sccm assignment enforce failed

SCCM Configmgr Troubleshooting Client software update issues

One of most important and critically used feature in configuration manager 2012 is  Software updates .It is always challenging and import task for any sccm administrator to achieve good patch compliance success rate within the given SLA(Service level agreement).Patch compliance success rate is depends mainly on heath of your SCCM clients and some times things may go wrong even though sccm client is healthy (able to receive applications/packages and performing inventory except patches).

I have created lot of SSRS reports on software update compliance out of many,one of the widely used report is get the patch compliance status of software update group for specific collection with linked report to get the computers with unknown and required status for troubleshooting (to check when was the last hardware,last software scan,last user ,OS etc).

Coming to the subject line, I have been seeing many questions on the configuration manager forums and social networking sites on software update patching issues .couple of questions on the subject line are like

1) Client getting packages ,applications but not software updates

2) Most of the clients receiving deployed software updates but still few do not get.

3) Clients not detecting software updates

4) clients log says ,patches required but sccm reports says,updates not required( means complaint)

5) Client log says patches not required but sccm report says ,updates required.

6) Software update failing to install ,how to fix 

7) I have added patches to the existing software update group/deployment and these newly added patches not deploying successful and many more ….

The solution for the most of the above issues can be identified and solved by analyzing the the client logs before we do in-depth troubleshooting.

In this blog post (SCCM 2012 Troubleshoot software update client issues),I will explain you the basic troubleshooting steps (only on client side ) which will help you to resolve issues on your own by analyzing the logs and take it further afterwards.

Before we jump into the troubleshooting,I would like to illustrate the main components which are involved in deploying software updates.

When you enable software update agent setting in client agent settings,a policy will be created with this setting and stored in SQL Database.So when client initiate machine policy,it communicate with management point which includes the software update client feature installation instructions to be installed or applied on the client. In this process, Client will create local GPO with WSUS Settings by leaving automatic updates .

If you do not  disable automatic updates (Via GPO) leaving the door open for the WUA to do things on its own outside the control of ConfigMgr including installing any updates approved directly in WSUS (including new versions of the agent itself which are automatically approved) and rebooting systems which have a pending reboot. Neither of these is desirable in a ConfigMgr managed environment and thus the recommendation for disabling automatic updates. As for the rest of the Windows Update GPO settings, they are meaningless in the context of ConfigMgr so it doesn't really matter what you set those to if you disable automatic updates,more from here

If you choose to create a GPO for WUA, you must configure the Windows Update Server option to point to the active software update point server in the site or location. If there is an existing GPO that was intended to manage standalone WSUS prior to implementing Configuration Manager in your environment, the GPO could override the local GPO created by Configuration Manager, which can cause issues when the software update client tries to communicate with the software update point server.

Software update Components involved are:

1.Windows update agent (WUA)

2.Software update client agent (from SCCM)

3.Windows management instrumentation (WMI)

Note: Make sure you disable the automatic updates via GPO,further reading http://blog.configmgrftw.com/software-updates-management-and-group-policy-for-configmgr-cont/

Windows Update agent(WUA): is responsible for scheduling and initializing scan, detection, download, and install of updates on the client machine. WUA Agent is an implanted service in a Windows service (SVCHOST.exe) and is named Windows Update which you can see from services.msc.

If you disable WUA Agent, software update agent will not function correctly. So it always recommended to not disable this service.

Software update client agent (from SCCM): When you enable the software update agent,it will install 2 actions on the client 1) Software update scan cycle 2) software update deployment Evaluation Cycle

Software Update Scan Schedule :This action perform the software update scan (along with WUA) against the Microsoft update catalog, which occurs every 7 days by default.

software update Deployment evaluation:This action Initiate the software update deployment to start download and install the updates.

