User affinity

In SCCM 2012 suppose the user affinity is created for 5days and 60min.
In such cases, as i understand the user must logon to that machine for 5 days with a min of 60min per day to create an affinity with the machine.
Suppose, if the user required to login to a machine for 3days, does it mean that he will not get the software assigned to him???
Option would be, clear the affinity?? If there are approx 10 such machines, then it not an effincient way to clear affinity on each of them.
Creating a collection would be an option, but iam skeptical about it.
Any other way?? If any..
System Security analyst at CapG

The user must use the machine for 60 mins over a 5 day period, not 60 mins per day over a 5 day period..
The below link shows how to export the UDA with a powershell script
http://blog.coretech.dk/kaj/export-out-user-device-affinity-relationship-with-powershell/
Its best to set over a 7 days period to account for the weekend or there could be 2 days out of the five used by the weekend giving the user only 3 days to make the affinity
Something like 480 mins over 7 days..
If the 480 min threshold is reached before the 7 day period I believe the affinity is made, without having to reach the 7 day marker.
You may have to be a little patient before all affinity data is available as I remember..
Kevin Case | My blog www.sccmroad.wordpress.com/ Twitter: @casekev | | Please mark as helpful/answer if this resolved your issue

Similar Messages

User Affinity question

So, I've been battling for months trying to figure out why user affinity isn't working for me. I finally figured it out the other day. I'm hoping you guys have a
way around this.
When Microsoft came out with Advanced Auditing features, they changed how machines look at auditing settings that are pushed down to them. If you push any Advanced Auditing,
the machine will completely ignore any basic auditing settings.
From: Advanced Security Auditing FAQ (Technet article)
"What is the interaction between basic audit policy settings and advanced audit policy settings?
Basic audit policy is not compatible with advanced audit policy settings that are applied by using Group Policy in Windows Server 2008 R2 and Windows 7. This is because
as soon as advanced audit policy settings are applied by using Group Policy, the current computer's audit policy settings are cleared before the resulting advanced audit policy settings are applied. After you apply advanced audit policy settings by using Group
Policy, you can only reliably set system audit policy for the computer by using the advanced audit policy settings."
The problem is, I personally never set advanced auditing on the desktops. But, apparently, someone did. I've combed through all the GPOs that affect desktops and there
is no remaining advanced auditing settings. But I still can't get the basic settings to apply.
So, my question: Is it possible to configure the advanced auditing in such a way that SCCM will gather affinity info from it? Otherwise, I don't see a way of getting affinity
to work automatically, and I'll have to set and maintain affinity for 3000+ machines.
Thanks,
Joe

I would have check the following (I'm sure you did some of it but double check cant heart)
Run RSOP.MSC and verify the following:
In the resultant Set Of Policy Check the source of the advanced audit policy and remove this GPO (if exist).
Check if Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings
is enabled under Computer Configuration\Windows Settings\Security Settings\Local Policy\Security Options.
"Windows Vista and later versions of Windows allow audit policy to be managed in a more precise way using audit policy subcategories.
Setting audit policy at the category level will override the new subcategory audit policy feature."
You need to set this value to disable so audit will not be forced by subcategory level.
Check if the value of SCENoApplyLegacyAuditPolicy is set to 1 under HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\ and change it to 0 (equivalent to disable in the value before but cannot be in conflict).
Please take a moment to Vote as Helpful and/or Mark as Answer where applicable. Thanks.

