How to Reconcile a CMDB Against Your Other Asset Sources

Why does a CMDB drift from reality?

A CMDB is only as current as the data that reaches it. ServiceNow describes its CMDB as a "single, trusted system of record for all configuration item (CI) data", fed by ServiceNow Discovery and by certified Service Graph Connectors that curate data from multiple sources. That design works when every source is connected and every change goes through a process. In practice, assets change outside the process: a cloud workload is started from a pipeline, a laptop is reimaged, a server is retired in the hypervisor but never in the CMDB. Each tool records its own slice at its own pace, and the CMDB holds whatever arrived last.

Reconciliation is the recurring check that closes that gap. It does not replace the CMDB. It keeps the CMDB accurate, so the incident, change and request work that runs on it starts from correct records.

Step 1: Which fields should you reconcile first?

Start narrow. Reconciling every attribute of every configuration item is a project that rarely ends. Pick the fields that downstream processes depend on:

• Presence: does the asset exist in the CMDB at all?
• Status: is a record marked retired while the device still reports in to other tools?
• Owner or assignment group: who receives the ticket when something is wrong?
• Hostname, serial number and operating system: the identifiers other tools use to recognize the asset.
• Environment or business unit: which change process and which risk rating apply.

Write the list down with the reason each field matters. It becomes the scope of the precedence rules in step 3.

Step 2: How do you match CMDB records to other sources?

Records from different tools rarely share one key. Match on identifiers that stay stable when an asset moves: serial number, MAC address and hostname for hardware, the instance ID for cloud workloads, and the directory object ID for identities. Lansweeper, for example, documents merging duplicate records on MAC address, serial number and hostname rather than IP address, because IP addresses are reassigned.

Then choose the sources to compare. A typical first set is the EDR console, the endpoint management tool, the identity provider, each cloud account and a network discovery tool. Each one sees assets the others miss. Network discovery finds devices with no agent; the cloud console finds workloads that never touched the corporate network.

Step 3: Which source wins when two tools disagree?

Set a precedence rule per field, not per tool. The EDR console may be the best source for whether an agent is running, the endpoint management tool for the primary user, the cloud provider for instance state, and the HR or identity system for the owner. Record these rules where the team can see and change them. When a disagreement cannot be settled by a rule, route it to a person rather than letting the last write win.

Step 4: What does a reconciliation review look like?

Group the differences into three buckets:

• Missing from the CMDB: the asset reports in to other tools but has no configuration item.
• Stale in the CMDB: the record exists, but its status or key fields no longer match what the sources report.
• Missing from the sources: the CMDB lists an asset that no tool has seen recently, which may mean it was retired or that it has no agent at all.

Work the first bucket first. An asset nobody has recorded has no owner, and often no controls.

Step 5: How do corrections get back into the CMDB?

Through the CMDB's own processes, so its audit trail and relationships stay intact. Most tools in our ranking can hand data to ServiceNow. runZero documents a ServiceNow integration that enriches the CMDB. Lansweeper sends inventory into ServiceNow, Jira Service Management, Freshservice and other ITSM tools. Axonius documents enforcement actions to create, update and disable or remove assets in ServiceNow. On 22 July 2026 it also described a CMDB Reconciliation Workspace that compares the CMDB against correlated adapter data, flags assets missing from the CMDB and mismatched field values, and can create missing records through its Action Center.

Whichever tool is used, the CMDB of record stays the place the workflow runs. The reconciliation layer finds differences and proposes changes; the system of record records them and routes the work.

How often should you reconcile?

As often as the fastest-changing source. Cloud workloads and SaaS accounts change daily, so a quarterly audit misses most of that change. A workable pattern is continuous comparison for presence and status, and a monthly review of owner and business unit fields, which change less often and usually need a person to confirm.

What should you measure?

Three numbers show progress, and all three come from your own data: the count of assets missing from the CMDB, the count with a status mismatch, and the count with no owner. Track them weekly and report the trend. Avoid comparing total asset counts between tools. A higher count can mean more duplicates rather than more coverage.