Shaun Cassells at MyITForum.com : SMS 2003

Auto-Fix Windows Update Agent

scassells — Wed, 02 Feb 2011 18:54:00 GMT

Source: http://blogs.technet.com/b/michaelgriswold/archive/2010/04/15/auto-fix-wmi.aspx

One of the hardest things to tackle in SCCM these days is client health. It is an on-going issue because it is hard to diagnose and hard to programmatically fix. SCCM’s client is much improved over older versions but it still has occasional issues and its dependencies such as WMI and Windows Update Agent still have theirs as well.

While looking into this for one customer I came up with a trick that won’t solve all client health problems, but it moves one step closer. This trick is for some of the Windows Update Agent (WUA) issues. If anyone uses this and finds issues or improvements please let me know and I will follow-up or correct this post as needed.

The first step is to identify the machines having WUA issues. There are probably several ways but what I found useful was to look for clients sending 11416 status messages. Creating a status message query was easy but creating a collection based on status messages takes a little more work to build. Here is one I put together that seems to do the trick:

select distinct SYS.Name,SYS.Client from SMS_StatusMessage as stat join sms_r_system as SYS on stat.machinename = SYS.name where stat.ModuleName = "SMS Client" and stat.MessageID = 11416 and DateDiff(dd,stat.Time, GetDate()) <1

This query gets all the machine names that have sent a 11416 status message in the last day and cross references with the system object for that machine so that a collection of machines can be put together.

Once you have your collection of machines identified the next step is to send those machines something to repair WUA. KB971058 has a nice Fix It script that will do this and you can download it from the KB. It is an MSI and in my testing using the default settings seemed to be enough to fix most machines. As an MSI you can have SCCM create your package and program by creating a package from definition and pointing at the MSI file itself. This should give you a silent run option.

Once you have the package in place advertise it to your collection created based on the query above and see if that solves your WUA health issues. For my customer we saw a 92% reduction in WUA issues using this method.

** Correction** I had previously posted this as a WMI fix, when this is really a WUA fix. I just had WMI on my brain. My apologies for any confusion.

Find overlapping boundaries in SMS/ConfigMgr/SCCM

scassells — Wed, 18 Aug 2010 17:23:00 GMT

I am not sure why I never posted this before:

http://blogs.msdn.com/b/rslaten/archive/2007/03/20/finding-overlapping-boundaries-in-sms-smsboundaries-v1-42.aspx

The script works great and has a well written xml generator for vb (for those who like to script spelunk.

Savings Space on SMS / SCCM servers by deleting PCK files - the pitfalls and fixes.

scassells — Tue, 08 Sep 2009 21:05:00 GMT

The following is a guest post from: Ted Skarbek

The following is a write up on package replication after user deleted PCK files:

With our aging SMS 2003 servers running out of drive space for the distribution points and new packages being created much faster (and typically larger on average) than the older packages were being retired we were scraping for bits of space to keep moving until the new SCCM 2007 system gets into production. It was found that the servers being used as the DPs had a significant portion (roughly 40%) of the total drive space assigned to the DP being taken up by PCK files. To free up the capacity we elected to delete PCK files which hadn’t been modified in the last 3-6 months figuring that anything that hadn’t been modified in that time probably wouldn’t need to be modified, and if it did then the PCK file should just replicate back out to the DP so it might just take a little longer.

Somewhat shortly after making the decision to delete the older PCK files we encountered a few older packages which needed to have slight modifications to them replicated out to the DPs. Sometime after issuing an “Update Distribution Points” command from the SMS console it was noticed that on at least a few of the DPs the package had not yet updated (under package status these sites still indicated the previous source version, targeted “1”, but installed was “0”, and retrying was “1”). This had been an observed behavior in the past and typically would be resolved by just updating the DPs again. In this case it did not resolve the issue so I began digging into it further.

What I found was that it appeared the DP was giving an error that it couldn’t open the PCK file on the local server, which is somewhat to be expected since it isn’t there, but common sense would seem to indicate that if the file was not present that it would just get copied out automatically. At this point the package wouldn’t even remove from the targeted server since it was aware that it should be updating and that the PCK file was no longer present (apparently if the DP is trying to perform an action on a package, it won’t move onto the next one until the first one completes successfully). After a little investigation of the issue the best resources I was able to locate were the following:

http://technet.microsoft.com/en-us/library/bb892806.aspx

Under “What it does” for Package Updates:

“Builds a new, complete, compressed package file and a delta compressed package file from the updated package source files. The delta file is passed to all distribution points.”

http://www.myitforum.com/forums/m_82981/mpage_1/key_Clearing%252COld%252Cdata/tm.htm#82981

Under a post from “rlauder”:

“This is the compressed source of a package and is used for refresh purposes if a subordinate site server is instructed to refresh it' s own copy. If you' re lucky and you' ve trashed it, the parent server may well just request a new copy from its own parent, but don' t bank on it.”

So it seems that the expectation that the PCK files would automatically replicate out was apparently unreasonable. I have been able to determine two solutions to enable us to update the DPs when the PCK files have been removed:

1. In order to update a package on a DP which was last updated before our modification above here’s what seems to work:

a. Remove all targeted DP’s

b. Wait for the package status to be all 0’s on ALL DP’s (Source Version “0”, Targeted “0”, Installed “0”, Retrying “0”)

c. Update the Package from Source

d. Re-add the DPs

e. I’ve never seen this have a problem.

2. If the package is updated without removing the DP’s what you will likely see is that the Source Version stays the same, Targeted stays at “1”, Installed goes to “0”, and Retrying probably goes to “1” (as seen in the Package Status area). Once this starts happening even removing the DP won’t work (Targeted, Installed, and Retrying will all “0”, but Source Version will still stay the same).

a. To resolve the problem now the PCK files need to be manually copied from the parent server (\\<serverName>\sms_cpsg$\<PKG ID>.pck) to the target server (using the same sms_cpsg$ share).

b. Once the PCK file is back on the server(s) the package can be updated again and everything should be fine.

c. Note: only the PCK file needs to be copied, all files with the *.DLT and *.DLT.x extension can be ignored.

d. Sometimes I do have a problem manually copying the PCK files as it tells me I don’t have permission to write to the file on the target location (even though I have create and modify access to the target location and the file isn’t present) but in these cases the server Admin’s has been able to successfully copy the files.

