Sudheesh Blog on System Center.......

Overall Compliance Reports for updates shows Unknown Status in System Center Configuration Manager

Sudheesh N — Wed, 07 Mar 2018 09:36:31 GMT

Overall Compliance Reports for updates shows Unknown Status in System Center Configuration Manager Getting Unknown Status in Overall Compliance reports, is one of the most common issue many of us face while running the software update reports for compliance. The general troubleshooting what we do is to try send the state message again or troubleshoot the state message flow. This is the simple state message resync script (VBS) we use RefreshServerComplianceState() Sub RefreshServerComplianceState() dim newCCMUpdatesStore set newCCMUpdatesStore = CreateObject ("Microsoft.CCM.UpdatesStore") newCCMUpdatesStore.RefreshServerComplianceState wscript.echo "Ran RefreshServerComplianceState." End Sub Even after this we still would have issues with few machines where we see that the state is unknown. So a good understanding of the state message which are a part of the report is required . For Software updates reports we have the following state messages.

300	SUM_ASSIGNMENT_COMPLIANCE
301	SUM_ASSIGNMENT_ENFORCEMENT
302	SUM_ASSIGNMENT_EVALUATION
400	SUM_CI_DETECTION
401	SUM_CI_COMPLIANCE
402	SUM_CI_ENFORCEMENT
500	SUM_UPDATE_DETECTION
501	SUM_UPDATE_SOURCE_SCAN

Since we are talking about the Overall compliance report here the state message in question is 500-SUM_UPDATE_DETECTION.Further, State Message IDs are used to define specific state messages for each topic type. For example, a State Message for a Software Updates (Topic Type 500) would have the Status Message ID of 0, 1, 2 or 3 which would then depict the actual state of the given update on a client machine as below:

Topic Type	State Message ID	State Message Description
500	0	Detection state unknown
500	1	Update is not required
500	2	Update is required
500	3	Update is installed

A complete list of the Topic Type’s and State Message ID’s is listed in the below article: https://technet.microsoft.com/en-us/library/bb932203.aspx When a client Scan against the wsus server the State Messages being raised. Every time a State Message is raised, we look in the WMI to see if a State Message for this Topic ID and Topic Type already exists. If it does, we overwrite the State Message in WMI with the new State. If it does not exist, we create a new instance and save the current State. We store the state message in the WMI Namespace: root\CCM\StateMsg and WMI Class: CCM_StateMsg If you look for a state message it will be something like this for type 500 it would look something like this. Once this state messages reach the server it updates the following table in database dbo.Update_ComplianceStatus. Please note that though you have many updates in your ConfigMgr server database, you wont see the same number of 500 messages. Client will for sure send 500 for all the updates that is required and installed. And also for some not required one, which I have seen is for some common updates , office updates etc. But not required information for all not required updates when compared with your synced catalogue are not send from the client as a state message. The calculation of the same is done on the server. To find the same I had looked at the RDL file for the compliance report and could see that it is picking up from the v_Update_ComplianceStatusAll. If you see this view it has information for all the four state for all the updates for each resource ID But if you look at the base table dbo.Update_ComplianceStatus you will not find entries for 0 and 1 for status which you would see it in the v_Update_ComplianceStatusAll view Now to understand from where it is building this information we had checked the view v_Update_ComplianceStatusAll SELECT ci.CI_ID, cm.ResourceID, ISNULL(cs.Status, CASE WHEN ss.ScanPackageVersion >= ci.MinSourceVersion THEN 1 ELSE 0 END) AS Status, ISNULL(cs.LastStatusCheckTime, ss.ScanTime)AS LastStatusCheckTime, cs.LastStatusChangeTime, cs.EnforcementSource, cs.LastEnforcementMessageID, cs.LastEnforcementMessageTime, cs.LastEnforcementStatusMsgID, cs.LastErrorCode,ISNULL(cs.LastLocalChangeTime, ss.LastLocalChangeTime) AS LastLocalChangeTime FROM dbo.v_UpdateCIs AS ci CROSS JOIN dbo.v_ClientMachines AS cm LEFT OUTER JOIN dbo.Update_ComplianceStatus AS cs ON cs.CI_ID = ci.CI_ID AND cs.MachineID = cm.ResourceID AND (cs.Status > 0 OR ci.CIType_ID = 9) LEFT OUTER JOIN dbo.Update_ScanStatus AS ss ON ss.MachineID = cm.ResourceID AND ss.UpdateSource_ID = ci.UpdateSource_ID So The status is set based on this logic ISNULL(cs.Status, CASE WHEN ss.ScanPackageVersion >= ci.MinSourceVersion THEN 1 ELSE 0 END) . Now it is clear that

First we will look the dbo.Update_ComplianceStatus and compare with dbo.v_UpdateCIs and whatever has Status in first table it was updated in the view's Status value (1,2 or 3).
Then we will look at dbo.Update_ScanStatus and check ScanPackageVersion and MinSourceVersion from dbo.v_UpdateCIs and then if ScanPackageVersion >= MinSourceVersion THEN 1 ELSE 0 for Status value.

So here, one more state message is important which is send from the client which is 501 for SUM_UPDATE_SOURCE_SCAN. If the client has send the failed message and if the ScanPackageVersion is not updated to the latest in the dbo.Update_ScanStatus then those updates which has ScanPackageVersion < MinSourceVersion will be set to "0" which means unknown status. We can get in to such issues when there is a Scan Failures or if after the successful synchronization the client is yet to send the Scan status. So the Logic is the 501 state message has to be with the latest MinSourceVersion and a with success message. In few cases I could see that the software scan was successful but the driver scan had failed with a warning like below. Though everything related to update deployment was working fine WARNING: Sync of Drivers failed (Software succeeded): 0x8024402b The 501 state message send by client had the error and the ScanPackageVersion was not updated and hence the clients were showing unknown status for Not required updates. The same can also happen if the WSUS to which the client is scanning is in a lower version of MinSourceVersion than the top server. Hope this information will be useful Sudheesh Narayanaswamy This posting /Script is provided "AS IS" with no warranties and confers no rights

