I've inherited an environment spanning more than 50 LANs and sites with very little trustworthy documentation. I need to build an inventory of PCs, laptops, servers, switches, firewalls, routers, wireless access points, printers, CCTV/NVR systems, and other network-connected devices, but I'm starting with almost no reliable baseline.
I'm mainly looking for a practical initial-discovery process rather than advice on which asset-management database to buy. Would you combine tools such as Lansweeper, Nmap or SNMP scans, endpoint agents, DHCP and DNS data, ARP tables, Active Directory, Entra ID, and Intune, then import the results into something like Snipe-IT?
Because the sites are on separate LANs, I'm also interested in how you would handle discovery when a central scan cannot reach every VLAN or location. What would your process look like if you were starting from a blank sheet with an undocumented environment and an unreliable managed-service provider?
4 Answers
Don't underestimate physical site surveys. Automated discovery will miss unmanaged switches, hubs, devices behind transparent equipment, and anything with client isolation or poorly configured management services. Once you have a list of suspicious MAC addresses, use the switch MAC table and switch-port mappings to locate them, then verify the cabling and equipment in person.
I’d prioritize a few of the least documented or most business-critical sites for hands-on visits. Take photos, record rack and closet details, trace unknown connections, and update the logical inventory with what you actually find. The device hanging above a ceiling tile may never identify itself cleanly through SNMP or a normal scan.
If you have the budget, a discovery platform such as Lansweeper can speed up the first pass, and an existing RMM may already have useful endpoint data. I would still treat those results as one source rather than the authoritative inventory. Validate them against DHCP, DNS, network tables, local scans, and site surveys.
Build the process so it can run repeatedly: store the scan date and source for every record, flag devices that have disappeared or changed, and maintain an explicit unknown-assets list. Once the data is cleaned up, then feed the verified records into your asset-management system. A one-time export will be out of date very quickly.
The RMM data is worth checking even if the current provider has done a poor job. It may still contain useful endpoint names or agents, but I would compare it against independent network evidence before trusting it.
Start with the infrastructure that already has a view of the network. Collect DHCP scopes and lease history, DNS records, firewall interfaces and logs, ARP tables, switch MAC-address tables, and CDP/LLDP neighbors. That should reveal the subnets, active devices, and a rough device count for each site before you begin active scanning.
Then run scans locally at each site or VLAN rather than relying entirely on scans across the WAN. A small workstation, appliance, or other temporary scanner at each location can run scheduled Nmap or similar scans and send the results back to a central system. Cross-site scans are often blocked, filtered, or throttled and can make the environment look quieter than it really is.
Layer endpoint sources such as Active Directory, Entra ID, and Intune over the network results. Anything appearing in DHCP or ARP but not in endpoint management becomes an unknown-device queue, which is where printers, cameras, NVRs, unmanaged equipment, and workgroup devices usually show up.
For a low-cost starting point, map every subnet and VLAN from the firewalls, routers, and switches, then work through DHCP leases, DNS, ARP, and MAC tables. Scan each network locally and record open services, hostnames, vendor information, and MAC addresses. Keep separate classifications for confirmed, likely, and unknown devices so guesses do not become permanent facts.
Pay special attention to devices that appear in network data but not in directory or endpoint-management exports. Those are often printers, cameras, wireless equipment, storage appliances, or unauthorized workgroup systems. After the first inventory, schedule recurring discovery and make someone responsible for reviewing changes.
Exactly. A scan can tell you that something is responding, but it usually cannot tell you that there are several unmanaged switches hidden around an office or that a mystery device is physically connected in an unexpected place.