Probably moreso an SQL based query. But what I'm looking to do is have an email alert each time a new machine group is created. Main reason behind that is those pesky groups that just keep coming back either from an old agent installation or a client who may no longer be with you.
For the moment I'm just running an SQL query each weekday and comparing the output against the previous day to base my findings on.
I've been doing the same thing - intermittently logging in as master/master, looking at all machine groups, and if I see "main.____", they're getting deleted.
Best I could come up with was to create a "unnamed" group, with "unnamed.new" and "unnamed.waiting_to_delete".
Set the naming policy put all gateways from inactive clients (if that's an option, it does make things easier) into "unnamed.new", with alerts setup for new agents in that group. I then delete the agents on next checkin, throw them in "waiting_to_delete" for 2-3 weeks minimum. With any luck, it'll stick on the system and remove it permanently (unless it's installed via GPO module, and then it's still a problem).
The "Notify on new agent installation" doesn't seem to take effect on old agent groups which have since been deleted, which is why I need the "unnamed.new" group.
It's sloppy, a definite hack job, but it works for now. Point of reference: my company is still small, only 500-600 agents at the moment.
Alternatively, you can leave those machine groups and set the Agent licenses to zero. Then just remove that machine group from all scopes. The result is nobody sees those groups and no agents can check into them.
I think this should turn into a feature request as it would be useful to be alerted when new groups get created for masters so they can check that the engineer set them up correctly if legitimate or delete them if they are not suppose to be there.