Note: when you create software update deployment with deadline for ex: at 4.00 PM ,the actual time that software update client start updating the installation is depends on on setting disable deadline randomization ((located in the Computer Agent client settings)

A delay of up to 2 hours will be applied with deadline time to install required software updates . This randomization prevents all software update clients from starting update installations at the same time (This setting is disabled by default). More info,read https://technet.microsoft.com/en-in/library/gg682067.aspx?f=255&MSPPError=-2147217396 . If you enable this setting,then the deployed software updates will be installed with deadline what you set i.e at 4.00PM (based on Client local time or UTC).

It is also good to know the patch compliance states which are sent as state messages by client to site server .Patch compliance is calculated based on these 4 states.

Installed : This means the software update is applicable and the client already has the update installed. 

Not Required: This means the software update is not applicable to the client .

Required: This means the software update is applicable but is not yet installed.Alternatively, it may mean that the software update was installed but the state message has not yet been sent to to the site server.

Unknown : This means either that the client system did not complete the software scan or the site server did not receive the scan status from the client system.

Enough theory , Lets have a look at client troubleshooting steps. ( Note: Client logs can be found at %windir%\ccm\logs\ ,if you have not changed the default path).

There are many logs on the client which help you to troubleshoot client issues,but we only look at important logs what is required for software updates.

1 . First log to check is locationservices.log —>This log is used to check the correct software update point has been detected by the client.You can also see the management point and distribution point entries from this log.

2 . 2nd log to check is wuahandler.log –> when the software update scan cycle initiated, Windows update agent (windows update service) will contact WSUS (SUP) for scanning and if is successful,a state message will be sent to site server confirming that,software update scan is completed successfully which can be seen from this log. Get the report to know the software update scan results from here

For some reason,if you don’t see the successfully completed scan message,you should start troubleshooting from this log based on the error .

You can get the error description from CMTrace.exe tool. Copy the error code and use ctrl+L (Error lookup) from your cmtrace.exe ,get the error description  .

If WSUS entries are not set correctly or having any issues locating the correct WSUS,you can set WSUS entry manually or script.Further troubleshooting is required .

The registry location for the WSUS entries as follows:

HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU with UseWUSserver =1

3. 3rd log is windowsupdate.log –>If software update scan is successful from wuahandler.log ,you can ignore this log file and directly move to next log (updatesdeployment.log) .If Software update scan is not successful then,you should look at this log for more information.  This log Provides information about when the Windows Update Agent connects to the WSUS server and retrieves the software updates for compliance assessment and whether there are updates to the agent components.

Using these 2 logs (wuahandler.log and windowsupdate.log) ,try to fix the errors and make sure ,you see the scanning successful from wuahandler.log

4 .4th log to check is UpdatesDeployment.log —> Provides information about the deployment on the client, including software update activation, evaluation, and enforcement. Verbose logging shows additional information about the interaction with the client user interface.

This log shows the number of updates and deployments being targeted to a machine.

From above log snippet ,you see that,the total actionable updates = 0 means ,client do not require any additional updates that you targeted to this PC.For some reason,if the client says non-compliant from your sccm reports,try to refresh compliance state using https://msdn.microsoft.com/en-us/library/cc146437.aspx ,and monitor updatestore.log to see if the state messages (like Successfully raised Resync state message)has been sent to the site server (MP) or not.

you can alternatively use the below PowerShell script ,deploy to your clients monthly twice or once as per the business needs.

$SCCMUpdatesStore = New-Object -ComObject Microsoft.CCM.UpdatesStore $SCCMUpdatesStore.RefreshServerComplianceState() New-EventLog -LogName Application -Source SyncStateScript -ErrorAction SilentlyContinue Write-EventLog -LogName Application -Source SyncStateScript -EventId 555 -EntryType Information -Message "Sync State ran successfully"

updatedeployment.log also tell you that,what assignments (Update deployments) made with count of updates in each deployment. From above log, Assignment {C37C45D8-E722-4EB7-AC21-014925079560} has total CI = 6 , means ,the assignment has total 6 patches .

