My Endpoint defintion update ADR seems to have stopped working

Hi,
I noticed this morning that all my Endpoint clients haven't downloaded any Endpoint definitions since 1/13/2015.  If I check the update history on the clients they show that the last time they installed an Endpoint definition update was 1/13/2015. 
If I look at the software updates on my SCCM 2012 SP1 server it shows that the last Endpoint definition update downloaded was yesterday (1/14/2015) evening but nothing since then.  It also shows that this Endpoint definition update wasn't downloaded
or deployed as all the Endpoint definition updates have been in the past
The status for the Endpoint definition update ADR says successful and no errors so I'm a little confused as to what's going on here. This has been working fine for over 2 years.
Any suggestions as to where to look to try and diagnose what's happening?
Thanks
Nick

Hi,
I have reviewed the ruleengine.log.  I looked at the ruleengine.lo_ and the ruleengine.log files.  The ruleengine.lo_ shows this from last night:
Successfully downloaded the update content from internet.  $$<SMS_RULE_ENGINE><01-14-2015 02:03:36.439+480><thread=4948 (0x1354)>
Updating package "P0100005" now...  $$<SMS_RULE_ENGINE><01-14-2015 02:03:36.473+480><thread=4948 (0x1354)>
Download action completed for the AutoDeployment  $$<SMS_RULE_ENGINE><01-14-2015 02:03:40.744+480><thread=4948 (0x1354)>
~Enforcing Create Deployment Action  $$<SMS_RULE_ENGINE><01-14-2015 02:03:40.765+480><thread=4948 (0x1354)>
~  Create Deployment Rule Action XML is: <DeploymentCreationActionXML xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="<CollectionId>SMS00001</CollectionId><IncludeSub>true</IncludeSub><Utc>true</Utc><Duration>0</Duration><DurationUnits>Hours</DurationUnits><AvailableDeltaDuration>2</AvailableDeltaDuration><AvailableDeltaDurationUnits>Hours</AvailableDeltaDurationUnits><SuppressServers>Unchecked</SuppressServers><SuppressWorkstations>Unchecked</SuppressWorkstations><AllowRestart>false</AllowRestart><DisableMomAlert>false</DisableMomAlert><GenerateMomAlert>false</GenerateMomAlert><UseRemoteDP>true</UseRemoteDP><UseUnprotectedDP>true</UseUnprotectedDP><UseBranchCache>true</UseBranchCache><EnableDeployment>true</EnableDeployment><EnableWakeOnLan>false</EnableWakeOnLan><AllowDownloadOutSW>false</AllowDownloadOutSW><AllowInstallOutSW>false</AllowInstallOutSW><EnableAlert>true</EnableAlert><AlertThresholdPercentage>90</AlertThresholdPercentage><AlertDuration>7</AlertDuration><AlertDurationUnits>Days</AlertDurationUnits><EnableNAPEnforcement>false</EnableNAPEnforcement><UserNotificationOption>HideAll</UserNotificationOption><LimitStateMessageVerbosity>true</LimitStateMessageVerbosity></DeploymentCreationActionXML">http://www.w3.org/2001/XMLSchema"><CollectionId>SMS00001</CollectionId><IncludeSub>true</IncludeSub><Utc>true</Utc><Duration>0</Duration><DurationUnits>Hours</DurationUnits><AvailableDeltaDuration>2</AvailableDeltaDuration><AvailableDeltaDurationUnits>Hours</AvailableDeltaDurationUnits><SuppressServers>Unchecked</SuppressServers><SuppressWorkstations>Unchecked</SuppressWorkstations><AllowRestart>false</AllowRestart><DisableMomAlert>false</DisableMomAlert><GenerateMomAlert>false</GenerateMomAlert><UseRemoteDP>true</UseRemoteDP><UseUnprotectedDP>true</UseUnprotectedDP><UseBranchCache>true</UseBranchCache><EnableDeployment>true</EnableDeployment><EnableWakeOnLan>false</EnableWakeOnLan><AllowDownloadOutSW>false</AllowDownloadOutSW><AllowInstallOutSW>false</AllowInstallOutSW><EnableAlert>true</EnableAlert><AlertThresholdPercentage>90</AlertThresholdPercentage><AlertDuration>7</AlertDuration><AlertDurationUnits>Days</AlertDurationUnits><EnableNAPEnforcement>false</EnableNAPEnforcement><UserNotificationOption>HideAll</UserNotificationOption><LimitStateMessageVerbosity>true</LimitStateMessageVerbosity></DeploymentCreationActionXML> 
$$<SMS_RULE_ENGINE><01-14-2015 02:03:40.785+480><thread=4948 (0x1354)>
~  Rule XML is: <AutoDeploymentRule xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="<DeploymentId>{68cf82b3-f610-4c8d-a0f3-f2c15f7e3ab4}</DeploymentId><DeploymentName>Automatic">http://www.w3.org/2001/XMLSchema"><DeploymentId>{68cf82b3-f610-4c8d-a0f3-f2c15f7e3ab4}</DeploymentId><DeploymentName>Automatic
Deployment Rule for Endpoint Protection</DeploymentName><UpdateGroupId>ScopeId_382D7556-03CE-4803-8A55-13D9A3E061CB/AuthList_d7c4dfd4-7288-4998-8660-7670b7869ae1</UpdateGroupId><UpdateGroupName/><LocaleId>1033</LocaleId><UseSameDeployment>true</UseSameDeployment><AlignWithSyncSchedule>false</AlignWithSyncSchedule><NoEULAUpdates>false</NoEULAUpdates><EnableAfterCreate>true</EnableAfterCreate><ScopeIDs><ScopeID>SMS00UNA</ScopeID></ScopeIDs></AutoDeploymentRule> 
$$<SMS_RULE_ENGINE><01-14-2015 02:03:40.805+480><thread=4948 (0x1354)>
~  Criteria Filter Result XML is: <AutoDeploymentRule xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="<DeploymentId>{68cf82b3-f610-4c8d-a0f3-f2c15f7e3ab4}</DeploymentId><DeploymentName>Automatic">http://www.w3.org/2001/XMLSchema"><DeploymentId>{68cf82b3-f610-4c8d-a0f3-f2c15f7e3ab4}</DeploymentId><DeploymentName>Automatic
Deployment Rule for Endpoint Protection</DeploymentName><UpdateGroupId>ScopeId_382D7556-03CE-4803-8A55-13D9A3E061CB/AuthList_d7c4dfd4-7288-4998-8660-7670b7869ae1</UpdateGroupId><UpdateGroupName/><LocaleId>1033</LocaleId><UseSameDeployment>true</UseSameDeployment><AlignWithSyncSchedule>false</AlignWithSyncSchedule><NoEULAUpdates>false</NoEULAUpdates><EnableAfterCreate>true</EnableAfterCreate><ScopeIDs><ScopeID>SMS00UNA</ScopeID></ScopeIDs></AutoDeploymentRule> 
$$<SMS_RULE_ENGINE><01-14-2015 02:03:40.825+480><thread=4948 (0x1354)>
~    Parsing Deployment Action XML...  $$<SMS_RULE_ENGINE><01-14-2015 02:03:40.845+480><thread=4948 (0x1354)>
Could not find element PersistOnWriteFilterDevices  $$<SMS_RULE_ENGINE><01-14-2015 02:03:40.865+480><thread=4948 (0x1354)>
Invalid boolean value   $$<SMS_RULE_ENGINE><01-14-2015 02:03:40.889+480><thread=4948 (0x1354)>
Could not find element StateMessageVerbosity  $$<SMS_RULE_ENGINE><01-14-2015 02:03:40.909+480><thread=4948 (0x1354)>
Could not find element AllowWUMU  $$<SMS_RULE_ENGINE><01-14-2015 02:03:40.937+480><thread=4948 (0x1354)>
Invalid boolean value   $$<SMS_RULE_ENGINE><01-14-2015 02:03:40.966+480><thread=4948 (0x1354)>
~    Parsing Rule XML...  $$<SMS_RULE_ENGINE><01-14-2015 02:03:40.985+480><thread=4948 (0x1354)>
