Software Updates Deployment Evaluation Cycle Enforcement state unknown

Hi All,
I have an issue were I deployed software updates to a collection that have a maintenance window of 5 hours. The next day when I checked the deployments tab it show the updates as 75% compliant with 3 Servers failed to install updates as no further maintenance
windows were planned.
I then check the deployments tab 2 days later and it still showed 75% compliant but all the servers were in the unknown Client
check passed/Active
Is this because I have no further maintenance windows please advise and if not how can I resolve this thanks

You should not use the deployments node in the console to check for software updates compliancy. The reason is because it shows the status of the deployment and not of the installation of the updates. For example if the updates are installed, the deployment
will show compliant, but when the next re-evaluation of the deployment fails, the deployment will show as failed, while the updates are actually still installed. So always use the reports to check for compliancy.
My Blog: http://www.petervanderwoude.nl/
Follow me on twitter: pvanderwoude

Similar Messages

Software Updates Deployment Evaluation.

Hi,
I would like to get some clarification around the Software Updates Deployment Eval. cycle. (SCCM R2 CU3)
Example scenario:
I have a Software Update Group that contains 200 updates. This SUG includes updates that are prerequisites for other updates in the same SUG. So, when scanning occurs. Only one of these updates are at that particular time considered applicable.
The software update deployment deadline is reached. The update is installed, as expected. The then agent reports compliance against the update deployment.
Then comes the Software Update Scan schedule, when a new scan is made against the SUP more updates are now detected as required because of the previously installed update - from the same SUG which are deployed.
This leaves me in a situation where the agent is compliant against the Software Update deployment and non-compliant in regards to the actual Software Update Group.
I can of course just hit the schedule for Software Update Deployment Evaluation manually on the agent or simply do something (adding an update or whatever) that modifies the actual software updates deployment policy. This would in turn cause a new evaluation
to occur at the client.
Bottom line. Is my conclusion correct or have i missed something here?
If i'm correct, a good thing would be to add scheduling options available for the actual "software update deployment evaluation".
That would really come in handy in situations like above scenario.
Br,
Chris

The next scheduled scan cycle will pick up the newly applicable but non-compliant updates in the deployment.
However, note that update compliance at the client level is done against the entire update catalog as this is actually done by the Windows Update Agent (WUA) which knows nothing about ConfigMgr. Thus, the fact that an update is in a deployment or not is
completely irrelevant as far as compliance and compliance reporting goes (which is part of the reason why compliance reporting in ConfigMgr is tricky).
Updating the policy of an update deployment will kick off a scan cycle (just like creating a new deployment will) on the clients which is why you are probably seeing this behavior as addressing the scenario.
Jason | http://blog.configmgrftw.com | @jasonsandys
Thanks Jason,
What you are describing exactly matches the point I’m trying to make here. There is no correlation what so ever between update scans and actual software update deployments. The logic just isn't there. Which is a logic that is lacking
– in my opinion.
I really do think there is room for improvement here.
Case:
A customer wants to minimize the spread of reboots (a maint. window overnight should be sufficient for the agent to get the server fully up to date). The admin – who also wants to minimize effort in regards to worrying about MS bundling\prereq
requirements – simply wants it all to be taken care of by the updates deployment agent.
Example:
Software update deployment contains required updates as well as updates that will not be detected as required - until the deployment has been run – and a new update scan cycle has taken place.
The server reboots and updates deployment agent says all is fine – with regards to the deployment in it's current state, of course.
But it's not.
The server then issues a new scan (maybe 4 hours later and way behind the end of the maint. window) according to the software updates scan schedule, and suddenly 10 more updates are applicable, but still within the same deployment.
What happens? Nothing, sadly. Next maint. window? Nothing.
Not even a (client agent set – and scheduled) software update deployment re-eval takes care of this since – according to my findings – the deployment will never really be evaluated against again without administrative intervention.
Suggestion:
Whenever a software update deployment has been run, succeeded and passed the "after reboot" detectjob. Initiate a new evaluation of this deployment in full – of course including a pre-eval software updates scan. Just add
a few steps to the logic of updates deployment.
Evaluate.
Apply.
Initiate a new scan.
Re-Evaluate.
Apply again (if needed)
Reboot
Initiate a new scan.
Re-evaluate
Isn’t this the way WAUA has always worked? Why shouldn’t this method be adopted here as well? Why should ConfigMgr not honour the procedure?
Result:
Administrative relieve. Since I know that a software update deployment will always do the job, in full. No need for manual triggers or policy modifications.
Caveats:
I do realize the fact that – if this would be the scenario - the admin sometimes will not be aware of what might happen during the nightly maint. window since he cannot solely rely on compliance data.
Anyways:
This should at least be a deployment option in future releases.
"Force rescan and deployment re-evaluation after first run." Simple.
Would make life easier and keep the spread of reboots concentrated to one night and to a minimum. (Given the appropriate length of maint. windows of course)
Consider things like KB2919355 and how WUAU agent handles that against Windows Update.
Br,
Chris