How do you check the deployment name for particular assignment ? well ,you can add Deployment Unique ID column for software update deployment or use below SQL syntax .

SELECT * FROM vSMS_UpdateGroupAssignment WHERE vSMS_UpdateGroupAssignment.Assignment_UniqueID= ' {C37C45D8-E722-4EB7-AC21-014925079560} '

For some reason,if you don’t see the newly added patches installing ( issue no:7) ,you can check updatedeployment.log with particular assignment group and patch count .If the count of patches are less than what it supposed to be,then you may have to refresh the machine policy ,initiate software update scan and wait for a while before client start downloading the policies.

If you see some updates are pending for action (total actionable updates <>0)  but not installing,look at CAS.log if your client is able to locate the content on the Distribution point or not.

UpdatesDeployment.log will also tell you ,if enough maintenance window ( ServiceWindowManager.log ) time available to install the updates.Read the following blogs to know the maintenance window calculation for software update installation.

http://blogs.technet.com/b/configurationmgr/archive/2013/06/11/configmgr-2012-support-tip-clients-never-reboot-even-when-required-in-a-deployment.aspx

http://blogs.technet.com/b/csloyan/archive/2010/10/24/maintenance-window-calculations-explained.aspx

5 .5th log to check check is UpdatesStore.log —>Provides information about the compliance status for the software updates that were assessed during the compliance scan cycle (Status like Missing/Installed).

If you see all things working good, the final log to refer is RebootCoordinator.log —>Provides information about the process for coordinating system restarts on client computers after software update installations.

Below diagram shows the configuration manager Client side software update deployment flowchart captured from configuration manager software update management filed experience guide .

For troubleshooting clients, You can use tools like deployment monitoring tool,configuration manager support center etc.

I normally use the configuration manager support center to troubleshoot the client issues to check if the policy for the deployed software update group received correctly or not based on the PolicyIVersion .

Open the support center (you can download from Microsoft) ,connect to remote machine (need admin rights on remote computer) .

go to policy tab,click on requested  and then Load requested policy .you will see list of wmi instances on the left.

click on settings( root\ccm\policy\machine\requestedconfig ) ,click on CCM_updateCIassignment , click the policyID ,on the right side,you will see information about the software update group.

check the policy version on the client and on the site server .now you know how to take it further troubleshooting. Good luck.

Couple of common workarounds when troubleshooting software update issues :

1. Stop the windows update service,rename or delete the Software Distribution folder (%windir%\softwareDistribution) and start windows update service. This approach provides a fresh start with a new Windows Update data store if the Datastore.edb file is corrupted.

2. Restart the windows update service ,trigger software update scan cycle and software update deployment evaluation cycle.follow the logs.

4. http://eskonr.com/2014/11/sccm-configmgr-2012-software-update-scan-failed-onsearchcomplete-failed-to-end-search-job-error-0xc8000222/

5. http://eskonr.com/2014/11/sccm-configmgr-2012-patch-report-ou-based-compliance-status-per-update-group/

6. http://eskonr.com/2014/10/sccm-configmgr-2012-software-update-scan-error-group-policy-settings-were-overwritten-by-a-higher-authority-error-code-0x87d00692/

7.Refer software update client issues  https://technet.microsoft.com/en-in/library/bb932189.aspx

8.  Software Update Management Troubleshooting in Configuration Manager   https://support.microsoft.com/en-sg/help/10680/software-update-management-troubleshooting-in-configuration-manager

This post will be updating with possible solutions frequently.So keep checking this blog post.

Related Posts

Enhancing sccm software update deployments for better compliance and efficiency, troubleshooting unexpected reboots caused by software center computer maintenance setting, managing windows 11 updates: downgrading from 23h2 to 22h2 using remediation and safeguard hold policies, 67 comments.

Thank you for your excellent article. I having issues with the "Async searching of updates using WUAgent started." process starting and never completing, then errors out and start over again. I have restarted the Update Service, reinstalled agents, deleted the Software Dist folder, but still nothing. Any suggestions?

