Other day,I was looking at the client health dashboard which I published long ago https://gallery.technet.microsoft.com/SCCM-Configmgr-2012-SSRS-2863c240 . From the dashboard report ,noticed that couple of clients were having software update scan issues .

If client fail to perform success software update scan ,it is out of patching window and client will never send or receive any software updates that you deploy from SCCM. You always need to make sure your clients are performing the successful software update scan as per the schedule you configure in SCCM client agent settings. Software update troubleshooting guide http://eskonr.com/2015/04/sccm-2012-troubleshoot-client-software-update-issues/

So ,the report had couple of clients with software update scan failures with lasterrorcode –2147012894 which leads to me take a look at one client (XXXXXXX) and see what's happening on that.

If you want to see, how your clients are performing software update scan (without dashboard) ,run the below SQL query in management studio.

This query will help you to get list of client that have issues with software update scan (software update scan not success).

--SQL code list clients with software update scan failures

select distinct sys.name0 [Computer Name],os.caption0 [OS],convert(nvarchar(26),ws.lasthwscan,100) as [LastHWScan],convert(nvarchar(26),sys.Last_Logon_Timestamp0,100) [Last Loggedon time Stamp],
sys.user_name0 [Last User Name] ,uss.lasterrorcode,uss.lastscanpackagelocation from v_r_system sys
inner join v_gs_operating_system os on os.resourceid=sys.resourceid
inner join v_GS_WORKSTATION_STATUS ws on ws.resourceid=sys.resourceid
inner join v_updatescanstatus uss on uss.ResourceId=sys.ResourceID
where uss.lasterrorcode!='0'
order by uss.lasterrorcode

Login to the problem client (it can be workstation or server ) ,open WUAHandler.log located in C:\widows\ccm\logs ,notice the below error.

OnSearchComplete - Failed to end search job. Error = 0x80072ee2.

Scan failed with error = 0x80072ee2.

0x80072ee2—>The operation timed out

The above log (Error) do not give much information  ,so this leads me to look at windowsupdate.log located in C:\windows folder

This log has several entries related to proxy request ,send and download file failed etc.

2016-09-01    12:45:14:216     820    ce0    Misc    WARNING: SendRequest failed with hr = 80072ee2. Proxy List used: <10.133.48.48:8080> Bypass List used : <(null)> Auth Schemes used : <>

2016-09-01    12:45:14:216     820    ce0    Misc    FATAL: SOAP/WinHttp - SendRequest: SendRequestUsingProxy failed. error 0x80072ee2

2016-09-01    12:45:14:216     820    ce0    PT      + Last proxy send request failed with hr = 0x80072EE2, HTTP status code = 0

Problematic Client is healthy and able to send inventory and receive other deployments like applications etc but software update scan is failing all the time.

if you look at the above log snippet, it is failing to download the cab files from WSUS server . It looks like ,client has some issues downloading the content ,so how do I check what is causing the problem for content download ?

From Windowsupdate.log snippet, client is trying to access the URL http://SCCMServerName.domain:8530/ClientWebService/WusServerVersion.xml which is failed due to proxy settings.

From other working client, found the below URL succeeded but not on the problem client  ,so I ran the below URL on non-working client and it surely have issues with proxy.

http://SCCMServerName.domain:8530/ClientWebService/WusServerVersion.xml

I ran the same URL on working client and got below results:

How do I fix the proxy issues on the problem client and get the rid of software update scan issues ?

There is a registry key on the client machine which you will have to change to get it working. What is the registry ?

Login to working client that is reporting to the same SCCM site( WSUS) ,open the registry and export for the below registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections

Save it on desktop ,copy it to the problematic client and run it (double click on it ).

Once the registry key is imported ,Open services.msc from RUN command ,restart windows update service.

follow windowsupdate.log and WUAHandler.log

After few min ,I noticed that, scan still failed with error code ,but this time it is different : OnSearchComplete - Failed to end search job. Error = 0x80244010.

0x80244010.—> The number of round trips to the server exceeded the maximum limit.

After a while ,it will try (you don’t have to do any) again to sync and sync will get Successfully completed .

If the sync is not running ,initiate software update scan cycle and monitor WUAHandler.log

Now go back to your site server ,run the SQL query ,you will see problematic client will no longer appear.

Summary:

For software update scan issues with error code:0x80072ee2

login to the working client ,export the registry key ,import into the problem client ,restart windows update service ,wait for a while ,monitor the logs.

References :

http://eskonr.com/2015/04/sccm-2012-troubleshoot-client-software-update-issues/

http://s9org.blogspot.sg/2015/03/software-updates-are-not-getting.html

https://blogs.technet.microsoft.com/sus/2008/09/18/wsus-clients-fail-with-warning-syncserverupdatesinternal-failed-0x80244010/

Since few days ,have been working on case with Microsoft on client issue wherein ,some clients stuck at downloading the policies/jobs and remain in Queued state without any reason and they never get deployments.

When you deploy the software update group to collection ,you will have to put a special attention to configuration setting in download settings : “If software updates are not available on preferred distribution point or remote distribution point,download content from Microsoft updates”

This is a new feature in Configuration manager 2012 SP1 that allows clients to fall back and use Windows Update to download the content. The client will only download content for the updates you have approved and deployed to client.

This is good option to select when the content is not available on Distribution point or client has some issues (possibly network)downloading the content from distribution point and client will direct to Microsoft update,download the content and install it.

But ,what happens when client do not have access to the internet (Microsoft update) and content is not available on the DP ? Here the problem comes.

If you check the option “if updates not available on DP, download from Microsoft Updates”, when the local/remote DP’s content location is not available, clients fallback to download from Microsoft Update, however, if it also fails at downloading from MU with some Internet connection issue, the DTS job (DataTransferService) keeps retrying the download the content and increments the Active job count on each failure until reaching the Active Job limit of 50 and  it never gets decremented.

DataTransferService.log shows

Downloading from http://wsus.ds.download.windowsupdate.com:80/c/msdownload/update/software/secu/2016/07 without proxy encountered error: BITS error: 'The operation timed out

Context: 'The error occurred while the remote file was being processed.

QUEUE: Active job count incremented, value = 50

DTSJob {97A264D2-B234-4ED7-B1D9-257F80920063} in state 'Queued'.

If the client exhausts the Active Job limit, the clients get stuck and never receive any policy unless you reset the active job limit .

Though we have successfully distributed the content to DP’s (can see from the console and reports) and hundreds of clients in the same subnet/region are successfully downloaded /installed but not all clients.

So the only possible fix is: Restart SMS agent host on the problematic clients. This process will reset the active job limit and start downloading the policies and content without any further changes on the site server ,but make sure to deselect the setting if your clients do not have access to internet.

I am not sure with the selected settings above (download content from Microsoft update ),if this issue appear in Configuration manager current branch or is it only appear in Configmgr 2012  .

This issue is filed as bug in Microsoft connect and is active Status . https://connect.microsoft.com/ConfigurationManagervnext/feedback/details/956321/css-configmgr-2012-r2-dts-does-not-decrement-active-bits-job-counter-when-it-fails-to-download-content-from-the-mu-location

There is no updated information yet on this issue from product team but can we see this issue fix in next cumulative update for Configmgr 2012 ?

I wrote a blog post year ago on how to get count of MS Office Editions with versions installed across my environment using SCCM Configmgr. This report consists of 2 reports .1st report is ,to get count of Microsoft Editions for ex: how many are office 2003, 2007 ,2010 and 2013 and 2nd report is actually drilled report linked to 1st report to give list of all MS Office editions (what are the editions of office 2003 ,2007,2010 and 2013) with its client count .

Many of my blog viewers have requested through comments and some of them are via social networking sites ,that they want drill down the 2nd report to see the list of clients with each office edition and version.

Having drilled report to see the list of clients will certainly help to investigate and upgrade them to latest version of Microsoft office.

You can always create collection for office editions but having a report like this would help to export them to excel and other SSRS supported formats.

