Deployment Question and non-compliant

Hi, I have a question about deployments and non-compliant systems. Since we updated to 2012 R2 I have had many patching deployments fail with non-compliant messages. If I bring up the deployment it shows many are installed and many are Required.
Could anyone answer the following question?
If for example I am deploying a IE 11 patch to Windows 7 machines that does not have IE 11 installed yet would that give the non-compliant error because it cannot install the IE11 patch? This would also apply to .Net 4 and 4.5 for example. We deploy Software
Update Groups based on Operating Systems so every month I search for every patch non-expired and not superseded for the OS in question and then make the software update group based on that. I figured if the software update group had a patch for a product like
IE 11 that was not installed on the device yet it just would not install it.
Any help is appreciated.

Hi,
If the update isn't applicable let's say that IE11 is not installed it will not report it as non-compliant and it will not report it as required either so you should be fine in the reports.
Regards,
Jörgen
-- My System Center blog ccmexec.com -- Twitter
@ccmexec

Similar Messages

FCS Antimalware Engine Deployment Status shows non-compliant

We have Forefront Client Security as the enterprise antivirus solution. We see that all the computers are updated with the latest virus definition files through WSUS with no issues. When I generate the compliance report, (deployment summary) I find that
the pie charts for spyware deployment status and the antivirus deployment status show normal counts.
However, I see that the Antimalware Engine isn't updated. The current version, per the report is 1.1.9901.0, but we have over 1800 computers running version 1.1.10802.0.
I'm new to Forefront, and would like to know what the procedure is to update the engine version on all the 1800+ computers with minimum administrative effort. :)
As an example, please find the version details of one of the clients below:
Client Version: 1.5.1937.0
Engine Version: 1.1.10802.0
Antivirus definition: 1.179.857.0
Antispyware definition: 1.179.857.0
Support
For more information on the program, visit the Microsoft information page at http://go.microsoft.com/fwlink/?LinkId=64530.
Any help would be greatly appreciated. Thank you in advance!

Hi,
Does other Client Security components report with correct version numbers and only Antimalware Engine is incorrect?
Best Regards,
Joyce
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

AIA Deployment Questions and Answers

Question Is it recommended to have one single Deployment Plan for all the composites, or one each for the requestor ABCS, Provider ABCS, EBS etc?
Answer There is no particular recommendation. If you have implemented your services properly and idependently (see http://blogs.oracle.com/aia/2010/11/aia_11g_best_practices_for_dec.html), you can deploy them in any order and it does not really matter if you have one or multiple DPs as everything gets deployed.
Question Looking at the DP that gets generated, it looks like they can be manually created, without going through the AIA LCW, BOM generation etc. I know it is not the approach suggested as per AIA flow, but is there anything wrong with doing it?
Answer There is nothing really wrong with hand-crafting the DP except that you lose the overall stream of information from start to end in your development lifecycle. But some customers actually decided to do it this way, though.
Question What is the significance of the /oracle/product/Middleware/AIA/aia_instances/my_instance/AIAMetaData/config/AIAConfigurationProperties.xml file? When an interface is migrated from Dev to Test, how do I make sure that this file is updated in Test instance? Is it by manually updating and running UpdateMetaData.xml? or the AID will take care of it?
Answer This file is absolutely key at runtime as services read certain properties (e.g. the actual endpoint of the services that are called) from that file. I would assume your services will fail if you don't have a valid file on your test environment, i.e. having a section for each of your services.
And yes, the AID takes care of maintaining it. Every service you created with Service Constructor should have a file called AIAServiceConfigurationProperies.xml. When running AID to deploy such a service, it first adjusts the values in that file to match the current environment, then merges the content into AIAConfigurationProperties.xml and finally uploads it to MDS.

