Shaun Cassells at MyITForum.com : Client Health

Slow startup fix: Login to your corporate network while remote

scassells — Tue, 15 Feb 2011 18:55:00 GMT

Summary: The following is a method to allow group policy (gpupdate) logon setting to be applied while NOT on the corporate Intranet.

The following was a study on how to improve my logon times while remote from the corporate intranet for months at a time.

Group Policy was not being updated and logon scripts were never run. The corporate VPN client would not allow me to maintain connection during a logoff and logon event.

Solution:

1) Run your VPN software as system

2) Logoff

3) Logon

4) Close the VPN software

How:

1) Go to Sysinternals.com and download the Suite

2) Expand the zip

3) The following is a little different for XP and later OSs

a. XP

i. PSExec –sid <Path and VPN program>

ii. On XP the program will just appear.

b. Vista, 7, Server

i. Open a command (cmd.exe) prompt with Administration Rights

1. Start

2. Enter cmd in the search bar

3. Right click the search result and Run as administrator

ii. Psexec –sd –i 0 <Path and VPN program>

1. Session 0 Isolation was introduced with Vista

iii. A task bar icon for Interactive Services Detection will appear.

1. Click the View the message button

4) You will need to configure your VPN client as system has zero access to your logon account

a. This is something you will have to know

b. Note: clip board between normal desktop and Session 0 will not work

5) Connect your VPN

6) Return to you desktop by clicking Return now

7) Logoff

8) Logon

9) Vista, 7, Server you will need to do the following to have the Interactive services Detection popup again:

a. Open command prompt with Administration Rights

b. Net stop ui0detect

c. Net start ui0detect

You have now successfully forced your client to logon to your intranet.

I would suggest running gpupdate /force (again from an elevated rights cmd prompt) and then logoff and logon again.

Auto-Fix Windows Update Agent

scassells — Wed, 02 Feb 2011 18:54:00 GMT

Source: http://blogs.technet.com/b/michaelgriswold/archive/2010/04/15/auto-fix-wmi.aspx

One of the hardest things to tackle in SCCM these days is client health. It is an on-going issue because it is hard to diagnose and hard to programmatically fix. SCCM’s client is much improved over older versions but it still has occasional issues and its dependencies such as WMI and Windows Update Agent still have theirs as well.

While looking into this for one customer I came up with a trick that won’t solve all client health problems, but it moves one step closer. This trick is for some of the Windows Update Agent (WUA) issues. If anyone uses this and finds issues or improvements please let me know and I will follow-up or correct this post as needed.

The first step is to identify the machines having WUA issues. There are probably several ways but what I found useful was to look for clients sending 11416 status messages. Creating a status message query was easy but creating a collection based on status messages takes a little more work to build. Here is one I put together that seems to do the trick:

select distinct SYS.Name,SYS.Client from SMS_StatusMessage as stat join sms_r_system as SYS on stat.machinename = SYS.name where stat.ModuleName = "SMS Client" and stat.MessageID = 11416 and DateDiff(dd,stat.Time, GetDate()) <1

This query gets all the machine names that have sent a 11416 status message in the last day and cross references with the system object for that machine so that a collection of machines can be put together.

Once you have your collection of machines identified the next step is to send those machines something to repair WUA. KB971058 has a nice Fix It script that will do this and you can download it from the KB. It is an MSI and in my testing using the default settings seemed to be enough to fix most machines. As an MSI you can have SCCM create your package and program by creating a package from definition and pointing at the MSI file itself. This should give you a silent run option.

Once you have the package in place advertise it to your collection created based on the query above and see if that solves your WUA health issues. For my customer we saw a 92% reduction in WUA issues using this method.

** Correction** I had previously posted this as a WMI fix, when this is really a WUA fix. I just had WMI on my brain. My apologies for any confusion.