[Forum FAQ]How to troubleshoot common issue when configuring user device affinity from usage data

Symptom:
Some clients might fail to automatically configure user device affinity from usage data if you have manually configured user device affinity before.
When you check the UserAffinity.log, you can find the similar error messages as below:
User 'XXXXX\XXXXX' has xxxxx usage minutes UserAffinity
Setting auto affinity for user 'XXXXX\XXXXX'. UserAffinity
Found same state message existing. (was sent before) Skip sending same state message for user 'XXXXX\XXXXX'.. UserAffinity
Figure 1. Error Message in UserAffinity.log
Cause:
As the log said, there is a user affinity state message existing in WMI which prevents client from sending new user affinity state message.
Resolution:
We can delete the user affinity state message in WMI to force the client to resend the user affinity state message.
We can follow the steps below:
1. Run Windows Management Instrumentation Tester (“Wbemtest”).
2. In Windows Management Instrumentation Tester dialog box, click “Connect”.(Figure 2)
Figure 2.
3. Type “root\ccm\statemsg” under the Namespace table and then click “Connect”.(Figure 3)
Figure 3.
4. Click “Enum Classes”. (Figure 4)
Figure 4.
5. Choose “Recursive”
in Superclass Info dialog box.(Figure 5)
Figure 5.
6. Double-click “CCM_StateMsg” in Query Result dialog box.(Figure 6)
Figure 6.
7. Click “Instances”
in Object editor for CCM_StateMsg dialog box. (Figure 7)
Figure 7.
8. Choose the messages that contain "domain/user_Auto" and click “Delete” in the Query Result dialog box.(Figure 8)
Figure 8.
After you delete user affinity state message in WMI, the user affinity state message for the user will be resent. After a period time, we can check the UserAffinity.log to
see if the user affinity state message has been successfully sent. The related information would be similar as below:
Successfully sent user affinity state message for user 'xxxxx\xxxxx'.
Successfully created pending user affinity for user 'xxxxx\xxxxx' into WMI.
Figure 9.
Please click to vote if the post helps you. This can be beneficial to other community members reading the thread.

I'm not sure whether this is the appropriate place to add this but - a (possible) cause that I have seen which is not mentioned above is a request for an AAAA record (IPv6 address)
being responded to with an A record (IPv4 address).
DNS debug logging (Windows 2008 R2 SP1) captured requests to
192.225.156.200 and the corresponding responses. In each case the response was followed in the debug log by the event “The DNS server encountered an invalid domain name
in a packet from 192.225.156.200. The packet will be rejected. The event data contains the DNS packet.”
The domain name in the response was the same as that in the query, and looks OK.
The logged query shows an AAAA record (IPv6 address) request and the logged response returned an A record (IPv4 address).
http://www.rfc-editor.org/rfc/rfc4074.txt “Common
Misbehavior Against DNS Queries for IPv6 Addresses” says, under “Expected Behavior”:
   Suppose that an authoritative server has an A RR but has no AAAA RR
   for a host name. Then, the server should return a response to a
   query for an AAAA RR of the name with the response code (RCODE) being
   0 (indicating no error) and with an empty answer section (see
   Sections 4.3.2 and 6.2.4 of [1]). Such a response indicates that
   there is at least one RR of a different type than AAAA for the
   queried name, and the stub resolver can then look for A RRs.

Anyone use User Device Affinity?

Just wanted to know if anyone is using User Affinity to deploy software and if
you are, can you please share any headaches I should be on the lookout for. We
use it in limited fashion (via AD Group Membership) and its working well. I would like to expand its use
and wanted to make sure I don't miss anything.
Any assistance / recommendations are appreciated...
Thank you

sorry for the confusion...
We have User Device Affinity working. I've created AD user groups, created the collection which populates the primary device for the users in the group, and deployed software to it. Works perfect "so far" but I've only used it for a couple applications.
Lets say I move this to 50 or 100 applications though
In thinking long term. Is there anything I should be away of in the deployment process. Any type of User Device Affinity maintenance issues, allowing users to assign primary devices, etc.. just anything out of the ordinary that people have seen
when using the Primary Device deployment method that maybe I should be away of...
Thanks again

Automatic User Device Affinity doesn't work

Hi, the automatic User Device Affinity doesn't work in my environment and I don't know why! The audit policies are enabled by GPO and User Device Affinity is correctly configured in SCCM. Below are some screenshots including de log of User Device Affinity.
Anybody could help-me please?

