal network segments and IP ranges
  • DNS names and FQDN patterns
  • Authentication methods and endpoints
  • Certificate information
  • Service principal names (SPNs)
  • Windows authentication vs. certificate authentication
  • Deployed applications and versions
  • Source file locations
  • Download URLs and content hashes
  • Installation command lines and parameters

​
Use Cases

First-stage reconnaissance to understand the complete SCCM environment layout, including servers, network paths, and configurations.
Identify network paths, shares, and servers that can be targeted for lateral movement within the environment.
Build a complete map of the SCCM infrastructure including management points, distribution points, and network topology.

​
Performance Considerations

This command may take significant time to complete (20+ seconds) as it:
  • Searches through multiple large log files
  • Performs pattern matching across thousands of log entries
  • Analyzes file system permissions and metadata

​
Security Implications

Information gathered by triage can reveal:
  • Internal network topology and server locations
  • Administrative access patterns and privileged paths
  • Application deployment methods and source locations
  • Authentication mechanisms and security configurations