Patches That Fix the Vulnerability For MS17-010

Sudheesh N — Wed, 17 May 2017 05:44:03 GMT

WannaCry ransomware attack currently spreading across the globe and every one is busy working to patch the machines for MS17-010. There has been a doubt on which updates covers this Vulnerability. After looking through the https://technet.microsoft.com/en-us/library/security/ms17-010.aspx and also Catalogue of Microsoft, here is the list of updates with the operating System and date released. Note:

There are few updates which has got released on 5/13/2017 For windows 2003 and XP.
Beginning with the October 2016 release, Microsoft has changed the update servicing model for Windows 7, Windows Server 2008 R2, Windows 8.1, Windows Server 2012, and Windows Server 2012 R2. You would have Security Only Quality Update and Security Monthly Quality Rollup so if one of the same is installed on the machine it would cover the Vulnerability. For eg we have KB4012212 and KB4012215 For windows Server 2008 R2 so if one of these is installed on the machine it would cover the Vulnerability.

Title	Products	Classification	Last Updated
Security Update for Windows 8 (KB4012598)	Windows 8	Security Updates	5/13/2017
Security Update for Windows XP SP3 (KB4012598)	Windows XP	Security Updates	5/13/2017
Security Update for Windows Server 2003 for x64-based Systems (KB4012598)	Windows Server 2003& Datacenter Edition	Security Updates	5/13/2017
Security Update for Windows 8 for x64-based Systems (KB4012598)	Windows 8	Security Updates	5/13/2017
Security Update for Windows XP SP3 for XPe (KB4012598)	Windows XP Embedded	Security Updates	5/13/2017
Security Update for Windows Server 2003 (KB4012598)	Windows Server 2003& Datacenter Edition	Security Updates	5/13/2017
Security Update for Windows XP SP2 for x64-based Systems (KB4012598)	Windows XP x64 Edition	Security Updates	5/13/2017
March, 2017 Security Only Quality Update for Windows 7 for x64-based Systems (KB4012212)	Windows 7	Security Updates	3/28/2017
March, 2017 Security Only Quality Update for Windows 7 (KB4012212)	Windows 7	Security Updates	3/28/2017
March, 2017 Security Only Quality Update for Windows Embedded Standard 7 (KB4012212)	Windows Embedded Standard 7	Security Updates	3/28/2017
March, 2017 Security Only Quality Update for Windows Embedded Standard 7 for x64-based Systems (KB4012212)	Windows Embedded Standard 7	Security Updates	3/28/2017
March, 2017 Security Only Quality Update for Windows Server 2008 R2 for x64-based Systems (KB4012212)	Windows Server 2008 R2	Security Updates	3/28/2017
March, 2017 Security Only Quality Update for Windows Server 2008 R2 for Itanium-based Systems (KB4012212)	Windows Server 2008 R2	Security Updates	3/28/2017
March, 2017 Security Only Quality Update for Windows 8.1 (KB4012213)	Windows 8.1	Security Updates	3/28/2017
March, 2017 Security Only Quality Update for Windows 8.1 for x64-based Systems (KB4012213)	Windows 8.1	Security Updates	3/28/2017
March, 2017 Security Only Quality Update for Windows Server 2012 R2 (KB4012213)	Windows Server 2012 R2	Security Updates	3/28/2017
March, 2017 Security Only Quality Update for Windows Embedded 8 Standard (KB4012214)	Windows 8 Embedded	Security Updates	3/28/2017
March, 2017 Security Only Quality Update for Windows Embedded 8 Standard for x64-based Systems (KB4012214)	Windows 8 Embedded	Security Updates	3/28/2017
March, 2017 Security Only Quality Update for Windows Server 2012 (KB4012214)	Windows Server 2012	Security Updates	3/28/2017
March, 2017 Security Monthly Quality Rollup for Windows Server 2012 (KB4012217)	Windows Server 2012	Security Updates	3/13/2017
March, 2017 Security Monthly Quality Rollup for Windows Embedded 8 Standard for x64-based Systems (KB4012217)	Windows 8 Embedded	Security Updates	3/13/2017
March, 2017 Security Monthly Quality Rollup for Windows Embedded 8 Standard (KB4012217)	Windows 8 Embedded	Security Updates	3/13/2017
Security Update for Windows Vista (KB4012598)	Windows Vista	Security Updates	3/12/2017
Security Update for Windows Server 2008 (KB4012598)	Windows Server 2008	Security Updates	3/12/2017
Security Update for Windows Vista for x64-based Systems (KB4012598)	Windows Vista	Security Updates	3/12/2017
Security Update for Windows Server 2008 for Itanium-based Systems (KB4012598)	Windows Server 2008	Security Updates	3/12/2017
Security Update for Windows Server 2008 for x64-based Systems (KB4012598)	Windows Server 2008	Security Updates	3/12/2017
Security Update for WES09 and POSReady 2009 (KB4012598)	Windows XP Embedded	Security Updates	3/12/2017
March, 2017 Security Monthly Quality Rollup for Windows 7 (KB4012215)	Windows 7	Security Updates	3/12/2017
March, 2017 Security Monthly Quality Rollup for Windows Server 2008 R2 for x64-based Systems (KB4012215)	Windows Server 2008 R2	Security Updates	3/12/2017
March, 2017 Security Monthly Quality Rollup for Windows Embedded Standard 7 (KB4012215)	Windows Embedded Standard 7	Security Updates	3/12/2017
March, 2017 Security Monthly Quality Rollup for Windows Server 2008 R2 for Itanium-based Systems (KB4012215)	Windows Server 2008 R2	Security Updates	3/12/2017
March, 2017 Security Monthly Quality Rollup for Windows 7 for x64-based Systems (KB4012215)	Windows 7	Security Updates	3/12/2017
March, 2017 Security Monthly Quality Rollup for Windows Embedded Standard 7 for x64-based Systems (KB4012215)	Windows Embedded Standard 7	Security Updates	3/12/2017
March, 2017 Security Monthly Quality Rollup for Windows 8.1 for x64-based Systems (KB4012216)	Windows 8.1	Security Updates	3/12/2017
March, 2017 Security Monthly Quality Rollup for Windows Server 2012 R2 (KB4012216)	Windows Server 2012 R2	Security Updates	3/12/2017
March, 2017 Security Monthly Quality Rollup for Windows 8.1 (KB4012216)	Windows 8.1	Security Updates	3/12/2017
Cumulative Update for Windows 10 (KB4012606)	Windows 10,Windows 10 LTSB	Security Updates	3/10/2017
Cumulative Update for Windows 10 for x64-based Systems (KB4012606)	Windows 10,Windows 10 LTSB	Security Updates	3/10/2017
Cumulative Update for Windows 10 Version 1511 for x64-based Systems (KB4013198)	Windows 10	Security Updates	3/10/2017
Cumulative Update for Windows 10 Version 1511 (KB4013198)	Windows 10	Security Updates	3/10/2017
2017-03 Delta Update for Windows 10 Version 1607 for x64-based Systems (KB4013429)	Windows 10	Security Updates	3/10/2017
2017-03 Delta Update for Windows Server 2016 for x64-based Systems (KB4013429)	Windows Server 2016	Security Updates	3/10/2017
2017-03 Delta Update for Windows 10 Version 1607 for x86-based Systems (KB4013429)	Windows 10	Security Updates	3/10/2017
Cumulative Update for Windows 10 Version 1607 for x64-based Systems (KB4013429)	Windows 10	Security Updates	3/10/2017
Cumulative Update for Windows 10 Version 1607 (KB4013429)	Windows 10	Security Updates	3/10/2017
Cumulative Update for Windows Server 2016 for x64-based Systems (KB4013429)	Windows Server 2016	Security Updates	3/10/2017

