UTMStack

Articles, updated 10 min read

Computer Inventory Management: Methods and Tools for 2026

By UTMStack Team

You cannot patch, license or protect a computer you do not know about. Yet most organizations find gaps the first time they compare lists: laptops that never come back to the office network, servers someone built for a project, virtual machines in a cloud account, and software installed by users without asking. A spreadsheet updated by hand falls behind within weeks.

This guide explains what a computer inventory should hold, the three ways to collect it, and the tools that do the work, from free open source projects to commercial products. Every license and feature below was checked against the project’s or vendor’s own site in October 2026. We build UTMStack, a security information and event management (SIEM) platform that keeps its own inventory of the systems it monitors, so weigh our view accordingly.

The short answer: computer inventory management means keeping an up-to-date list of every computer and device you own, the hardware inside it, the software installed on it, who uses it and when it was last seen. Collect it automatically: install an agent on the computers you manage, scan servers and network devices without an agent, and run network discovery to catch devices nobody registered. Then merge the results into one list. Free tools such as GLPI, OCS Inventory NG, Snipe-IT, osquery and Open-AudIT cover most needs; Lansweeper and Microsoft Intune are common paid choices.

Why the inventory comes first

Security frameworks put inventory at the start for a reason.

  • The CIS Critical Security Controls (version 8.1) begin with Control 1, inventory and control of enterprise assets, and Control 2, inventory and control of software assets. Control 2 asks that only authorized software is installed and can run.
  • The NIST Cybersecurity Framework 2.0 asks that inventories of hardware (ID.AM-01) and of software, services and systems (ID.AM-02) are maintained.
  • PCI DSS 4.0 requirement 12.5.1 asks for an inventory of in-scope system components, with a description of each one’s function, kept current.

Beyond audits, the inventory decides what your vulnerability scans cover, which machines your security tools watch, how many software licenses you really need and when hardware should be replaced.

What to track

AreaFields worth keepingWhy
IdentityHost name, serial number, asset tag, manufacturer and modelMatch the same machine across tools
HardwareProcessor, memory, disk, Trusted Platform Module (TPM)Plan upgrades, check requirements for new operating systems
Operating systemName, version, build, last patch dateFind unsupported or unpatched systems
NetworkIP and MAC addresses, network or siteLocate a device during an incident
SoftwareEach installed application, version and publisherFind vulnerable, unlicensed or unapproved software
ComponentsLibraries inside applications, such as log4j, as a software bill of materials (SBOM)Find flaws hidden inside other programs
OwnershipUser, department, locationKnow who to call
LifecyclePurchase date, warranty end, status (in use, stored, retired)Budget replacements, dispose of disks safely
HealthLast seen, agent status, criticalitySpot devices that went silent

One good inventory record

An example laptop, with the fields that make the record useful

FIN-LT-0421 serial 5CG4512ABC2 Windows 11 Pro 24H2, patched 2026-10-083 10.0.4.17, 3C:52:82:1A:9F:044 212 applications5 owner: Finance, assigned user6 last seen 2026-10-147
  1. Host name that follows a naming rule
  2. Serial number to match purchase and warranty records
  3. Operating system and when it was last patched
  4. Addresses to find it on the network
  5. Installed software, with versions
  6. The person and department responsible
  7. When it last reported, so silent devices stand out
Illustrative values. A record without an owner or a last-seen date is the first kind to go stale.

Keep furniture, vehicles and other physical assets in a separate system. They need different fields, and mixing them into an IT inventory makes both harder to use.

Three ways to collect inventory

MethodHow it worksStrengthsGaps
Agent-basedA small program on each computer reports hardware and software to a server on a scheduleDeep detail; works for laptops off the office networkOnly covers devices where you installed it
AgentlessA server logs in to devices remotely, using Windows Management Instrumentation (WMI), Secure Shell (SSH), the Simple Network Management Protocol (SNMP) or cloud and virtualization application programming interfaces (APIs)Nothing to install; covers switches, printers and appliancesNeeds stored credentials; misses devices that are offline or off the network
Network discoverySweeps address ranges with ping, Address Resolution Protocol (ARP) tables and SNMP, or watches traffic, to find anything that answersFinds devices nobody registeredShows that a device exists, not what software it runs

Most organizations need all three. Agents give the depth, agentless scans cover devices that cannot run an agent, and discovery finds the gaps between them.

How one inventory gets built and stays current

Four steps, repeated on a schedule

  1. DiscoverNetwork sweeps and traffic data find what is connected
  2. CollectAgents and agentless scans read hardware and installed software
  3. ReconcileMerge duplicates by serial number, add owners and status
  4. WatchFlag new, silent and unapproved devices and software
The reconcile step is where most inventories fail: two tools that disagree about the same laptop.