This request is pending from very long ,it was lying in my to-do list and finally going out through this blog post.

So what all you need to get this report (Count of MS office editions ) implemented in your SCCM site ?

Download the 3 reports from the TechNet Gallery ,upload the reports into your SSRS folder (make sure they all in same folder),change the data source for each report and you are good to run.

Note: This report will list only Microsoft Office 2003,2007,2010 and 2013 but not office 365. If you need office 365, you may have to wait for next update ,otherwise you can edit the RDL file and customize it.

How does the report look like ?

1. Count of MS Office editions

2. List MS Office editions for selected version (ex: 2003)

3. List of Clients by specific MS Office edition and version

Hope it helps.

Recently ,I worked on on a SCCM project and as initial step ,it was mandatory to bring all the desktops and servers (where ever it was missing) into SCCM with Client installed.

Though ,there are different client installation methods available to install SCCM Client , one of the  most widely used client installation method is Client startup script deployed via group policy.

Jason Sandys (MVP) created nice Client Startup Script (group policy) that install configmgr client agent during the system initial boot up.

If you want to achieve good client success rate ,would strongly recommend to look into script and get it implemented .

You can download the script from his blog post http://blog.configmgrftw.com/configmgr-client-startup-script/ .It has pdf document with all the instructions ,how to edit the xml file to make necessary changes.

In this blog post, I will show you, how to implement Jason Sandys client start script in your environment starting from creation of SCCM client folder ,creation of group policy ,deploying the group policy and tracking the results incase of any failures. Hope this blog can help to start with.

1. Login to your SCCM server ,create a folder called SCCMClient in D:drive( any other)

2. Copy the SCCM Client installation source files from your SCCM installed directory to above created folder (SCCMClient).

Copy the client installation files to SCCMClient folder

3.Create folder called hotfix in SCCMClient folder to place the hotfixes if at all any. (If you do not have any hotfixes to install ,you can simply ignore this step) .This step is needed to install the hotfixes along with SCCM client . If you are running on configmgr R2 SP1 CU3, then you need copy CU3 hotfix files into it.

4. Since am running on SCCM 2012 R2 SP1 CU3 (KB3135680) ,go to your hotfix folder (D:\Program Files\Microsoft Configuration Manager\hotfix\KB3135680\Client) ,identify the correct KB (latest cumulative update) ,client folder, copy the folder into hotfix folder.

Copy above 2 folders into hotfix folder

5. Now we need to share this folder so that ,it can be accessed during the client install at system boot up time.

Right click on the folder properties ,Go to sharing tab ,advance sharing

Client on Permissions ,give full control to every one

Click Ok ,Ok ,Ok

Note the share folder path which is need to input into the control file (xml) later.

6. Now ,we will create another folder inside the SCCMClient to store the error logs for the client that fail for some reason so we can investigate at later times.

Create a folder called Errorlogs

7. With this ,we have finished with folder creation and copied all necessary files . Now lets edit the start up script file and move onto group policy creation.

Go to the downloaded script folder ,edit ConfigMgrStartup.xml using notepad and make necessary changes as said in the PDF document .

This xml file is used supply the input parameters need for vbscript during the client installation.

You are required to make couple of changes as listed below (mandatory).

Parameters to edit are:

AgentVersion—Client with less than this version will initiate SCCM client install

ClientLocation—Client installation folder what we created above initiate ccmsetup from specified.

ErrorLocation –to store the error logs (computername.log) incase of any SCCM client failure

AutoHotfix –if you have any hotfix to install ,will added to the ccmsetup.exe command line else ,you can ignore this .

SMSMP---Management Point

For all the location paths, I would recommend to use FQDN instead of hostname.

My xml file looks like this:

<?xml version="1.0"?>
<Startup>
<Option Name="LocalAdmin" >eskonr/localadmin</Option>
<Option Name="SiteCode" >P01</Option>
<Option Name="CacheSize">10120</Option>
<Option Name="AgentVersion">5.00.8239.1403</Option>
<Option Name="MinimumInterval">0</Option>
<Option Name="ClientLocation">\\SGCM01.apac.eskonr.com\SCCMClient</Option>
<Option Name="MaxLogFile">2048</Option>
<Option Name="ErrorLocation">\\SGCM01.apac.eskonr.com\SCCMClient\Errorlogs</Option>
<Option Name="AutoHotfix">\\SGCM01.apac.eskonr.com\SCCMClient\Hotfix</Option>
<Option Name="Delay" >5</Option>
<InstallProperty Name="FSP">SGCM01.apac.eskonr.com</InstallProperty>
<InstallProperty Name="SMSMP">SGCM01.apac.eskonr.com</InstallProperty>
<CCMSetupParameter Name="BITSPriority">HIGH</CCMSetupParameter>
<CCMSetupParameter Name="noservice" />
<ServiceCheck Name="BITS" State="Running" StartMode="Auto" Enforce="True" />
<ServiceCheck Name="winmgmt" State="Running" StartMode="Auto" Enforce="True" />
<ServiceCheck Name="wuauserv" State="Running" StartMode="Auto" Enforce="True" />
<ServiceCheck Name="lanmanserver" State="Running" StartMode="Auto" Enforce="True" />
<ServiceCheck Name="RpcSs" State="Running" StartMode="Auto" Enforce="True" />
<RegistryValueCheck Key="HKLM\SOFTWARE\Microsoft\Ole" Value="EnableDCOM" Expected="Y" Enforce="True" Type="REG_SZ"/>
<RegistryValueCheck Key="HKLM\SOFTWARE\Microsoft\Ole" Value="EnableRemoteConnect" Expected="Y" Enforce="False" Type="REG_SZ"/>
<RegistryValueCheck Key="HKLM\SOFTWARE\Microsoft\Ole" Value="LegacyAuthenticationLevel" Expected="2" Enforce="False" Type="REG_DWORD"/>
<RegistryValueCheck Key="HKLM\SOFTWARE\Microsoft\Ole" Value="LegacyImpersonationLevel" Expected="2" Enforce="False" Type="REG_DWORD"/>
</Startup>

save the xml file .

we are now ready to implement the client start up script using Group policy.

if you are not authorized/permission issues to create group policy ,take the below scripts and handover to Active Directory guy to create start up script for you.

8.Login to the domain controller ,Go to Group Policy Management console ,create new Group policy and called it ‘Install Configmgr Client 2012’

Right on the GPO you created above and click on edit

Drill down to Policies –windows settings –scripts (startup/ Shutdown) ,double click on startup

Click on Show files

Now we need to place the vbscript and xml file in the startup folder

If you have issues with access denied when trying to place the files, you may have to open the actual folder (C:\windows etc) on your domain controller to place the files.

Go back to the startup script properties and click add and browse to select vb script

select ConfigMgrStartup1.75.vbs

In the script parameters ,type in /Config:ConfigMgrStartup.xml

Click ok

Click ok and close the Group Policy Management Editor .

we are now ready to link the GPO to any OU that you want the computers receive Configmgr client during the system boot up.

For troubleshooting ,script will create log file with name Scriptfilename.log (ConfigMgrStartup1.75.vbs.log) in C:\windows\temp folder and for some reason ,the client did not install ,it will copy the log file to errorlog location with computer name as log file.

Hope it helps.

Working on fine tuning collections to get the clients (DEV,UAT,PROD etc)  from Active Directory based on OU for reporting purpose .Reporting can be either application deployment or software update compliance or anything that you want .In my case, all the OU’s in Active Directory are created based on BU( Business Unit) and business unit most likely with country name in OU.

Lets take example of OU structure like below in my Active Directory.

With the above OU structure ,I want to create collection that list all computers from PROD/DR OU for each Business Unit (Hong kong,Singapore,India etc) . Parent OU can be DBS,CT,CX or anything under each Business Unit.

So to get all computers from PROD/DR OU for Hong Kong Business Unit ,we will use wildcard character (%) with like operator in WQL Query .

