Tutorial: Creating a compliance report for management in under 5 mins.

Yeah, the auto-delete is a good shout. People forget about that storage creep entirely.

Email body only is the real win though. Forces you to boil it down to 3-4 numbers and a green/red status. If they need the PDF, they can ask, but they never do.

I've also seen teams accidentally leave old reports scheduled after a project ends, just burning through storage for an audience of zero.

Yep, "bodies only" is the move. But the real trap is thinking a green/red status means anything.

I once had a manager fixate on a single red flag in a body-only email for weeks, demanding daily deep dives. Turns out it was a single test machine from a decommissioned project. The report looked clean, but that one "red" became a full-time job.

Forcing yourself into 3-4 numbers is great discipline, but it also turns your report into a blinking dashboard. Make sure those numbers are un-gameable, or you'll just spend your life explaining them.

Stale scan times are the bane of these quick reports. I've found the coverage gap panic is real, but it's often just a handful of developer laptops that sleep for weeks. Flagging them as "offline assets" in a separate section solves the optics problem.

The bigger issue is when the scan time is fresh, but the underlying data isn't because the agent's stuck in a queue. That's when your 5-minute explanation falls apart and you need real logs.

"Burning through storage for an audience of zero" is the perfect summary of half my cost reports.

Forcing the summary into the email body does save storage, but it also creates a different cost - time. Now someone has to manually compile and paste those 3-4 numbers every week. That's not free, even if it only takes five minutes. Over a year, that's hours of someone's salary, which often outweighs the trivial blob storage cost.

The real win isn't the storage saved, it's proving that no one ever asks for the PDF. If they did, you could just run the report on demand. But they don't.

You're right, that filter setup is the fastest way to get something presentable out the door.

I'd add one thing: before you save and schedule it, check the **Computer Groups** filter. If it's set to 'All', you might be including test or staging machines that will spike your incident count and trigger panic. Limiting it to your production groups from the start saves you the 'ignore these machines' email five minutes after the report sends.

Absolutely. If your data aggregation itself takes time, then scheduling the report is just scheduling a timeout.

I've had complex vulnerability queries take over 10 minutes to run. The email would go out blank. You don't find out until someone asks.

I've followed this exact recipe before, and while it works for the initial ask, the hidden cost is the follow-up questions. When that PDF lands with a red status, you'll get a second email demanding root cause, and that's where the 5-minute report falls apart.

The columns you listed lack any context for remediation. Adding a "Last User" column (if your directory sync works) or "Asset Tag" can turn a panic query into a simple ticket assignment. Without it, you're now manually cross-referencing that Computer Name against three other systems.

Good starting point, but that "Last Scan Time" column can be a trap. If your scans are scheduled and a machine was off, it'll show a stale date and cause more panic questions.

You're better off adding a "Days Since Last Scan" calculated column with a red/yellow/green condition. Makes the status obvious without them asking.

That's a solid improvement. I'd take it one step further and make the "Days Since Last Scan" column's logic external to the report itself, if your reporting tool allows it. Define the green/yellow/red thresholds as variables or a config file.

If the compliance threshold changes - say from 7 to 14 days for laptops - you can update it in one place for all scheduled reports instead of editing each report's calculated column manually. It prevents a future "Why did we get an alert on day 8?" scenario after a policy update you forgot to propagate everywhere.

Hah, the "done in under 5" is the real magic trick. Been there.

Just one practical snag - before you schedule it, run it manually and open the PDF. I've been bitten by weird pagination where the 'Status' column, which is the whole point, gets cut off and prints on a separate page. Boss gets a report that's just computer names and policies. Double-checking that layout buys you more peace than the five minutes it costs.

Oh, the phantom column. Been there more than once. It's not just pagination - some reporting engines have a "print to PDF" mode that uses different CSS. What looks fine in the web view gets a hidden overflow in the PDF render.

I now keep a dummy "PDF test" schedule that runs once a day to a test email. Catches those surprises before they land in the director's inbox.

That's a good point about the stale date causing confusion. I've seen that happen.

What do you do for machines that are intentionally offline for long periods, like kiosks? Wouldn't they always show red in a "days since" column, even if they're compliant when they eventually check in?

You've hit on a classic problem. For those long-offline assets, we treat them as a separate asset class in the data model itself. Their compliance logic is different.

We add a tag or flag for 'intermittent' devices. Then the report logic uses a different threshold for them. So a kiosk might be green if scanned within 90 days, while a server turns yellow at 7. It means your data source needs to support that classification, but it stops the noise.

Oh, that's a really smart point about the Policy Applied Date. I would've totally missed that.

What happens if a policy gets renamed, though? Would the applied date still stick to the original policy name, or does it reset? Trying to think if that could cause its own confusion.

That's the basic approach, sure. But "Last Scan Time" is useless on its own. It'll just trigger "why hasn't X scanned since last month?" emails.

Add a calculated column like `NOW() - [Last Scan Time]` and set conditional formatting. Red for >7 days, green otherwise. Stops the questions before they start.

Also, test the PDF output on a dummy schedule first. The column order sometimes gets mangled in the render.