An old post but,
This can happened when activating
advanced audit policy in one of the GPO. once it was activated, it gets override the regular audit policy with different event id's that SCCM don't recognize. in addition, the machine tattooed with those settings so removing the GPO wont revert the settings.
Check out this thread for more information and help:
http://social.technet.microsoft.com/Forums/en-US/f3a4b675-e955-4cd2-bba6-d51ea06dd362/user-affinity-not-working-properly?forum=configmanagergeneral
Please take a moment to Vote as Helpful and/or Mark as Answer where applicable. Thanks.

User details in a specific computer- Config Mgr 2012 R2

I am using SCCM 2012 R2. I need to have an option for user details on a computer in a specific collection. When I select a computer after searching under devices, I would like to see search options(attached Screen shot)
for Primary device user or other details last logon etc. related to user on that computer.
Its currently not available in the product I guess. I have also tried to enable last logon in AD discovery.
I have user affinity configured and can see these details from SCCM reports but would like to see user details when I select the computer and see who the user this belongs to rather than running and creating custom reports. Currently I am implementing
SCCM and migrating setup from an existing tool. These features are readily available in that tool.
Any help on this please.
Thanks

I've already logged something similar, back in Feb, at MS Connect website for checking deployments as would be good to see last logged in user.
https://connect.microsoft.com/ConfigurationManagervnext/feedback/details/823608/sccm-2012-checking-deployment-to-system
You'll need to sign up and join the Configuration Manager program to view and you can vote this up as an issue and add your feedback. The more votes the better ;-)
Cheers
Paul | sccmentor.wordpress.com

Can you Identity users primary device assgined by the user agent via Powershell?

Hi,
I've been using the Get-CMUserDeviceAffinity to find a users primary device, however i'm experiancing problems when a user has more than 1 primary device (I have 2, my laptop and an RDS server). Is there a way to query a users
primary device filtered on the User Affinity type? i.e. User Agent assigned?
Regards,
Chris
Chris Gibson

it looks like you want Source "4", per the dbo.UserMachineSources table:
SourceID            Name
1            Software Catalog
2            Administrator
3            User
4            Usage Agent
5            Device Management
6            OSD
7            Fast Install
8            Exchange Server connector
Mike Crowley | MVP
My Blog --
Baseline Technologies

Email profile uses Device Enrollment Manager user?

Hello,
I have an iOS device that was enrolled via the Apple Device Enrollment Program, using a Device Enrollment Manager account, and I have since deployed an email profile configuration policy to it. After it received the policy now the account
of the Device Enrollment Manager is locked in as the user in the email profile. Is that normal behavior? I thought that enrolling a device using a user who is a member of the Device Enrollment Management group would leave the device open for another
user?
Thanks!

Hello, I was looking through TechNet a little more about this and unless I'm reading this wrong, which is certainly possible, it seems to suggest that you should be able to access company data as the end user using CYOD enrollment or a device enrollment
manager enrollment scenario:
User affiliation – Specifies how devices are enrolled.
Prompt for user affinity – The device can be affiliated with a user during initial setup and could then be permitted to access company data and email as that user. This mode supports a number of scenarios:
Corporate-owned personal device – “Choose Your Own Device” (CYOD) Similar to privately owned or personal devices but the administrator has certain privileges including permission to wipe, reset, administer, and unenroll the device. The
device’s user can install apps and has most other permissions for device use where not blocked by management policy.
Device enrollment manager account – The device is enrolled using a special Intune administrator account. It can be managed as a private account, but only a user who knows the enrollment manager credentials can install apps, wipe, reset,
administer, and unenroll the device. For information about enrolling a device shared by many users through a common account, see
Enroll corporate-owned devices with the Device Enrollment Manager in Microsoft Intune.
No user affinity – The device is user-less. Use this affiliation for devices that perform tasks without accessing local user data. Apps requiring user affiliation are disabled or won’t work.
With this in mind, since accessing corporate data as the user is supported with CYOD and device enrollment manager, I can't imagine that the intention of the device enrollment managers (DEM) group was designed so when a device is enrolled with a DEM
user that only data for that DEM user is available, right? That just wouldn't make sense. Also, if enrolling a device using a DEM user account is only for devices that don't need access to corporate data, then what's the difference between enrolling
a device using a DEM user, or enrolling a device with "No user affinity"? Also, when I've enrolled a device using a DEM account, I was later easily able to install apps with no prompt for DEM credentials, TechNet seems to imply that credentials
are needed for functions like that. Shouldn't something have asked me for permission to install an app?