ESKONR.INTRANET.ASIA/HK/LI/INFRASERVERS/%PROD%

The above Query will list all PROD clients from OU ‘HK/LI/infraservers’

If you want to list all PROD computers from HK OU irrespective of what Child OU they are in, but should be in PROD OU ,use the following condition.

ESKONR.INTRANET.ASIA/HK/%PROD%

If you want to combine PROD and DR Clients into 1 collection ,you can use OR condition by creating 2 criteria's like below.

ESKONR.INTRANET.ASIA/HK/%PROD%

OR

ESKONR.INTRANET.ASIA/HK/%DR%

So ,How to achieve this using collection ?

Create new Device Collection ,Name the collection ,limit the collection to All Systems  ,Add rule and select Query rule ,name the collection again ,select Edit Query statement

Click on Criteria ,select start Burst icon ,click Select

select Attribute class as System Resource and Attribute  as

Click Ok ,select Operator as like and Value is your domain name/HK/LI/%PROD%

Click Ok ,Ok ,Ok and accept the default steps you see the screen.

Below is sample collection criteria used in my lab:

List all servers from PROD and DR OU excluding server 2003 operating system as my lab is running 1 server 2003 OS.

You can still it customize this query as per your needs but all you need is ,how to wild card operator .

Hope it helps!

Long ago ,I did step by step guide series on how to Install MBAM 2.5 SP1 integration with SCCM Configmgr 2012/Current Branch . In that guide,I have used MBAM server which has SQL server  and MBAM components installed on local server and integrate MBAM with Configmgr 2012 server.

Few days ago ,I was trying to install MBAM 2.5 SP1 and integrate with SCCM Configmgr Current Branch 1606 in my lab. In this setup ,my requirement was different .I do not want to install SQL Server on MBAM server (local)  instead ,use existing SQL instance (remote) to install MBAM Databases and reports.

Since I already have SQL Server installed locally on my Configmgr server ,have decided to use this SQL instance for my MBAM setup.

Before I start the setup in my lab ,I followed the steps on my blog post but I encountered some issues during the installation of web components and reports.

In this blog post, I will share the steps (no screen shots),tips and PowerShell scripts that I have used to setup MBAM in my lab.

If you are looking for step by step guide series on how to install  MBAM 2.5 SP1,please go through http://eskonr.com/2015/09/how-to-install-mbam-2-5-sp1-and-integrate-with-sccm-configmgr-2012-r2-sp1/

In my lab ,I already have SCCM CB 1606 installed with SQL (local) and I will use this SQL to install my MBAM databases and reports (remote).

Below is my lab setup:

1 Domain Controller (DC01 ,apac.eskonr.com)

1 SCCM server running on Current Branch (CMCB01) with SQL local

1 MBAM Server (MBM01 , Plane server with domain join)

Here are the steps what I followed in short .

1.Create required MABM Accounts.

2.Register SPN for MBAM Server

3.Login to MBAM Server (MBAM01)  and install the prerequisites like IIS components (No SQL server is needed ,we will be using remote SQL) and ASP.net MVC 4

4.Login to SCCM server(CMCB01) ,perform the changes to MOF,Hardware inventory ,run the MBAM server setup to perform system center configuration manager integration. you must run this setup only in your SCCM Server .

5.Login to MBAM Server (MBAM01) ,Insert/Copy Supported Version of SQL server media and install SSRS Reporting services (native) . SSRS must be installed and running during the MBAM Server installation.

Configure SSRS in "native" mode and not in unconfigured or "SharePoint" mode. You cannot use remote installed SSRS for MBAM Server.

6. On MBAM Server ,open Reporting services configuration manager ,click on connect ,go to web service URL ,create Virtual Directory ,move on to database tab ,create reportserver database (place the database on remote server that you wish to have ,in this case it will be on my SCCM Server) and to create the reportserver DB (I name it MBAMReportServer) on SCCM SQL , make sure you have full permissions on SCCM SQL database. Follow the steps reporting services configuration manager take you through.

7. Make sure the reporting services account that is running on your MBAM Server (MBAM01) must use domain account (cannot be system account and NT account) to connect to remotely configured Reportserver database . so open services.msc ,properties of SQL Service Reporting services ,choose account that permissions to connect to reportserver DB(MBAMReportServer) on SCCM Server.

8.Restart SQL Service reporting services.

9. Now its time to start the installation of MBAM components on MBAM Server (MBAM01).

10. Launch MBAM server setup ,go with default installation and open MBAM server Configuration ,click on add new features ,select databases (Compliance and Audit, Recovery Database) ,Reports .

11. when the databases are created ,launch MBAM Server setup,again and this time select the leftover component Web Applications (Administration and monitoring and self-service portal).

At this step ,I had some issues with Application pool account that failed to connect to MBAM recovery and hardware database which was installed on my Configmgr SQL server. so I had to look at the logs to troubleshoot the issue by providing the enough permissions to MBAM Recovery and hardware database on my SCCM server for MBAM_HD_AppPool account

Error:

Cannot connect to the database using specified connection string 'Data Source=CMCB01.apac.eskonr.com;Initial Catalog="MBAM Recovery and Hardware";Integrated Security=True'

Error: System.Data.SqlClient.SqlException (0x80131904): Login failed for user 'APAC\MBAM_HD_AppPool'.

12. If you see any errors during the installation of any of the MBAM components, check the event viewer which will give you more information about the issue . Where to look at event viewer ?

Open event viewer ,Applications and service logs ,Microsoft ,windows ,MBAM-Setup ,in this ,you have 2 sections 1) Admin 2) Operational .

All these steps can be performed through PowerShell scripts right from creation of MBAM User accounts/Groups to installation of MBAM components.

Tanner Slayton Sr Consultant Cyber Security from Microsoft has posted MBAM scripts on Github ,can be downloaded from https://github.com/tslayton.

13. Configure GPO settings as per the requirement ,for more information on this ,you can read part 5 of my step by step guide series

14. If you want add support for the BitLocker XTS-AES encryption type ,then install September 2016 servicing release hotfix from  https://support.microsoft.com/en-us/kb/3168628

Below are scripts /command lines that I have used while installing the MBAM components in my lab.

Adding IIS Features:

Write-Host 'Adding IIS and the components required for MBAM Installation of the Helpdesk and SelfService Portals'
$Features = 'Web-Server', 'Web-WebServer', 'Web-Common-Http', 'Web-Default-Doc', 'Web-Static-Content', 'Web-Security', 'Web-Filtering', 'Web-Windows-Auth', 'Web-App-Dev', 'Web-Net-Ext45',
'Web-Asp-Net45', 'Web-ISAPI-Ext', 'Web-ISAPI-Filter', 'Web-Mgmt-Tools', 'Web-Mgmt-Console', 'NET-WCF-Services45', 'NET-WCF-HTTP-Activation45', 'NET-WCF-TCP-Activation45',
'WAS', 'WAS-Process-Model', 'WAS-NET-Environment', 'WAS-Config-APIs'
Add-WindowsFeature -Name $Features

Install MBAM componets:

Import-Module 'C:\Program Files\Microsoft BitLocker Administration and Monitoring\WindowsPowerShell\Modules\Microsoft.MBAM\Microsoft.MBAM.psd1'

# Enable compliance and audit database
Enable-MbamDatabase -AccessAccount 'APAC\MBAM_DB_RW' -ComplianceAndAudit -ConnectionString 'Data Source=CMCB01.apac.eskonr.com;Integrated Security=True' -DatabaseName 'MBAM Compliance Status' -ReportAccount 'APAC\MBAM_DB_RO'

# Enable recovery database
Enable-MbamDatabase -AccessAccount 'APAC\MBAM_DB_RO' -ConnectionString 'Data Source=CMCB01.apac.eskonr.com;Integrated Security=True' -DatabaseName 'MBAM Recovery and Hardware' -Recovery