Hope this information will be helpful Sudheesh Narayanaswamy

Status of Update per Update ID from WSUS server

Sudheesh N — Tue, 16 May 2017 15:23:42 GMT

With the Current issue with Ransome Wancrypt we had a requirement where we had WSUS only to get report. WSUS reports are there but the reports were not friendly. So we had to write two scripts using powershell , one to Get the Summary of Update Installation Status for a Specific or a Set of Updates and second one to get the list of computers where a updated is needed for a specific Update or for a set of updates. Thought of Sharing the same as it could be useful for few who are using WSUS as their Patching Mechanism.

Updates Status Primary for a Specific or a Group of Updates. (These Update ID are for KB4012212,KB4012213,4012214,KB4012598)

########################################################################## #Script to get the Report from WSUS for Updates Status Primary for a Specific or a Group of Updates #Version 1.0 File Name Report_Summary.ps1 # Output Folder file path is $outputfile a #Created by: Sudheesh Narayanaswamy #Created for Any WSUS server #Created on: 5/16/2017 #Run this script in the WSUS server ################################################################################ $outputfile = "C:\Temp\" $outputfile = $outputfile + "Report_Summary_" + $env:COMPUTERNAME + ".csv" #Change server name and port number and $True if it is on SSL [String]$updateServer1 = $env:COMPUTERNAME [Boolean]$useSecureConnection = $False [Int32]$portNumber =80 $updateid=( 'fb31138f-b6a5-499c-9eb6-5b5f9fff6bfd', '86ac3cc3-e972-41a8-ac78-45bc5a950faa', '5680ca8f-be92-4d13-8e4e-587aa462e838', '57dbd57f-89b2-4abb-8582-14fc17870bb8', '80bc2b42-a953-4096-8595-130e9a9c9fb9', '652eea96-c2e8-4548-8f9a-40964e5e6a74' ) # Load .NET assembly [void][reflection.assembly]::LoadWithPartialName("Microsoft.UpdateServices.Administration") # Connect to WSUS Server $updateServer = [Microsoft.UpdateServices.Administration.AdminProxy]::getUpdateServer($updateServer1,$useSecureConnection,$portNumber) write-host "<<>>" -foregroundcolor "yellow" $computerscope = New-Object Microsoft.UpdateServices.Administration.ComputerTargetScope $updatescope = New-Object Microsoft.UpdateServices.Administration.UpdateScope $updatescope.ApprovedStates = [Microsoft.UpdateServices.Administration.ApprovedStates]::LatestRevisionApproved $updatescope.IncludedInstallationStates = [Microsoft.UpdateServices.Administration.UpdateInstallationStates]::NotInstalled $updatescope.FromArrivalDate = [datetime]"1/1/2017" $u=$updateServer.GetUpdates($updatescope ) $u=$updateServer.GetSummariesPerUpdate($updatescope,$computerscope)

foreach ($u1 in $u ) { if ($updateid -contains $u1.UpdateId) {

$needed= $u1.DownloadedCount + $u1.NotInstalledCount +$u1.InstalledPendingRebootCount $Title= $updateServer.GetUpdate($u1.UpdateId).Title $o= New-Object PSObject $o | Add-Member NoteProperty Title $Title $o | Add-Member NoteProperty Installed $u1.InstalledCount $o | Add-Member NoteProperty Required $needed $o | Add-Member NoteProperty Failed $u1.FailedCount $o | Add-Member NoteProperty Notapplicable $u1.NotApplicableCount $o | export-csv $outputfile -Append -NoTypeInformation

}

write-host "<<>>" -foregroundcolor "yellow"

trap { write-host "Error Occurred" write-host "Exception Message: " write-host $_.Exception.Message write-host $_.Exception.StackTrace exit } # EOF