Patch deployment with status "Enforcement state unknown"

Hi All
I am pretty new to the patch deployment.
I generated a report and see there is Last State column with "Enforcement state unknown", not sure if it means failed for those hostnames or will be retried for the installation.
Kindly clarify.
Regards
Ramesh
Regards Ram

They will only start to install updates automatically when there is an active update deployment with a scheduled deadline that has past. See for a lot more information:
http://technet.microsoft.com/en-us/library/gg682168.aspx#BKMK_SUMCompliance
Also, when Days since last communication is more than 0, that's usually an indication that the client is not communicating any more. That can be caused by a lot of things including something simple as that the device is turned of, or not
connected with the network.
My Blog: http://www.petervanderwoude.nl/
Follow me on twitter: pvanderwoude

Enforcement State Unknown but updates visible on clients?

Hi all. A strange issue has just appeared in one of our environments with software update deployments. It would appear the report "Enforcement States for a Deployment" is stuck showing clients as "Enforcement State Unknown".
The clients can see updates no problem at all, so functionally I have no issue. Updates are available and install correctly, but my issue is my deployments are now completely blind in that I have no status updates at all - 4+ days now and the status
hasn't changed. I can't see any issue on the client side - StateMessage.log indicates it can successfully forward messages.
Weirdly, this issue only seems to be affecting Software Update Deployments as software distribution reports are updating their statuses as expected.
I've checked inboxes for blacklogs and can't see anything too out-of-the-ordinary, and I've also tried the "force state refresh" VBS that's doing the rounds on these boards. I've even tried reinstalling the client and recreating the deployments, but all
these actions have me believe the issue is with my SCCM server only.
Can anyone help me?
EDIT - The plot thickens somewhat. The report "Evaluation states for a deployment" has just changed to "Evaluation Succeeded", but "Enforcement States for a Deployment" remains at "Enforcement State Unknown". HELP!

I think, you need to take a pause and analyse the log files to verify that everything is gng well.
The below blog posts would help you in doing that,
http://blogs.technet.com/b/configurationmgr/archive/2010/11/04/information-on-the-configmgr-2007-client-side-process-for-software-updates.aspx
http://blogs.technet.com/b/sudheesn/archive/2010/11/10/troubleshooting-sccm-part-iii-software-updates.aspx
Anoop C Nair -
@anoopmannur
MY BLOG:
http://anoopmannur.wordpress.com
User Group:
ConfigMgr Professionals
This posting is provided AS-IS with no warranties/guarantees and confers no rights.

Adding new Updates makes Reports show compliance status as "Enforcement state unknown". Old updates are still installing though.

Hi, Just wondering if anyone has seen this before and resolved it?
Basically, 2012 Software Updates have been working fine for over a year. Last months Patch Tuesday updates were fine too.
However, this week I added a new update to a Software Update Group/deployment. This update did not deploy, and when I run a report, I get "Enforcement state unknown" for ALL clients in the collection. This happens to any deployment I amend. And
also if I create a new update group and new deployment - same thing - "enforcement status unknown".
However, updates previous to this week continue to download and install fine for all deployments. Deployments which I have not changed appear to continue to report correctly (unknown, compliant, pending system restart, etc).
In the SCCM console for Software Updates, the "required" and "installed" figures are still showing correctly.
Custom software packages continue to download and install too.
All servers have sufficient disk space. Most collections dont have maintenance windows, and the deadlines are correct.
Not sure what this could be, a problem with the Management Point? But I can see any errors in the "monitoring" view on the server. The client log files like "wuahandler.log" and "windowsUpdate.log" appear fine also, no obvious
errors.
I cant see any evidence of a group policy conflict. The WSUS entry is still correct in the local group policy (GPEDIT.MSC/admin template/windows comp/ windows update).
Any ideas here? Thanks

There were absolutely no errors in WUAhandler.log on existing machines - all looked normal, which baffled me. Machines with newly installed SCCM client only had machine and user policy update, so could not check for Software Updates.
However, I through web searches, I found a solution on another discussion here:
https://social.technet.microsoft.com/Forums/en-US/1cefa9e0-a7f9-48d1-83b9-34d2293bab64/sccm-2012-r2-problem-with-device-deployment-user-deployments-ok?forum=configmanagerapps
Basically the issue was described as a "corrupt PADBID in the database". A SQL query code detects if the issue is present, and another SQL code fixes the issue.
What lead me to this fix was searching for this error in "CCMEXEC.LOG" online: "System task 'PolicyEvaluator_Unlock' returned error code 0x8000ffff".

