SHA keep reporting client non-compliant

I checked the NAP logs on client PC (Applications and Services Logs\Microsoft\Windows\Network Access Protection\Operational) found that the client's SHA keep reporting "non-compliant" even it's in production zone. (Using 802.1x Enforcement NAP
with PEAP-TLS.) 
Anyone has idea? Is this the correct behavior？ THANKS!!!
======================================
Log Name: Microsoft-Windows-NetworkAccessProtection/Operational
Source: Microsoft-Windows-NetworkAccessProtection
Date: 3/31/2014 3:46:08 PM
Event ID: 29
Task Category: None
Level: Information
Keywords:
User: NETWORK SERVICE
Computer: xxx.com
Description:
A Statement of Health Response with correlation ID {87323ABC-xxxxx-4474-96F7-xxxxxxx} - 2014-03-31 07:46:07.496Z was received from the enforcement client 79623.
The current client state is Full Access.
The following SHAs report this client non-compliant:
The following error categories were encountered: FailureCategory None, FailureCategory None,
 The probation expiration time is: 25184-1009-00T-02:-01:-01.955161500Z
The help URL is:
The duration of health check was 1186 ms.
======================================

Hi,
Thanks for your question.
Based on my experience, the event ID 29 is a normal condition and no further action is required. For more detailed information, please refer to the link below:
Event ID 29 — NAP Agent Communication with the Enforcement Client
Best regards,
Susie

Similar Messages

  • How can I get report of only non compliant clients via Fileshare or to admin mailbox each day?

    I need to figure out how to get a daily report of non compliant clients in SCCM2012 to admin email or fileshare.
    Is there any built-in report that returns only non compliant clients I could use to accomplish this,
    and create alert subscription or exchange server connector to receive the message / file once a day ?
    Do I need to use SQL Server Reporting Services for this ? New to SCCM and getting confused with all those reports,
    sorry ;-)

    Yes you need SSRS for this.
    This will help.
    http://be.enhansoft.com/post/2013/08/27/How-to-Set-up-a-Windows-File-Share-Subscription.aspx
    http://be.enhansoft.com/post/2013/08/14/How-to-Set-up-an-Email-Subscription-in-SSRS.aspx
    Non compliant for what?
    http://www.enhansoft.com/

  • ISE 1.2 - Posture Detail Assessment - enforcement audit mode report not show status for non-compliant

    ISE 1.2 - Posture Detail Assessment - enforcement audit mode report not show status for non-compliant.
    - For old version 1.1.4 it can be reported for non-compliant, How can I generate report for this? 
    Thanks
    Kosin Usuwanthim

    It used to be in there (id 226635 is the last one with it); should I clean it up a bit and put it back with a bit more of a disclaimer?

  • Client reporting non-compliant for unknown reasons

    I have a single workstation MBAM test environment, and for whatever reason I cannot get this workstation to appear as compliant with policy.  According to the reports, the OS drive (the only drive) is non-compliant, however all of the settings seem
    to match.  I don't see any errors in the event logs.  Can anyone see anything I might be missing?

    Gaurav, the client settings were matching the policy.  I took nearly all configurations out of the policy to make sure I wasn't missing something.
    slaplace, the hotfix looks like it might take care of it.  I changed the policy to only require AES 128 bit w/ Diffuser (while the client was encrypted AES 256 bit w/ Diffuser), and the client came back as compliant.  I will set policy back to
    256 w/ Diffuser and verify the client comes back non-compliant again, then will apply the hotfix and see if that fixes it. 
    Will let you all know how it works.
    EDIT: Applying the hotfix to the client fixed it.  The client now reports compliant using 256 bit w/ diffuser.  Thanks everyone.

  • Send a OBIEE report to non OBIEE user (Client) Mail in OBIEE11g

    Hi Frenz,
    i`m fresher to OBIEE, i need the step for "Send a OBIEE report to non OBIEE user (Client) Mail in OBIEE11g". searched in on-line got only OBIEE 10g Documents that one also followed but no result.Please help Me....the Step to config a Mail for external user.
    Thnaks,

    Have the SMTP server configured by your admin and create agent privilege given to your role. Then Schedule an Agents to yourself/Testuser with the report to be sent to external user as its Content. Set up the Delivery Profile of the recipient. In the set up for email device - delivery profile specify the external email address. This might be useful
    http://www.oracle.com/webfolder/technetwork/tutorials/obe/fmw/bi/bi11115/delivers/alerts.htm
    Thanks.