2. Computers which require a specific update or a set of updates ########################################################################## #Script to get the Report from WSUS for Computers which require a specific update or a set of updates #Version 1.0 File Name Report_detailed.ps1 # Output Folder file path is $outputfile a #Created by: Sudheesh Narayanaswamy #Created for Any WSUS server #Created on: 5/16/2017 #Run this script in the WSUS server ################################################################################ $outputfile = "C:\Temp\" $outputfile = $outputfile + "Report_Detail_" + $env:COMPUTERNAME + ".csv" #Change server name and port number and $True if it is on SSL [String]$updateServer1 = $env:COMPUTERNAME [Boolean]$useSecureConnection = $False [Int32]$portNumber =80 $updateid=( 'fb31138f-b6a5-499c-9eb6-5b5f9fff6bfd', '86ac3cc3-e972-41a8-ac78-45bc5a950faa', '5680ca8f-be92-4d13-8e4e-587aa462e838', '57dbd57f-89b2-4abb-8582-14fc17870bb8', '80bc2b42-a953-4096-8595-130e9a9c9fb9', '652eea96-c2e8-4548-8f9a-40964e5e6a74' ) # Load .NET assembly [void][reflection.assembly]::LoadWithPartialName("Microsoft.UpdateServices.Administration") # Connect to WSUS Server $updateServer = [Microsoft.UpdateServices.Administration.AdminProxy]::getUpdateServer($updateServer1,$useSecureConnection,$portNumber) write-host "<<>>" -foregroundcolor "yellow" $computerscope = New-Object Microsoft.UpdateServices.Administration.ComputerTargetScope $updatescope = New-Object Microsoft.UpdateServices.Administration.UpdateScope $updatescope.ApprovedStates = [Microsoft.UpdateServices.Administration.ApprovedStates]::LatestRevisionApproved $updatescope.IncludedInstallationStates = [Microsoft.UpdateServices.Administration.UpdateInstallationStates]::NotInstalled $updatescope.FromArrivalDate = [datetime]"1/1/2017" $Update=$updateServer.GetUpdates($updatescope ) foreach ($u1 in $Update) { if ($updateid -contains $u1.Id.UpdateId) { $Computers= $u1.GetUpdateInstallationInfoPerComputerTarget($ComputerScope) $Title= $updateServer.GetUpdate($u1.Id.UpdateId).Title foreach ($C1 in $Computers) { if ($C1.UpdateInstallationState -ne "Installed" -and $C1.UpdateInstallationState -ne "NotApplicable" ) { $ComputerName= $updateServer.GetComputerTarget($C1.ComputerTargetId).FullDomainName $o= New-Object PSObject $o | Add-Member NoteProperty Title $Title $o | Add-Member NoteProperty ComputerName $ComputerName $o | Add-Member NoteProperty Status $C1.UpdateInstallationState $o | export-csv $outputfile -Append -NoTypeInformation } } } } write-host "<<>>" -foregroundcolor "yellow" trap { write-host "Error Occurred" write-host "Exception Message: " write-host $_.Exception.Message write-host $_.Exception.StackTrace exit } # EOF Hope This would be helpful Sudheesh Narayanaswamy

Logoff a Specific User from a Group of Remote Computers (PowerShell Script)

Sudheesh N — Tue, 02 Aug 2016 05:05:15 GMT

At times we get request on that we need to log off a particular user from multiple machines where he has remotely logged in forcefully. This scripts helps in doing the same. For a particular task I had written this and though would be helpful for others hence sharing. It uses one input files $path1 = "c:\temp\servers.csv" You can put the name of the servers or IP Address with line delimiter Like below and save it as servers.csv SERVER1 SERVER 2 1.1.1.1 10.10.0.1 ... Script ==================================== $username = 'Sudheesh' $path1 = "c:\temp\servers.csv" $Servers= Import-csv -path $path1 -Header servername foreach($Server1 in $Servers) { $Server= $Server1.servername $Server $session = ((quser /server:$server | ? { $_ -match $username }) -split ' +')[2] logoff $session /server:$server } Hope this Helps Sudheesh Narayanaswamy This posting /Script is provided "AS IS" with no warranties and confers no rights

Report for Local admins using SCCM

Sudheesh N — Fri, 04 Mar 2016 09:54:00 GMT

If you follow the below link and user the configuration item and get the inventory , the data will be in the database .

https://blogs.technet.com/b/sudheesn/archive/2014/12/12/collect-hardware-inventory-of-local-admins.aspx

I have few request coming in asking for reports for the same. I have created two reports and sharing the rdl with you all so that it can be useful.

1. Computers with a Specific account (user or Group ) in local Administrator

2. Local Administrators for a specific Computers

Steps

1. Download the RDL file and save it is the server we have reporting Service point.

2. Go to https:// ?ReportServerName? /reports and got to Configmgr

3. Select Upload files …In the window click on browse and select the RDL file. Click ok . You can select the folder you would like to upload

4. Once uploaded Select the repot and then select Manage

5. Select Data sources and click on browse

6.Select the ConfigMgr folder expand and go to the bottom and select the data source and select ok.

Once done you should be able to see the report and run the report

Hope this helps

Sudheesh N

Microsoft Infrastructure Consultant

RDL_files.zip

Application Deployment Policy Creation Flow

Sudheesh N — Sun, 23 Aug 2015 09:49:18 GMT

The application model of Configuration Manager 2012 uses Configuration Items. So the deployment and policy creation is a little different from the package creation. I am trying here to explain the flow of events which happens till the policy created on the server for a specific deployment.

When you create the deployment for an application the SMS provide inserts the data to the basic table and depending on the trigger, it will update the table change notification tables as any other process does.

The application details are as below which is was used

Application ID : ScopeId_2A471255-BD73-43F1-B1C0-613FC1A40798/Application_c637da7c-a62d-494e-a71e-b863b1a7196b/1
Application CI_ID :224
Deployment ID : {D82B1B46-9636-4560-AE1A-22110840A7AC}
Assignment ID : 1677218
Collection SITEID: 00100015 ,
Collection ID : 14

Now the SMSDBMON comes to action

You would see the following changes and corresponding files getting dropped by SMSDBMON