Software Update Deployment - Compliance Status = Unknown - Client Check passed/active

Hi,
First I want to say, that I found many Forum-Posts which describes a similar issue, but it is not exactly my issue...
I have a ADR (Auto Deployment Rule) which creates every Month a Windows Update Package, and deploys it. The Deployment starts from a custom day, and ends 14 days later (Deadline). Now I have the issue, that the compliance chek in the deployment status is
"reseted" every day (at 0:00) - (at least after the Deadline!)... The Compliance Check starts every day at 0:00 and then tries to reach every Computer again! So if the Computer-object is powered on and responding, it turns over to compliant (because
it is already compliant - the Windows Update Installation works fine...). But if the Computer is not powered on / not responding the next day, it turns over to "Unknown - Client check passed/active" instead of staying in the Status "compliant"
until it is powered on / respinding again, then it changes over to compliant again... Why is that?
Is there a issue with the Client Settings?:
- Software Update Scan (every day)
- Software Update Re-Evaluation (every day)
- Compliance Settings (every day at 0:00) -> but is this not for the Configuration Baselines?
any other ideas?
Patrik

As soon as the computer get the Software Update configuration items, it will start compliance checking, then send the compliance check result to MP.
From your description, the powered on computers sent the state message to the MP when they got the deployment policy. And the frequency of Status Summarizers of updates deployment for a deployment that was modified in the last
30 days is 60 minutes. Because the site server had not recieved the state message from the powered off computers so that the compliance state was changed to Unknown.
Juke Chou
TechNet Community Support

Software Updates Deployment Shows "Unknown" Computers, Previously Had Compliant

I'm not sure what is going on, but can anyone tell me why a software updates deployment would all of a sudden show all computers as having an "Unknown" status? Previously, most computers were "Compliant" and there were a couple
with errors. When I went to check it (about a week after the original deployment), I found it had reset all to "Unknown" status. This was yesterday, and now today there are a couple computers showing "Compliant" but most are
still "Unknown". It is not set up with ADR, so it's not (at least I don't think) looking for newer updates. Any ideas?

A re-evaluation of the software update deployment, which you configure in the client settings, can cause this behavior. That's why you should always use the reports for compliance checks and not the deployments node.
My Blog: http://www.petervanderwoude.nl/
Follow me on twitter: pvanderwoude