~    SQL is: select cis.CI_ID from vCI_ConfigurationItems cis join vProvisionedCIs pci on cis.CI_ID = pci.CI_ID where cis.CI_ID in (17025246, 17025329) order by cis.CI_ID  $$<SMS_RULE_ENGINE><01-14-2015 02:03:41.006+480><thread=4948
(0x1354)>
~      2 of 2 updates are downloaded and will be added to the Deployment.  $$<SMS_RULE_ENGINE><01-14-2015 02:03:41.312+480><thread=4948 (0x1354)>
~    SQL is: select CI_UniqueID from vCI_ConfigurationItems where CI_ID in (17025246, 17025329) order by CI_ID  $$<SMS_RULE_ENGINE><01-14-2015 02:03:41.339+480><thread=4948 (0x1354)>
    SQL is: select distinct cira.ReferencedCI_ID from v_CIRelation_All cira ~join v_AuthListInfo ugi on cira.CI_ID = ugi.CI_ID~where ugi.CI_UniqueID = 'ScopeId_382D7556-03CE-4803-8A55-13D9A3E061CB/AuthList_d7c4dfd4-7288-4998-8660-7670b7869ae1'~and
cira.RelationType = 1 and cira.Level = 1 order by cira.ReferencedCI_ID~  $$<SMS_RULE_ENGINE><01-14-2015 02:03:43.288+480><thread=4948 (0x1354)>
Updates evaluated are different from those in the old deployment. Deployment is not current.  $$<SMS_RULE_ENGINE><01-14-2015 02:03:43.361+480><thread=4948 (0x1354)>
~  Associated Update Group ID found as: ScopeId_382D7556-03CE-4803-8A55-13D9A3E061CB/AuthList_d7c4dfd4-7288-4998-8660-7670b7869ae1  $$<SMS_RULE_ENGINE><01-14-2015 02:03:43.395+480><thread=4948 (0x1354)>
~  Associated Deployment ID found as: {68cf82b3-f610-4c8d-a0f3-f2c15f7e3ab4}  $$<SMS_RULE_ENGINE><01-14-2015 02:03:43.414+480><thread=4948 (0x1354)>
~    Associated Update Group: ScopeId_382D7556-03CE-4803-8A55-13D9A3E061CB/AuthList_d7c4dfd4-7288-4998-8660-7670b7869ae1 with RBAC Scope SMS00UNA  $$<SMS_RULE_ENGINE><01-14-2015 02:05:02.269+480><thread=4948 (0x1354)>
~    Added CI with CI_UniqueID=379684f0-2a93-4acb-aacb-7c2199aa5dd5, CI_ID=17025246 to the deployment  $$<SMS_RULE_ENGINE><01-14-2015 02:05:03.334+480><thread=4948 (0x1354)>
~    Added CI with CI_UniqueID=bbdb363d-9580-4763-9b83-f3c38fe4fed3, CI_ID=17025329 to the deployment  $$<SMS_RULE_ENGINE><01-14-2015 02:05:03.357+480><thread=4948 (0x1354)>
HandleAlerts - Alert ID= 16777222  $$<SMS_RULE_ENGINE><01-14-2015 02:05:13.242+480><thread=4948 (0x1354)>
Setting alert instance name $SUMCompliance2UpdateGroupDeploymentName  $$<SMS_RULE_ENGINE><01-14-2015 02:05:13.635+480><thread=4948 (0x1354)>
~SQL written back is: update Rules set Data = N'<AutoDeploymentRule xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
<DeploymentId>{68cf82b3-f610-4c8d-a0f3-f2c15f7e3ab4}</DeploymentId> <DeploymentName>Automatic Deployment Rule for Endpoint Protection</DeploymentName> <UpdateGroupId>ScopeId_382D7556-03CE-4803-8A55-13D9A3E061CB/AuthList_d7c4dfd4-7288-4998-8660-7670b7869ae1</UpdateGroupId>
<UpdateGroupName></UpdateGroupName> <LocaleId>1033</LocaleId> <UseSameDeployment>true</UseSameDeployment> <AlignWithSyncSchedule>false</AlignWithSyncSchedule> <NoEULAUpdates>false</NoEULAUpdates>
<EnableAfterCreate>true</EnableAfterCreate> <ScopeIDs><ScopeID>SMS00UNA</ScopeID> </ScopeIDs> </AutoDeploymentRule>' where RuleID = 16777218  $$<SMS_RULE_ENGINE><01-14-2015 02:05:15.457+480><thread=4948
(0x1354)>
~CRuleHandler: Rule 16777218 Successfully Applied!  $$<SMS_RULE_ENGINE><01-14-2015 02:05:15.941+480><thread=4948 (0x1354)>