  • Send a OBIEE report to non OBIEE user (Client) in Mail OBIEE 11g

    Hi Frenz,
    i`m fresher to OBIEE, i need the step for "Send a OBIEE report to non OBIEE user (Client) Mail in OBIEE11g". searched in on-line got only OBIEE 10g Documents that one also followed but no result.Please help Me....the Step to config a Mail for external user.
    Thnaks,

    This is the Oracle Forms forum. Please post on the appropriate forum here https://forums.oracle.com/forums/category.jspa?categoryID=16

  • Connection issues of Historical Reports Client over a non-Cisco VPN/third party VPN

    When trying to run the Cisco Unified CCX Historical Reports Client over a non-Cisco VPN, the user receives an error.
    The major failure is the connection problem between Historical Reports Client and Cisco Unified CCX Server.
    Error :
    An error occurred while communicating with web server.
    All available connections to database server are in use by other client machines. Please try again later and check the log file for error 5054.
    This works fine when connected to through Cisco VPN .
    Is the third party VPN/ customer's web based VPN blocking the connection between UCCX  server and HRC machine ??
    Thanks !!!
    Shridhar Reddy

    Hi Sridhar,
    Also please try accessing the database port 1504 from your client box.
    Reference:
    http://www.cisco.com/en/US/docs/voice_ip_comm/cust_contact/contact_center/crs/express_8_5/configuration/guide/uccx851pug.pdf
    Hope it helps.
    Anand
    Pls rate helpful posts !!

  • DHCP configuration for non-compliant clients

    So your question isn't for a live situation, but because you are studying for a test?

    hello!
    i have a question about network policy server..
    that is , how to configure DHCP server to lease IP address to non-compliant client??
    specifically for access to remediation servers
    thank you..
    This topic first appeared in the Spiceworks Community

  • Server showing non compliant for a no longer targeted Configuration Item

    Hi all, 
    I have a server that was removed from a collection which had a DCM baseline targeted to it.  It is still showing non compliant for Configuration items that were targeted at the old collection.  (which is correct, it isn't compliant but it isn't supposed
    to be).  I am trying to create a collection based on non compliant items but this server keeps showing up where it shouldn't be.  is there anyway to 'flush' all the compliance information and let the client rebuild it?
    thanks
    -cornasdf
    http://cornasdf.blogspot.com

    The collection is based on a WQL query that basically says, where the configuration item name = x and state <> compliant.  
    I have several of these where the servers that are non compliant fall into a collection that has an advertisement that remediates them.  
    The difficulty here is that I have a collection of BackEnd servers, based on IP Subnet.  That collection has a DCM Baseline targeted at it that checks for non compliance on specific items.  When building
    some new servers, we connected to hte wrong network for a couple of days, so they were in the included in BackEnd Servers collection which handed out the baseline.  We disconnected that link and the servers have fallen out of that collection.  The
    baseline no longer shows in teh control panel app.  
    But in my compliance collections, it still shows up as non compliant for that Conf Item.  
    I have a work around in place.  actually two.  The first was to just delete the client and let it reinstall.  That worked but seems heavy handed.  Secondarily, i narrowed my query by collection,
    ie the query for non compliance now is limited to the collection where I apply the baseline.  this is somewhat limiting for future instances (and shouldn't be necessary).
    it seems like a bad enough design flaw that I assumed I must be missing something pretty obvious.  if I remove a server from a collection w/ a baseline, it shouldn't still be non compliant for things non longer targeted to it.
    -cornasdf
    http://cornasdf.blogspot.com

  • Machine shows Non compliant in SCCM 2012R2 Configuration Manager

    We are using 2012 sccm R2 and one of our client machine shows non compliant in the reports. When we check the machine , we found that all the required and approved patches are downloaded . So it should be a compliant machine .
    SCCm Clinet is ACtive and we are able to run the cycles from the machine too. Would like to know what all steps that we need to perform for solving the issue.
    Server OS 2008 R2
    Thanks
    Madhu Madhavan

    if client having wmi issues pertaining to configmgr,then it will not (most cases) send the inventory .check the inventoryagent.log .To fix WMI issues.you can try the script http://eskonr.com/2009/03/how-to-troubleshoot-the-systems-which-has-wmi-issues-rebuild-wmi-repository/
    if you are sure that,client is functioning normal and the issue is only with software update compliance,you can try refresh the compliance state using script https://msdn.microsoft.com/en-us/library/cc146437.aspx.
    Eswar Koneti | Configmgr blog:
    www.eskonr.com | Linkedin: Eswar Koneti
    | Twitter: Eskonr