RCV: INSERT on CI_CIAssignments for CIAssignmentNotify_iu [16777218 ][157236] SMS_DATABASE_NOTIFICATION_MONITOR 8/23/2015 6:56:58 PM 2536 (0x09E8)
RCV: INSERT on RBAC_ChangeNotification for Rbac_Sync_ChangeNotification [431 ][157237] SMS_DATABASE_NOTIFICATION_MONITOR 8/23/2015 6:56:58 PM 2536 (0x09E8)
RCV: INSERT on CrpChange_Notify for CrpChange_Notify_ins [14 ][157238] SMS_DATABASE_NOTIFICATION_MONITOR 8/23/2015 6:56:58 PM 2536 (0x09E8)
RCV: UPDATE on CI_CIAssignments for CIAssignmentNotify_iu [16777218 ][157239] SMS_DATABASE_NOTIFICATION_MONITOR 8/23/2015 6:56:58 PM 2536 (0x09E8)
RCV: UPDATE on CI_CIAssignments for CIAssignmentNotify_iu [16777218 ][157240] SMS_DATABASE_NOTIFICATION_MONITOR 8/23/2015 6:56:58 PM 2536 (0x09E8)
RCV: UPDATE on CI_AssignmentTargetedCIs for CI_AssignmentTargetedCIs_ADDED [16777218 ][157241] SMS_DATABASE_NOTIFICATION_MONITOR 8/23/2015 6:56:58 PM 2536 (0x09E8)
RCV: UPDATE on CI_AssignmentTargetedCIs for CI_AssignmentTargetedCIs_CIAMGR [16777218 ][157242] SMS_DATABASE_NOTIFICATION_MONITOR 8/23/2015 6:56:58 PM 2536 (0x09E8)
RCV: INSERT on RBAC_ChangeNotification for Rbac_Sync_ChangeNotification [432 ][157243] SMS_DATABASE_NOTIFICATION_MONITOR 8/23/2015 6:56:58 PM 2536 (0x09E8)

CIA File is dropped in objgmgr.box
Modified trigger definition for Object Replication Manager[CIAssignmentNotify_iu]: table CI_CIAssignments(AssignmentID) on insert,update, file CIA in dir C:\Program Files\Microsoft Configuration Manager\inboxes\objmgr.box\ SMS_DATABASE_NOTIFICATION_MONITOR 8/23/2015 6:56:58 PM 2536 (0x09E8)
SND: Dropped C:\Program Files\Microsoft Configuration Manager\inboxes\objmgr.box\16777218.CIA [157236] SMS_DATABASE_NOTIFICATION_MONITOR 8/23/2015 6:56:58 PM 2536 (0x09E8)
RBC file is dropped for the RBAC on hman.box
Modified trigger definition for Hierarchy Manager[Rbac_Sync_ChangeNotification]: table RBAC_ChangeNotification(ID) on insert, file RBC in dir C:\Program Files\Microsoft Configuration Manager\inboxes\hman.box\ SMS_DATABASE_NOTIFICATION_MONITOR 8/23/2015 6:56:58 PM 2536 (0x09E8)
SND: Dropped C:\Program Files\Microsoft Configuration Manager\inboxes\hman.box\431.RBC [157237] SMS_DATABASE_NOTIFICATION_MONITOR 8/23/2015 6:56:58 PM 2536 (0x09E8)
CRP file for the policypv.box with .CRP
Modified trigger definition for Policy Targeting Evaluator[CrpChange_Notify_ins]: table CrpChange_Notify(CollectionID) on insert, file CRP in dir C:\Program Files\Microsoft Configuration Manager\inboxes\policypv.box\policytargeteval\ SMS_DATABASE_NOTIFICATION_MONITOR 8/23/2015 6:56:58 PM 2536 (0x09E8)
SND: Dropped C:\Program Files\Microsoft Configuration Manager\inboxes\policypv.box\policytargeteval\14.CRP [157238] SMS_DATABASE_NOTIFICATION_MONITOR 8/23/2015 6:56:58 PM 2536 (0x09E8)

There are few other files which get dropped bases on the CI Model, currently not taking in to consideration on this.

Now the Objreplmgr component then picks the CIA file and process the same

***** Processing Application Assignment {D82B1B46-9636-4560-AE1A-22110840A7AC} ***** SMS_OBJECT_REPLICATION_MANAGER 8/23/2015 6:56:58 PM 2932 (0x0B74)
Deleting notification file C:\Program Files\Microsoft Configuration Manager\inboxes\objmgr.box\16777218.CIA SMS_OBJECT_REPLICATION_MANAGER 8/23/2015 6:56:58 PM 2932 (0x0B74)
Found file trigger for C:\Program Files\Microsoft Configuration Manager\inboxes\objmgr.box\16777218.ADD SMS_OBJECT_REPLICATION_MANAGER 8/23/2015 6:56:58 PM 2932 (0x0B74)
Info: Sussessfully get New CI Added notification file C:\Program Files\Microsoft Configuration Manager\inboxes\objmgr.box\16777218.ADD for CI Assignment Id 16777218, new CI added to this assignment SMS_OBJECT_REPLICATION_MANAGER 8/23/2015 6:56:58 PM 2932 (0x0B74)
CI Assignment {D82B1B46-9636-4560-AE1A-22110840A7AC} has 1 Targeted CI(s) SMS_OBJECT_REPLICATION_MANAGER 8/23/2015 6:56:58 PM 2932 (0x0B74)
PolicyID {D82B1B46-9636-4560-AE1A-22110840A7AC} PolicyVersion 1.00 PolicyHash SHA256:387A3415CDE9CE97E3213077D3DD3305FAF79085F5B156A4186F89740436CBF0 SMS_OBJECT_REPLICATION_MANAGER 8/23/2015 6:56:58 PM 2932 (0x0B74)
Notifying policy provider about changes in policy content/targeting SMS_OBJECT_REPLICATION_MANAGER 8/23/2015 6:56:59 PM 2932 (0x0B74)
Successfully created policy for CI Assignment {D82B1B46-9636-4560-AE1A-22110840A7AC} SMS_OBJECT_REPLICATION_MANAGER 8/23/2015 6:56:59 PM 2932 (0x0B74)
Catalog evaluation: Getting model id for CI Assignment ID = 16777218 SMS_OBJECT_REPLICATION_MANAGER 8/23/2015 6:56:59 PM 2932 (0x0B74)
Catalog table insert/update evaluation for Model Id 224 SMS_OBJECT_REPLICATION_MANAGER 8/23/2015 6:56:59 PM 2932 (0x0B74)
Notifying policy provider about changes in policy content/targeting SMS_OBJECT_REPLICATION_MANAGER 8/23/2015 6:57:00 PM 2932 (0x0B74)
Successfully updated Policy Targeting for CI Assignment {D82B1B46-9636-4560-AE1A-22110840A7AC} SMS_OBJECT_REPLICATION_MANAGER 8/23/2015 6:57:00 PM 2932 (0x0B74)