# Enable self service web portal feature
Enable-MbamWebApplication -CompanyName 'Eskonr' -ComplianceAndAuditDBConnectionString 'Data Source=CMCB01.apac.eskonr.com;Initial Catalog="MBAM Compliance Status";Integrated Security=True' -HelpdeskUrlText 'Contact Helpdesk or IT department.' -HostName 'MBM01.apac.eskonr.com' -InstallationPath 'C:\inetpub' -Port 80 -RecoveryDBConnectionString 'Data Source=CMCB01.apac.eskonr.com;Initial Catalog="MBAM Recovery and Hardware";Integrated Security=True' -SelfServicePortal -VirtualDirectory 'SelfService' -WebServiceApplicationPoolCredential (Get-Credential -UserName "APAC\MBAM_HD_AppPool" -Message WebServiceApplicationPoolCredential)

# Enable report feature
Enable-MbamReport -ComplianceAndAuditDBConnectionString 'Data Source=CMCB01.apac.eskonr.com;Initial Catalog="MBAM Compliance Status";Integrated Security=True' -ComplianceAndAuditDBCredential (Get-Credential -UserName "APAC\MBAM_DB_RO" -Message ComplianceAndAuditDBCredential) -ReportsReadOnlyAccessGroup 'APAC\MBAM_HD_Reports'

# Enable agent service feature
Enable-MbamWebApplication -AgentService -ComplianceAndAuditDBConnectionString 'Data Source=CMCB01.apac.eskonr.com;Initial Catalog="MBAM Compliance Status";Integrated Security=True' -DataMigrationAccessGroup 'APAC\MBAM_HD_DataMig' -HostName 'MBM01.apac.eskonr.com' -InstallationPath 'C:\inetpub' -Port 80 -RecoveryDBConnectionString 'Data Source=CMCB01.apac.eskonr.com;Initial Catalog="MBAM Recovery and Hardware";Integrated Security=True' -WebServiceApplicationPoolCredential (Get-Credential -UserName "APAC\MBAM_HD_AppPool" -Message WebServiceApplicationPoolCredential)

# Enable administration web portal feature
Enable-MbamWebApplication -AdministrationPortal -AdvancedHelpdeskAccessGroup 'APAC\MBAM_HD_Adv_Users' -ComplianceAndAuditDBConnectionString 'Data Source=CMCB01.apac.eskonr.com;Initial Catalog="MBAM Compliance Status";Integrated Security=True' -HelpdeskAccessGroup 'APAC\MBAM_HD_Users' -HostName 'MBM01.apac.eskonr.com' -InstallationPath 'C:\inetpub' -Port 80 -RecoveryDBConnectionString 'Data Source=CMCB01.apac.eskonr.com;Initial Catalog="MBAM Recovery and Hardware";Integrated Security=True' -ReportsReadOnlyAccessGroup 'APAC\MBAM_HD_Reports' -ReportUrl 'http://mbm01.apac.eskonr.com/ReportServer' -VirtualDirectory 'HelpDesk' -WebServiceApplicationPoolCredential (Get-Credential -UserName "APAC\MBAM_HD_AppPool" -Message WebServiceApplicationPoolCredential)

# Enable self service web portal feature
Enable-MbamWebApplication -CompanyName 'Eskonr' -ComplianceAndAuditDBConnectionString 'Data Source=CMCB01.apac.eskonr.com;Initial Catalog="MBAM Compliance Status";Integrated Security=True' -HelpdeskUrlText 'Contact Helpdesk or IT department.' -HostName 'MBM01.apac.eskonr.com' -InstallationPath 'C:\inetpub' -Port 80 -RecoveryDBConnectionString 'Data Source=CMCB01.apac.eskonr.com;Initial Catalog="MBAM Recovery and Hardware";Integrated Security=True' -SelfServicePortal -VirtualDirectory 'SelfService' -WebServiceApplicationPoolCredential (Get-Credential -UserName "APAC\MBAM_HD_AppPool" -Message WebServiceApplicationPoolCredential)

Hope it helps!

Working on setting up the new hierarchy for SCCM Configmgr Current Branch 1606. As part of installation process ,it ask for prerequisite downloads folder and for it ,I can either choose Download Required files (it will download from internet )or Use  previously downloaded files (download the files on any machine that has internet access and copy the files to your SCCM server). I choose download required files from internet as my server is has internet access through proxy IP.

After a while ,download of prereq’s failed ,which lead me to look at ConfigMgrSetup.log for the error details.

Log (ConfigMgrSetup.log)  snippet is below:

ERROR: WinHttpReceiveResponse failed 80072ee2

ERROR: Download() failed with 0x80072EE2

ERROR: Failed to download language pack manifest (0x80072EE2)

I open IE on my windows server 2012 R2 Box and try to browse the URL that is displayed in log http://go.microsoft.com/fwlink/?LinkId=746984 to see if it works or not.

Below is what I see when I browse the URL and this is due to default Internet explorer settings .Download of any file is disabled (Default setting) on server 2012 R2.

In order to fix this ,we have to do some custom changes to Internet explorer settings to enable download file.

So I opened Internet Explorer options ,go to Security tab ,select Internet and Custom Level to enable the download File option but I see Custom Option is disabled with message : Some settings are managed by your system administrator (GPO policy)

This is due to the Group policy .My Group policy does not allow to perform any changes to the default IE settings.

What to do next next to download the files and allow my SCCM Server download files going forward ? Should I talk to AD team who control the group policy to allow custom level settings ? Nah .you don’t need to.

There is registry setting that control the above Custom Level Setting .If you make changes to that setting ,your IE setting Custom Level option is enabled and from there ,you can enable Download file.

Open the Registry on your server (you need to be administrator or run CMD as administrator)

Browse through HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings

change Security_HKLM_only value to 0 from 1.

Now open IE Settings ,Security Tab, Internet ,Go to Custom Level

Downloads –>file Download ,select enable.

Click Ok.

Now try to browse the URL ,you are good to download the files.

After a while ,GPO policy will refresh and the registry setting may change back to 1 but Enable download option in the security setting custom Level will not be changed .

Thanks to my Friend (Alpesh) for providing the quick Fix .

Other day ,I have got a request to install/update VMware tools (32bit and 64bit) on servers that are running on VMware platform to latest version (as per the vsphere server version or what requester needs).

VMware Tools is a suite of utilities that enhances the performance of the virtual machines guest operating system and improves management of the virtual machine. Without VMware Tools installed in your guest operating system, guest performance lacks important functionalities.

To deploy VMware tools ,you can either use Legacy method called package or Application deployment method .If you go with package ,you will loose the control of deploying the vmware tools only on computers with model vmware virtual platform (unless you create collections separately) and check if the required tools already installed and many other things.

Application method always preferable for any deployments (unless specific reason) as it provides much control over packages to deploy applications.

In this blog post, we will see ,how to create VMware tools application for 32bit ,64bit with detection logic and requirements to install only on computers with model ‘VMware Virtual Platform‘.

I will divide this guide into 4 steps as listed below.

1. Copy VMware source files.

2.Create Global Condition for Computer model

3. Create Application which consists of 2 deployment types (32bit & 64bit ) with detection logic ,requirement rules.

4.Distribute the Application

5.Deploy the application to collection

6.Check the application status on Client

7.Deployment Results

1. Copy VMware source files.

Get the source files from the requestor and copy it to SCCM content source folder location.

It contain source files for both 32bit (setup.exe)and 64bit (setup64.exe) Operating system.

2.Create Global Condition for Computer model:

Before we create application for VMware tools ,we want to check if the computer model is vmware or not, if OS is not running on vmware platform ,we do not want to install vmware tools.

To check the application mode, we need to create global condition which can be used later in Requirements tab.

Right click on Global Conditions –>select create Global Condition

Fill the information as listed below.

Name: Computer Model

Device Type:Windows

Condition Type: Setting

Setting Type: WQL Query

Data Type: String

Name Space: root\cimv2

Class: Win32_computerSystem

Property: Model

Click on Ok

Now ,on the Global Condition node, you will see newly created Condition with Type -Custom (not default and created by User) ,read only –No (can edit it) and In Use –No (not yet used).

