Modifying the default SC Endpoint Protection 2012 report

I got a request from a customer that they want to be able to subscribe to the built in report “Antimalware Activity Report” in Configuration Manager 2012. As this report requires a start date and end date to run the report will be be emailed for the dates that are entered when you create the subscription and not the current date.

Modifying the report to be for the last day or for the last 7 days and remove the Start Date and End Date prompt.

Here is how to do it:

1. Browse to the Configuration Manager 2012 reporting site

2. Under Endpoint Protection, select the “Antimalware Activity Report” and select “edit in report builder”

3.Under Parameters select @StartDate and Edit parameter

4. Change the visibility to “Hidden”
5. In the available values section change to “Get values from a query” with the below settings:

6. Then we do the same for the @EndDate parameter:

7. Then we save the report with a new name like “Anitmalware Activity Report – Last 7 days”

Now when we run the report we are no longer prompted for a Start Date and an End Date, only which device collection the report should be based on.

Then we are done!

If you want to change the interval from 7 days to only include todays activity we can change that as well really easy in the Report Builder.
Under “Datasets” select the “StartEndDates” dataset and edit the query. Change the “-7” in the query to how many days back in time you want the report, for only todays activity set it to “0”.

Then the query looks like this:
select DATEADD(day,0,DATEDIFF(day, 0, GetUTCDate())) as StartDate, DATEADD(day,0,DATEDIFF(day, 0, GetUTCDate())) as EndDate

Then we save report again as for example “Antimalware activity report – todays activity”

I hope this can be useful for more than me