SCCM manages every endpoint in most enterprise and government environments, but it almost never appears in the CMDB. The site hierarchy, distribution points, service accounts, and collection scoping are configuration decisions that directly affect security posture, and they are tracked nowhere.

Security teams find SCCM misconfigurations during pen tests, report them in PDFs, and the findings get filed away. Nobody tracks remediation. The same issues show up in the next assessment.

CMDB-Kit has an SCCM domain extension that models the management plane as CIs: sites, site roles, collections, security roles, service accounts, boundary groups, and findings. Each finding links to the specific CI it affects and the remediation status.

Has anyone run an SCCM security assessment and tried to track findings persistently? What did you use?