Windows Update Agent rebooting systems after Software Update deployment

I have a software update deployment that is configured to install software updates on a collection of servers at 4:00 AM with a suppressed reboot. The updates get deployed and no reboot occurs as expected. Then ~8 hours later WUA starts up and the
servers get rebooted.
There is a maintenance window applied to the collection from 4:00 AM to 6:00 AM to allow the updates to install.
I've read a few forum and blog posts on this issue and have implemented some settings via GPO, but the reboots are still occurring. The settings that were applied are referenced in the link below.
https://support.microsoft.com/kb/2476479?wa=wsignin1.0
Here is a snippet from the WindowsUpdate.log:
2014-10-22 12:00:26:153 1428 8a88 AU Received AU Resume timeout
2014-10-22 12:00:26:153 1428 8a88 AU Additional Service {117CAB2D-82B1-4B5A-A08C-4D62DBEE7782} with Approval type {Pre-install notify} added to AU services list
2014-10-22 12:00:26:153 1428 8a88 AU Can not perform non-interactive scan if AU is interactive-only
2014-10-22 12:02:08:512 1428 8a88 AU AU received policy change subscription event
2014-10-22 12:16:43:463 1428 8a88 AU ########### AU: Uninitializing Automatic Updates ###########
2014-10-22 12:16:43:479 1428 8a88 WuTask Uninit WU Task Manager
2014-10-22 12:16:43:697 1428 8a88 Service *********
2014-10-22 12:16:43:697 1428 8a88 Service ** END ** Service: Service exit [Exit code = 0x240001]
2014-10-22 12:16:43:697 1428 8a88 Service *************
2014-10-22 12:19:29:728 1428 e584 Misc =========== Logging initialized (build: 7.8.9200.16604, tz: -0400) ===========
2014-10-22 12:19:29:728 1428 e584 Misc   = Process: C:\WINDOWS\system32\svchost.exe
2014-10-22 12:19:29:728 1428 e584 Misc   = Module: c:\windows\system32\wuaueng.dll
2014-10-22 12:19:29:728 1428 e584 Service *************
2014-10-22 12:19:29:728 1428 e584 Service ** START ** Service: Service startup
2014-10-22 12:19:29:728 1428 e584 Service *********
2014-10-22 12:19:29:744 1428 e584 Agent   * WU client version 7.8.9200.16604
2014-10-22 12:19:29:744 1428 e584 Agent   * Base directory: C:\WINDOWS\SoftwareDistribution
2014-10-22 12:19:29:744 1428 e584 Agent   * Access type: No proxy
2014-10-22 12:19:29:744 1428 e584 Service UpdateNetworkState Ipv6, cNetworkInterfaces = 2.
2014-10-22 12:19:29:744 1428 e584 Service UpdateNetworkState Ipv4, cNetworkInterfaces = 2.
2014-10-22 12:19:29:744 1428 e584 Agent   * Network state: Connected
2014-10-22 12:19:29:744 1428 e584 Service UpdateNetworkState Ipv6, cNetworkInterfaces = 2.
2014-10-22 12:19:29:744 1428 e584 Service UpdateNetworkState Ipv4, cNetworkInterfaces = 2.
2014-10-22 12:19:29:791 1428 e584 Agent *********** Agent: Initializing global settings cache ***********
2014-10-22 12:19:29:791 1428 e584 Agent   * Endpoint Provider: 00000000-0000-0000-0000-000000000000
2014-10-22 12:19:29:791 1428 e584 Agent   * WSUS server:
http://Internal-WSUS.Domain:8530
2014-10-22 12:19:29:791 1428 e584 Agent   * WSUS status server:
http://Internal-WSUS.Domain:8530
2014-10-22 12:19:29:791 1428 e584 Agent   * Target group: (Unassigned Computers)
2014-10-22 12:19:29:791 1428 e584 Agent   * Windows Update access disabled: No
2014-10-22 12:19:29:791 1428 e584 Misc WARNING: Network Cost is assumed to be not supported as something failed with trying to get handles to wcmapi.dll
2014-10-22 12:19:29:806 1428 e584 WuTask WuTaskManager delay initialize completed successfully..
2014-10-22 12:19:29:822 1428 e584 Report CWERReporter::Init succeeded
2014-10-22 12:19:29:822 1428 e584 Agent *********** Agent: Initializing Windows Update Agent ***********
2014-10-22 12:19:29:822 1428 e584 DnldMgr Download manager restoring 0 downloads
2014-10-22 12:19:29:838 1428 e584 AU ########### AU: Initializing Automatic Updates ###########
2014-10-22 12:19:29:838 1428 e584 AU Additional Service {117CAB2D-82B1-4B5A-A08C-4D62DBEE7782} with Approval type {Pre-install notify} added to AU services list
2014-10-22 12:19:29:838 1428 e584 AU AIR Mode is disabled
2014-10-22 12:19:29:838 1428 e584 AU   # Policy Driven Provider:
http://Internal-WSUS.Domain:8530
2014-10-22 12:19:29:838 1428 e584 AU   # Detection frequency: 22
2014-10-22 12:19:29:838 1428 e584 AU   # Approval type: Disabled (User preference)
2014-10-22 12:19:29:838 1428 e584 AU   # Auto-install minor updates: No (User preference)
2014-10-22 12:19:29:838 1428 e584 AU   # ServiceTypeDefault: Service 117CAB2D-82B1-4B5A-A08C-4D62DBEE7782 Approval type: (Pre-install notify)
2014-10-22 12:19:29:838 1428 e584 AU   # Will interact with non-admins (Non-admins are elevated (User preference))
2014-10-22 12:19:29:838 1428 e584 AU WARNING: Failed to get Wu Exemption info from NLM, assuming not exempt, error = 0x80240037