CliFix SMS_DEF.Mof edit

scassells — Wed, 26 Aug 2009 21:27:00 GMT

The CliFix script writes to the registry, a count of the number of times a fix has run. And the last time a fix ran. As well as the last time the script ran.

This will allow you to track trends in your environment, parts of the script not working, or a great pie chart for your management to say how well you've fixed your environment.

Best

#pragma namespace ("\\\\.\ oot\\cimv2")
#pragma deleteclass("ClientHealthStartup", NOFAIL)
[DYNPROPS]
Class ClientHealthStartup
{
[key] string KeyName;
String CHK_SYSTEMPATH;
String CHK_SYSTEMPATH_TIME;
String CHK_BITS_SERVICE;
String CHK_BITS_SERVICE_TIME;
String RunCount;
String RunCount_TIME;
String WMI;
String WMI_TIME;
String CHK_FIREWALL_ICS_SERVICE;
String CHK_FIREWALL_ICS_SERVICE_TIME;
String CHK_CCMEXEC;
String CHK_CCMEXEC_TIME;
String CHK_CACHESIZE;
String CHK_CACHESIZE_TIME;
String MSI_SERVICE;
String MSI_SERVICE_TIME;
String WMIStatus;
String WMIStatus_TIME;
String CHK_RPC_SERVICE;
String CHK_RPC_SERVICE_TIME;
String CHK_WMI_SERVICE;
String CHK_WMI_SERVICE_TIME;
String CHK_SERVER_SERVICE;
String CHK_SERVER_SERVICE_TIME;
String CHK_RemoteReg;
String CHK_RemoteReg_TIME;
String CHK_WUS_SERVICE;
String CHK_WUS_SERVICE_TIME;
String SCFileExist;
String SCFileExist_TIME;
String TERMSERVICE_SERVICE;
String TERMSERVICE_SERVICE_TIME;
};
[DYNPROPS]
Instance of ClientHealthStartup
{
keyname="SystemCenter.fr";
[PropertyContext("Local|HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\ClientHealthStartup|CHK_SYSTEMPATH"),Dynamic,Provider("RegPropProv")] CHK_SYSTEMPATH;
[PropertyContext("Local|HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\ClientHealthStartup|CHK_SYSTEMPATH_TIME"),Dynamic,Provider("RegPropProv")] CHK_SYSTEMPATH_TIME;
[PropertyContext("Local|HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\ClientHealthStartup|CHK_BITS_SERVICE"),Dynamic,Provider("RegPropProv")] CHK_BITS_SERVICE;
[PropertyContext("Local|HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\ClientHealthStartup|CHK_BITS_SERVICE_TIME"),Dynamic,Provider("RegPropProv")] CHK_BITS_SERVICE_TIME;
[PropertyContext("Local|HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\ClientHealthStartup|RunCount"),Dynamic,Provider("RegPropProv")] RunCount;
[PropertyContext("Local|HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\ClientHealthStartup|RunCount_TIME"),Dynamic,Provider("RegPropProv")] RunCount_TIME;
[PropertyContext("Local|HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\ClientHealthStartup|WMI"),Dynamic,Provider("RegPropProv")] WMI;
[PropertyContext("Local|HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\ClientHealthStartup|WMI_TIME"),Dynamic,Provider("RegPropProv")] WMI_TIME;
[PropertyContext("Local|HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\ClientHealthStartup|CHK_FIREWALL_ICS_SERVICE"),Dynamic,Provider("RegPropProv")] CHK_FIREWALL_ICS_SERVICE;
[PropertyContext("Local|HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\ClientHealthStartup|CHK_FIREWALL_ICS_SERVICE_TIME"),Dynamic,Provider("RegPropProv")] CHK_FIREWALL_ICS_SERVICE_TIME;
[PropertyContext("Local|HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\ClientHealthStartup|CHK_CCMEXEC"),Dynamic,Provider("RegPropProv")] CHK_CCMEXEC;
[PropertyContext("Local|HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\ClientHealthStartup|CHK_CCMEXEC_TIME"),Dynamic,Provider("RegPropProv")] CHK_CCMEXEC_TIME;
[PropertyContext("Local|HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\ClientHealthStartup|CHK_CACHESIZE"),Dynamic,Provider("RegPropProv")] CHK_CACHESIZE;
[PropertyContext("Local|HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\ClientHealthStartup|CHK_CACHESIZE_TIME"),Dynamic,Provider("RegPropProv")] CHK_CACHESIZE_TIME;
[PropertyContext("Local|HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\ClientHealthStartup|MSI_SERVICE"),Dynamic,Provider("RegPropProv")] MSI_SERVICE;
[PropertyContext("Local|HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\ClientHealthStartup|MSI_SERVICE_TIME"),Dynamic,Provider("RegPropProv")] MSI_SERVICE_TIME;
[PropertyContext("Local|HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\ClientHealthStartup|WMIStatus"),Dynamic,Provider("RegPropProv")] WMIStatus;
[PropertyContext("Local|HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\ClientHealthStartup|WMIStatus_TIME"),Dynamic,Provider("RegPropProv")] WMIStatus_TIME;
[PropertyContext("Local|HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\ClientHealthStartup|CHK_RPC_SERVICE"),Dynamic,Provider("RegPropProv")] CHK_RPC_SERVICE;
[PropertyContext("Local|HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\ClientHealthStartup|CHK_RPC_SERVICE_TIME"),Dynamic,Provider("RegPropProv")] CHK_RPC_SERVICE_TIME;
[PropertyContext("Local|HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\ClientHealthStartup|CHK_WMI_SERVICE"),Dynamic,Provider("RegPropProv")] CHK_WMI_SERVICE;
[PropertyContext("Local|HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\ClientHealthStartup|CHK_WMI_SERVICE_TIME"),Dynamic,Provider("RegPropProv")] CHK_WMI_SERVICE_TIME;
[PropertyContext("Local|HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\ClientHealthStartup|CHK_SERVER_SERVICE"),Dynamic,Provider("RegPropProv")] CHK_SERVER_SERVICE;
[PropertyContext("Local|HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\ClientHealthStartup|CHK_SERVER_SERVICE_TIME"),Dynamic,Provider("RegPropProv")] CHK_SERVER_SERVICE_TIME;
[PropertyContext("Local|HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\ClientHealthStartup|CHK_RemoteReg"),Dynamic,Provider("RegPropProv")] CHK_RemoteReg;
[PropertyContext("Local|HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\ClientHealthStartup|CHK_RemoteReg_TIME"),Dynamic,Provider("RegPropProv")] CHK_RemoteReg_TIME;
[PropertyContext("Local|HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\ClientHealthStartup|CHK_WUS_SERVICE"),Dynamic,Provider("RegPropProv")] CHK_WUS_SERVICE;
[PropertyContext("Local|HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\ClientHealthStartup|CHK_WUS_SERVICE_TIME"),Dynamic,Provider("RegPropProv")] CHK_WUS_SERVICE_TIME;
[PropertyContext("Local|HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\ClientHealthStartup|SCFileExist"),Dynamic,Provider("RegPropProv")] SCFileExist;
[PropertyContext("Local|HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\ClientHealthStartup|SCFileExist_TIME"),Dynamic,Provider("RegPropProv")] SCFileExist_TIME;
[PropertyContext("Local|HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\ClientHealthStartup|TERMSERVICE_SERVICE"),Dynamic,Provider("RegPropProv")] TERMSERVICE_SERVICE;
[PropertyContext("Local|HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\ClientHealthStartup|TERMSERVICE_SERVICE_TIME"),Dynamic,Provider("RegPropProv")] TERMSERVICE_SERVICE_TIME;
};
#pragma namespace ("\\\\.\ oot\\cimv2\\SMS")
#pragma deleteclass("ClientHealthStartup", NOFAIL)
[SMS_Report(TRUE),SMS_Group_Name("ClientHealthStartup"),SMS_Class_ID("ClientHealth|ClientHealthStartup|1.0")]
Class ClientHealthStartup: SMS_Class_Template
{
[SMS_Report(TRUE),key] string KeyName;
[SMS_Report(TRUE)] String CHK_SYSTEMPATH;
[SMS_Report(TRUE)] String CHK_SYSTEMPATH_TIME;
[SMS_Report(TRUE)] String CHK_BITS_SERVICE;
[SMS_Report(TRUE)] String CHK_BITS_SERVICE_TIME;
[SMS_Report(TRUE)] String RunCount;
[SMS_Report(TRUE)] String RunCount_TIME;
[SMS_Report(TRUE)] String WMI;
[SMS_Report(TRUE)] String WMI_TIME;
[SMS_Report(TRUE)] String CHK_FIREWALL_ICS_SERVICE;
[SMS_Report(TRUE)] String CHK_FIREWALL_ICS_SERVICE_TIME;
[SMS_Report(TRUE)] String CHK_CCMEXEC;
[SMS_Report(TRUE)] String CHK_CCMEXEC_TIME;
[SMS_Report(TRUE)] String CHK_CACHESIZE;
[SMS_Report(TRUE)] String CHK_CACHESIZE_TIME;
[SMS_Report(TRUE)] String MSI_SERVICE;
[SMS_Report(TRUE)] String MSI_SERVICE_TIME;
[SMS_Report(TRUE)] String WMIStatus;
[SMS_Report(TRUE)] String WMIStatus_TIME;
[SMS_Report(TRUE)] String CHK_RPC_SERVICE;
[SMS_Report(TRUE)] String CHK_RPC_SERVICE_TIME;
[SMS_Report(TRUE)] String CHK_WMI_SERVICE;
[SMS_Report(TRUE)] String CHK_WMI_SERVICE_TIME;
[SMS_Report(TRUE)] String CHK_SERVER_SERVICE;
[SMS_Report(TRUE)] String CHK_SERVER_SERVICE_TIME;
[SMS_Report(TRUE)] String CHK_RemoteReg;
[SMS_Report(TRUE)] String CHK_RemoteReg_TIME;
[SMS_Report(TRUE)] String CHK_WUS_SERVICE;
[SMS_Report(TRUE)] String CHK_WUS_SERVICE_TIME;
[SMS_Report(TRUE)] String SCFileExist;
[SMS_Report(TRUE)] String SCFileExist_TIME;
[SMS_Report(TRUE)] String TERMSERVICE_SERVICE;
[SMS_Report(TRUE)] String TERMSERVICE_SERVICE_TIME;
};

