I've inherited an environment spanning more than 50 LANs and sites with almost no trustworthy documentation. I need to build an asset inventory from the ground up, covering PCs, laptops, servers, switches, firewalls, routers, wireless access points, printers, CCTV/NVR systems, and other network-connected devices.
I'm more interested in the initial discovery process than in choosing an asset-management database. Would you combine tools such as Lansweeper, Nmap or SNMP scans, endpoint agents, DHCP and DNS data, Active Directory, Entra, Intune, and the existing RMM platform, then import the results into something like Snipe-IT?
Because the sites are on separate LANs, I also need a practical way to discover devices locally without relying on one central scan across the WAN. How would you approach this from a blank sheet, especially when the existing documentation and managed-service-provider data cannot be trusted?
4 Answers
Start with the infrastructure that already has visibility: document every subnet and VLAN from the firewalls and switches, then export DHCP scopes and lease history, DNS records, ARP and MAC tables, and CDP/LLDP neighbors. This gives you a rough network map and device count before you begin active scanning.
Run a scanner locally at each site or LAN rather than trying to scan everything across the WAN. A small workstation or lightweight device can run scheduled Nmap scans and send the results to a central location. WAN routing, filtering, and throttling can otherwise make the results look incomplete. Add AD, Entra, and Intune exports for managed endpoints, then create an “unknown devices” queue for anything found on the network but missing from those systems. That is where printers, cameras, NVRs, workgroup machines, and unmanaged equipment will usually appear.
Keep the discovery process repeatable from the beginning. A one-time inventory will be out of date quickly, so schedule rescans and compare changes over time before loading cleaned-up records into the asset database.
Lansweeper or a similar discovery platform can speed things up, and Intune is useful for managed Windows endpoints, but no single tool will give you a complete inventory. Also check whether the current RMM can export useful device data, even if its existing records are unreliable. Tools for automated discovery and dependency mapping can help later, but first establish the network boundaries and gather evidence from DHCP, DNS, firewalls, switches, wireless systems, and local scans.
Don't underestimate physical site visits. Automated discovery will find most routed devices, but it won't reliably reveal unmanaged switches hidden in ceilings, hubs, transparent firewalls, isolated wireless clients, or equipment that has no useful management services enabled. Once you identify the difficult sites, use switch MAC tables and switch-port mappings to trace unknown devices back to a closet or port, then verify the wiring and labels in person.
If budget is limited, begin with DHCP, DNS, firewall interfaces, and the existing switch configuration. Build a list of every subnet, VLAN, NAT boundary, and active lease, then scan each reachable network locally. Check wireless controller data separately and distinguish corporate, guest, and isolated networks. Anything visible in ARP or firewall logs but absent from AD or endpoint management should stay on a separate unknown-assets list until someone verifies it.
That makes sense. I'll treat scans as a starting point and reserve on-site work for the unexplained devices and the locations where the network data doesn't line up.