Computer inventory tools compared

ToolTypeLicense or priceCollects byBest for
GLPIAsset management and service deskFree, GPL-3.0 (agent GPL-2.0)Agent, plus network discovery and SNMP inventoryOne open source system for inventory and tickets
OCS Inventory NGInventoryFree, GPL-2.0Agent, plus IpDiscover and SNMPLightweight automatic inventory
Snipe-ITAsset lifecycle trackingFree, AGPL-3.0Import, API and sync adapters (no scanner of its own)Who has which laptop, licenses, warranties
osqueryEndpoint query agentFree, Apache-2.0 or GPL-2.0Agent you query with SQL, the standard database languageEngineers who want raw, queryable data
Open-AudITDiscovery and auditFree Community edition, AGPL-3.0; paid editionsNetwork discovery and audit scriptsNetwork-wide discovery and change tracking
LansweeperCommercial IT asset managementPaid, priced by number of assetsAgentless scanning plus optional agentLarge mixed networks
Microsoft IntuneEndpoint managementIncluded in Microsoft 365 bundles such as E3 and E5Enrolled devices report to MicrosoftOrganizations already on Microsoft 365

GLPI

GLPI (from the French Gestionnaire Libre de Parc Informatique) is an open source asset and service desk platform under the GPL-3.0 license. It tracks computers, peripherals, printers, contracts and software licenses, and links them to help desk tickets. The GLPI Agent (GPL-2.0) inventories Windows, Linux and macOS computers and can sweep networks with ARP, ping and SNMP to find other devices and read details from switches and printers.

OCS Inventory NG

OCS Inventory NG is an open source inventory tool under the GPL-2.0. Its agents report hardware and software from Windows, Linux, macOS and other systems. A feature called IpDiscover finds active devices that cannot run an agent, and agents can then query them with SNMP. It can also push software packages to computers.

Snipe-IT

Snipe-IT is an open source asset management system under the AGPL-3.0. It answers the business questions: who has which laptop, when it was bought, when the warranty ends and which licenses are assigned. It does not scan the network itself. Assets come in by spreadsheet (CSV) import, through its API, or through sync adapters that pull devices from management tools.

osquery

osquery, released under Apache-2.0 or GPL-2.0, turns the operating system into tables you query with SQL: installed programs, running processes, network connections, hardware and more. It runs on Linux, macOS and Windows. On its own it answers questions about one machine; you need a separate management server to collect results from many.

Open-AudIT

Open-AudIT discovers devices on your network and records what each one is, how it is configured and when it changes. It is now maintained by FirstWave, which bought its original developer, Opmantek. The community code is on GitHub under the AGPL-3.0, and paid editions add features.

Lansweeper

Lansweeper is a commercial IT asset management product. It discovers devices without installing anything, using protocols such as WMI, SSH and SNMP, and an optional agent covers computers that are rarely on the network. It is sold in plans priced by the number of assets.

Microsoft Intune

Intune manages enrolled Windows, macOS, iOS and Android devices. Each device reports hardware details such as serial number, model, operating system, storage, memory and Trusted Platform Module version, and Intune lists discovered applications. Microsoft says the inventory refreshes every seven days. It only sees enrolled devices, so it does not find unmanaged ones. Most organizations get it as part of a Microsoft 365 bundle.

How to set up computer inventory management

  1. Decide the scope and the fields. Start with the table above and drop what nobody will use.
  2. Run discovery across every network range to get a first list of what is connected.
  3. Deploy agents to every computer you manage, including remote laptops.
  4. Add agentless collection for switches, printers, hypervisors and appliances.
  5. Reconcile. Match records by serial number, remove duplicates and assign an owner and status to each device.
  6. Set rules. For example: alert when a new device appears, mark devices not seen for 30 days for review, and flag software that is not on the approved list.
  7. Connect the inventory to security. Your vulnerability scanner and your SIEM should cover every device on the list, and a device missing from either is a gap. See our comparison of vulnerability management tools.
  8. Review monthly, and fully reconcile before each audit.

How UTMStack fits

UTMStack is a SIEM, not a full IT asset management tool. Its inventory comes from the systems it monitors. It keeps a live list of every agent and data source, with host name, IP and MAC addresses, operating system and version, status and when it last sent data. Each source shows as live, idle or offline, so a server that stops sending logs is flagged instead of going unnoticed.

Agent-based vulnerability scans on Windows and Linux list installed applications and the libraries inside them, flag vulnerable versions and can produce a software bill of materials. You can group sources by site, team or customer and rate how critical each one is, so alerts show what kind of system was hit. Network data such as NetFlow also shows devices that cannot run an agent.

What it does not do: UTMStack does not run a separate active network discovery scan, and its vulnerability scanner only checks the targets you give it. It does not track purchase dates or warranties, so pair it with a tool such as GLPI or Snipe-IT for the lifecycle side. See asset management in UTMStack, how it watches switches and firewalls in network device monitoring, or try the live demo with no sign-up. The Community edition is free and open source; paid editions are priced per device, never by log volume.

Frequently asked questions

What is computer inventory management? Keeping an accurate, current list of every computer and device, its hardware, its installed software, its owner and its status, usually collected automatically by agents and network scans.

What is the difference between IT asset management and inventory? Inventory is the list of what exists and what is on it. IT asset management adds the business lifecycle: purchase, assignment, licenses, warranty, cost and disposal.

What is the best free PC inventory tool? GLPI or OCS Inventory NG for automatic hardware and software inventory, Snipe-IT for tracking who has what, and osquery for engineers who want queryable data. All are open source.

Can I inventory computers without installing an agent? Yes. Agentless tools log in over WMI, SSH or SNMP. You will miss laptops that are rarely on the network, so most teams add agents for those.

How often should the inventory update? Daily for agents is common. Intune refreshes every seven days. Treat any device not seen for 30 days as a question to answer, not a record to keep.

Does UTMStack discover devices automatically? It lists every agent and data source that sends it data, and network data shows other devices talking on your network. It does not run a separate active discovery scan.

Sources

Keep reading