The Case of the Missing Advertisement and a Restart

scassells — Thu, 16 Jul 2009 18:59:00 GMT

Mystery: A machine had received an advertisement that may or may not have restarted a workstation.

The requestor had the Advertisement ID from the machine but they couldn’t locate the advertisement in the console. For the sake of this mystery our advertisement will be MIS00042.

This mystery has two questions.

1. Where is the advertisement in the console?

2. Did the SMS Program restart the PC?

One

Where in the console is the advertisement? SMS 2003 does not have a search function like ConfigMgr 2007 however this method will work for either environment. There are two tables (not views) that will be helpful.

· Dbo.Folders

· Dbo.FolderMembers

Where in the console is the advert?

With SMS 2003 and ConfigMgr folders have become a very useful way to organize info in the console. As such we will need a method to search the FolderMembers for the appropriate parent folder.

SELECT dbo.Folders.Name, dbo.Folders.ParentContainerNodeID

FROM dbo.Folders INNER JOIN

dbo.FolderMembers ON dbo.FolderMembers.ContainerNodeID = dbo.Folders.ContainerNodeID

WHERE (dbo.FolderMembers.InstanceKey = 'MSI00042')

This will return two pieces of information. The first is the Name of the folder containing the Advertisement. The second is the ParentContainerNodeID. If the ParentContainerNodeID is zero then it is a top level folder. If the value is not zero, then you can query again basing your where statement on ContainerNodeID. With the Name of the folder your console spelunking will be much easier.