Once this is completed you would find the CI_assignments table update

At the same time the CRP file which is dropped in the

Found 14.CRP SMS_POLICY_PROVIDER 8/23/2015 6:56:58 PM 2796 (0x0AEC)
Adding to delete list: C:\Program Files\Microsoft Configuration Manager\inboxes\policypv.box\policytargeteval\14.CRP SMS_POLICY_PROVIDER 8/23/2015 6:56:58 PM 2796 (0x0AEC)
--WaitForInboxChangeNotification SMS_POLICY_PROVIDER 8/23/2015 6:57:00 PM 2796 (0x0AEC)

Now the objereplmgr find the related CI items and do the needful. The relation is like this for CI_ID related to this application with CI_ID 224

Assigned CIs: [ 39 226 ] SMS_OBJECT_REPLICATION_MANAGER 8/23/2015 6:57:00 PM 2932 (0x0B74)
Begin processing Assigned CI: [39] SMS_OBJECT_REPLICATION_MANAGER 8/23/2015 6:57:00 PM 2932 (0x0B74)
39 Referenced VS CIs: [ ] SMS_OBJECT_REPLICATION_MANAGER 8/23/2015 6:57:00 PM 2932 (0x0B74)
VersionInfo policy for CI 39 is Machine type SMS_OBJECT_REPLICATION_MANAGER 8/23/2015 6:57:00 PM 2932 (0x0B74)
VersionInfo policy for CI 39 is Machine type SMS_OBJECT_REPLICATION_MANAGER 8/23/2015 6:57:01 PM 2932 (0x0B74)
PolicyID Windows/All_Windows_Client_Server/VI/VS PolicyVersion 1.00 PolicyHash SHA256:2D646F6A67F56E7A13A7EBF26C6488EA4BB7D9C2AA83447DFC3B3647B9015243 SMS_OBJECT_REPLICATION_MANAGER 8/23/2015 6:57:01 PM 2932 (0x0B74)
VersionInfo policy for CI 39 is up-to-date SMS_OBJECT_REPLICATION_MANAGER 8/23/2015 6:57:01 PM 2932 (0x0B74)
VersionInfo policy Windows/All_Windows_Client_Server/VI/VS is up-to-date SMS_OBJECT_REPLICATION_MANAGER 8/23/2015 6:57:01 PM 2932 (0x0B74)
Begin processing Assigned CI: [226] SMS_OBJECT_REPLICATION_MANAGER 8/23/2015 6:57:01 PM 2932 (0x0B74)
Creating VersionInfo policy for CI 226 SMS_OBJECT_REPLICATION_MANAGER 8/23/2015 6:57:01 PM 2932 (0x0B74)
Creating VersionInfo policy ScopeId_2A471255-BD73-43F1-B1C0-613FC1A40798/RequiredApplication_c637da7c-a62d-494e-a71e-b863b1a7196b/VI/VS SMS_OBJECT_REPLICATION_MANAGER 8/23/2015 6:57:01 PM 2932 (0x0B74)
226 Referenced VS CIs: [ 224 225 149 122 133 ] SMS_OBJECT_REPLICATION_MANAGER 8/23/2015 6:57:01 PM 2932 (0x0B74)
##############
##############
You would then see that the CI_assignment processing is done
Successfully updated CRCs for CI Assignment {D82B1B46-9636-4560-AE1A-22110840A7AC} SMS_OBJECT_REPLICATION_MANAGER 8/23/2015 6:57:05 PM 2932 (0x0B74)
Successfully processed Application Assignment {D82B1B46-9636-4560-AE1A-22110840A7AC} SMS_OBJECT_REPLICATION_MANAGER 8/23/2015 6:57:05 PM 2932 (0x0B74)

We would then see that PAC file getting dropped by smsdbmon

Modified trigger definition for Policy Targeting Evaluator[PolicyAssignmentChg_Notify_iu]: table PolicyAssignmentChg_Notify(PADBID) on insert,update, file PAC in dir C:\Program Files\Microsoft Configuration Manager\inboxes\policypv.box\policytargeteval\ SMS_DATABASE_NOTIFICATION_MONITOR 8/23/2015 6:57:13 PM 2536 (0x09E8)
SND: Dropped C:\Program Files\Microsoft Configuration Manager\inboxes\policypv.box\policytargeteval\16809612.PAC [157247] SMS_DATABASE_NOTIFICATION_MONITOR 8/23/2015 6:57:13 PM 2536 (0x09E8)

The policy provider then would see that processing

Found the certificate that matches the SHA1 hash. SMS_POLICY_PROVIDER 8/23/2015 6:57:19 PM 3720 (0x0E88)
Completed batch with beginning PADBID = 16809612 ending PADBID = 16809614. SMS_POLICY_PROVIDER 8/23/2015 6:57:19 PM 3720 (0x0E88)
--Process Policy Changes SMS_POLICY_PROVIDER 8/23/2015 6:57:19 PM 3720 (0x0E88)
Found some Policy changes, returning New LastRowversion=0x000000000035604C SMS_POLICY_PROVIDER 8/23/2015 6:57:19 PM 3720 (0x0E88)
Processing Updated Policies SMS_POLICY_PROVIDER 8/23/2015 6:57:19 PM 3720 (0x0E88)

Building Collection Change List from New and Targeting Changed Policies SMS_POLICY_PROVIDER 8/23/2015 6:57:19 PM 3720 (0x0E88)
--Update Policy Targeting Map SMS_POLICY_PROVIDER 8/23/2015 6:57:19 PM 3720 (0x0E88)
**** Evaluating Collection 14 for targeting changes **** SMS_POLICY_PROVIDER 8/23/2015 6:57:19 PM 3720 (0x0E88)
Advanced client policy changes detected for collection 14, *** 3 Added & 0 Deleted ***. SMS_POLICY_PROVIDER 8/23/2015 6:57:19 PM 3720 (0x0E88)
--Process Policy Targeting Map SMS_POLICY_PROVIDER 8/23/2015 6:57:19 PM 3720 (0x0E88)

You should then see the relation in respolicymap table for the all the members of the collection

Hope this Helps

Sudheesh Narayanaswamy

How to parse a XML file and get the Node value using Powershell

Sudheesh N — Wed, 08 Jul 2015 22:46:06 GMT

Let us say that we have sample XMl file like this

ToAll
FromME
Reminder
Hello World!