SCCM 2012 Software Center remembered user apps

Hi
Most of our packages are advertised to all users, only a few are advertised to machines. When a new user 'A' opens the Software Center only the packages advertised to the machine appear in the list with a status of available.
When I login as a User 'B' that has previously installed packages they appear as installed in the Software Center list, as expected.
When I re image the machine and reset the user B's profile and login as User B the applications appear in Software Center as available.
User Affinity is turned off, How can I ensure these Applications don't re appear in Software Center?
Thanks
Ian

I don't understand the behaviour you are referring to.
AVAILABLE deployments to USERS can be seen in the application catalog. All other deployments will be shown in Software Center. That includes REQUIRED delpoyments to users, AVAILABLE & REQUIRED to devices.
As far as I'm aware there are no exceptions
http://blogs.technet.com/b/configmgrteam/archive/2012/03/31/introducing-the-application-catalog-and-software-center-in-system-center-2012-configuration-manager.aspx
Gerry Hampson | Blog:
www.gerryhampsoncm.blogspot.ie | LinkedIn:
Gerry Hampson | Twitter:
@gerryhampson

Automatically upgrade any superseded versions of this application not auto installing - Status always waiting for next maintenance schedule

Hello,
I'm trying to deploy an application to a user group with the option checked for "Automatically upgrade any superseded versions of this application" but it never auto installs.
- The application is set to install to system whether the user is logged on or off.
- We do have user affinity, therefore the user does have a one or more primary devices setup.
- If I run the install manually, it will superseded and install the new application and uninstall the old applications.
- The estimated installtion time minutes is set to 0
- The maxmimum allowed run time is set to 120 minutes.
We're on version SCCM 2012 SP1.
My assumption of how it should work
If the user is logged in or NOT and it's during the maintenance window, it should auto install the application. Maybe I'm wrong.
Here's the scenario.
User JohnDoe has application Viewer 1.0 installed on his machine. He installed this app via the SCCM application catalog. We now need to deploy Viewer 2.0 of this application. I want to ensure when it's deployed it replaces Viewer 1.0 hence
the reason to check the "auto upgrade.."check box.
Here's what happens. In software center, it will pre-downlaod the software and then set the status to "Waiting for next maintenance schedule". The problem is that the status stays like this forever. We do have maintenance windows set
on the device collection that JohnDoe's primary device is part of. Here are our maintenance windows.
- Daily - 9PM to 5AM = 8 hours
- Weekly - Saturday - 12:00AM to 12:00 = 24 hours
- Weekly - Sunday - 12:00AM to 12:00 = 24 hours
Coordinated UTC is not checked.
The business hours in software center are set to 5am to 10pm.
One would assume that it would auto install during the night since we have a big maintenance windows. I checked the ServiceWindowmanager.log and it does seem to show the various maitnenance windows.
Here's what I've tried
- If I make the deployment required, it will install right away regarless of maintenance windows. However, i don't want to use this option because if the user logs in to other machine (e.g. boardroom computer), it will auto install this software.
- If JohnDoe clicks install in Software center or application catalog, it works. There's nothing wrong with the packages. The issue seems to be related with the maintenance windows.
- If I disable the maintenance windows, then it seems to work but only when I'm logged in. It still does not work if I'm logged out. It only kicks off the installation when I login if it's not during the business hour set in software center.
We need the maintenance windows since we don't want windows patching to occur during the day.
- I searched and ran the report to ensure there's not another maintenance windows setup that would prevent this from installing.
Our current workaround
To ensure users are using the latest version, we deploy the application required for a couple of days, then delete that deployment once we reach a high 90%. The problem with that is if some computers are turned off, they would be using the older version
and it will never get upgraded unless the user installs it manually.
Has anyone encountered this? Any other log files I should look at? Anything else I should verify ? I know in SCCM 2012 R2, you can set the maintenance window to only apply this schedule to software update (patching) but that option doesn't seem
to be available in SCCM 2012 SP1.
Any help, suggestiong, I will take. Thanks.