Hi,
Based on the above, if the composite folder contains AIAServiceConfigurationProperies.xml, the AID should do the following,
1. Adjust the values of the server and port, as long as the necessary replace token command is included in the Preinstallscript of the Deployment Plan
2. Merge the content of the /composite/AIAServiceConfigurationProperies.xml into $AIA_INSTANCE/AIAMetaData/config/AIAConfigurationProperties.xml
3. Upload $AIA_INSTANCE/AIAMetaData/config/AIAConfigurationProperties.xml into MDS.
I have tried to run the Deployment Plan given below, and the above steps did not happen.
<DeploymentPlan component="XXXX" version="3.0">
<PreInstallScript>
     <replace file="${AIA_HOME}/Composites/ABCS/Ebiz/CreatePurchaseOrderListEbizProvABCSImpl/composite.xml"
     token="xxxxxxxx.xxxxx.xxx.xxx" value="${fp.server.adminhostname}"/>
     <replace file="${AIA_HOME}/Composites/ABCS/Ebiz/CreatePurchaseOrderListEbizProvABCSImpl/composite.xml"
     token="9999" value="${fp.server.soaserverport}"/>
     <replace file="${AIA_HOME}/Composites/ABCS/Ebiz/CreatePurchaseOrderListEbizProvABCSImpl/AIAServiceConfigurationProperties.xml"
     token="xxxxxxxx.xxxxx.xxx.xxx" value="${fp.server.adminhostname}"/>
     <replace file="${AIA_HOME}/Composites/ABCS/Ebiz/CreatePurchaseOrderListEbizProvABCSImpl/AIAServiceConfigurationProperties.xml"
     token="9999" value="${fp.server.soaserverport}"/>
</PreInstallScript>
<Configurations>
<EndpointConfigurator target-server="pips.XXXX" dir="${AIA_HOME}">
</EndpointConfigurator>
<Datasource name="APPS" jndiLocation="jdbc/APPS" action="create" database="participatingapplications.Ebiz.db.EBIZ01" xa-enabled="true" wlserver="pips.XXXX"/>
<UpdateMetadata wlserver="pips.XXXX" >
<fileset dir="${AIA_HOME}/AIAMetaData">
<include name="AIAComponents/ApplicationObjectLibrary/Mar/**" />
<include name="AIAComponents/ApplicationConnectorServiceLibrary/Mar/**" />
<include name="AIAComponents/ApplicationObjectLibrary/Ebiz/**" />
<include name="AIAComponents/ApplicationConnectorServiceLibrary/Ebiz/**" />
</fileset>
</UpdateMetadata>

<DbAdapter connection-instance-jndi="eis/DB/APPS" datasource-jndi="jdbc/APPS" xa-enabled="true" action="create" wlserver="pips.XXXX"/>

</Configurations>
<Deployments>
<Composite compositeName="CreatePurchaseOrderListEbizProvABCSImpl" compositedir="${AIA_HOME}/Composites/ABCS/Ebiz/CreatePurchaseOrderListEbizProvABCSImpl" revision="1.0" wlserver="pips.XXXX" action="deploy"/>
</Deployments>
<PostInstallScript>
</PostInstallScript>
</DeploymentPlan>
Can you please let me know if I am missing something in the DP.
Thanks,
Anish.

Devices in Deployment status show up as Non-Compliant

In the deployment status section of SCCM 2012 we have 6 of the 10 servers listed in the In-Progress tab which are Non-compliant. 3 of the servers are list as Downloaded Updates. Verified that the boundaries are set up correctly and check relevant logs and
no software updates are being pushed out to the servers almost an hour into the maintenance window. Not sure what the cause is, could use all the help I can get. Thanks!

Hi,
Is the client healthy?(CcmEval.log, ClientIDManagerStartup.log, ClientLocation.log, LocationServices.log)
Could the client communicate with MP? Please check CcmMessaging.log and open
http://<MP Name>/sms_mp/.sms_aut?mplist in IE on the client to see whether it can find the MP.
Best Regards,
Joyce

What is "Remediate non Compliant Rule when supported" and how to use it ?