3.Create Application

Go to Application Management –Applications Node

Right click on folder that you would like to create the application and select Create Application

Since the file is exe ,select Manually specify the application information

Enter the application name and other information as needed

Accept the default (unless you don’t have anything to specify)

We will now create 2 deployment types 1 for 32bit and other for 64bit and I call them as x86 ,x64.

Click on Add

Since we are using exe for the deployment and it doesn’t come with msi ,select type as script and select manual this time as well.

Name it as Install x86 .

Specify the content location folder that you have copied the source files.

Installation Program: setup.exe /S /v" /qn REBOOT=R"

It will install silently without reboot .If you to reboot upon the completion of installation ,remove reboot=R ,more information here

We will now add detection method .It will help us to skip if the deploying version or greater already exist ,if not,install the tools.

Click On add Clause

Fill the content as per below screenshot.

Setting Type: File System

Type: File

Patch:C:\Program Files(x86)\VMware\VMware Tools\

File or Folder Name: vmtools.dll

Value: 10.0.9.55972

How to get version ?

On your source folder ,right click on setup.exe file ,you will find the vmware tools version in details tab.

Click Next

As per settings shown below for User Experience tab

Requirements tab:

We will now create 2 requirement rules 1 for OS and other for Model .

Click on Add

Since this is 32bit vmware tools and we want to install only on OS running x86 with vmware model.

select category: Device

Condition: Operating System

One of the Operating system: 32bit of server 2008 and others if you need.

Click Ok

we need to add one more rule for model ,so click on Add again

Select Category :Custom

Condition : Computer Model

Operator: Equals

Value:VMware Virtual Platform

These requirement rules use AND operator .So Server OS must be running on x86 and model: VMware Virtual Platform

Click Next ,accept default settings

Verify Summary Page

Click Next

Close

We have now created deployment type for 32bit VMware tools .We need to do the same for 64bit vmware tools as well.

Click on Add and follow the same procedure as we did above except few things need change and they are listed below:

Installation Program:setup64.exe /S /v" /qn REBOOT=R"

Detection method:

Path :C:\Program Files\VMware\VMware Tools\

Requirement rules: OS will be only 64bit (can be server 2008 ,server 2012 and others)

when you are done, you will see 2 deployment types

Verify summary Page:

Click close to close the application wizard

we now created application with 2 deployment types (32bit and 64bit) .

By default ,when you create application ,settings Allow clients to use a fallback source location for content and deployment options for deployment are not enabled.

If you need above settings to be enabled ,do it for both the deployment types else ignore it.

Now ,we will distribute the application to distribution points . Right click on application and select distribute content

Go through the steps as you do for other applications.

when you are done with application distribution ,its time to deploy application to collection.

5.Deploy the application to collection

Create a collection that wanted to receive the new vmware tools  (Installing the new version of vmware tools will automatically upgrade the existing version (old) to new .Only new version will exist )

If you simply add all systems ,this application will not install on all computers as we have a requirement rule to install it only on computer running on vmware platform with either 32bit or 64 bit.

So create collection as your needs and deploy the application to the collection.

6.Check the application status on Client

Login into client PC ,run machine policy retrieval and evaluation cycle

Open Software Center ,you will now see vmware tools appear on available software tab (This is for CM12 ,if you are on CMCB with new software center,you know where it will be)

Click on Install ,Client will download the source files into ccmcache and start the installation

Monitor the application deployment logs ( AppDiscovery.log,AppEnforce,DcmWmiProvider) more about logs ,please refer https://technet.microsoft.com/en-us/library/hh427342.aspx

After a while ,you will see application installed . If it fails,check the logs and troubleshoot why did it failed

7. Deployment results:

you can run the default report to check the status of application or can also see from deployment monitoring tab or from the console itself as shown below

Hope you found this post useful!

Few days back ,I was helping friend of mine ,who had some issues with SCCM Client and he was unable to launch Software Center .When he try to open Software Center application,it immediately pop-up with error code as shown below .

SCNotification has stopped working .

The procedure entry point HttpsisHostHstsEnabled could not be located in the dynamic link library WININET.dll

I tried launching event viewer ,MMC etc but unable to open any of them and all giving same error code as No storage available to perform this operation.

I tried uninstalling SCCM Client, remove SMS certificates ,delete smscfg.ini ,restart the client and install the client but still get same error.

How do I fix this issue if reinstalling the client did not help ?

If you look at the error message ,it says ,The procedure entry point HttpsisHostHstsEnabled could not be located in the dynamic link library WININET.dll.

This lead me to replace the existing WININET.dll file from working client in both System 32 and Syswow64 folder .

Note: In order to perform the following steps,you need to have local administrative rights on the client .

By default ,this file is owned by trusted installer and if you simply delete /rename this file and copy wininet.dll from working client ,it doesn’t allow you replace the file.

How to delete\replace the file then ? Well ,we will try to take the ownership of this file and then perform the operation on it.

Go to C:\windows\system32 folder on problem client ,right click on wininet.dll, Properties ,go to security ,click on Advanced

click on Owner Tab and select Edit

On the owner tab ,select administrators or user listed in the Change Owner from Trustedinstaller.

Windows security pop-up appear and proceed to perform these changes.

Now ,we have taken the ownership of WININET.dll file .

We will try to rename the file to something else like WININET_old.dll and then we will copy the file from working client to here.

Login or access admin$ share on any other working client ,copy WININET.dll file from C:\windows\system32 folder ,paste it on non-working client folder C:\windows\system32

We need to perform the same procedure as we did above for Syswow64 folder (incase if x64 OS) as well .

Go to C:\windows\syswow64 and take the ownership of file WININET.dll from trustedinstaller to administrators or other user who has local administrative rights.

Rename the file to WININET_old.dll .

Login or access admin$ share on any other working client ,copy WININET.dll file from C:\windows\syswow64 folder ,paste it on non-working client folder C:\windows\syswow64

Now reboot the client and launch System Center application ,it works as usual without any errors.

I have no idea what causes this issue and have not spent much time to find the root cause.

If you have any other better solution which worked, please post it via comments ,I will update the blog post for others.

Hope it helps!

Since few months ,Microsoft publishing some great guides (deep dive) on SCCM Configmgr understanding and troubleshooting process ,tips and tricks that will help Configmgr administrators in solving issues.

It is really hard to find these useful links through search engines when needed for reference and to  send it internally for the team to go through .

I have tracked all the useful links in my OneNote and I have decided to let it go out for public incase for reference.

This blog post will be updating now and then ,when there is new content available.

1. Understanding and Troubleshooting Content Distribution in Microsoft Configuration Manager: This guide helps administrators understand the content distribution process and serves to build a foundation for diagnosing and resolving general content distribution related problems

2.Software Updates in Configuration Manager Current Branch Deep Dive – Client Operations

3.Troubleshooting the Database Replication Service in Microsoft Configuration Manager: This guide helps determine the type of DRS problem you are experiencing, explains how the processes work and offers troubleshooting suggestions for some of the most common problems.

4.Troubleshoot the Install Application task sequence in Microsoft Configuration Manager: This guide helps you understand the Install Application task sequence process and troubleshoot common problems that may occur. The Install Application task sequence step issued to install applications as part of the overall task sequence.

5.Troubleshooting PXE boot issues in Configuration Manager 2012:Helps administrators diagnose and resolve PXE boot failures in System Center 2012 Configuration Manager(ConfigMgr 2012 or ConfigMgr 2012 R2).

6.Software Update Management Troubleshooting in Configuration Manager: This guide helps you troubleshoot the software update management process in Microsoft System Center Configuration Manager, including client software update scanning, synchronization issues and detection problems with specific updates.

7.Configuring Software Update synchronization in System Center Configuration Manager: This guide explains the System Center Configuration Manager software update synchronization process from start to finish. Each step in the process is explained, including the various settings that control how update retrieval and synchronization are performed, common problems seen with each step in the process, as well as general troubleshooting tips.