Two

Did this advertised program cause the workstation to restart? First we will assume that the package will not restart the workstation (that can be confirmed in the package run logs – outside the scope of this discussion). Second we need to check the program flags to see if SMS restarts the computer when the program has finished running bit is set.

Okay, where are the ProgramFlags? The program flags which can be found with just the AdvertisementID in the dbo.v_AdvertisementInfo view.

SELECT *

FROM dbo.v_AdvertisementInfo

WHERE (AdvertisementID = 'MSI00042')

You are looking for the ProgramFlags value. In this case it is -2012175360.

Hex, Binary and Decimal Aside*********

In several Microsoft program values are calculated in Hex or Binary but stored in Decimal.

If you open up Calc.exe change it to scientific method you can type in the negative number and convert it to Hex (Hex button is the first from the left under the numerical field)

In this case when you change the decimal -2012175360 to hex you get FFFFFFFF8810A400. You can ignore the proceeding eight F’s. The Hex value is 8810A400.

If you open up Calc.exe change it to scientific method you can type in the negative number and convert it to Binary (Bin button is the fourth from the left under the numerical field)

In this case when you change the decimal -2012175360 to hex you get 1111111111111111111111111111111110001000000100001010010000000000.

/Aside*********

Okay, that’s great so what? Well if you reference the SDK (see end of article for links) for SMS_Program. You’ll find the following Entry in Program Flags for bit 19:

bit 19 (0x00040000)

SMS restarts the computer when the program has finished running.

Notice it is both the binary Bit 19 (a one with 18 zeros after it) and the Hex value of 0X00040000. So those two methods above are going to be useful.

Okay, how do I check to see if the setting is there? You use the logical AND condition.

8810A400 & 40000 = 0 (or false) if the value returned was 40000 that would mean it is present.

1111111111111111111111111111111110001000000100001010010000000000

You may notice that the 19th bit is zero or false. If you do bitwise comparison you’ll get a value of zero.

Note: You can do the bitwise AND function in Calc.exe too. (button is under the clear - top right)

Note: To add a value to a string, use the OR function in either programming or Calc.exe.

Summary

We were able to find the Advertisement in a folder in the console. We were also able to prove that the program was not set to cause SMS to restart the workstation.

References

SMS 2003 SDK 3.1:

http://www.microsoft.com/downloads/details.aspx?FamilyId=58833CD1-6DBB-45BB-BB77-163446068EF6&displaylang=en

Configuration Manager 2007 SDK 4.0: http://www.microsoft.com/downloads/details.aspx?FamilyId=064A995F-EF13-4200-81AD-E3AF6218EDCC&displaylang=en

SMS 2003 SDK for SMS_Progam

Data type: uint32
Access type: Read/write
Qualifiers: Bits

Defines the installation characteristics of the program, such as whether this is an unattended install, the install restarts the computer, or the install runs in a minimized window. The default flags are USERCONTEXT, USEUNCPATH, and ANY_PLATFORM.

When using SMS_Program programmatically, ensure that no conflicting options are selected. For example, NOUSERLOGGEDIN and USERCONTEXT should not be used together.

Note

· Unlisted bits are either obsolete or unused by SMS.

Bit flag	Description
Bit 6 (0x00000020)	Disables MOM alerts while the program runs. Requires SMS 2003 SP1
Bit 7 (0x00000040)	Generates MOM alert if the program fails. Requires SMS 2003 SP1.
Bit 8 (0x00000080)	For Advanced Client only. If set, this program's immediate dependent should always be run.
Bit 9 (0x00000100)	Indicates a device program. If set, the program is not offered to desktop clients.
Bit 10 (0x00000200)	This program's immediate dependent should always be run.
Bit 11 (0x00000400)	The countdown dialog is not displayed.
Bit 12 (0x00000800)	The command requires Add Remove Programs to be restarted—for example, APASetup.exe.
Bit 13 (0x00001000)	The command is disabled by company policy—for example, no "Run from Network" support.
Bit 14 (0x00002000)	A user must be logged on for the program to run.
Bit 15 (0x00004000)	The program must be run as the local Administrator account.
Bit 16 (0x00008000)	The program is offered to each new user that logs on. If this bit is not set, the program is offered only to the first user that logs on.
Bit 17 (0x00010000)	The program must be run by every user for whom it is valid. Valid only for mandatory jobs.
Bit 18 (0x00020000)	The program is run only when no user is logged on.
bit 19 (0x00040000)	SMS restarts the computer when the program has finished running.
Bit 20 (0x00080000)	Use a UNC path (no drive letter) to access the distribution point.
Bit 21 (0x00100000)	Persists the connection to the drive specified in the DriveLetter property. The USEUNCPATH bit flag must not be set.
Bit 22 (0x00200000)	Run the program as a minimized window.
Bit 23 (0x00400000)	Run the program as a maximized window.
Bit 24 (0x00800000)	Hide the program window.
Bit 25 (0x01000000)	SMS logs off the user when the program has finished running.
Bit 26 (0x02000000)	The program runs using the Legacy Client Software Installation. This account is used for unattended installs and requires the UNATTENDED bit to be set. For information about this account, see the Microsoft Systems Management Server 2003 Concepts, Planning, and Deployment Guide. You can specify this account in the SMS Administrator console or programmatically by using the site control file.
Bit 27 (0x04000000)	The program runs on any platform; ignore the supported operating system field.
Bit 28 (0x08000000)	Notifies the user if the program exceeds the Duration time by more than 15 minutes.