2014-10-22 12:19:29:853 1428 e584 AU AU finished delayed initialization
2014-10-22 12:19:29:884 1428 e584 AU #############
2014-10-22 12:19:29:884 1428 e584 AU ## START ## AU: Search for updates
2014-10-22 12:19:29:884 1428 e584 AU #########
2014-10-22 12:19:29:884 1428 e584 Agent SkipSelfUpdateCheck search flag set for serverId: 117CAB2D-82B1-4B5A-A08C-4D62DBEE7782
2014-10-22 12:19:30:416 1428 e584 Report *********** Report: Initializing static reporting data ***********
2014-10-22 12:19:30:416 1428 e584 Report   * OS Version = 6.2.9200.0.0.197008
2014-10-22 12:19:30:416 1428 e584 Report   * OS Product Type = 0x00000008
2014-10-22 12:19:30:416 1428 e584 Report   * Computer Brand = HP
2014-10-22 12:19:30:416 1428 e584 Report   * Computer Model = ProLiant BL460c Gen8
2014-10-22 12:19:30:416 1428 e584 Report   * Platform Role = 1
2014-10-22 12:19:30:416 1428 e584 Report   * AlwaysOn/AlwaysConnected (AOAC) = 0
2014-10-22 12:19:30:431 1428 e584 Report   * Bios Revision = I31
2014-10-22 12:19:30:431 1428 e584 Report   * Bios Name = Default System BIOS
2014-10-22 12:19:30:431 1428 e584 Report   * Bios Release Date = 2014-02-10T00:00:00
2014-10-22 12:19:30:431 1428 e584 Report   * Bios Sku Number = 641016-B21
2014-10-22 12:19:30:431 1428 e584 Report   * Bios Vendor = HP
2014-10-22 12:19:30:431 1428 e584 Report   * Bios Family = ProLiant
2014-10-22 12:19:30:431 1428 e584 Report   * Bios Major Release = 255
2014-10-22 12:19:30:431 1428 e584 Report   * Bios Minor Release = 255
2014-10-22 12:19:30:431 1428 e584 Report   * Locale ID = 1033
2014-10-22 12:19:30:431 1428 e584 AU <<## SUBMITTED ## AU: Search for updates [CallId = {2787252C-D4B8-46B5-BB42-0C616042113C} ServiceId = {117CAB2D-82B1-4B5A-A08C-4D62DBEE7782}]
2014-10-22 12:19:30:431 1428 dae0 Agent *************
2014-10-22 12:19:30:431 1428 dae0 Agent ** START ** Agent: Finding updates [CallerId = AutomaticUpdates]
2014-10-22 12:19:30:431 1428 dae0 Agent *********
2014-10-22 12:19:30:431 1428 dae0 Agent   * Online = No; Ignore download priority = No
2014-10-22 12:19:30:431 1428 dae0 Agent   * Criteria = "IsInstalled=0 and DeploymentAction='Installation' or IsPresent=1 and DeploymentAction='Uninstallation' or IsInstalled=1 and DeploymentAction='Installation' and RebootRequired=1
or IsInstalled=0 and DeploymentAction='Uninstallation' and RebootRequired=1"
2014-10-22 12:19:30:431 1428 dae0 Agent   * ServiceID = {117CAB2D-82B1-4B5A-A08C-4D62DBEE7782} Third party service
2014-10-22 12:19:30:431 1428 dae0 Agent   * Search Scope = {Machine & All Users}
2014-10-22 12:19:30:431 1428 dae0 Agent   * Caller SID for Applicability: S-1-5-18
2014-10-22 12:19:30:494 1428 dae0 Agent   * Found 0 updates and 0 categories in search; evaluated appl. rules of 0 out of 0 deployed entities
2014-10-22 12:19:30:494 1428 dae0 Agent *********
2014-10-22 12:19:30:494 1428 dae0 Agent ** END ** Agent: Finding updates [CallerId = AutomaticUpdates]
2014-10-22 12:19:30:494 1428 dae0 Agent *************
2014-10-22 12:19:30:509 1428 d158 AU >>## RESUMED ## AU: Search for updates [CallId = {2787252C-D4B8-46B5-BB42-0C616042113C} ServiceId = {117CAB2D-82B1-4B5A-A08C-4D62DBEE7782}]
2014-10-22 12:19:30:509 1428 d158 AU   # 0 updates detected
2014-10-22 12:19:30:509 1428 d158 AU #########
2014-10-22 12:19:30:509 1428 d158 AU ## END ## AU: Search for updates [CallId = {2787252C-D4B8-46B5-BB42-0C616042113C} ServiceId = {117CAB2D-82B1-4B5A-A08C-4D62DBEE7782}]
2014-10-22 12:19:30:509 1428 d158 AU #############
2014-10-22 12:19:30:509 1428 d158 AU All AU searches complete.
2014-10-22 12:19:30:525 1428 e584 AU #############
2014-10-22 12:19:30:525 1428 e584 AU ## START ## AU: Search for updates
2014-10-22 12:19:30:525 1428 e584 AU #########
2014-10-22 12:19:30:525 1428 e584 AU Additional Service {117CAB2D-82B1-4B5A-A08C-4D62DBEE7782} with Approval type {Pre-install notify} added to AU services list
2014-10-22 12:19:30:525 1428 e584 Agent SkipSelfUpdateCheck search flag set for serverId: 117CAB2D-82B1-4B5A-A08C-4D62DBEE7782
2014-10-22 12:19:30:525 1428 e584 AU <<## SUBMITTED ## AU: Search for updates [CallId = {A3E41A4C-E9CB-4172-B6B0-99D556FB9102} ServiceId = {117CAB2D-82B1-4B5A-A08C-4D62DBEE7782}]
2014-10-22 12:19:30:525 1428 dae0 Agent *************
2014-10-22 12:19:30:525 1428 dae0 Agent ** START ** Agent: Finding updates [CallerId = AutomaticUpdates]
2014-10-22 12:19:30:525 1428 dae0 Agent *********
2014-10-22 12:19:30:525 1428 dae0 Agent   * Online = Yes; Ignore download priority = No
2014-10-22 12:19:30:525 1428 dae0 Agent   * Criteria = "IsInstalled=0 and DeploymentAction='Installation' or IsPresent=1 and DeploymentAction='Uninstallation' or IsInstalled=1 and DeploymentAction='Installation' and RebootRequired=1
or IsInstalled=0 and DeploymentAction='Uninstallation' and RebootRequired=1"