8.complete guide to Microsoft WSUS and Configuration Manager SUP maintenance

9.Flowchart - Update replication for System Center Configuration Manager :These data flows display the process by which an in-console update you select to install replicates to additional sites. These flows also display the process of extracting the update to run prerequisite checks and to install updates at a central administration site and at primary sites.

10.Software Update Management Troubleshooting in Configuration Manager:This guide helps you troubleshoot the software update management process in Microsoft System Center Configuration Manager, including client software update scanning, synchronization issues and detection problems with specific updates.

See you all in the next post!

Colleague of mine has received request to check why did the SCCM client (server OS) rebooted during office hours and more details about the reboot (who initiated etc.). I started looking at this request to find out whether the client was rebooted due to windows patching or any applications pushed by SCCM.

During my troubleshooting ,I went through several client logs ,event viewer,SQL Query,PowerShell script etc .

In this blog post, I will try to list down the steps that went through to identify who rebooted the SCCM Client (server OS).

1. First and foremost that anyone would look at is ,event viewer to find out who rebooted the server (whether it was SCCM Client or any user).

Go to event viewer –> Windows logs –-> system ,right click and select filter current log ,enter 1074 (Event ID:1074 for reboot) as shown below.

Event ID:1074 –>This event is written when an application causes the system to restart, or when the user initiates a restart or shutdown by clicking Start or pressing CTRL+ALT+DELETE, and then clicking Shut Down. This event is written to the system log only when the Shutdown Event Tracker group policy setting is enabled or not configured.

You will see lot of entries with 1074 event ID ,of which ,we only look at the recent one .

From the above screen, the recent restart was initiated by SMS agent host (ccmexec) on 10/31/2016 05:45:10 PM due to applications or software update installation. This doesn’t tell you the username as the restarted was initiated by system account (NT AUTHORITY\SYSTEM)

The process C:\Windows\CCM\CcmExec.exe (ComputerName) has initiated the restart of computer  ComputerName on behalf of user NT AUTHORITY\SYSTEM for the following reason: No title for this reason could be found
Reason Code: 0x80020001
Shutdown Type: restart
Comment: Your computer will restart at 10/31/2016 05:45:10 PM to complete the installation of applications and software updates.

Now ,we need to find out ,what was installed on the server during the reboot time/before and does client have enough maintenance window to reboot .

2. Lets check what is the available maintenance window for the server ,that might help to analyze any installation that has pending reboot with enough maintenance window allowed reboot or not.

I use the following SQL query to check the available maintenance window for specific client.

DECLARE @file varchar(5000);
SET @file='Server Name'

select MW.[Collection Name],MW.[MW Name],MW.Description,convert(nvarchar(26),MW.StartTime,100)[StartTime],MW.Duration
from
(
select fcm.CollectionId, coll.Name [Collection Name],s.Name [MW Name],s.Description,s.StartTime,s.Duration
from dbo.v_R_System sys
Right JOIN dbo.fn_SplitString(@file,',' ) AS fss ON sys.Name0 = fss.substring
join dbo.v_FullCollectionMembership FCM on sys.ResourceID = fcm.ResourceID
join dbo.v_Collection coll on Coll.CollectionID = fcm.CollectionID
left join v_ServiceWindow S on s.CollectionID=fcm.CollectionID
) MW
where MW.[MW Name] not like ''

I have used @file is basically to pipe large number of clients that I wanted to query for. If you want to list the MW for more than 1 client ,your @file should be @file=’server1,server2,server3,server4’

With above SQL query ,I do not see any maintenance window available for server to reboot that time (server rebooted time ).

3. Now ,we will go back to problem server ,login to see what was Installed by SCCM during the reboot time or before the reboot.

we will try to look at AppEnforce.log (for applications),execmgr.log (for packages) and windows update logs (WUAHandler.log,UpdatesHandler.log) and other logs that you suspect.

AppEnforce.log :

From appenforce.log, there was an application that installed silently without any reboot (Matched exit code 3010 to a PendingSoftReboot entry in exit codes table.)

So the application doesn’t have any force reboot option and for sure,something else is caused the reboot .

4. Now ,take a look at the RebootCoordinator.log and MaintenanceCoordinator.log if that helps to reveal some information about reboot behavior.

RebootCoordinator.log

From above log,I see couple of entries related to server reboot which help my job to identify the root cause.

User S-1-5-21-1009845188-1641970364-1010270793-4361695 is getting pending reboot information

ServiceWindowsManager has not allowed us to Reboot

MTC allowed us to reboot

Notified UI grace period start with 900 grace seconds and 300 final seconds.

System reboot request succeeded.

As you see from the log, user SID is getting pending reboot information which means, someone logged into the server during the reboot of the server.

How to find who is that user ? Well ,you can find it using event viewer security logs or PowerShell script that converts SID to User name.

I have used below PowerShell script that convert SID Value to User Name

$objSID = New-Object System.Security.Principal.SecurityIdentifier ("S-1-5-21-1009845188-1641970364-1010270793-4361695")
$objUser = $objSID.Translate( [System.Security.Principal.NTAccount])
$objUser.Value

copy the script ,change the SID Value and run the PowerShell script on the problem server to find the user name.

Now I got the user name ,who logged into the server during the reboot, but I cannot take this information as granted and confirm that this user initiated the reboot.

Well, RebootCoordinator.log doesn’t confirm if logged user restarted the server .So what next ?

In SCCM Configmgr 2012 and above, there are logs for users as well.These logs records the activity for notifying users about software for the specified user.

These user notify logs named with SCNotify_<domain>@<username>_1.log

open the log for the user (_SCNotify_<domain>@<Username>_2.log) who  logged into the server during the server reboot if he/she initiated .

From this log,found lot of useful information of which ,found below entry that confirm user allowed to restart system.

RestartCountdownDialog: IsRestartSystemAllowed - user is allowed to restart system      (Microsoft.SoftwareCenter.Client.Pages.RestartCountdownDialog at .ctor)

Notification is for a logoff/restart required or logoff/restart countdown.      (Microsoft.SoftwareCenter.Client.Notification.NotifyObjectBase at ShowBalloonTip)

Number of total seconds in countdown is 900; starting value is 2; seconds til restart is 898, system will restart at 5:45:09 PM (utc end time = 9:45:10 AM)      (Microsoft.SoftwareCenter.Client.Pages.RestartCountdownDialog at .ctor)

This confirm that, user who logged into the server has initiated the reboot and nothing from SCCM client.

If you have any other possible methods to identify who initiated the reboot, post it via comments section.

Until next!

Have seen couple of times on SCCM Configmgr forums asking for ‘How to get applications /deployment types that has allow clients to use fallback source location for content ’ is checked or not.

Allow fallback source location for content: This feature is designed to allow client to gain access (fallback) to content that is not available on a Distribution Point (DP) that is located in their Boundary Group.

If this feature is not implemented correctly, it can lead to unexpected results and high network utilization over remote WAN links.

For more information about fallback source location and distribution point, please read TechNet article https://technet.microsoft.com/en-us/library/gg712321.aspx?f=255&MSPPError=-2147217396#BKMK_PreferredDistributionPoint .

When this question was asked ,I thought ,I would look at it when I get time and later it went to my To-Do item list due to time constraints and never looked at it in the recent days.

Recently ,I had similar requirement to identify the list of applications with its deployment type properties to find out how  many of them are not checked this option ‘allow clients to use fallback source location for content ‘ and download options (slow or unreliable network boundary)

If you want to know the list of applications that has this option checked or not ,there is no default report and no easy way to check in console as well.

Either you have to create custom report or PowerShell (PoSH) script.

when you create an application using application wizard ,there are couple of options that doesn’t show you in GUI (unless you use scripting to create apps) and these are like allow clients to use a fallback and deployment options etc.

If you have few number of applications in SCCM ,it is easy to do manual check by right click on deployment type and look for this option ,but what if you have large number of applications with multiple deployment types and you want them to be displayed in report ?

Before we try to create report for this ,we need to identify ,what table/view this information is stored in and after we identify the right view,we can write SQL query.