Clearing a Client Cache and PowerShell

scassells — Wed, 29 Apr 2009 15:02:00 GMT

Recently we had a bad package deployment that was precached. Now we need to delete the bad file while excluding Office 2007 and Office 2003 files if they are present:

1)       Delete everything script from Tim Minter on error resume next

dim oUIResManager
dim oCache
dim oCacheElement
dim oCacheElements

set oUIResManager = createobject("UIResource.UIResourceMgr")

if oUIResManager is nothing then
      wscript.echo "Couldn't create Resource Manager - quitting"
      wscript.quit
end if

set oCache=oUIResManager.GetCacheInfo()

if oCache is nothing then
      set oUIResManager=nothing
      wscript.echo "Couldn't get cache info - quitting"
      wscript.quit
end if

set oCacheElements=oCache.GetCacheElements

for each oCacheElement in oCacheElements
                oCache.DeleteCacheElement(oCacheElement.CacheElementID)
next

set oCacheElements=nothing
set oUIResManager=nothing
set oCache=nothing

2) Delete a specific object

a. This would require a modification of the script above to delete the correct package ID.

b. Add input of package ID to exclude. Add test in the for each section to exclude that packageid that matched the ContentID

For fun here is how you would list the cache in powershell

((New-Object -comobject UIResource.UIResourceMgr).getcacheInfo()).GetCacheElements()

A background on the automation of the client cache : http://support.microsoft.com/kb/839513

Translation:

When a package is downloaded to the advanced client cache the client agent places a lock on the package and the lock is not removed until a day later (24 hours) after the program is executed or a month (30 Days) if the package has not be executed. When the lock is removed from the package a day or a month later depending in the circumstance it cannot be re-locked until it is removed from the client cache and downloaded again.

When your packages need to be downloaded locally to the advanced client and the cache is full or lacks sufficient free space to accommodate the download the client will enumerate the packages in the cache if any exist and attempt to determine if the existing packages in the cache have already executed and the allotted 24 hours has not yet passed. If it finds packages where this is the case the agent then deletes them to allow more free space and then attempts to download the package again. On the second attempt to download the package if there is now sufficient free space remaining the package is downloaded to be executed.

SCCM: http://technet.microsoft.com/en-us/library/bb892803.aspx

SMS 2003 Client Health Startup Script v4.19

scassells — Tue, 14 Apr 2009 19:21:00 GMT

A few bug fixes.

Thanks very much to Hector Cortez: http://myitforum.com/cs2/blogs/hcortez/default.aspx

Version 4.19: http://myitforum.com/cs2/blogs/scassells/Public_SMS_CLIFIX_4.19.vbs.txt

Orginal Article: http://myitforum.com/cs2/blogs/scassells/archive/2009/01/28/sms-2003-client-health-startup-script-v4-18.aspx

Windows Update Agent – SMS 2003 SP2 or SP3 - Reporting

scassells — Mon, 02 Mar 2009 20:52:00 GMT

The Windows Update Agent (WUA) has a lot of versions floating around. The newest is

WUA 3.0 version 7.2.6001.788

Who ever came up with this naming standard needs to have their head examined. Is it 3.0 or 7.2? Yes!?!?!

Several Key reasons to upgrade namely:

http://support.microsoft.com/kb/916089

http://support.microsoft.com/kb/927891

Okay cool. I also notice that in the SMS_Def.mof there is a class to track WUA version. Except that it does not work. The fix is here: http://support.microsoft.com/kb/940182

!!!Warning!!! There is a typo in the fix. At the end of step 4 there is a curly brace semicolon - }; - missing.

Good news, you don’t have to do the fix if you have Software Inventory (SINV) running in at least the default settings. SINV default settings include tracking all *.exe files. This means you can query on the WUAuclt.exe file name.

Try this query: (watch out for word wrap)

SELECT     dbo.vSMS_G_System_SoftwareFile.FileName, dbo.vSMS_G_System_SoftwareFile.FileDescription, dbo.vSMS_G_System_SoftwareFile.FileVersion,
                      dbo.vSMS_G_System_SoftwareFile.FileSize, dbo.vSMS_G_System_SoftwareFile.ModifiedDate, dbo.vSMS_G_System_SoftwareFile.FilePath,
                      dbo.vSMS_G_System_SoftwareFile.FileModifiedDate, dbo.v_R_System.Name0, dbo.v_R_System.User_Domain0, dbo.v_R_System.User_Name0
FROM         dbo.vSMS_G_System_SoftwareFile INNER JOIN
                      dbo.v_R_System ON dbo.vSMS_G_System_SoftwareFile.ClientId = dbo.v_R_System.ResourceID
WHERE     (dbo.vSMS_G_System_SoftwareFile.FileName IN ('wuauclt.exe', 'wuauclt1.exe')) AND
                      (dbo.vSMS_G_System_SoftwareFile.FilePath = 'c:\windows\system32\')

Update for SMS 2003 - SP3 from MeenEnta

SELECT dbo.v_GS_SoftwareFile.FileName, dbo.v_GS_SoftwareFile.FileDescription,
dbo.v_GS_SoftwareFile.FileVersion,
dbo.v_GS_SoftwareFile.FileSize,
dbo.v_GS_SoftwareFile.ModifiedDate,
dbo.v_GS_SoftwareFile.FilePath,
dbo.v_R_System.Name0,
dbo.v_R_System.User_Domain0, dbo.v_R_System.User_Name0
FROM dbo.v_GS_SoftwareFile INNER JOIN dbo.v_R_System ON dbo.v_GS_SoftwareFile.ResourceID = dbo.v_R_System.ResourceID
WHERE (dbo.v_GS_SoftwareFile.FileName IN ('wuauclt.exe')) AND (dbo.v_GS_SoftwareFile.FilePath = 'c:\windows\system32\')
Order by dbo.v_GS_SoftwareFile.FileVersion, dbo.v_R_System.Name0

Another WMI QUery

select * from SMS_R_System inner join SMS_G_System_SoftwareFile on SMS_G_System_SoftwareFile.ResourceID = SMS_R_System.ResourceId where SMS_R_System.OperatingSystemNameandVersion = "Microsoft Windows NT Workstation 5.1" and SMS_G_System_SoftwareFile.FileName = "wuauclt.exe" and SMS_G_System_SoftwareFile.FilePath = "C:\\windows\\system32\\" and SMS_G_System_SoftwareFile.FileVersion < "7.2.6001.788"

SMS 2003 Client Health Startup Script v4.18

scassells — Wed, 28 Jan 2009 20:35:00 GMT

Script updated: http://myitforum.com/cs2/blogs/scassells/archive/2009/04/14/sms-2003-client-health-startup-script-v4-19.aspx

Below is a listing of features in a reworked version of Dudeworks (Thanks Rob and Brian), 1E, et al. (see bottom for longer list) start up scripts. I recently became aware of Chris Stauffers Client Health Checker v1.2. My script focuses on workstation health, Chris’ focuses on SMS health. It is my hope in 2009 to combine these two if it seems intelligent to do. Hopefully we can have this all together in early 2009. Be great to present and then for everyone to tear apart at MMS... anything is possible.