Hi,
now i have created around 10 baselines for the driver compliance check for different make and model of laptops and desktops, the os platform on the computer will be Win 7 X 64 computers
CI's working fine and iam curious to learn what is the ( Remediate non Compliant Rule when supported ) option actually ment for , what all we can use it for ?
and i need a example with complete steps too please
all i can understand from the word Remediate is that it will either run a query or initiate a process such as install the correct version of driver etc , please correct me if iam wrong
Thank you
OSLM ENGINEER - SCCM 2007 & 2012

When creating a CI you can also configure a remediation script, that script will be used to remediate a non-compliant system. Also, some simple things like change the value of an existing registry key from 0 to 1 are supported out-of-the-box for compliance
and remediation.
An example:
http://www.petervanderwoude.nl/post/allow-direct-installation-of-windows-8-apps-via-compliance-settings-in-configmgr-2012/
Another example:
http://www.petervanderwoude.nl/post/go-to-desktop-on-sign-in-on-windows-8-1-via-compliance-settings-in-configmgr-2012/
My Blog: http://www.petervanderwoude.nl/
Follow me on twitter: pvanderwoude

Question Regarding Mesh with 3702 and non AC ap´s

Hello!
quick question regarding MESH deployments with 2 different sorts of AP´s: AC and non-AC modells: If my 3702i is my root AP´s, and 3602i my MAP - will AC still work in 80Mhz, or will I have to switch to 40mhz (and thus crippling (???) AC performance?)
Not 100% sure on this... I *think* it should still work for the normal 802.11n connection, but I´m not sure if the 80mhz channel width (needed??) for AC, will cause the non-ac 3602i to be stranded?
Thanks alot for your insight!

Currently, my network DHCP server is a software based DHCP server. In reading over your post if I understood correctly it sounds like the managed switch would have its own hardware based DHCP server to assign IP addresses to those clients identified on the "external" VLAN. Did I understand that correctly or did misread something?
DHCP server will be software based, even though you defined it on your switch, it is DHCP service running on its OS.
I am configuring this setup for a small business application and will need to purchase a managed switch with 16 or 24 ports. Do you have any recommendations on a particular managed switch that will handle the VLAN configuration and include POE while keeping costs in mind.
In this forum, most of us discussed about Cisco enterprise grade wireless. Here is 2960X series switch detail, if you are interested
http://www.cisco.com/c/en/us/products/switches/catalyst-2960-x-series-switches/index.html
You may need to check the pricing with your Cisco account manager or from a Cisco partner.
HTH
Rasika
**** Pls rate all useful responses ****

VCSE with dual NIC / SIP H323 encrypted call / traversal and non-traversal call license questions

Dear All,
I have a few questions and I would appereciate if someone will answer my questions?
1) May I know pros and cons of using Dual NIC and single NIC with VCSE in DMZ?
2) In order to make H323 and SIP encrypted call, what configuration need to be done on Cisco endpoint, non-cisco endpoint, VCSC and VCSE (both signalling and Media need to be encrypted).
3)let say my VCSE is in DMZ- endpoint A (cisco) and endpoint B (non-cisco) are registered on VCSE. I would like VCSE to use non-traversal call license when A call to B or B call to A regardless of whether H323 or SIP call.How can I force VCSE and endpoints to use non-traversal call. I only want VCSE to handle signalling and media is EP to EP direct. As traversal license is quite expensive.
I found following information from Cisco document.
all Cisco TelePresence endpoints are traversal enabled and so a traversal license will always be needed when at least one of the endpoints involved in the call is a Cisco TelePresence endpoint.
Is it possible to disable traversal client feature of Cisco endpoint?
Thanks and Best Regards,

voice register pool 4
add-->codec g711ulaw
voice register global
no create pro
create prof
and enable below debugs and send the logs
deb ccsip mess
deb voip ccapi inou
deb h225 asn1
deb h245 asn1

Deploying EAR and EJB (ClassLoader Question)

Hi,
Have a few queries. Appreciate any quick answers.
(a) To deploy a EAR or EJB jar to WebLogic server, is it necessary to include the jar location specifically in $CLASSPATH?
I think not. Am I correct?
(b) Is the bean/EAR deployed at module level? Is there a setting for this - is it at bean deployment descriptor? Where can I find this?
If (say) I need to update an EJB, do I un-deploy, update and re-deploy it?
Or must I restart the entire WLS container?