The following will read the file and get us the value of the nodes

$path= "C:\Sample.xml"
$oXMLDocument=New-Object System.XML.XMLDocument
$oXMLDocument.Load($path)
write-host "Value to To:" $oXMLDocument.note.to
write-host "Value to From:"$oXMLDocument.note.from
write-host "Value to Heading:"$oXMLDocument.note.heading
write-host "Value to Body:"$oXMLDocument.note.body

This is easy but when i had a do this and checked how it took me lot of time to come to this.

So thought of sharing

Hope it will be helpful

Sudheesh Narayanaswamy

==========================================================

This posting /Script is provided "AS IS" with no warranties and confers no rights

How to collect the Install date of updates using SCCM

Sudheesh N — Wed, 08 Jul 2015 21:05:00 GMT

We had requirements on to collect the information of Install date for updates which is not usually collected using inventory.

The below Steps will help to get that information in to SCCM database

1) Import the Cab file

Take the attached file--> Update Details.cab
In your ConfigMgr 12 console, on Assets and Compliance, Compliance Settings
Right-click on "Configuration Baseline" and Import this file (https://technet.microsoft.com/en-us/library/hh691016.aspx )
Once done deploy the baseline to the collection of machines from which you need.(https://technet.microsoft.com/en-us/library/hh219289.aspx )

2) Import the MOF file so that SMS_DEF.MOF is updated in 2012 this is how you do

On the console, Administration -> Client Settings -> right-click 'Default Client Settings' ->and go to properties.
Select Hardware Inventory, then on the right "Set Classes.
Click Import and browse to the updatedetails.mof file you saved.

Content of MOF file
========================================
[ SMS_Report (TRUE),

SMS_Group_Name ("CM_UpdateDetails"),
SMS_Class_ID ("MICROSOFT|CM_UPDATEDETAILS|1.0"),
Namespace ("root\\\\cimv2") ]
class CM_UpdateDetails : SMS_Class_Template
{
    [ SMS_Report (TRUE), key ]
    String     HotFixID;
    [ SMS_Report (TRUE) ]
    String     Installdate;
    [ SMS_Report (TRUE) ]
    String     Installedby;
    [ SMS_Report (TRUE) ]
    String     UpdateType;
};

============================================
You will get the data in the query
select * from v_GS_CM_UPDATEDETAILS

=======================================================================

The powershell script use to create a WMI entry is also available in the Zip file.

This posting /Script is provided "AS IS" with no warranties and confers no rights

