Custom Solution: Shortening Endpoint Central Inventory Scan Intervals via REST API

AI Preview

Is this content worth your time? Use the quick preview to decide.

Welcome to Techaptic!

In today’s guide, we show you how to perform inventory scans more frequently on ManageEngine Endpoint Central, shortening the native once-a-day interval limit.

Scheduled inventory scans in Endpoint Central are limited to running once a day, which might not be enough for dynamic environments requiring up-to-date data. In this post, we use Endpoint Central’s REST API, PowerShell, and Windows Task Scheduler to trigger full inventory scans at your desired intervals without altering the native schedule settings. We also prioritize security by utilizing the Windows DPAPI mechanism to securely encrypt the API token, tying it directly to the local machine so it is never exposed in plain text. Follow along to implement this custom solution and maintain real-time visibility over your endpoints safely.

🔗 Helpful Links

There are no helpful links in this one.

Video Tutorial

Used Commands

Secure API token storage script (Save-EcAuthTokenMachine.ps1)

<#
.SYNOPSIS
Techaptic - Endpoint Central Secure API Token Storage Script

.DESCRIPTION
Protects the Endpoint Central API authentication token by using
Windows DPAPI with the LocalMachine scope.

The encrypted token is stored as Base64 data, and the token file
permissions are restricted to SYSTEM and Administrators.

.NOTES
Author: Techaptic

The script must be run from an elevated PowerShell session.

Default Output:
C:\ProgramData\EPC\ec_authtoken.machine
#>

# C:\Scripts\Save-EcAuthTokenMachine.ps1
# Encrypts the token with DPAPI LocalMachine.

[CmdletBinding()]
param(
[Parameter()]
[string]$OutputPath = "$env:ProgramData\EPC\ec_authtoken.machine",

[Parameter()]
[string]$EntropyText = "EPC_TOKEN_V1_LOCALMACHINE"
)

function Ensure-Dir([string]$Path) {
$d = Split-Path -Parent $Path
if ($d -and !(Test-Path $d)) {
New-Item -ItemType Directory -Path $d -Force | Out-Null
}
}

function Get-Plain([Security.SecureString]$SecureString) {
$bstr = [Runtime.InteropServices.Marshal]::SecureStringToBSTR($SecureString)
try {
[Runtime.InteropServices.Marshal]::PtrToStringBSTR($bstr)
}
finally {
[Runtime.InteropServices.Marshal]::ZeroFreeBSTR($bstr)
}
}

Write-Host ""
Write-Host "Techaptic - Endpoint Central Secure API Token Configuration Initiated..." -ForegroundColor Cyan
Write-Host "------------------------------------------------------------------------" -ForegroundColor Cyan

Write-Host "Processing: Token directory preparation... " -NoNewline
Ensure-Dir $OutputPath
Write-Host "[SUCCESS]" -ForegroundColor Green

Write-Host "Paste Endpoint Central Authentication Token and hit Enter:" -ForegroundColor Yellow
$tokenSecure = Read-Host -AsSecureString
$plain = Get-Plain $tokenSecure

if ([string]::IsNullOrWhiteSpace($plain)) {
Write-Host "[ERROR] Token is empty. The process is cancelled." -ForegroundColor Red
throw "Token was entered empty. Process cancelled."
}

Write-Host "Processing: DPAPI LocalMachine encryption... " -NoNewline
Add-Type -AssemblyName System.Security

$bytes = [Text.Encoding]::UTF8.GetBytes($plain)
$entropy = [Text.Encoding]::UTF8.GetBytes($EntropyText)

$protected = [Security.Cryptography.ProtectedData]::Protect(
$bytes,
$entropy,
[Security.Cryptography.DataProtectionScope]::LocalMachine
)

$b64 = [Convert]::ToBase64String($protected)
Set-Content -Path $OutputPath -Value $b64 -Encoding ASCII -NoNewline
Write-Host "[SUCCESS]" -ForegroundColor Green

Write-Host "Processing: Token file ACL configuration... " -NoNewline
& icacls $OutputPath /inheritance:r | Out-Null
& icacls $OutputPath /grant:r "SYSTEM:(R)" "Administrators:(R)" | Out-Null
Write-Host "[SUCCESS] (SYSTEM and Administrators: Read)" -ForegroundColor Green

Write-Host "------------------------------------------------------------------------" -ForegroundColor Cyan
Write-Host "Process Completed. Authentication token stored securely." -ForegroundColor Green
Write-Host "Token File: $OutputPath" -ForegroundColor Green

Full inventory scan trigger script (Invoke-EcInventoryScanAll.ps1)

<#
.SYNOPSIS
Techaptic - Endpoint Central Full Inventory Scan Trigger Script

.DESCRIPTION
Triggers a full inventory scan for all computers managed by
ManageEngine Endpoint Central.

The script reads the DPAPI-protected API token created by
Save-EcAuthTokenMachine.ps1 and sends an authenticated POST
request to the Endpoint Central Scan All API.

