SCCM Newly Discovered Machines: Finding Devices from the Last 24 Hours

Finding Newly Discovered Machines in Configuration Manager

After a discovery cycle runs, it’s often useful to know exactly which machines have appeared in your Configuration Manager database for the first time — for example, to catch new builds that need the client pushed, or simply to keep an eye on what’s landing in your environment via AD System Discovery. Every discovered resource carries a creation timestamp you can query against. The following WQL, run from Monitoring > Queries, returns machines discovered within roughly the last 24 hours:

select SMS_R_SYSTEM.Name, SMS_R_SYSTEM.ResourceDomainORWorkgroup, SMS_R_SYSTEM.Client from SMS_R_System where DateDiff(hh, SMS_R_System.AgentTime, GetDate()) <= 24

If that doesn’t return what you expect on your site, keep in mind AD System Discovery has to actually run first — check Administration > Discovery Methods to confirm the schedule, since machines only get created in the database once a discovery cycle picks them up, not the moment they join the domain.

A Note on the “24 Hours” Window

The DateDiff(hh, ...) <= 24 comparison is an hour-boundary check, not a rolling 24-hour window in the strict sense — a machine discovered 23 hours and 59 minutes ago and one discovered 30 minutes ago will both match, but so will anything crossing into the 24th hour bucket, which can occasionally pull in a machine slightly older than a true “last day” cutoff depending on when the query runs. If you need a tighter, more precise window, switch to minutes instead of hours:

select SMS_R_SYSTEM.Name, SMS_R_SYSTEM.ResourceDomainORWorkgroup, SMS_R_SYSTEM.Client from SMS_R_System where DateDiff(mi, SMS_R_System.AgentTime, GetDate()) <= 1440

(1440 minutes = 24 hours, giving the same effective window but with finer granularity if you want to tune it later.)

Turning This Into a Standing Collection

Running this as an ad-hoc query is fine for a quick check, but if you want an ongoing view without re-running it manually, paste the same WQL into a new device collection with a scheduled incremental update instead of a one-off query — that gives you a collection that continuously reflects “machines discovered in roughly the last day,” which is useful as a target for a welcome-notification workflow or a daily new-machine report rather than something you check by hand.

Resources

• query
• WQL
• our SQL & WQL query library
• Browse our Windows Admin Toolkit picks on Amazon