2014-10-22 12:19:30:525 1428 dae0 Agent   * ServiceID = {117CAB2D-82B1-4B5A-A08C-4D62DBEE7782} Third party service
2014-10-22 12:19:30:525 1428 dae0 Agent   * Search Scope = {Machine & All Users}
2014-10-22 12:19:30:525 1428 dae0 Agent   * Caller SID for Applicability: S-1-5-18
2014-10-22 12:19:30:525 1428 dae0 Misc Validating signature for C:\WINDOWS\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\wuredir.cab:
2014-10-22 12:19:30:541 1428 dae0 Misc Microsoft signed: Yes
2014-10-22 12:19:30:541 1428 dae0 Misc Infrastructure signed: Yes
2014-10-22 12:19:30:556 1428 dae0 EP Got 9482F4B4-E343-43B6-B170-9A65BC822C77 redir SecondaryServiceAuth URL: "http://fe2.ws.microsoft.com/w81/2/redir/v2-storeauth.cab"
2014-10-22 12:19:30:588 1428 dae0 Agent Checking for updated auth cab for service 117cab2d-82b1-4b5a-a08c-4d62dbee7782 at
http://fe2.ws.microsoft.com/w81/2/redir/v2-storeauth.cab
2014-10-22 12:19:30:588 1428 dae0 Misc Validating signature for C:\WINDOWS\SoftwareDistribution\AuthCabs\Downloaded\117cab2d-82b1-4b5a-a08c-4d62dbee7782.cab:
2014-10-22 12:19:30:603 1428 dae0 Misc Microsoft signed: Yes
2014-10-22 12:19:30:603 1428 dae0 Misc Infrastructure signed: Yes
2014-10-22 12:19:30:775 1428 dae0 Misc Validating signature for C:\WINDOWS\SoftwareDistribution\AuthCabs\Downloaded\117cab2d-82b1-4b5a-a08c-4d62dbee7782.cab:
2014-10-22 12:19:30:791 1428 dae0 Misc Microsoft signed: Yes
2014-10-22 12:19:30:791 1428 dae0 Misc Infrastructure signed: Yes
2014-10-22 12:19:30:791 1428 dae0 Misc Validating signature for C:\WINDOWS\SoftwareDistribution\WuRedir\117CAB2D-82B1-4B5A-A08C-4D62DBEE7782\wuredir.cab:
2014-10-22 12:19:30:806 1428 dae0 Misc Microsoft signed: Yes
2014-10-22 12:19:30:806 1428 dae0 Misc Infrastructure signed: Yes
2014-10-22 12:19:30:822 1428 dae0 EP Got 117CAB2D-82B1-4B5A-A08C-4D62DBEE7782 redir Client/Server URL: "https://fe2.ws.microsoft.com/v6/ClientWebService/client.asmx"
2014-10-22 12:19:30:978 1428 dae0 PT +++++++++++ PT: Synchronizing server updates +++++++++++
2014-10-22 12:19:30:978 1428 dae0 PT   + ServiceId = {117CAB2D-82B1-4B5A-A08C-4D62DBEE7782}, Server URL =
https://fe2.ws.microsoft.com/v6/ClientWebService/client.asmx
2014-10-22 12:19:31:025 1428 dae0 Agent   * Found 0 updates and 0 categories in search; evaluated appl. rules of 0 out of 0 deployed entities
2014-10-22 12:19:31:025 1428 dae0 Agent *********
2014-10-22 12:19:31:025 1428 dae0 Agent ** END ** Agent: Finding updates [CallerId = AutomaticUpdates]
2014-10-22 12:19:31:025 1428 dae0 Agent *************
2014-10-22 12:19:31:025 1428 d158 AU >>## RESUMED ## AU: Search for updates [CallId = {A3E41A4C-E9CB-4172-B6B0-99D556FB9102} ServiceId = {117CAB2D-82B1-4B5A-A08C-4D62DBEE7782}]
2014-10-22 12:19:31:025 1428 d158 AU   # 0 updates detected
2014-10-22 12:19:31:025 1428 d158 AU #########
2014-10-22 12:19:31:025 1428 d158 AU ## END ## AU: Search for updates [CallId = {A3E41A4C-E9CB-4172-B6B0-99D556FB9102} ServiceId = {117CAB2D-82B1-4B5A-A08C-4D62DBEE7782}]
2014-10-22 12:19:31:025 1428 d158 AU #############
2014-10-22 12:19:31:025 1428 d158 AU All AU searches complete.
2014-10-22 12:19:31:025 1428 d158 AU AU setting next detection timeout to 2014-10-23 14:19:28
2014-10-22 12:19:36:025 1428 e214 Report REPORT EVENT: {E04012FD-8FFD-4259-96D5-A5A34127F0A0} 2014-10-22 12:19:31:025-0400 1 147 [AGENT_DETECTION_FINISHED] 101 {00000000-0000-0000-0000-000000000000} 0 0 AutomaticUpdates Success Software
Synchronization Windows Update Client successfully detected 0 updates.
2014-10-22 12:19:36:025 1428 e214 Report CWERReporter finishing event handling. (00000000)
2014-10-22 12:29:29:914 1428 e584 AU AU invoking RebootSystem (OnRebootNow)
2014-10-22 12:29:30:055 1428 e584 AU Allowing auto firmware installs at next shutdown
2014-10-22 12:29:30:102 1428 e584 Misc WARNING: SUS Client is rebooting system.
2014-10-22 12:29:30:102 1428 e584 AU AU invoking RebootSystem (OnRebootRetry)
2014-10-22 12:29:30:367 1428 e584 Shutdwn Checking to see whether install at shutdown is appropriate
2014-10-22 12:29:30:367 1428 e584 Shutdwn user declined update at shutdown
2014-10-22 12:29:30:367 1428 e584 AU AU initiates service shutdown
2014-10-22 12:29:30:367 1428 e584 AU ########### AU: Uninitializing Automatic Updates ###########
2014-10-22 12:29:30:399 1428 e584 WuTask Uninit WU Task Manager
2014-10-22 12:29:30:445 1428 e584 Agent Sending shutdown notification to client
2014-10-22 12:29:30:445 5788 8084 COMAPI WARNING: Received service shutdown/self-update notification.
2014-10-22 12:29:30:461 1428 e584 Report CWERReporter finishing event handling. (00000000)
2014-10-22 12:29:30:539 1428 e584 Service *********
2014-10-22 12:29:30:539 1428 e584 Service ** END ** Service: Service exit [Exit code = 0x240001]
2014-10-22 12:29:30:539 1428 e584 Service *************
Any assistance is appreciated.
-Tim