.NOTES
Author: Techaptic

API Endpoint:
POST /api/1.4/inventory/computers/scanall

Required API Permission:
Inventory - Update

Default Token File:
C:\ProgramData\EPC\ec_authtoken.machine

Default Log File:
C:\Windows\Temp\ec_inventory_scanall.log
#>

# C:\Scripts\Invoke-EcInventoryScanAll.ps1

[CmdletBinding()]
param(
[Parameter(Mandatory)]
[string]$ServerBaseUrl,

[Parameter()]
[string]$TokenFile = "$env:ProgramData\EPC\ec_authtoken.machine",

[Parameter()]
[string]$EntropyText = "EPC_TOKEN_V1_LOCALMACHINE",

[Parameter()]
[string]$LogFile = "C:\Windows\Temp\ec_inventory_scanall.log",

[Parameter()]
[ValidateRange(5,300)]
[int]$TimeoutSec = 60
)

function Ensure-Dir([string]$Path) {
$d = Split-Path -Parent $Path
if ($d -and !(Test-Path $d)) {
New-Item -ItemType Directory -Path $d -Force | Out-Null
}
}

function Write-Log([string]$Msg, [ValidateSet("INFO","WARN","ERROR")]$Level="INFO") {
Ensure-Dir $LogFile
$ts = (Get-Date).ToString("yyyy-MM-dd HH:mm:ss")
Add-Content -Path $LogFile -Value "$ts | $Level | $Msg" -Encoding UTF8
}

function To-Json([object]$o) {
try {
return ($o | ConvertTo-Json -Depth 10 -Compress)
} catch {
return "<json_failed>"
}
}

function Get-AuthToken-FromLocalMachineFile([string]$Path, [string]$EntropyText) {
if (!(Test-Path $Path)) { throw "Token file not found: $Path" }

$b64 = (Get-Content -Path $Path -Raw).Trim()

if ([string]::IsNullOrWhiteSpace($b64)) { throw "Token file is empty: $Path" }

Add-Type -AssemblyName System.Security
$protected = [Convert]::FromBase64String($b64)
$entropy = [Text.Encoding]::UTF8.GetBytes($EntropyText)

$bytes = [Security.Cryptography.ProtectedData]::Unprotect(
$protected,
$entropy,
[Security.Cryptography.DataProtectionScope]::LocalMachine
)

$plain = [Text.Encoding]::UTF8.GetString($bytes)

if ([string]::IsNullOrWhiteSpace($plain)) { throw "Token decrypted but returned empty." }

return $plain
}

Write-Host ""
Write-Host "Techaptic - Endpoint Central Full Inventory Scan Initiated..." -ForegroundColor Cyan
Write-Host "------------------------------------------------------------------" -ForegroundColor Cyan

try {
Write-Host "Processing: Endpoint Central server address... " -NoNewline
$ServerBaseUrl = $ServerBaseUrl.Trim().TrimEnd("/")
Write-Host "[SUCCESS] ($ServerBaseUrl)" -ForegroundColor Green

try {
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
} catch {}

Write-Host "Processing: Secure authentication token retrieval... " -NoNewline
$authToken = Get-AuthToken-FromLocalMachineFile -Path $TokenFile -EntropyText $EntropyText
Write-Host "[SUCCESS]" -ForegroundColor Green

$headers = @{
"Authorization" = $authToken
"Accept" = "application/json"
"Content-Type" = "application/json"
}

$url = "$ServerBaseUrl/api/1.4/inventory/computers/scanall"

Write-Host "Processing: Inventory Scan All API request... " -NoNewline
Write-Log "START | INVENTORY scanall -> POST $url"

$resp = Invoke-RestMethod -Method POST -Uri $url -Headers $headers -TimeoutSec $TimeoutSec -ErrorAction Stop

Write-Log "RESPONSE: $(To-Json $resp)"
Write-Log "DONE | Success"
Write-Host "[SUCCESS]" -ForegroundColor Green

Write-Host "------------------------------------------------------------------" -ForegroundColor Cyan
Write-Host "Process Completed. Full inventory scan request was accepted." -ForegroundColor Green
Write-Host "API Endpoint: $url" -ForegroundColor Green
Write-Host "Log File: $LogFile" -ForegroundColor Green

exit 0
}
catch {
Write-Host "[ERROR] ($($_.Exception.Message))" -ForegroundColor Red
Write-Log ("FATAL: " + $_.Exception.Message) "ERROR"

Write-Host "------------------------------------------------------------------" -ForegroundColor Cyan
Write-Host "Process Failed. Full inventory scan could not be triggered." -ForegroundColor Red
Write-Host "Log File: $LogFile" -ForegroundColor Yellow

exit 1
}

Full Transcript

Click to see...

Introduction and Current Limitations

Hello everyone and welcome to the Techaptic channel. Today we will show you how to perform inventory scans more frequently on the ManageEngine Endpoint Central product. As you may know, scheduled inventory scans in the product can be configured to run at most once a day. This might not be sufficient for every environment, and we believe that the configuration we are going to make will be useful for those who want to retrieve more up-to-date information on the UI. There is a feature called Partial Scan within the product, but it neither updates all the inventory details nor works on anything other than Windows.