Hi, Is the issue happening on servers or workstation? if servers, you can refer this article http://eskonr.com/2017/08/sccm-configmgr-software-update-scan-stuck-with-error-code-80080005/

Thanks, Eswar

Hope you can help. I have couple of servers on different sites that are showing as non-compliant but software is installed. I run PS script above and all possible advices from web but non-compliant message is persistent. There are bunch of servers that are showing as compliant on same site. Under details for those assets status for all packages are "Installed" but there fields are blank for "Enforcement State" and "Last Enforcement Message Time". I suspect that SCCM is receiving this info from client and thus puts assets in "In Progress" state. Any idea how can I force "Enforcement State"

Seems to WUAHandler Log name mentioned like wuahander (spell mistake). it may new learner will confuse.

Thanks Madhu. I have corrected it.

Good information! Very helpful for day-to-day ConfigMgr administrators.

Any clue about this error message (by the way, only one of my servers is experiencing this behavior; everything fine on DPs):

CCCMUpdatesDeployment::GetUpdate failed, error - 0x87d00215 GetUpdate - failed to get targeted update, error = 0x87d00215. GetUpdate failed, error 87d00215 EnumerateUpdates for action (UpdateActionInstall) - Total actionable updates = 0

Hi, Error code 0x87d00215 refers to item not found. Check if the deployment or the content is active.

Can you advice what are the basic checks to do if 20H2 upgrade package deployment for windows 10 is not showing up in software center for download by user.

Hi, You can check the policyagent and policyevalutor log if the client receive the policy first in place. if the policy received by the client, check the deployment settings such as deadline, user experience etc. For some reason, if the content not distributed to DP, the deployment wont appear in the software center unless you choose to download from internet (if CMG available).

Very Good information provided here in this article. I’m facing continuously a problem.. The patches shown in some of the Client machine after the desired patching window. Nearly 4 Hours later the deployment deadline. Could you please let me know the exact solution for such issues?

Hi, Check if you have enabled deadline randomization in client settings that would delay the patches to upto 4 hrs after the deadline.

hello, it often happens to me that software center for updates says: "Waiting for another installation to complete". why? how to solve?

Hi, "Waiting for another installation to complete" is due to other installation running and it must complete. To check the current installation, you can read the client logs such as wuahandler.log, updatesdeployment.log.

I found your script today: https://gallery.technet.microsoft.com/SCCM-Configmgr-Powershell-ebbb2c0e/view/Reviews

It saved my day, rather week… many thanks for your effort. If I can leave a positive Feedback somewhere, let me know…

cheers Reto

Thanks for the feedback Reto. Glad you liked it.

Hello, Excellent article again. I have an issue with 4500331 which is not downloading in May 2019 or June 2019... I did not see any trace of this KB/Article in any log!!! Any idea Thanks, Dom

Hi, Did you check cas.log, contenttransfer and datatransfer service log for content download ? that should tell you why is the content failing to download.

Hello Eswar, I am having issue with newly created environment. When running ADR, it create SUP and when trying to deploy to machines, all machines just sits with in Unknown tab for days... Any idea what am i missing here?

Hi, are these computers did the successful software update scan ? Unknown means, client did not get the policy of this ADR deployment yet hence unknown. you can troubleshoot further by looking at policyagent,policyevalutor logs etc

Hello , I recently have installed SCCM current branch VERSION 5.00.8634.1000 BUILD 5.00.8634.1000. We detected that the most Patches for example for Windows 7 are showing in thee summary like NOT REQUIRED. I used your SQL query and only a few patches are required for Windows 7 (total 14) when the MACHINE has not been patche for almost a year. I download the patch from MS directly and I can install the same without problem. I checked all cient logs and the same looks fine. There is any idea what is going on? Thanks

Did you check in the wmi of client in software update instance if that particular patch is not required ? Looks like, more investigating needs to be done on the client PC rather installing the patch manually. Do you have any other clients that have same behavior so it would be easier to check from client WMI. I haven't encountered such issue .