Update.zip

Powershell Scripts to distribute packages to a set of DP

Sudheesh N — Wed, 01 Jul 2015 22:50:36 GMT

At times we get request on that we need to refresh the package or we need to distribute the package for a specific set of DP.
This scripts helps in distributing any kind of content (Application, legacy package, SUM package, driver package etc ) on the .
It uses two input files ($path1 = "c:\temp\server.csv"   ,$path2 = "c:\temp\Package.csv")
The first one you can enter the server names and in the second the package names .
Script
=======
Function Refresh-SpecificDP($ar) {
    $dpFound = $false
    $packageID=$ar[0]
    $siteCode=$ar[1]
    $dpName= $ar[2]
    If ($packageID.Length -ne 8)
    {
        Throw "Invalid package"
    }
    $distPoints = Get-WmiObject -Namespace "root\SMS\Site_$($siteCode)" -Query "Select * From SMS_DistributionPoint WHERE PackageID='$packageID'"
    ForEach ($dp In $distPoints)
    {
        If ((($dp.ServerNALPath).ToUpper()).Contains($dpName.ToUpper()))
        {
            $dpFound = $true
            Try {
                $dp.RefreshNow = $true
                $dp.Put() | Out-Null
                #$dpName + " - " + $packageID
                }
            Catch [Exception]
            {
                return $_.Exception.Message
            }
        }
    }
    If ($dpFound -eq $false)
    {
        Throw "No results returned."
    }
}
#main pgm
$path1 = "c:\temp\server.csv"
$path2 = "c:\temp\Package.csv"
$SiteCode='CAS'
Import-csv -path $path1 -Header servername | foreach `
{
    $ServerName=$_.servername
    Import-csv -path $path2 -Header Packageid | foreach `
    {
        $pkgID=$_.Packageid
        $PackageType= ""
        $a= Get-CMPackage | Select-Object PackageID | Where-Object {$_.PackageID -eq $pkgID }
        if ($a.PackageID -eq $pkgID)
        {
        $PackageType= "Package"
        }
        $a= Get-CMApplication | Select-Object PackageID | Where-Object {$_.PackageID -eq $pkgID }
        if ($a.PackageID -eq $pkgID)
        {
        $PackageType= "Application"
        }
        $a= Get-CMDriverPackage | Select-Object PackageID | Where-Object {$_.PackageID -eq $pkgID }
        if ($a.PackageID -eq $pkgID)
        {
        $PackageType= "Driver"
        }
        $a= Get-CMBootImage | Select-Object PackageID | Where-Object {$_.PackageID -eq $pkgID }
        if ($a.PackageID -eq $pkgID)
        {
        $PackageType= "BootImage"
        }
        $a= Get-CMOperatingSystemImage | Select-Object PackageID | Where-Object {$_.PackageID -eq $pkgID }
        if ($a.PackageID -eq $pkgID)
        {
        $PackageType= "OSImage"
        }
         If($PackageType -eq "Package")
                    {
                       $distpoints = Get-WmiObject -Namespace "root\SMS\Site_$($SiteCode)" -Query "Select * From SMS_DistributionPoint WHERE PackageID='$PkgID' and serverNALPath like '%$Servername%'" | Select-Object ServerNALPath
                          if ($distpoints.ServerNALPath.length -eq 0) {
                        #echo "This is a Package"
                        start-CMContentDistribution -PackageId   "$pkgID" -DistributionPointName "$ServerName"
                         write-host "Distributing Package :" $pkgID "of type " $PackageType "to DP:" $serverName
                        }
                        else {
                         write-host "Re-Distribting Package :" $pkgID "of type " $PackageType "to DP:" $serverName
                         $ar=$PkgID,$SiteCode,$Servername
                        Refresh-SpecificDP ($ar)
                        }
                    }
                    #For applications
                    If($PackageType -eq "Application")
                    {
                                                                                 $distpoints = Get-WmiObject -Namespace "root\SMS\Site_$($SiteCode)" -Query "Select * From SMS_DistributionPoint WHERE PackageID='$PkgID' and serverNALPath like '%$Servername%'" | Select-Object ServerNALPath
                          if ($distpoints.ServerNALPath.length -eq 0) {
                        #echo "This is an Application"
                        start-CMContentDistribution -ApplicationID "$pkgID" -DistributionPointName "$ServerName"
                                                                                                write-host "Distributing Package :" $pkgID "of type " $PackageType "to DP:" $serverName
                        }
                        else {
                         write-host "Re-Distribting Package :" $pkgID "of type " $PackageType "to DP:" $serverName
                         $ar=$PkgID,$SiteCode,$Servername
                        Refresh-SpecificDP ($ar)}
                    }
                    #For Driverpackages
                    If($PackageType -eq "Driver")
                    { $distpoints = Get-WmiObject -Namespace "root\SMS\Site_$($SiteCode)" -Query "Select * From SMS_DistributionPoint WHERE PackageID='$PkgID' and serverNALPath like '%$Servername%'" | Select-Object ServerNALPath
                          if ($distpoints.ServerNALPath.length -eq 0) {
                        #echo "This is a Driver"
                        Start-CMContentDistribution -DriverPackageID "$pkgID" -DistributionPointName "$ServerName"
                                                                                                write-host "Distributing Package :" $pkgID "of type " $PackageType "to DP:" $serverName
                        }
                        else {
                         write-host "Re-Distribting Package :" $pkgID "of type " $PackageType "to DP:" $serverName
                         $ar=$PkgID,$SiteCode,$Servername
                        Refresh-SpecificDP ($ar)}
                    }
                    #For BootImages
                    If($PackageType -eq "BootImage")
                    { $distpoints = Get-WmiObject -Namespace "root\SMS\Site_$($SiteCode)" -Query "Select * From SMS_DistributionPoint WHERE PackageID='$PkgID' and serverNALPath like '%$Servername%'" | Select-Object ServerNALPath
                          if ($distpoints.ServerNALPath.length -eq 0) {
                        #echo "This is a BootImage"
                        Start-CMContentDistribution -BootImageID "$pkgID" -DistributionPointName "$serverName"
                                                                                                write-host "Distributing Package :" $pkgID "of type " $PackageType "to DP:" $serverName
                        }
                        else {
                         write-host "Re-Distribting Package :" $pkgID "of type " $PackageType "to DP:" $serverName
                         $ar=$PkgID,$SiteCode,$Servername
                        Refresh-SpecificDP ($ar)}
                    }
                    #For OSImage
                    If($PackageType -eq "OSImage")
                    { $distpoints = Get-WmiObject -Namespace "root\SMS\Site_$($SiteCode)" -Query "Select * From SMS_DistributionPoint WHERE PackageID='$PkgID' and serverNALPath like '%$Servername%'" | Select-Object ServerNALPath
                          if ($distpoints.ServerNALPath.length -eq 0) {
                        #echo "This is a OSimage"
                        Start-CMContentDistribution –OperatingSystemImageID "$pkgID" -DistributionPointName "$serverName"
                                                                                                write-host "Distributing Package :" $pkgID "of type " $PackageType "to DP:" $serverName
                        }
                        else {
                         write-host "Re-Distribting Package :" $pkgID "of type " $PackageType "to DP:" $serverName
                         $ar=$PkgID,$SiteCode,$Servername
                        Refresh-SpecificDP ($ar)}
                     }
    }
}

Hope this helps

Sudheesh Narayanaswamy

This posting /Script is provided "AS IS" with no warranties and confers no rights

PowerShell Script to decline all Superseded Updates in WSUS

Sudheesh N — Tue, 24 Mar 2015 10:30:16 GMT

At time troubleshooting on cases we had to decline updates which are superseded from the WSUS and hence help to make sure that the no of updates the update agent scan is reduced.

=========================================================

#Change server name and port number and $True if it is on SSL

[String]$updateServer1 = "CMCAS"

[Boolean]$useSecureConnection = $False

[Int32]$portNumber =8530

# Load .NET assembly

[void][reflection.assembly]::LoadWithPartialName("Microsoft.UpdateServices.Administration")

$count = 0

# Connect to WSUS Server

$updateServer = [Microsoft.UpdateServices.Administration.AdminProxy]::getUpdateServer($updateServer1,$useSecureConnection,$portNumber)

write-host "<<>>" -foregroundcolor "yellow"

$updatescope = New-Object Microsoft.UpdateServices.Administration.UpdateScope

$u=$updateServer.GetUpdates($updatescope )

foreach ($u1 in $u )

{

if ($u1.IsSuperseded -eq 'True')

{

write-host Decline Update : $u1.Title

$u1.Decline()

$count=$count + 1

}

write-host Total Declined Updates: $count

trap

{

write-host "Error Occurred"

write-host "Exception Message: "

write-host $_.Exception.Message

write-host $_.Exception.StackTrace

exit

}

# EOF

==========================================================

This posting /Script is provided "AS IS" with no warranties and confers no rights