Reminder: this is not finalized. It takes a community. Please feel free to post updates in the forums.

Overview

Workstation Client Health maintenance is a continuous process that must be maintained. The following document gives an overview on how to fix several common workstation issues.

CliFix GPO startup script

In an effort to reduce the amount of common workstation issues I have developed a script to check and change the following common issues. This script is to be run via GPO startup scripts. This requires the script to work as the system account and have intranet connectivity. Both are accomplished by running as a GPO. Script Requirements

Script must be in a location where the computers system account has access. Usually on your domain controller ex. \\FQDNDomain\sysvol\ FQDNDomain\
sc.exe must be present for full successful run.

Either in the run path
system32
system32\DLLCache
Note: there are multiple versions floating around in the average environment

regsvr32.exe needs to be present
%systemroot%\system32 needs to be in system path

Script Settings

All, unless I missed some, sections of the script can be turned on and off in the top of the script. Please review the script as some features will fail without modification.

Please Review the following CONFIG SETTINGS Variables:

SMSVersion
ConfigMgrVersion
WKS_ASSIGNSITECODE
WKS_CacheSize
WKS_LocalAdminGroup
WKS_admACCT
RegPath
strWebAddress
StrCCRServer
strCCRSiteCode
CCMSetUP

What the Script Does

Checks to make sure the script has not run in X many hours.

Example if X = 12 the script will not run again until at least 12 hours after the last occurrence.
This will prevent a slow down on multiple reboots.

Sets DCOM permissions to be correct for SMS / SCCM configuration
Checks to make sure System Path has the 3 required windows paths enabled. (does NOT use WMI or require a restart to change values)

C:\windows
C:\windows\sysetm32
C:\windows\system32\wbem
Also removes %systemroot% from path replacing it with correct full path value
If one of the 3 paths is missing, it will parse the full path removing duplicates and adding a,b,or c to the beginning of the path statement leaving all else unchanged.

Check to see if sc.exe exists in the run from directory and if not in the system32 directory
Checks to see if this script is run on a workstation or server. If a server kills the script
Checks to make sure the correct local admin group is present (value is set in header of script)
Checks WMI service to see if it is set to auto and running. If not executes sc.exe to start the service.
Attempts to connect to WMI object
If the WMI object connect fails

Attempt to do a repair (if no previous status is present in the registry and approved via script switches)
Attempt to do a rebuild (if ‘repair’ status is present in the registry and approved via script switches)
If both the above have failed then do nothing and report major error

Checks to see if Admin$ is present, if not forces existence via WMI
Checks to see if msxml3.dll is registered, if not forces existence via WSH
Checks to see if Qmgr.dll and qmgrprxy.dll are registered, if not forces existence via WSH
Checks to see if OLEAut32.dll is registered, if not forces existence via WSH
Checks to make sure the following services are set to appropriate Status and Mode

RPC
WMI
Firewall/ICS
Server Service
Remote Registry
BITS
Windows Update Services
Terminal Services
Windows Installer
Note: You may want to review the settings for your environment on each of these services. All of the above services are set to default and either Manual or Automatic.

Check the SMS version
Checks the CCMExec service
If SMS is not correct version can be forced to do an install

Needs Review

If the all of the above test passed without issue you have a healthy workstation. The following two checks are for SMS.

Check log file last update time. If the PolicyEvaluator.log file has not been modified in past 14 days do a repair of the client.
Check client assignment. If no assignment set new site code based on AD boundaries in which the client is present.

Note: Some people may want to disable this as it relies on AD

If any fixes above had to be preformed

Check the advanced client state. Which client policies have enabled.
Check the cache size
Send a Client Configuration Request (CCR) to have client installed
Run CCMSetup from the install share on the server.

Note during this script several forms of reporting, logging, and information submitting have been preformed. The standard methods of reporting are:

Event log
Log file in the %temp% directory for the account used to run

GPO = C:\windows\temp

Reporting to a website that submits client status to a SQL table.

Future WebPost on how to do this

Other verbose methods include:· Two levels of command line reportingo Log to Command lineo Verbose to command line· network share copy

Future Additions:

Area's that need improvement

Checking the SMS Client
Install methods for SMS/ConfigMgr Client
ConfigMgr 2007 specific changes
WMI fixing / integration with WMIDiag.vbs

http://www.microsoft.com/technet/scriptcenter/topics/help/wmidiag.mspx

BITS Checking - Correct security
BITS version correct

References:

· MyITForum Forum: http://www.myitforum.com/forums/tm.asp?m=107044 · 1E: www.1e.com · Chris Stauffers soon to be reviewed: http://myitforum.com/cs2/blogs/cstauffer/archive/2008/06/13/client-health-check-script-and-scheduled-task-version-1-1-release.aspx · Brian Mason: Original Author of CliFix · Rob Olson: Original Author of CliFix at www.dudeworks.com · Greg Ramsey: http://myitforum.com/cs2/blogs/gramsey/ · Steve Pruitt: http://myitforum.com/cs2/blogs/spruitt/ · And the MSSMS list http://www.myitforum.com

Script v4.18: REMOVED. v4.19

http://myitforum.com/cs2/blogs/scassells/archive/2009/04/14/sms-2003-client-health-startup-script-v4-19.aspx

hopefully it will be up on www.dudeworks.com soon

Query: HINV older than 15 days

scassells — Tue, 20 Jan 2009 14:32:00 GMT

SELECT dbo.v_R_System.Name0, dbo.v_GS_WORKSTATION_STATUS.LastHWScan

FROM dbo.v_GS_WORKSTATION_STATUS

INNER JOIN

dbo.v_R_System ON dbo.v_GS_WORKSTATION_STATUS.ResourceID = dbo.v_R_System.ResourceID

where datediff(day, dbo.v_GS_WORKSTATION_STATUS.LastHWScan, getdate()) > 15

Software Install Review via the Add Remove Table

scassells — Tue, 06 Jan 2009 22:12:00 GMT

Software Install Review for Add Remove Table

I was reading Joe Funk’s Blog Post SMS Reports - Software Install Review.

