Rebuilding an asset register

Most asset registers are wrong in the same way: they are accurate about what was bought and inaccurate about what exists. Purchases get recorded because they involve finance. Disposals, redeployments, failures and replacements happen operationally and frequently leave no trace in the register.

Rebuilding one by walking the floor with a clipboard is slow, expensive and out of date the week it finishes. There is a better approach, which is to build the register from systems that already know.

Sources that already have the answer

You almost certainly have several partial inventories. Each is incomplete on its own and together they cover most of the estate.

Endpoint management. Whatever manages your laptops and desktops knows the machine name, serial number, model, operating system, last check-in and usually the logged-in user. This is the most complete source for endpoints.

Directory services. Computer accounts show what has authenticated. Stale accounts that have not authenticated in months are a useful signal about what has quietly disappeared.

Network discovery. Scanning your address ranges finds anything that responds. This catches devices no management agent covers: printers, cameras, appliances, unmanaged switches, and the machine somebody plugged in without telling anyone.

Switch tables. MAC address tables and ARP caches show what is physically connected and to which port. This is the most reliable source for network-attached devices, and it locates them.

DHCP leases. Everything that requested an address, including transient devices.

Virtualisation and cloud platforms. Complete and authoritative for virtual machines. Usually the easiest source to reconcile.

Software deployment and patching tools. Their target lists reveal what they believe exists, and the gap against other sources is informative.

Purchase records and warranty portals. Manufacturer portals let you query warranty status by serial number in bulk, which fills in purchase and expiry dates cheaply.

Reconciling them

Take each source, normalise it to a common shape, and match on the strongest identifier available: serial number first, then MAC address, then hostname. Hostname alone is unreliable because machines get renamed.

The interesting output is not the merged list. It is the disagreements:

• In endpoint management, not in the directory. Possibly a machine that has not authenticated recently, possibly a stale record.
• On the network, in no management system. Unmanaged devices. This category always exists and is worth investigating, because it includes both forgotten infrastructure and things that should not be there.
• In the directory, not seen on the network for months. Probably disposed of without being recorded.
• In purchase records, nowhere else. Either never deployed, or deployed and since disposed of.

Each category has a different action, and working through them is most of the rebuild.

What to record

Resist the temptation to design a comprehensive schema. A register with forty fields will have five populated.

Start with what you will actually use:

• Identifier: serial number, ideally with an asset tag.
• Type and model.
• Current status and location.
• Assigned owner, whether a person or a team.
• Purchase date and warranty or support expiry.
• Operating system and version, for anything that has one.
• Business criticality, even as a rough three-level rating.
• Last verified date.

That last field is the one that keeps the register honest. An entry not verified in a year is a claim, not a fact.

Where physical verification is still needed

Automated discovery finds things that are powered and connected. It misses two categories that need people.

Equipment in storage. Spares, decommissioned kit awaiting disposal, devices held for a project. This needs someone to look in the cupboard, and it usually finds more than expected.

Devices that are off or disconnected. Machines belonging to people on long leave, equipment at a site nobody visits, anything mothballed.

For these, a targeted physical check driven by the gaps your reconciliation identified is far more efficient than a full audit. You are confirming a short list, not counting everything.

Keeping it current

A register that is rebuilt and then neglected returns to its previous state within about a year. Three things prevent that.

Automate the refresh. Re-run the reconciliation on a schedule (monthly is reasonable) and report the differences rather than replacing the register wholesale. The differences are the interesting part and reviewing them takes minutes.

Attach updates to the events that change reality. New starter, leaver, hardware replacement, disposal, site move. Each should update the register as part of the process, not as a separate task somebody remembers. Joiners and leavers in particular are already processes with checklists; adding an asset step is straightforward.

Make disposal a controlled step. Disposal is where registers lose accuracy fastest, because equipment leaves quietly. Require a record with the date, method and, for anything holding data, evidence of secure wiping or destruction. You will need that evidence for compliance anyway.

What the exercise usually reveals

Beyond the inventory, a proper reconciliation tends to surface things worth acting on:

• Devices running operating systems past end of support that nobody had counted.
• Equipment still under warranty where nobody had been claiming.
• Support contracts being paid for equipment that was disposed of.
• Software licensed for more seats than exist, or fewer.
• Network devices nobody could account for.

Any one of these can offset the cost of the exercise. All of them are invisible without it, which is the honest argument for doing it.