--> An EAR includes one or more EJB files. You don't need to specify the location because it's contained at application.xml file inside the EAR.
--> Each bean has a deployment descriptor. You can see it at META-INF directory
If you need to update an EJB (that it is not part of and EAR), you are right.
The WLS container not need to be restarted.
Jin

Updates in progress - status non-compliant

I deployed my latest software updates (Patch Tuesday) a few days ago to my XP client collection (yes - I know it's going away soon :)) and I see that looking at the Deployment Status they are reading as
In progress but status set to non-compliant.
Strangely I had pushed the same deployment to my test collection a week previously and they had installed normally.
I had a look at various logs and everything seems to have no discernible errors but looking at a sample of the computers in question shows that the updates have NOT installed.
Opening the 'more details' pane for each computer shows that the software updates are set to a status of
required.
Confused as to where to look now to troubleshoot.
My software update deployment to my Windows 7 collection is successful. No errors in the deployment status window.
Any help or pointers are appreciated.
Thanks,
John

Hi,
If these update logs have no discernible errors, you could enable verbose logging to help you find more information.
Please check the logs in the following KB to find why were these updates not installed.
(http://technet.microsoft.com/en-us/library/hh427342.aspx#BKMK_SU_NAPLog)
Best Regards,
Joyce Li
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

App-V 5.0 // Visio - Project with Integration + local Office 2010 Deployment Kit and COM settings

Hi, I did read all the Microsoft and non-microsoft documentation first. However, I didn't find an answer to these 3 questions:
Situation:
* Locally installed Office 2010.
* Visio and Projects 2010 sequenced with App-V 5.0 SP3 sequencer with integration scenario (http://support.microsoft.com/kb/2830069)
* User-target of Visio and Project (I now according to documentation this should be published globally. Since not every user has a license this is no option. So far my tests do not show any problems with user-targeted visio/project)
* Visio has "allow COM objects to interact with the local system" and "OutOfProcessEnabled" enabled
1) When targeting both visio and project to the user with integration the licensing component only works for the first started application. Therefore I also install the licensing kit locally which make both the visio and project licensing work just fine.
Anyone sees a problem with having the license kit installed locally and stream the applications with integration on top? With my tests all seems to work well. The advantage of this is that I do not have to have separate packages for integration and non-integration
scenario's.
2) To make drag-and-drop from visio drawings in word work I enabled the COM interaction and I need also to set OutOfProcessEnabled="true". Does anyone now how to set OutOfProcessEnabled to true inside the .appv (it is possible with application
virtualization explorer) and not only manually afterwards in the xml's?
3) Should these COM settings be enabled for project as well? It seems that pasting in word from project has not the same interaction, it just pastes a table.

1. We did similar, installed that MSI for the licensing component locally, and streamed Project and Visio 2010, and so far so good.
2. There is no way to set those COM options inside the .appv. You can set integrated vs isolated, but no IP or OoP COM, you have to use the deployment XML.
3. This gets tougher to answer, but it goes to how much isolation do you want. Some of the articles are great just go over my head slightly, but have to deal with how the filter driver processes certain kinds of COM, IP or OoP. With Isolated
(as opposed to integrated) the COM systems (local and package) are totally isolated except for global exceptions.
With integrated, you can further 'integrate' the COM subsystems by enabling those options. Correct me if I'm mistaken though.
So do you need to? If everything works for you I'd say no, but you might find something else doesn't work without those settings.
Also very important, you cannot join a CG without those subsystems being equal. So if Project and Visio ever need to be in a CG together and the COM settings aren't identical, you will get an error at the client.
I really like this article but not going to lie it goes over my head a bit (a bit or a lot depending on my coffee intake)
http://blogs.technet.com/b/gladiatormsft/archive/2015/01/14/app-v-5-further-into-com-and-dynamic-virtualization.aspx

Latest Bioses UEFI and non UEFI for R9 290 GAMING 4G?

Please post latest bioses UEFI and non UEFI for R9 290 GAMING 4G:
sn: 602-V308-02SB1312014791
Thank's

Svet provided the latest vbios which is TV308MH.131.
Quote from: gjamie86 on 26-May-15, 22:02:09
I found a more recent file though at techpowerup (015.044.000.005.000000) Build date 2014-02-18 00:22:00.
You can't flash any random vbios. Even if it is offered for the same model at techpowerup. Any batch of the same card model can require a different vbios version. Only MSI or the staff here can tell you which version matches. The version informations taken from gpu-z (like 015.044.000.005.000000) are irrelevant and do not represent any real vbios version. Besides TV308MH.131 that has been provided is dated 08/13/14 (Month-Day-Year).
Quote from: gjamie86 on 26-May-15, 22:02:09
Last question, can I flash bios #2 as well or is that locked ?
The card offers a UEFI/GOP and a legacy vbios to switch between. Both could be updated (if there would be later versions what is not the case).
EDIT: gjamie86, just realized that you hijacked this thread. open an own topic and provide the S/N of card and current (original) vbios saved to file. >>Please read and comply with the Forum Rules.<<