I noticed he was using the v_GS_INSTALLED_SOFTWARE table which is included with Asset Intelligence features or ConfigMgr 2007. For those of us who do not have access to that information or for those whose information is not populating. I made a couple of changes so these reports can be run against the v_HS_ADD_REMOVE_PROGRAMS and v_GS_ADD_REMOVE_PROGRAMS tables

As always be aware of line wrap

Step 1 – Installdate0 Field

First thing I noticed is that in the v_GS_ADD_REMOVE_PROGRAMS table is that the values of InstallDate0 are the Wild West, from null to every format possible to convey some value.

Take a look at your own with this query:

SELECT DISTINCT InstallDate0
FROM dbo.v_GS_ADD_REMOVE_PROGRAMS

Example output:

20071011
4/11/2008
Tue Sep 23 08:09:58 PDT 2008
20080108
20060510
2006-10-30 14:30:53
12-5-2006
1/7/2008

Step 2 – Filter out invalid dates

Used the following SQL code to only work with those with valid date times

((CASE ISDATE(INST.InstallDate0) WHEN 1 THEN CAST(INST.InstallDate0 AS DateTime) ELSE NULL END)

Step 3 – Modify the Queries

Software Install review - Count, per application, of every install over past X days
'Currently Installed - This report contains only records for software that was installed (and remains installed) within the review period still installed when the SMS client last checked'

Declare @days INT;
Set @days = 4;

SELECT     INST.DisplayName0 AS Product, COUNT(*) AS Count, @days AS 'Scope of software install review (days)'
FROM         dbo.v_GS_ADD_REMOVE_PROGRAMS AS INST INNER JOIN
                      dbo.v_R_System AS SYS ON SYS.ResourceID = INST.ResourceID
WHERE     ((CASE ISDATE(INST.InstallDate0) WHEN 1 THEN CAST(INST.InstallDate0 AS DateTime) ELSE NULL END) >= DATEADD(dd, - CONVERT(INT, @days),
                      CURRENT_TIMESTAMP))
GROUP BY INST.DisplayName0
ORDER BY COUNT DESC, INST.DisplayName0

'Historical - Uninstalled/Reinstalled - This report contains records of software that was installed within the review period but was since uninstalled or reinstalled'

Declare @days INT;
Set @days = 4;

SELECT     INSTHist.DisplayName0 AS Product, COUNT(*) AS Count, @days AS 'Scope of software install review (days)'
FROM         dbo.v_HS_ADD_REMOVE_PROGRAMS AS INSTHist INNER JOIN
                      dbo.v_R_System AS SYS ON SYS.ResourceID = INSTHist.ResourceID
WHERE     ((CASE ISDATE(INSTHist.InstallDate0) WHEN 1 THEN CAST(INSTHist.InstallDate0 AS DateTime) ELSE NULL END) >= DATEADD(dd, - CONVERT(INT, @days),
                      CURRENT_TIMESTAMP))
GROUP BY INSTHist.DisplayName0
ORDER BY COUNT DESC, INSTHist.DisplayName0

Next steps are to work on the values I ignored as well as values with a NULL install date.

PowerShell: WMI WQL Queries – made easy for remote WMI especially for SMS 2003 or ConfigMgr 2007

scassells — Wed, 01 Oct 2008 19:43:00 GMT

Once upon a time to do a WMI query you had to use one of the following:

WMIC

Cumbersome
Must be an administrator

WBEMTEST

Make the popup windows stop

CIM Studio

Why doesn’t this save my query?
http://www.microsoft.com/downloads/details.aspx?familyid=6430F853-1120-48DB-8CC5-F2ABDC3ED314&displaylang=en

Now we have PowerShell. PowerShell allows a lot of formatting, but check out how easy it is to query WMI:

Note: Crtl+C breaks a query in PowerShell

1) Create the Query Object

$q = New-Object System.Management.ObjectQuery

2) Enter your Query

$q.QueryString = "Select * from Win32_MemoryDevice"

3) Create your searcher and pass the query

$s = New-Object System.Management.ManagementObjectSearcher($q)

4) Set your WMI Path

$s.Scope.Path = "\root\CIMv2"

Note: the proceeding slash for local machines

5) Run the query!

$s.Get()

Grab some useful info

$s.Get() | select Caption, EndingAddress

Caption	EndingAddress
Memory Device	2097151
Memory Device	2097151

Now lets do that again for a SMS 2003 or ConfigMgr 2007 WQL query!

1) Create the Query Object

$q = New-Object System.Management.ObjectQuery

2) Enter your Query

$q.QueryString = "Select * from SMS_R_System"

3) Create your searcher and pass the query

$s = New-Object System.Management.ManagementObjectSearcher($q)

4) Set your WMI Path

$s.Scope.Path = "\\ServerName\root\sms\site_SiteCode"

Note: the remote machine name. This is how you query remote workstations or server via WMI and PowerShell

5) Run the query!

$s.Get()

Grab some useful info

$s.Get() | Select Name, ClientVersion, OperatingSystemNameandVersion

Tip: this can potentially return a ton of information. You can reduce the returns by the following.