Hi,
Any update?
Best Regards,
Joyce
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Enforcement State Unknown issue in SCCM 2012 Patch management report.

Software updates are installed on machine. All updates shown in updates history, but machine not reporting back as Complaint. It showing in Enforcement State Unknown. Please help to resolve the issue.

Hi,
Have you tried to "Run Summarization" while right click the software update group?
If it still shows unknown, please check StateMessage.log on a client that updates show unknown to see whether the state messages have been forwarded successfully.
Best Regards,
Joyce Li
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

How to calculate the compliance for an software update deployment

Hi All,
I am trying to find as how do we calculate the compliance for an software update deployment.
Scenario, We have about 4000 machine in the domain. but we have some stale records in the domain which is about 1200. The AD cleanup for the stale records is planned for sometime in March.
So total number of machines in a collection (including the stale machines) are 5200.
The current compliance of that deployment shows the following status:
Complaint : 1156
In Progress : 1724
Error : 38
Unknown : 2462
And in the unknown, we have :
Client check failed/Active: 2
Client check failed/Inactive: 6
Client check passed/Active: 732
Client check passed/Inactive: 1722
Can you please suggest in understanding the formula that should be followed to get the compliance.

Your Compliancy, should be based solely off of the number of computers within CM12.
There are no “if”, “and” or “but” able it. This is the only way to truly and reliably provide numbers to management.
Again it should be very simple calculation:
(Total outstanding Security SU, Total outstanding
Critical SU, Total outstand Service packs, Total outstand Update Rollups, Total outstand Updates, Total outstand Definition Updates, Total outstand tools, Total outstand Feature packs) Vs Total applied SU (all Classifications)
Or
Total # of 100% patched PCs vs Total # of PCs as seen by CM12.
If you use any other calculation then you MUST include a disclaimer that you are filtering out computers because they might be invalid. Or you MUST define exactly how you are calculating the number. Therefore any compliancy rate that your calculate maybe
invalid too or at least it will change once you clean up AD.
I will never hide low compliancy numbers to management, I will always show it to them.
In many case I will ask to give a presentation to Management to explain why the numbers are so low.
Provide them with a list of action items that need to be done in order to bring up the number to more reasonable level. I also set their expectation on what a reasonable level is.
100% is unachievable; there is no exception to this!
95-99% Very excellent but expect to spend lots of $$$s to obtain these percentages.
90-95% is really, really, good; expect to spend $$s in this range.
85-89% is good; expect to set strict procedures
81-84 is ok but you could do better
Below 80% is bad
In your case, I would start by saying AD is dirty and need to be clean up, this has been schedule for March 2015. I would follow up this to say, in order to keep AD clean the follow procedures need to be define / updated / followed. You should also define
exactly what you are doing to ensure that all computers are management by CM12.
IMO these is no simple answer of this.
Garth Jones | My blogs: Enhansoft and
Old Blog site | Twitter:
@GarthMJ

Application Deployment Evaluation Cycle Query

Does anyone have a sql query to determine when machines in a collection last ran their Application Deployment Evaluation Cycle?
Thanks for any suggestions!