SIT Issues - Undefined Functions and non-compilation

Dear All,
FIrst off hi! Am new to LabVIEW, SIT and the forums. I currently have an issue with SIT 4.0 that I hope you can help me with.
Background:
We are trying to move a Simulink model off of a Windows environment into a cRIO-9004. This will run the simulation on startup and will get its data and will pass its data via UDP links (2 x Transmits, 2 x Receives). The system will not have a host VI, it is to run stand-alone in that respect.
Currently we have a model working fine in Simulink. It communicates both locally and over the network using custom UDP blocks that we wrote in C (and so have src for).
Issues:
Currently when we try to build a DLL from ANY model (even a simple output of a constant) the model will autocode into C and a DLL will build but when importing it into LabVIEW we are told that there are functions defined in the DLL that are not defined in the header (it lists a standard 21 functions [i.e. NISIT_<fn name>] ). The header seems to define a different 4 (or 5 - currently not to hand apologies) <Model name>_<fn name>. These are soemthing like Initialize, Update, Output, Terminate.
So I cannot currently import. The 21 functions seem overkill to manually define in the header but am I wrong? Why is the SIT not writing the header correctly. This issue relates to a model without our UDP blocks, the UDP functionality would be added around the DLL in LabVIEW using standard LabVIEW function blocks.
In addition, rather than directly importing the DLL we considered directly deploying a DLL with the UDP functions embedded in it. However, when using RTW in Simulink it autocodes to C fine, but upon compilation into a DLL is raises issues (in true MATLAB style, typically vague and non-helpful). Any ideas?
Many thanks for any of your time,
Rich
Additional Info:
LabVIEW 8.5 (with Real-Time Module)
MATLAB 2007a
MS VC++ 6.0
The engineer who wrote the custom UDP blocks suggests that it might be an issue with using WinSock in his blocks
Any other info please ask

Adnan,
Thank you for looking into this and I must apologise, my original post wasn't all that clear with hindsight. So I will answer you questions and try to be clearer on the situation:
There are two situations and issues here.
1) Any simlpe model (i.e. constant -> output, or say pulse_gen -> transfer_fn -> output) will happily compile and link to a DLL using you nidll.tlc and the makefile etc that it produces. When importing the DLL (just standard import, not using SIT Connection Manager) I get an error, however:
2) When exporting a DLL (like above) it will load fine onto the target when using SIT Connection Manager, no errors like above. We thought of using this method to do everything in Simulink and use the SIT connection manager as above to load it all. The issue we were having with this is that the UDP blocks that were custom written would not compile when using nidll.tlc and the makefile etc. It will run fine as an s-function in Simulink. The engineer who wrote the blocks thinks it might be that your makefile would not like the UDP blocks as they use Winsock and he assumes that the makefile will raise an error as winsock will not be in the LabVIEW environment.
So to fully answer your questions:
1) What are the exact codes?
When examining the error in Situation 1 that's exactly what I get. Interestingly if I include all the header it lists on the right hand side (clearer in the following screen print) then LabVIEW hangs when adding parsing the "simstruc" headers: (N.B. if you are looking at the addresses of these images then ignore the name of this one!)
The other error I'm getting with regards to the UDP blocks manifests as follows (ignore Paint in the background showing the Config Screen):
2) Does the error occur for any model or just yours?
The errors surrounding the missing functions concerns any model when importing (SIT Connection Manager seems not to mind). The error when compiling/linking the DLL surrounds just our model due to the UDP blocks
3) Are the 21 undefined functions created by you or purely by the Simulink compiler?
We haven't touched any of the files after they are thrown out of the compiler. The 21 or so functions it lists all begin NIRT_<FnName> (N.B. I previously posted wrongly stating NISIT_<FnName>. NIRT_ is correct) so I assume that's the compiler. The ones defined in the header (the 4) all start <ModelName>_<FnName>
The functions I assume I want (copied from the produced header file - I have not edited it. RWFJMildModel is the name of the Model file. There are no instances of the letters NIRT):
/* Model entry point functions */
extern void RWFJMildModel_initialize(boolean_T firstTime);
extern void RWFJMildModel_output(int_T tid);
extern void RWFJMildModel_update(int_T tid);
extern void RWFJMildModel_terminate(void);
The ones LabVIEW finds in the DLL (due to the DLL_EXPORT I imagine) and not the header can be seen in previous screen prints.
4) Are you using nidll.tlc as your System Target File?
Yes all instructions provided online, in the SIT 4 help etc are followed and this includes using nidll.tlc:
5) If the model you are trying to build does not use your custom UDP blocks, then why do you believe the issue is related to using WinSock in those blocks?
The model we plan on using eventually currently includes the UDP blocks, although if we cannot import them we will wrap the UDP functionality around the "rest of the model DLL" in LabVIEW provided we get that working. The other models are simple (as in thrown together in less than 30 secs) and I have no reason to believe this, I think this confusion was caused by my terrible first post, apologies.
Thank you for you help, it is much appreciated
Rich
P.S. My company blocks imagehosting sites so I cannot confirm if the screen prints are in place, in the right order etc. They should however all be there!