Application and its deployment type property information in SCCM 2012 and above, is not stored directly in database view instead, it is stored in xml file in function fn_ListDeploymentTypeCIs(1033) with column name SDMPackageDigest.

Once we know where the application deployment property information is stored, we need to know how to extract the required information from this xml file.

This xml file contains lot of information out of which ,we now only look at couple of important fields like application name,deployment name,type,UserInteractionMode,ExecutionContext ,RequiresLogOn,FallbackToUnprotectedDP,OnSlowNetwork. If you want retrieve other information from the xml ,do customize the report yourself.

To know more information about the xml file and how to extract the information from xml file using SQL query ,read here .

The information that is stored in xml file for allow clients to use fallback source location for content is in column FallbackToUnprotectedDP with values true or NULL

If you have selected option called Deployment options as shown in the diagram ,either with do not download content or download content from distribution point and run locally ,is in  column ‘OnSlowNetwork’ with values Download or DoNothing or NULL

I have created SSRS Report for you .So all you need is ,download the report from Technet, upload to your SSRS reports, change the data source and run the report.

Note:If you have large number of applications and you are looking for deployment type names that has not checked ‘allow clients to use fallback source location for content ’ option ONLY ,then may have to edit the report and do custom changes to list only those applications with filtering instead listing all in your SCCM.

How does the report look like ?

Hope you enjoyed reading this article.

See you in the next post!

Setting up new SCCM Configmgr Current Branch 1606 in production environment .As part of it ,have created source folder (repository for content store) and placed couple of packages/applications for testing . while trying to distribute the packages, all failed with same error code.

The source directory \\servername\sources$\Applications\Microsoft\SCUPCert doesn't exist or the SMS service cannot access it, Win32 last error = 5

Win32 last error = 5 translates to access denied .I made sure ,SCCM site Server account, user account /group had full access to the source folder location but missed to add System account.

To see if the system account have enough read permission to the above share ,simply use sysinternal tools and access the share if that works or not.

PSEXEC -i -s -d CMD

In my case ,it says access denied but am able to access using user account.

To fix this ,you need to provide permissions to SYSTEM account as well both in sharing and security tabs (NTFS Sharing).

Hope it helps!

The Microsoft Deployment Toolkit (MDT) is a free tool for automating Windows and Windows Server operating system deployment, leveraging the Windows Assessment and Deployment Kit (ADK) for Windows 10. Microsoft released new build version 8443 for Microsoft Deployment Toolkit with some quality updates. This build update requires Windows Assessment and Deployment Kit (ADK) for Windows 10, version 1607, which you can download from Microsoft Hardware Dev Center(adksetup.exe file version 10.1.14393.0).

You can download MDT build version 8443 from Microsoft Download Center.

Summary of the significant changes in this build of MDT:

• Supported configuration updates
• Support for the Windows ADK for Windows 10, version 1607.
• Support for Windows 10, version 1607, and Windows Server 2016.
• Support for Configuration Manager, version 1606.

Quality updates :

• Deployment Wizard scaling on high DPI devices
• Johan’s “uber bug” for computer replace scenario
• Multiple fixes for the Windows 10 in-place upgrade scenario
• Several fixes to Configure ADDS step
• Removed imagex/ocsetup dependencies, rely solely on DISM
• Includes the latest Configuration Manager task sequence binaries (version 1606)

Reference:  https://blogs.technet.microsoft.com/msdeployment/2016/11/14/microsoft-deployment-toolkit-8443-now-available/

Recently I had a requirement to create a PowerShell script to read text file/CSV for list of clients (servers mainly) and check if they appear in SCCM if so delete them ,track the information into log file for reference.

There could be various reasons why do you want to delete computer record from SCCM and for that, you can either delete the record directly from the console or use scripting to do it for you.

One of of the reason for me to create this script is ,to help the team to delete the server records from SCCM after they decom immediately using task scheduler. Why immediate ? can't I wait for default maintenance tasks to remove the computer object after it becomes inactive or aged ? well ,it does . Once the computer record is disabled in AD or not online for X days ,It becomes inactive . Once the client is inactive and fall into the range X days to match site maintenance tasks  then it will be removed from SCCM database . When I leave these decom clients for deletion using site maintenance tasks ,these decom servers do appear in compliance reports and client health reports in SCCM and because of this ,the client health dashboard doesn’t appear in good status.

So ,this script will help guys to pipe the computer records into text file (as input ) and run the script or can schedule the script to run weekly once or so. The script will read the text file ,check if the computer record exist in database or  not ,if not ,out-put to log ,if exist ,delete the entry ,out-put results to log and this loop continue until the last line read in text file.

Removing a device client manually deletes the client record from the Configuration Manager database. Typically, you should not use this action unless it is for troubleshooting scenarios. If you delete the client record and the Configuration Manager client is still installed and communicating with Configuration Manager, Heartbeat Discovery recreates the client record the Configuration Manager database, although the client history and any previous associations are lost.

To delete computer record from SCCM if exist ,I used inbuilt SCCM powershell cmdlet called Remove-CMDevice -name $comp –force .

You can download Powershell script to delete computer records from SCCM via TechNet .

You can use this script as schedule task to run on weekly basis .All you need is ,pipe the computer records into the notepad and let the script run for you automatically.

Problem:

Few weeks ago ,colleague of mine was trying to perform patch management on bulk number of clients (servers) as monthly patching ,as part of it he made sure the maintenance window was in place,deployment was set rightly for software updates deployment.

Maintenance window started ,patches started installing and after a while ,he logged in ( browse the reports ) to check the status for deployed patches (software update groups) using reports. He found that, 30-40% was compliant and rest of them non-compliant (majority) /unknown (very few) .

By the time ,he found something wrong ,he has only 1 hr left to finish the patching activity due to the maintenance window and after the maintenance window passed ,cannot reboot the servers and you need confirm the patching status with the application teams so that they can perform the application testing.

What do do now and how to get these non-compliant servers get fix in 1hr before the maintenance window elapse ? Since there was not enough time to troubleshoot the clients and look for other methods to fix ,had preferred manual method .

I got to know about this on the next day morning while I was chatting with him . I tried to sneak into the logs to help what could be the problem  but the logs are overwritten and nothing found for previous day issue.

The only status I got to know from him was that ,all updates available in software center showing  ‘Past due – will be installed’.

Solution:

If you ever get into such issues ,I would suggest to start picking one problem client for troubleshooting ,go through the logs to check if the client is waiting for enough maintenance window or updates are waiting to complete something before they could start etc.

There could be various reasons why the software updates failed  or not even started on client and to troubleshoot ,you must check the logs.  I written couple of articles on software updates troubleshooting and reference guides .

http://eskonr.com/2015/04/sccm-2012-troubleshoot-client-software-update-issues/

http://eskonr.com/2016/10/sccm-configmgr-troubleshooting-guides-for-reference/

coming to the problem ,how do I force to install the updates that are available in software center if I don’t have enough time to troubleshoot the issue or how do I install the updates that are made available on the client ?

Well ,we can use PowerShell script to select all the updates available in software center and install followed by settings configured in software update deployment like reboot or suppress reboot etc.

This script also useful to check if any updates are failed (from reporting you can get list of clients with status) for some reason and you want to install them without login to the client .

Part of the script taken from book Microsoft System Center Software Update Management Field Experience.pdf ,modified it to log the output,read notepad file for clients.

$MissingUpdates = Get-WMIObject -Namespace root\CCM\ClientSDK -Class CCM_SoftwareUpdate -Filter ComplianceState=0
$MissingUpdatesReformatted = @(MissingUpdates | Foreach-Object {if($_.ComplianceState -eq 0){[WMI]$_.__PATH}})
$InstallReturn = Invoke-WMIMethod -Namespace root\CCM\ClientSDK –Class CCM_SoftwareUpdatesManager -Name InstallUpdates –ArgumentList (,$MissingUpdatesReformatted)

Download the complete PowerShell script from TechNet Gallery Here.

To run the script on remote computers ,make sure you have enough permissions to connect wmi on remote computer and RPC (dynamic ) ports opened.

