Tuesday 21 May 2013

SCCM 2012 - Endpoint Protection Antimalware Activitiy Report Subscription with Dynamic Dates

Over the weekend I decided to work on some additional subscriptions for reports that I wanted out of SCCM 2012, and although the "Antimalware Activity Report" looks much like the "Antimalware Overall Status and History" I discussed in my previous blog post, it it somewhat different in it's execution.

I opened the report in SQL Server Report Builder and noticed that it had the same @StartDate and @EndDate parameters as well as the DateRange dataset as the "Antimalware Overall Status and History" report, so I figured this would be easy. I saved the report with an appended name (usually add -last 7 days) and tried to figure out how to make it work automatically. I deleted the @StartDate and @EndDate parameters and tried to save, which gave me an error that a subreport is using these parameters somewhere. It seems that a report won't save if there are errors, and if there are errors, it tells you where they are specifically, so this has become my new meathod of tinkering.

Subreport, well that's news to me, what are these? I looked over to the right hand side of report builder and noticed these gray boxes:

Right clicking on each individual box will show give you an option for "Subreport Properties"....so I guess I found the sub reports which are referencing my date variables. Go into the Subreport Properties on each gray box , navigate to Parameters and you should see something like this:

Click on the little "fx" icon next to StartDate and replace the expression within with this:


Repeat the same thing with the EndDate and replace the expression with this:

 Repeat this for every Subreport.  Once this is done, you will be able to delete the DateRange Dataset as well. Save your report and create your subscription. The subscription will automatically update the dates everytime it executes and you will get your dynamic report showing Antimalware activity for the last 7 days.

Why Microsoft didn't make this a default behavious is anyone's guess. On the bright side, the MBAM 2.0 report doesn't require any dates and just shows the state of your BitLocker encryption at the time the report is ran.


  1. This works exactly the same as Malware Activity Report except it will pull from a dynamic date range instead of a static date range. I am an author and I Write My Essay For Me, I have this problem, and your content is solving my problem, I follow the step you are sharing it really works.

  2. mallware nneds to be sort ASAP as it is destroying the software and you are saying that its a by default thing i dont knew that but its should be solved soon. but if you all students are looking for the assignment help, here is best essay writing service service who sorts your problem very easily in very cheap rates.

  3. Great Job! Your exploration and workaround demonstrate the power of customization within SCCM 2012. Keep up the great work! Would you like to do my dissertation for me at an affordable price. I performed the same action for the EndDate parameter, but i can't find the proper solution.

  4. Greetings! I'm Thomas, a Assignment Help from Dissertation Educators. With my in-depth knowledge and expertise, I can help you create a well-structured and compelling dissertation.