Regards, Eswar

Very good article and very useful. But I have a question/problem.

I use for application testing 2 desktops and when necessary I will refresh them with an image using SCCM. But at the moment I don’t get the updates of last month. In all the logfiles you described in your article I don’t see any error messages. When I use SCCM reporting to check the compliance of a security update I see the 2 desktops with the state “Update is not required”. On the desktops the update is NOT installed. When I download the update from Microsoft I can install it without any problem. Very strange is that a week ago I installed these updates on the 2 desktops for testing and there was no problem.

Before I image the desktops I first remove them from SCCM with hopefully all the history it has. But I have the idea that somewhere it is still noted that the update are installed and there for the state is “Update is not required”. I already used your Powershell script to refresh the compliance state. Any idea how this problem can be solved.

Regards Ron

this article should be mandatory for every SCM administrator. Fantastic! Thank you very much.

Thanks for your kind words .

Eswar, I am getting a strange issue with updates on my servers. in the Updatedeployment.log I am getting this verbiage:

Update already available, just resolve properties. So the updates are there however not installing due to a properties issue. I checked maintenance windows ( they are good) and I checked to make sure clients were pointing to the SUP... any thoughts?

First off: Thank you for this article! This is invaluable information to have as an SCCM administrator.

Secondly: The obligatory question =) Have you ever run into an issue where the clients are installing the updates successfully, but not showing the correct status in the Console? For example, recently in my environment we deployed the 2017-08 Security-only Update for 2012 R2 to various servers. Subsequently, most of these servers reflect an 'Unknown' deployment status (Asset Details only show 'Client check passed/Active')... but a few of the targeted servers correctly show the expected In Progress status (Asset Details: Pending system restart).

I've been pouring over the client and server logs (per your article) and can see that all the targeted servers DID correctly discover the software update deployment at the expected time, installed the update by the deadline time, and locally are reporting that they are now in a pending reboot state. All looks well client-side, I can't find a single issue there. I've even run the above PowerShell to refresh the server compliance state; no issues found in updatestore.log - the resend (client side) appears to be perfectly fine.

However on the server side, these systems still show up as Deployment Status: Unknown. I've rerun the summarization multiple times and refreshed, as well viewed from a separate console installation on another machine- no change. It acts like the MP server is either (a) not receiving the status message, or (b) not correctly reporting on it.

Thanks in advance,

Hi Jared, Is this issue happening to all clients or few clients ? If this is happening to all clients, then there must be something to suspect on the server side components .If this is affecting only few ,it is something to do with client side or server side processing. For machine status that shows unknown ,when was the last update scan completed successfully for the problem client ? if the clients showing unknown status in report,then it must be that ,client is either not doing update scan or state messages are processing at site server. can you delete the client from SCCM console and initiate the heartbeat DDR cycle on the client ,wait for while to let client info appear in SCCM console if this makes any difference ? I am not saying this is full solution but to give a try.

Pretty informative article!!

Is there an easy way to identify if the updates were installed by windows automatic updates or from SCCM updates deployment?

You can go through the windowsupdate.log, updatesdeployment.log and wuahandler.log . If you are using SCCM to manage patching, it is always recommended to disable windows automatic updates to avoid the conflicts with SCCM and auto reboot issues (default is every day 3AM).

http://sccmtooltraining.blogspot.in/2017/07/sccm-training-tutorials-for-beginners.html

Hello, I currently have SCCM 2012 on a Server 2008. I am building a new SCCM Branch 1702 on Server 2016. The 2008 Server is still in production and we use that for deploying updates, with our WSUS server stand alone and it being the Site System Server on the SCCM 2012 server.