1 | foreach {$s.get()} | select name, resourceID

Source: "/\/\o\/\/ [MVP]" http://groups.google.nl/group/microsoft.public.windows.server.scripting/browse_thread/thread/7c0e03c992d507ac/2d8706e707d27965?lnk=st&q=get-content+of+large+files.&rnum=1&hl=en#2d8706e707d27965

Summary: Doing a WQL query via PowerShell is very easy assuming you have the rights to read the WMI.

PowerShell: How do I trigger SMS 2003 Inventory Actions?

scassells — Wed, 01 Oct 2008 19:07:00 GMT

The following is a continuation of: http://myitforum.com/cs2/blogs/scassells/archive/2008/05/20/powershell-sms-2003-configmgr-2007-scripting.aspx

COM object for the SMS 2003 control panel API

$a = New-Object -comobject cpapplet.cpappletmgr

Expose the member variables via Get-Member or GM $a | gm

Name	MemberType	Definition
GetClientActions	Method	IClientActions GetClientActions ()
GetClientComponents	Method	IClientComponents GetClientComponents ()
GetClientProperties	Method	IClientProperties GetClientProperties ()

$a.GetClientActions() | Format-table ActionID, Name

ActionID	Name
{00000000-0000-0000-0000-000000000102}	Software Inventory Collection Cycle
{00000000-0000-0000-0000-000000000107}	MSI Product Source Update Cycle
{00000000-0000-0000-0000-000000000101}	Hardware Inventory Collection Cycle
{00000000-0000-0000-0000-000000000104}	Standard File Collection Cycle
{00000000-0000-0000-0000-000000000103}	Discovery Data Collection Cycle
{3A88A2F3-0C39-45fa-8959-81F21BF500CE}	Request & Evaluate User Policy
{8EF4D77C-8A23-45c8-BEC3-630827704F51}	Request & Evaluate Machine Policy
{00000000-0000-0000-0000-000000000106}	Software Metering Usage Report Cycle

What are the members for GetClientActions()?

$a.GetClientActions() | gm

Name	MemberType	Definition
PerformAction	Method	void PerformAction ()
ActionID	Property	string ActionID () {get}
DisplayNameResDLL	Property	string DisplayNameResDLL () {get}
DisplayNameResID	Property	int DisplayNameResID () {get}
Name	Property	string Name () {get}

To Trigger these actions:

Perform a software inventory:

$a.GetClientActions() |? {$_.name -like 'Soft*Inv*'} |% {$_.PerformAction()}

Perfom a Hardware Inventory: (no shortcuts)

(New-Object –COMObject CPApplet.cpappletmgr).GetClientActions() |? {$_.Name –like ‘Hardware*’} |% {$_.PerformAction()}

I have the WMI table name how to I find the corresponding SQL table?

scassells — Tue, 30 Sep 2008 18:08:00 GMT

The easiest way is to change the SMS_ to V_ and look around in the SQL Database. Lots of great articles about that on myitforum.

How about a query to match on partial table names:

Select correct database. Usually SMS_<SiteCode>

SELECT * FROM sysobjects WHERE name LIKE '%Compliance%' and xtype in ('U', 'V')

What is xtype?

C = CHECK constraint
D = Default or DEFAULT constraint
F = FOREIGN KEY constraint
L = Log
P = Stored procedure
PK = PRIMARY KEY constraint (type is K)
RF = Replication filter stored procedure
S = System table
TR = Trigger
U = User table
UQ = UNIQUE constraint (type is K)
V = View
X = Extended stored procedure

One last thing to try. There is a table in SMS 2.0, SMS 2003 and ConfigMgr that displays collection queries in both WQL (what you see in the console) and SQL.

SELECT CollectionID, QueryKey, WQL, SQL

FROM dbo.Collection_Rules_SQL

ConfigMgr / SMS Reporting Website – What if you enter the wrong credentials?

scassells — Tue, 09 Sep 2008 17:12:00 GMT

I was working with my LAB default reporting site the other day when it prompted me for my user credentials. Without paying attention I typed in my production credentials. It loaded up fine except the navigation window displays nothing.

Oh good, security is working as desired. Now I just need to log out and change my credentials. Hang on there is no logout or switch credentials. How annoying.

Well, I have 30 other windows open. I don’t want to close Internet explorer.

1) Delete all cookies.

a. No Joy

2) Delete Files

a. No Joy

3) Clear History

a. No Joy

Come on this cant be that impossible. Searching Google… nada.

The only consistent way I found to change the ID was to close and reopen IE.

Anyone have any suggestions?

Shaun Cassells at MyITForum.com : SMS 2003

Auto-Fix Windows Update Agent

Find overlapping boundaries in SMS/ConfigMgr/SCCM

Savings Space on SMS / SCCM servers by deleting PCK files - the pitfalls and fixes.

CliFix SMS_DEF.Mof edit

The Case of the Missing Advertisement and a Restart

One

Two

**********Hex, Binary and Decimal Aside*******************

**********/Aside*******************

Summary

References

Clearing a Client Cache and PowerShell

SMS 2003 Client Health Startup Script v4.19

Windows Update Agent – SMS 2003 SP2 or SP3 - Reporting

SMS 2003 Client Health Startup Script v4.18

Overview

CliFix GPO startup script

Script Settings

What the Script Does

Future Additions:

Query: HINV older than 15 days

Software Install Review via the Add Remove Table

PowerShell: WMI WQL Queries – made easy for remote WMI especially for SMS 2003 or ConfigMgr 2007

1) Create the Query Object

2) Enter your Query

3) Create your searcher and pass the query

4) Set your WMI Path

5) Run the query!

Grab some useful info

1) Create the Query Object

2) Enter your Query

3) Create your searcher and pass the query

4) Set your WMI Path

5) Run the query!

Grab some useful info

PowerShell: How do I trigger SMS 2003 Inventory Actions?

COM object for the SMS 2003 control panel API

What are the members for GetClientActions()?

To Trigger these actions:

I have the WMI table name how to I find the corresponding SQL table?

ConfigMgr / SMS Reporting Website – What if you enter the wrong credentials?

Hex, Binary and Decimal Aside*********

/Aside*********