Monitoring Collection Membership with WMI EVENTS

I attended the Microsoft Management Summit in sunny Las Vegas this year and managed to wake up early enough on Friday to make it to Kim Oppalfens 8:30 Session on WMI.  Kim battled the fallout of a volcano to attend the very last day of the conference so he could present his session on WMI for System Center Configuration Administrators.  I'm glad he was able to make it so that he could open up my eyes to WMI Events.  Thank you Kim.

Check out Kim Oppalfens blog on the subject

Before you read more:

If you aren't sure what WMI is (Windows Management Instrumentation), then check out the MSDN Library on the subject.  There, you can find a wealth of information about WMI with plenty of examples to help you start using it.  The System Center Configuration Manager Administrator console heavily utilizes WMI and being that WMI is scriptable, we can use this to our advantage when automating some of our administrative tasks.

WMI EVENTS

WMI Events are just that; events.  They take place in the WMI infrastructure when a change occurs that affects the data contained within it. 

The power, for an SCCM administrator, is that you can use this to monitor changes to collections, advertisements, site configuration, and pretty much anything else you can see in the SCCM Administrator console.  Kim Oppalfens had demonstrated the ability to monitor collections and trigger a machine policy refresh on a remote client system in his MMS session.  The ability to automatically tell the client that it was just added to a collection opens up the door to your own customized software deployment process!

The idea here is to be able to trigger a software deployment within a very short period of time on a client by monitoring the collection membership changes. 

Before I begin, I'll spare myself some typing and refer you to the System Center Configuration Manager SDK, where you can find methods on calling machine policy refresh and triggering other client actions.

System Center Configuration Manager 2007 Software Development Kit (SDK) v4.0

http://www.microsoft.com/downloads/details.aspx?familyid=064a995f-ef13-4200-81ad-e3af6218edcc&displaylang=en

There are several classes that refer to the collections in your SCCM infrastructure.  A few examples are:

• SMS_Collection
• SMS_CollectionMember
• SMS_FullCollectionMembership
• SMS_CollectionRule
• 'SMS_CM_RES_COLL_<CollectionID>
• …More

Each collection has it's own class.  They begin with “sms_cm_res_coll_” and end in the collectionID.  Example:  'SMS_CM_RES_COLL_DEV00909'

There are several different properties of the SMS_CM_RES_COLL_XXXXXXXX class, including Name and ResourceID.  This is where the information in the console comes from when you click on a collection and view the members.  By monitoring the creation of instances in the SMS_CM_RES_COLL_XXXXXXXX collections using WMI Events and using information in the SDK, we can perform numerous operations on these clients. 

Just a few examples:

• Clients that haven’t reported heartbeat: Trigger some health-checks via PSEXEC.exe
• Systems that need a reboot: Send the shutdown command remotely
• Systems with missing inventory items: Trigger a full hardware inventory

Here is a simple script to get you started in WMI Event Scripting.  It will trigger a machine policy refresh on a client within 10 seconds of it being added to a specific collection:

‘--------------------------BEGIN SCRIPT-----------------------------------

' VBScript source code
Option Explicit

Dim objWMIService, objItem, colItems, strComputer, i, strProcessDeleted, strSiteCode
Dim strComputertoRefresh, objCCM, objClient, objSched

Const MachinePol = "{00000000-0000-0000-0000-000000000021}"

' On Error Resume Next
strComputer = "sccm-central"
strSiteCode = "DEV"

' WMI connection
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\sms\site_" & strSiteCode)

' Subscribing to the WMI event for the collection membership change within 10 seconds
Set colItems = objWMIService.ExecNotificationQuery("SELECT * FROM __InstanceCreationEvent WITHIN 10 WHERE TargetInstance ISA 'SMS_CM_RES_COLL_DEV0001A'")

' Purposely allowing the script to loop forever.
do until i = 1
    ' Until you receive an event, don't move forwar
    set strProcessDeleted = colItems.NextEvent
    wscript.echo "CollectionMemberChanged: " & strProcessDeleted.TargetInstance.ResourceID & " was added to the collection."
        ' Telling the member that was just added to request machine policy
        strComputertoRefresh = strProcessDeleted.TargetInstance.Name

        Set objCCM = GetObject("winmgmts://" & strComputertoRefresh & "/root/ccm")
        Set objClient = objCCM.Get("SMS_Client")
        Set objSched = objClient.Methods_("TriggerSchedule"). _
            inParameters.SpawnInstance_()
        objSched.sScheduleID = MachinePol
        objCCM.ExecMethod "SMS_Client", "TriggerSchedule", objSched

loop

'WSCript.Quit

‘--------------------------END SCRIPT-----------------------------------

 

The script is definitely not error-proof at this stage, and in fact, it will crash if a member is added that is not currently online.  So definitely test, tweak, modify to your heart’s content.  Hopefully, this gets you started on your way to writing your own event driven scripts.