- If I make the deployment required, it will install right away regarless of maintenance windows. However, i don't want to use this option because if the user logs in to other machine (e.g. boardroom computer), it will auto install this software.
Re-check your deployment, specially the user experience:
If you've checked the box next to "Software installation", it will install after the deadline has passed and ignores maintenance windows. Change the deployment to required and uncheck that box and the software should be installed according to your
maintenance windows.

Automatically configure UDA question

First,I set 'automatically configure user device affinity from usage data' in UDA settings to 'No',then client will send a state message (TopticID:1600) indicates that CCM client is waiting the UDA request to be approved and save it in wmi during
the user affinity usage task.State message and logs look like this:
>>>>>>Starting processing user affinity usage task<<<<<<
Auto affinity threshold settings Days = '30', User minutes threshold = '2880', Auto approve affinity = '0'.
Clean up agents user logon events...
Retrieving user minutes map...
Loading approved and pending user affinities...
Checking if any pending affinity is approved...
Checking usage minutes per user against current minutes threshold...
User 'abc\def' has 3425 usage minutes
Setting auto affinity for user 'abc\def'.
Successfully sent user affinity state message for user 'abc\def'.
Successfully created pending user affinity for user 'abc\def' into WMI.
>>>>>>Finished processing user affinity usage task<<<<<<
After that,I turn on 'automatically configure user device affinity from usage data' ,but client will only refresh the old state message (TopticID:1600) in wmi which indicates it has automatically set uda for the user and
will not send the new state message to site server becasue it consider the same state message existing in wmi.
>>>>>>Starting processing user affinity usage task<<<<<<
Auto affinity threshold settings Days = '7', User minutes threshold = '1500', Auto approve affinity = '1'.
Clean up agents user logon events...
Retrieving user minutes map...
Loading approved and pending user affinities...
Checking if any pending affinity is approved...
User 'abc\def' in pending affinity is not approved yet
Checking usage minutes per user against current minutes threshold...
User 'abc\def' has 3608 usage minutes
Setting auto affinity for user 'abc\def'.
Found same state message existing. (was sent before) Skip sending same state message for user 'abc\def'..
>>>>>>Finished processing user affinity usage task<<<<<
I can manually delete the TopicID 1600 message in wmi and restart the ccm client,after that the new uda state message will send into the site dabase and pending request in console will be disappeared.
That is my question.Actually the state message content is different from the old one.Why ccm client consider they are the same messages and will not send it so that the uda information is not set for user in ccm database.(In console it
always display as a pending request)

Sorry for the delay.
I tested the situation again and came into the same result.
1. If the logged on user have already reached the threshold before you changed the Client Setting to Yes for Auto UDA, the State Message did not send out again. Because the agent thought this box is in pending state, no more state message needed.
2. If the logged on user have not reached the threshold before you changed that setting, the Auto UDA State Message will send if the user reaches the threshold in the future.
Seems this is by design. Anyway, I recorded this situation.
Juke Chou
TechNet Community Support