SHA keep reporting client non-compliant

I checked the NAP logs on client PC (Applications and Services Logs\Microsoft\Windows\Network Access Protection\Operational) found that the client's SHA keep reporting "non-compliant" even it's in production zone. (Using 802.1x Enforcement NAP
with PEAP-TLS.)
Anyone has idea? Is this the correct behavior？ THANKS!!!
======================================
Log Name: Microsoft-Windows-NetworkAccessProtection/Operational
Source: Microsoft-Windows-NetworkAccessProtection
Date: 3/31/2014 3:46:08 PM
Event ID: 29
Task Category: None
Level: Information
Keywords:
User: NETWORK SERVICE
Computer: xxx.com
Description:
A Statement of Health Response with correlation ID {87323ABC-xxxxx-4474-96F7-xxxxxxx} - 2014-03-31 07:46:07.496Z was received from the enforcement client 79623.
The current client state is Full Access.
The following SHAs report this client non-compliant:
The following error categories were encountered: FailureCategory None, FailureCategory None,
The probation expiration time is: 25184-1009-00T-02:-01:-01.955161500Z
The help URL is:
The duration of health check was 1186 ms.
======================================

Hi,
Thanks for your question.
Based on my experience, the event ID 29 is a normal condition and no further action is required. For more detailed information, please refer to the link below:
Event ID 29 — NAP Agent Communication with the Enforcement Client
Best regards,
Susie

Non-Compliant Issue

Can anyone explain to me why the following item is considered non-compliant on this list? It states for the reason that it could not find a compatible TPM, but when you look at the details it clearly shows that it is encrypted and that TPM is the protector
type.

I answered my own question on this one. It is apparently a bug in MBAM 2.5 when using AES-256 with Diffuser. I installed Hotfix KB2975636 on the client system and it corrected in the next update without an issue.
If anyone else is looking for this Hotfix, here is the link.
https://support.microsoft.com/kb/2975636?wa=wsignin1.0

SCCM 2012 R2 - Last Enforcement State is Non-Compliant

Hi,
I deployed Windows updates to my Desktop collection as Requred updates. Then, I run summarization and saw various last enforcement states: compliant, unknown and
in progress (including downloading, installing, reboot required etc).
Then I deployed Windows updates to my Servers collection as Available updates. In this case, I see in
In Progress section only Non-Compliant status. No records about Reboot required state etc. I ran many times the Software Update cycle on client, but no changes.
In but deployments I set Message level on Detailed.
Is it a normal behaviour for Available updates?

Because the SU are set to available, the SU will not automatically download and apply, therefore you are less likely to see anything but non-compliant and compliant.
Yes there is a small chance that you will see other status messages but that is strictly a timing issue. As you happened to run the report at the exact moment that someone is installing the SU on a server.
Garth Jones | My blogs: Enhansoft and
Old Blog site | Twitter:
@GarthMJ

Deployment Question and non-compliant

Similar Messages

Maybe you are looking for