~CRuleHandler: ResetRulesAndCleanUp()  $$<SMS_RULE_ENGINE><01-14-2015 02:05:15.963+480><thread=4948 (0x1354)>
~Updated Success Information for Rule: 16777218  $$<SMS_RULE_ENGINE><01-14-2015 02:05:16.098+480><thread=4948 (0x1354)>
~CRuleHandler: Deleting Rule 16777218  $$<SMS_RULE_ENGINE><01-14-2015 02:05:16.178+480><thread=4948 (0x1354)>
~Found notification file D:\Program Files\Microsoft Configuration Manager\inboxes\RuleEngine.box\16777218.RUL  $$<SMS_RULE_ENGINE><01-14-2015 02:05:27.395+480><thread=4948 (0x1354)>
RuleSchedulerThred: Change in Rules Object Signalled.  $$<SMS_RULE_ENGINE><01-14-2015 02:05:27.430+480><thread=2788 (0xAE4)>
Refreshed ScheduleList instance for Rule (16777218) from schedule string (00447A8000100008) with next occurence (1/15/2015 2:00:00 AM)  $$<SMS_RULE_ENGINE><01-14-2015 02:05:27.462+480><thread=2788 (0xAE4)>
Refreshed ScheduleList instance for Rule (16777221) from schedule string (008D8A8000100008) with next occurence (1/14/2015 4:00:00 AM)  $$<SMS_RULE_ENGINE><01-14-2015 02:05:27.485+480><thread=2788 (0xAE4)>
FindNextEventTime found next event for RuleID 16777221 as :1/14/2015 4:00:00 AM  $$<SMS_RULE_ENGINE><01-14-2015 02:05:27.507+480><thread=2788 (0xAE4)>
RuleEngine: Got next rule execution time successfully. Next event is in  114 minutes  $$<SMS_RULE_ENGINE><01-14-2015 02:05:27.526+480><thread=2788 (0xAE4)>
Sleeping for 15 minutes  $$<SMS_RULE_ENGINE><01-14-2015 02:05:27.551+480><thread=2788 (0xAE4)>
There is the message:
Could not find element PersistOnWriteFilterDevices  $$<SMS_RULE_ENGINE><01-14-2015 02:03:40.865+480><thread=4948 (0x1354)>
so not sure what that means.  I manually ran the Endpoint Definition update ADR from the SCCM console and after doing that it SCCM did appear to download and deploy the latest Endpoint definition from MS. Though interestingly enough if I now look at
the status of the Endpoint Definition update ADR it has a status that says:
0X80072EE2 Network connection: Windows Update Agent ecountered transient network connection-related errors
and if I look at the ruleengine.log file I see the following:
Downloading content with ID 16997511 in the package  $$<SMS_RULE_ENGINE><01-15-2015 11:08:49.618+480><thread=1044 (0x414)>
Failed to download the update from internet. Error = 12002  $$<SMS_RULE_ENGINE><01-15-2015 11:09:55.274+480><thread=1044 (0x414)>
Failed to download ContentID 16997511 for UpdateID 17025570. Error code = 12002  $$<SMS_RULE_ENGINE><01-15-2015 11:09:55.279+480><thread=1044 (0x414)>
Downloading content with ID 16997512 in the package  $$<SMS_RULE_ENGINE><01-15-2015 11:09:55.313+480><thread=1044 (0x414)>
But it appears that this didn't prevent the ADR from working correctly as all my clients seem to have pulled down the latest Endpoint Definition update from the SCCM server.
This morning I also went to the Software section and initiated a "Synchronize Software Updates" from the SCCM console.  In the SCCM console the Software Update Point  Synchronization status shows the last sync completed and the status
is 0x0000.  I looked a the wsyncmgr.log and wsyncmgr.lo_ files and they don't seem to show any errors.
What triggers the ADR to run?

Similar Messages

Maybe you are looking for