This script will check if the account you trying to run has enough permissions on remote computer ,if yes go into loop else move onto next client to perform the check and it repeat.

Script pipe the information into log file with client name, Targeted patches (approved patches) ,pending patches (include failed,waiting for MW etc) ,reboot pending and finally Compliant if it has nothing in software center to install.

If a client already installed all patches and waiting for reboot ,I considered it as compliant in the script as it will be rebooted either manually or auto reboot based on the settings you configured in deployment.

Post your feedback via comments section.

Introduction:

One of my blog reader asked question about ‘There is report in your blog to find out packages that has no advertisements created,but is there similar report to find applications with no deployments created’.

I found this question is valid and is needed if you want to perform maintenance tasks like cleanup packages,applications,collections etc .Performing regular maintenance is important to ensure correct site operations.

There are several default site maintenance tasks available that maintain the health of your site database but when it comes to clean up unused collections,packages,applications etc,you have to find way to do it.

There are instances where someone create application without any deployment or deployment was created and deleted it later leaving the application in the console for longer time ,many other instances .

If you are Maintaining a maintenance log to document dates that maintenance was conducted, by whom, and any maintenance-related comments about the task conducted, I would add the following tasks to the maintenance document as they also required to cleanup every 6 months or yearly once.

1.Clean up unused collections

2.clean up unused packages

3.clean up unused applications etc.

This blog post covers task 3 to identify applications without any deployments and not used in any other task sequence.

How to create SQL query or SSRS report to identify applications with no deployments?

To create such report ,first you need to identify the SQL views that store the information about applications and its dependencies. For that, you can refer Configmgr SQL view documentation available here

There are 3 main sql views/functions that store the information about applications ,its deployment info,dependent application info and task sequence app references  etc and they are listed below:

dbo.fn_ListApplicationCIs(1033)

vSMS_AppRelation_Flat

v_TaskSequenceAppReferencesInfo

I will be using above views to create nice SSRS report.This report mainly output applications that has zero deployments and these applications are not referenced in any task sequence.

This report contains fields like application name,Created by,Datelastmodified,Application age since created (days),Isenabled,is deployed,number of DT(deployment types),no of dependencies,number of devices with app,number of devices with failure.

After you run the report, take a look at column dependentdeployments as this filed refers this application is used as dependent application in another application (supersedence ).

ex: Application A appear in this report with dependentdeployments >1 which means ,application A is used as supersedence application in other applications listed in the dependentdeployments .

How does the report look:

Download the RDL file from Technet Gallery Here ,upload to your SSRS reports ,change the datasource and run it.

Introduction:

Few months ago ,we had an issue with one of the deployment (it was software updates) that was deployed to collection with override service window due to emergency patch to be installed on the clients.

Deployment went fine and results were positive .All good ,but after few days ,some clients were added to the above deployed collection and you know what, as soon the clients are added to the collection ,they had new policy now and try to perform scan against the deployed software updates to check if they are already installed or not ,if not installed ,they try to install right away due to the setting ‘Override Service Window’ .What happens after the installation ? If the patch you have deployed to the collection require reboot ,it will check if there is any MW available to reboot ,if there is no maintenance window, it will reboot else wait for the maintenance window.

Unfortunately ,some of the newly added clients had maintenance window on different collection on the next few days ,which no one noticed and client REBOOTED .

For sure if there is any such unplanned reboot occur, you must be in position to explain with root cause and how are you going to prevent such issues in the future with RCA (Root cause analysis).

So a request came to identify/create report that will help us to identify how many such deployments (it can be application,package or software update ) do exist with OverrideServiceWindows and RebootOutsideOfServiceWindows options selected.

Have got some time to allocate for this request ,so am posting it here for you guys incase you need to identify such deployments (applications,packages,software updates,baselines) .

Below screen show the Deployment settings under User experience Tab with User notifications,deadline behavior and device restart behavior settings.

How to get list of deployments with OverrideServiceWindows and RebootOutsideOfServiceWindows selected ?

To get information about OverrideServiceWindows and RebootOutsideOfServiceWindows for deployments, you need to first identify the right SQL views in SCCM.

All Deployments information (packages,applications,baselines ,software updates) stored in view called: v_CIAssignment

So have used this view to retrieve the information and put it in a nice SSRS report with options to choose OverrideServiceWindows and RebootOutsideOfServiceWindows  Yes or No.

How to identify if the deployment is package or application or software update ?

Use the below numbers to identify the deployment or package type.

When 0 Then 'Package'
When 2 Then 'Application'
When 3 Then 'Driver'
When 4 Then 'Task Sequence'
When 5 Then 'Software Update'
When 7 Then 'Virtual'
When 257 Then 'Image'
When 258 Then 'Boot Image'
When 259 Then 'OS Package'

Below is the report how it looks like: you can choose the options what you want and based on the selection ,report will give you the deployment information.

As usual ,have posted the report into TechNet Gallery ,download it from Here ,upload it your SSRS reports ,change the data source and run it.

Introduction:

I started blogging in year 2009 on www.eskonr.wordpress.com which was free from wordpress, but later I decided to move it to my own domain called www.eskonr.com in year 2010. Since then every year the number of views on my blog is getting increased twice and thrice compared to its previous year with increase in number of interesting posts on SCCM/Configmgr and its connected objects.

As we entered into new year 2017,I was noticing the statistics of my blog for previous years and overall views until today. I stumbled across seeing the total count of views on my blog that has reached (~) 2 Million views since it was created .

I should thank all my blog readers who followed and supported me writing useful blog posts . Hope this year is going to be another exciting year with more focused on Hybrid environment (SCCM+Intune),MBAM and SQL Stuff.

Crunchy numbers:

Year 2016 has its best ever views with 656,175 (650K) which means the views increased 1.5 times compared to last year (2015).

The busiest day of the year was August 24th with 3549 views with total published post count 41.

Attractions in 2016:

These are the posts that got most views in 2016.

How did they find you?

The top referring sites in 2016 are:

Where did they come from (Top 5 countries )?

Most visitors came from The United States. India & U.K. were not far behind.

Once again thank you all and hope you enjoyed reading post on my blog. Have a great year ahead.

Introduction:

Maintenance windows in Configmgr help to ensure that client configuration changes occur during periods that do not affect the productivity of the organization.

Following Operations can be performed during the Maintenance window:

• Software update deployments
• Compliance settings deployment and evaluation
• Operating system deployments
• Task sequence deployments

More about MW https://technet.microsoft.com/en-us/library/hh508762.aspx?f=255&MSPPError=-2147217396

Problem:

So ,If you want to know the client maintenance window for next few days (20 days or recently occurred in the last 20 days ) ,you have no built in report and for that, you must go with custom report to find out the clients that are undergoing the changes that are deployed by your SCCM team.

I had a requirement to create report to get client maintenance window with prompt to choose past (occurred) and future days (going to happen) or simply enter the client name to list available maintenance Windows.

Solution:

This blog post will help you to identify the clients have maintenance window setup for the next few days or recently occurred with some custom dates.

What you get with this report : list clients with their collection name, Maintenance Window Name, Description (effective date),Days ahead (If –(minus) ,it was past date ,else future date )

After you run this report, it will prompt you to choose Past (-10) and Future (10) .Past and Future is considered from Current date.

For Ex: Today is 24-Jan-2017 ,I have client PC001 in collection ABC with MW set 21-Jan-2017 and PC002 in collection CDE with MW set 28-Jan-2017 .So I choose Past as 3 days and future 10 days ,I should get all clients from ABC and CDE collections as their MW fall under past (2) and future date (10) .

If I choose past as 1 day and future 3 days ,I won’t get anything in the report as there is no client that has MW between 1 <--->3 from current date.

The logic used in the SQL is: Maintenance Window date should be <future date and >past date from the current Date as shown in below snippet.

How does the report look like ?

As usual, download the RDL file from TechNet Gallery here ,upload to your SSRS folder ,change the data source and run the report.