Assign UDA to machines immediately

My OSD TS sets SMSTSAssignUsersMode to Auto, and prompts for SMSTSUdaUsers. The SCCM client settings are set to NOT allow auto configure of UDA. When the OSD TS completes, I have some software that needs to pull the Primary User from the
database to configure the app (add the primary user to the Remote Desktop Access local group.)
So, after the TS completes, can see the primary user in the Device's properties. If I log onto the machine, and run A PS script to pull the primary user, it comes back empty. I have tested this script on other machines that have "baked"
for a while (days) and it does return the user properly. So it seems there is some kind of wait period for setting this, even though it has been explicitly set via the console.
The UDA logs never mention assignment of Primary User.
Is there any way to speed this up? Or am I missing something here?
TIA

have you verified the user affinity as i describe here ?
http://www.windows-noob.com/forums/index.php?/topic/4522-using-sccm-2012-rc-in-a-lab-part-10-using-prestart-and-extrafiles-to-get-more-out-of-uda/
Step by Step Configuration Manager Guides >
2012 Guides |
2007 Guides | I'm on Twitter > ncbrady

UDA set wrong during OSD

Hi, I have MDT 2013 + SCCM 2012 R2 Environment. I am using a UDI task sequence. I provide option to set computer using UDI wizard and set user device affinity. All work well, untill, someone changes the name of Computer using UDI wizard. In case the
computername is changed, the new computer object in CM does not have user affinity set. Instead, I see that the old object (before rename using UDI during OSD) in CM console get the UDA set(OSD defined). I did try deleting the old name from CM console
after starting TS, but this also did not help set the UDA to new object in CM. How do I get around this problem. We want to have a functionality of setting OSD defined UDA even for computers where the user might change the name using UDI wizard.

Anyone??

Thinking I may have broke User/Device Affinity in my setup?

Morning,
User/Device affinity has been working well for us for a number of weeks now. I think maybe some recent changes I made to Group Policy regarding event logs may have borked it because the number of affinity's is slowing going down over the past
few days according to the "Use device affinity associations per collection" report.
Here are the settings I am currently been using for weeks now:
User Device Minutes: 960
User Device days: 7
Auto config: Yes
Group Policy stuff:
Audit account logon events: Success, Failure
Audit logon events: Success, Failure
Maximum Security log size: 1048576
Retain security log: 14 days
Retention method for security log: by days
These changes were made just recently which we be the problem. We made these changes because they were filling up the logs with noise and rolling over:
Audit Filtering Platform Policy Change: Success
Audit non sensitive Privilege Use: Success
Audit Sensitive Privilege Use: Success

Since no one has answer this post, I recommend opening a support case with CSS as they can work with you to solve this problem.
Garth Jones | My blogs: Enhansoft and
Old Blog site | Twitter:
@GarthMJ

SCCM 2012 Clear all user device affinity

Over a year ago UDA was set by mistake to manual affinity confirmations
Since that time
several thousands of requests was received at admin console.
Couple of weeks ago UDA was set to automatic affinity based on usage statistics. Unfortunately only new OS deployments get UDA based on usage and 98% of other PCs still have no affinity.
It was decided to
clear the queue of current device affinity requests at admin console on "All systems" collection by rejecting them due to I do not want to set admin affinity record in UDA - it is permanent IMO.
It did not help to get new UDA for old PCs
because clients believing that they already set it before. (see log file)
User 'XXXXX\XXXXX' has 25960 usage minutes UserAffinity 07.07.2014 16:11:21 2112 (0x0840)
Setting auto affinity for user 'XXXXX\XXXXX'. UserAffinity 07.07.2014 16:11:21 2112 (0x0840)
Found same state message existing. (was sent before) Skip sending same state message for user 'XXXXX\XXXXX'.. UserAffinity 07.07.2014 16:11:21 2112 (0x0840)
It is definitely a client WMI issue, because reinstalling client with uninstallation checkbox fix the problem on second computer policy retrieval cycle.
I need a way to clear somehow old affinity states in client history to set it again based on usage statistics. Any advice?

Hi,
Have you tried to delete the state message from WMI? I saw that is stored in root\ccm\statemsg -> Enum Classes -> Recursive -> double-click CCM_StateMsg -> Instances. There should be messages that contain "domain/user_Auto".
Best Regards,
Joyce
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

User affinity

Similar Messages

Maybe you are looking for