Thanks Garth and Jason. About the only place that seems to provide the information is the client side appdiscovery.log file. I have a couple sql queries that return things like last software scan date, etc, and I was hoping there might be something
similar for the application deployment evaluation cycle.
To your question, Jason, we have a vdi solution that is closely scrutinized by the powers that be. Every utilization spike on the storage array triggers a flurry of "why did that happen?" emails from management (a behavior born out of a couple
previous array crashes). It's been useful to correlate some the SCCM actions time stamps to the time frames of some of these spikes. In this particular case, a spike was monitored when somebody used right click tools to run the application deployment
evaluation cycle on a large collection of vdi machines. Bet you're sorry you asked now!
Anyway, thanks again. I'll script out another solution.

How to troubleshoot Software Update Deployment Errors

Hi Guys,
Could you guys please help me to troubleshoot 'Software Update Deployment Errors'. I have been trying to troubleshoot the below mentioned errors but I am not sure what step should I take for each different errors.
Could you guys please help me stating what kind of troubleshooting steps should we take for such update deployment errors.
Many Thanks,
Chandan

You would have to examine client-side logs like UpdatesDeployment.log, U*.log in general, ScanAgent.log, WUAHandler.log, WindowsUpdate.log and CI*.log.
Torsten Meringer | http://www.mssccmfaq.de

Change Software Updates deployment priority

Hi
We use SCCM 2012 R2 CU2.
whenever a new client is being installed and registered it gets its policies and deployments.
our problem is that there are many software updates that being deployed and it takes a very long time until they finish their installation.
while what is more important for us is the clients to get software deployments
before the software updates.
I know I can change packages priority but as I understand - it only changes the priority between the software packages.
is there any way to make the software deployments to be installed before the software updates for new clients?
even if there's no build-in solution, I'd be happy to get a friendly workaround.
I thought about auto-adding the clients to a software update deployment collection only after all the packages are being deployed, but maybe some of you can come up with something better
thanks!

You can't prioritize in policy for a client. The first policy that arrives is the first that's being served..
If you're talking about the first thing after the OS deployment, then I would try to update my clients completely during the deployment already. That would solve your problem already. In that same scenario, you could also think about installing
computer or user targetted applications during the task sequence. For examples about both scenario's see:
Computer-targeted:
http://www.petervanderwoude.nl/post/install-computer-targeted-application-during-os-deployment-via-powershell-and-configmgr-2012/;
User-targeted:
http://www.petervanderwoude.nl/post/install-user-targeted-applications-during-os-deployment-via-powershell-and-configmgr-2012/.
If you're not talking about an OS deployment, your only option is indeed to add the clients later to the software update collection(s). In that case you could also try to automate it via PowerShell by using the
Add-CMDeviceCollectionDirectMembershipRule.
My Blog: http://www.petervanderwoude.nl/
Follow me on twitter: pvanderwoude

SCCM - software updates deployment.

Hi All,
i have adobe acrobat version 10.1.10 installed on my mahcine, when ever i am trying to up deploy an Adobe acrobat 10.1.13 for my machine using but its not gettin updated. Also , one thing that i have seen is even after deployment it is not showing up under
deployment package.
Can anyone help on this, Iam using shavlik higher version of SCUP with SCCM to achieve this.
Rsg,

Hi,
You could troubleshoot software updates deployment by checking logs.
UpdatesDeployment.log
UpdatesHandler.log
WUAHandler.log
%windir%\WindowsUpdate.log
For more information:https://technet.microsoft.com/en-us/library/hh427342.aspx#BKMK_SU_NAPLog
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

Can windows 8 be upgraded to 8.1 through CM 2012 Software Updates deployment?

Hi,
Can windows 8 be upgraded to 8.1 through CM 2012 Software Updates deployment rather than having it downloaded through Windows Store?

The update is not available via software updates. However, if you are doing multiple updates, you can bypass the Windows Store.
http://www.petri.co.il/upgrade-to-windows-8-1-without-windows-store.htm#
Gerry Hampson | Blog:
www.gerryhampsoncm.blogspot.ie | LinkedIn:
Gerry Hampson | Twitter:
@gerryhampson

Software Updates Deployment Evaluation Cycle Enforcement state unknown

Similar Messages

Maybe you are looking for