Be careful when creating a custom inventory scan.
Created a custom inventory scan for reporting on .exe & .pst files for user's mapped drives to a file server.
One file server in particular was experiencing high CPU usage for a sustained period of time by the System Process.
After using Process Explorer we discovered it was SRV.sys service and 50 files were being read at a time, spanning a 2 TB volume with over 1 million files.  Users had read access to most of this drive and the custom inventory scan for user folders was scanning this drive.  On one particular day there were 800+ machines running this scan at the same time based upon the task status reports in Altiris.  Needless to say the cause was readily apparent and we removed the directory which pointed to the server having the issues.

...

Just a quick, useful tweak. This info is available on many places on the web, but I thought I'd throw it on Connect too for anyone who could benefit from it.

The My Computer icon, by default, looks like this:

With this registry tweak, you can add username and computer information, like this:

Manual Method

To make this change manually:

1. Open the Registry editor, regedt32.
2. Go to HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}

3. Change the value of LocalizedString to:

   %USERNAME% on %COMPUTERNAME%
   

   (or whatever you'd like it to read)

   (default value is: @%SystemRoot%\system32\SHELL32.dll,-9216...

Ever wanted to, not only know which rule has run, but also want to work with that data?

I did and here are my findings so far as I have not found any historical information on this matter here.

Looking in the workitem_details_view, there is a filed called workitem_rules_fired. In here the rules are stored that are started after the saving of that "workitem_number" - "workitem_version".
When you start looking for these ID's you will see no rules has the same ID as stored in workitem_xxx_view (xxx = does not matter which workitem view you are looking at).

Going through all the views/tables I found the following:
All rules defined by Altiris or created in your company, are "stored" in wu_custom_instance_view view. Strange thing is, the value of ID's in the workitem_xxx_views are completely different in comparisson with ...

Sometimes there is a need to reroute an existing incident when certain criteria are met.

For example:

An incident is created that multiple agents will have to work in a specific order.  A good example is a new employee who needs access to multiple systems.  Perhaps some approval is needed before work can begin.  An incident rule can force the rerouting of the ticket when the approval is granted.  Using an incident rule  (based off of business logic)  you can detect when the first  step of the process has been completed and then re-reroute the incident to the next worker/queue.

Simply create an incident rule that will change the assigned worker id to 0 when your criteria is met.  Changing the assigned worker id to 0 will force altiris to reroute the incident.  Based off your business logic you can have a routing rule that will find the correct worker/queue to reroute the incident.

NOTE: I am not...