Solution Architecture and Security

In this video, without altering Endpoint Central’s existing schedule settings, we will enable inventory scanning at our desired intervals by utilizing the product’s REST API infrastructure and Windows Task Scheduler. The working logic of what we are going to do is quite simple. Windows Task Scheduler will handle the frequency of the inventory scanning, and it will trigger a specific PowerShell script which includes some information about the REST API data of Endpoint Central. This REST API will automatically trigger all the endpoints of the Endpoint Central server without intervening with Endpoint Central’s native inventory scanning mechanism. Of course, when it comes to scripts, you want this to be done in the most secure way possible. At this point, a second script is designed to meet these security requirements. Here’s how: In such scripts using APIs, authentication data must be stored securely. For this, we will not write the authentication token we get from the Endpoint Central server directly into the script or the Task Scheduler parameters. We will encrypt this token using the Windows DPAPI mechanism, tying it to the local machine scope. Thus, it won’t be stored in plain text, and it will be impossible to decrypt the encrypted token file on another server. Finally, since we will only grant permissions to the Administrators built-in group and also the SYSTEM user for the file where the token is kept, we will have restricted the permissions at the ACL level as well.

Generating the Endpoint Central API Key

Now let’s move on to the configuration. First, let’s go to the Endpoint Central server and generate our token. From the ‘Admin’ tab, go to ‘API Key Management’ under ‘Integrations’. Let’s generate a new key. From the ‘Service Name’, select ‘Custom Integrations’ and type a service name. From the ‘Permissions’ tab, go to the ‘Inventory’ section and enable the ‘Update’ permission. We will not need the other permissions here. And for the API key restrictions, if you want, you can specify an expiration date for the API. In our case, we will stick with the ‘Never Expire’ setting and click ‘Save and Continue’ and ‘Generate Key’. Let’s copy the API key to a notepad temporarily, close this window, and minimize the Endpoint Central UI.

Preparing and Running the Token Encryption Script

Now we will create our first PowerShell script under the C drive. I will create a folder for it named ‘scripts’. And I will call the PowerShell script Save-ECAuthTokenMachine.ps1. Please make sure to change the extension of the file. Let’s open it and paste our code. You will find these codes on our website as well. Let’s save it. Let’s copy the directory path. Open PowerShell with admin credentials and go to this directory. First, let’s handle the execution policy. Type ‘Yes’. And then run the script. The script wants us to paste the token here and hit Enter. Let’s copy the token and paste it and hit Enter. The process is completed, and it grants the necessary ACL configurations for the SYSTEM and the Administrators. Also, it created the token file under C:\ProgramData\EPC. Let’s check if it is there. Yes, this is the token file.

Automation Script and Task Scheduler Configuration

Let’s go back and create our main PowerShell script. Let’s call it Invoke-ECInventoryScanAll.ps1. Let’s open it and paste our other script. Let’s save and close it. Now we have to configure the Task Scheduler to point to this PowerShell script. Let’s close this and open the Windows Task Scheduler. Let’s create a new task here. Let’s give it a name. For the user account, make sure to select the SYSTEM account. And enable ‘Run with highest privileges’. Go to the ‘Triggers’ tab. Click ‘New’ to adjust the frequency of this inventory scanning. I will configure it to run every 3 hours indefinitely. And make sure that it is enabled, and click ‘OK’. For the ‘Actions’ tab, let’s click ‘New’. With the ‘Start a program’ action, let’s choose the powershell.exe. Let’s choose it. For the ‘Add arguments’ option, let me copy the argument; it’s a bit long. I will explain what it is first. We will adjust the execution policy here, and we will target the PowerShell script here with the -File parameter. Also, for the server-based URL, we have to make sure the Endpoint Central address is provided along with the port. In my case, I copied [https://epc.adt.techaptic.com:8383](https://epc.adt.techaptic.com:8383). This is the one for me. And I am copying it as it is. For the ‘Start in’ option, we can type the directory path of the scripts, which is C:\scripts. Click ‘OK’. For the ‘Conditions’, you can adjust according to your needs. I will uncheck these. For the ‘Settings’, I will not change anything here and click ‘OK’.

Testing and Best Practice Recommendations

Before testing it, let’s go back to the Endpoint Central UI. Go to ‘Inventory’ and go to ‘Scan Systems’ and make sure there is no ongoing scanning here. Let’s test the configuration. Right-click the task and click ‘Run’. Let’s go to the UI and refresh the page. Yes. As you can see, the Task Scheduler has successfully called the API and initiated the inventory scanning, and it is now running the scanning process for the agents. Lastly, it is worth mentioning that even though we could reduce this scanning process down to the minute level, my recommendation is to leave this setting at a maximum of every 3 hours. This is because the agent and the server have many tasks they perform, and inventory information doesn’t usually change more frequently than that. A setting like this will be the best approach to prevent the system from slowing down. I think we’ve come to the end of this video. Thank you for watching. See you next time. Bye.

Comment or discuss on