  • SCCM 2012 R2 - Last Enforcement State is Non-Compliant

    Hi,
    I deployed Windows updates to my Desktop collection as Requred updates. Then, I run summarization and saw various last enforcement states: compliant, unknown and
    in progress (including downloading, installing, reboot required etc).
    Then I deployed Windows updates to my Servers collection as Available updates. In this case, I see in
    In Progress section only Non-Compliant status. No records about Reboot required state etc. I ran many times the Software Update cycle on client, but no changes.
    In but deployments I set Message level on Detailed. 
    Is it a normal behaviour for Available updates?

    Because the SU are set to available, the SU will not automatically download and apply, therefore you are less likely to see anything but non-compliant and compliant.
    Yes there is a small chance that you will see other status messages but that is strictly a timing issue. As you happened to run the report at the exact moment that someone is installing the SU on a server.
    Garth Jones | My blogs: Enhansoft and
    Old Blog site | Twitter:
    @GarthMJ

  • Deployment Question and non-compliant

    Hi, I have a question about deployments and non-compliant systems. Since we updated to 2012 R2 I have had many patching deployments fail with non-compliant messages. If I bring up the deployment it shows many are installed and many are Required.
    Could anyone answer the following question?
    If for example I am deploying a IE 11 patch to Windows 7 machines that does not have IE 11 installed yet would that give the non-compliant error because it cannot install the IE11 patch? This would also apply to .Net 4 and 4.5 for example. We deploy Software
    Update Groups based on Operating Systems so every month I search for every patch non-expired and not superseded for the OS in question and then make the software update group based on that. I figured if the software update group had a patch for a product like
    IE 11 that was not installed on the device yet it just would not install it.
    Any help is appreciated.

    Hi,
    If the update isn't applicable let's say that IE11 is not installed it will not report it as non-compliant and it will not report it as required either so you should be fine in the reports.
    Regards,
    Jörgen
    -- My System Center blog ccmexec.com -- Twitter
    @ccmexec

  • Variable to keep a client list

    I was thinking to use a variable to keep a client list which would be eventually used in reports. Without using a variable I have to type the list in case statement.
    Does this feature available in OBIEE?
    Thanks,
    Ted

    I have a list of client number and it is tracked as a group. In other words, all metrics are grouped by two groups (in my list or not in the list). For example, the client numbers are from 1 to 300. In my report, I have only 3 columns (month end date,client group,total balance). For the client group, I have to enter the list in the CASE statement in order to have two separate groups (One with client number between 1 and 300 and other group NOT IN Between 1 and 300). I have found this would work for some ad hoc reports. As I started building dashboard with different reports tracking my portfolio, I have ended up keying in the list in all reports. However, the difficult part is to change list in different reports when updating it. In other programming language, I could keep all client numbers in big list and then use it in other reports by referencing a variable name. Does Oracle BI have similar feature? I am new to Oracle BI tool and not sure about how to approach this problem.
    Any help is appreciated.
    Thanks,
    Ted

  • Devices in Deployment status show up as Non-Compliant

    In the deployment status section of SCCM 2012 we have 6 of the 10 servers listed in the In-Progress tab which are Non-compliant. 3 of the servers are list as Downloaded Updates. Verified that the boundaries are set up correctly and check relevant logs and
    no software updates are being pushed out to the servers almost an hour into the maintenance window. Not sure what the cause is, could use all the help I can get. Thanks!

    Hi,
    Is the client healthy?(CcmEval.log, ClientIDManagerStartup.log, ClientLocation.log, LocationServices.log)
    Could the client communicate with MP? Please check CcmMessaging.log and open
    http://<MP Name>/sms_mp/.sms_aut?mplist in IE on the client to see whether it can find the MP.
    Best Regards,
    Joyce

  • Non-Compliant Issue

    Can anyone explain to me why the following item is considered non-compliant on this list? It states for the reason that it could not find a compatible TPM, but when you look at the details it clearly shows that it is encrypted and that TPM is the protector
    type.

    I answered my own question on this one.  It is apparently a bug in MBAM 2.5 when using AES-256 with Diffuser.  I installed Hotfix KB2975636 on the client system and it corrected in the next update without an issue. 
    If anyone else is looking for this Hotfix, here is the link.
    https://support.microsoft.com/kb/2975636?wa=wsignin1.0

Maybe you are looking for