I have added that same WSUS server as well as a Site System Server on the new 2016 Server so i can test to clients. When I setup a package to deploy, nothing happens on the client. When I view Component Status on the 2016 server, i see SMS_SITE_COMPONENT_MANAGER error

Site Component Manager detected that site system "\\WSUSAP1.LOCAL.INTRANET" is currently in use by ConfigMgr site (Server 2008).

Possible cause: You accidentally configured this site system as part of this site and as part of site XXX(2008 Server). Solution: Remove this site system from the list of site systems for this site or for site XXX(2008 Server).

AND also this

Site Component Manager failed to configure site system "\\WSUSAP1.LOCAL.INTRANET" to receive Configuration Manager Server Components.

Solution: Review the previous status messages to determine the exact reason for the failure. Site Component Manager cannot install any Configuration Manager Server Components on this site system until the site system is configured successfully. Site Component Manager will automatically retry this operation in 60 minutes. To force Site Component Manager to immediately retry this operation, stop and restart Site Component Manager using the Configuration Manager Service Manager.

Am I able to have 2 different SCCM servers with different Site Codes using 1 WSUS server??

Always like your article sir. very helpful to me as a beginner

Hello Eswar. I was facing with problem while execution scan for updates from SUP the error is OnSearchComplete - Failed to end search job. Error = 0x8024401c. Scan failed with error = 0x8024401c. Machine is Windows Server 2016, sccm client installed correctly, the version of WUA is 10.0.14393.82 Do you know, if it possible to do something?

the Scan failed with error = 0x8024401c -- > Same as HTTP status 408 - the server timed out waiting for the request. Looks like downloading or scanning may be timedout. can you check the windowsupdate.log to see if the WSUS location is pointed correctly. Try to initiate update scan ,post the logs.

Hi all, I would like to get severity of patches from client side? Could you please tell me how to do that?

Hi, what do you mean by severity of patches ? you can use the default software update report to get different kinds of data.

Hi Eswar. So for some reason non of my machines are taking patches anymore. They are not taking anything from Dec patch Tuesday, the last set they took was the end of Nov. Except for WINDOWSUPDATE.LOG (I don't seem to have that file) I don't see anything out of the ordinary in the client logs. How would I even know if it's a client issue and not a server issue?

what does the client logs says ? do you see anything wrong in wuahalnder.log,windowsupdate.log about software update scan ? if the scan is doing correctly ,go back to your SCCM server ,look for the client ,what patches is it requesting. if there are no patches needed by the client ,then you are good else try to deploy any of the client requested patches and see if any progress.

Use the below SQL Query to find the patches required by specific client for troubleshooting purpose: Replace the hostname and run the SQL query from SQL management studio.

declare @PC nvarchar (255);set @PC=' VSGWin701 ' select CAST(DATEPART(yyyy,ui.DatePosted) AS varchar(255)) + '-' + RIGHT('0' + CAST(DATEPART(mm, ui.DatePosted) AS VARCHAR(255)), 2) AS MonthPosted, CONVERT(VARCHAR(26),ui.DatePosted, 103) [Date Posted], ui.bulletinid [BulletinID],ui.articleid [ArticleID], ui.Title, Approved=(case when ctm.ResourceID is not null then 'Yes' else 'No' end), Required=(case when css.Status=2 then 'Yes' else 'No' end), ui.InfoURL as InformationURL,ui.ci_uniqueID, CONVERT(VARCHAR(26),ui.DateLastModified, 100) [Date LastModified] , Deadline=CONVERT(VARCHAR(26),cdl.Deadline, 100) , case when ui.IsSuperseded=1 then 'Yes' else 'No' end as 'Superseded', case when ui.IsExpired=1 then 'Yes' else 'No' end as 'Expired' from V_UpdateComplianceStatus css join v_UpdateInfo ui on ui.CI_ID=css.CI_ID left join v_CITargetedMachines ctm on ctm.CI_ID=css.CI_ID and ctm.ResourceID = css.ResourceID INNER join v_CICategories_All catall2 on catall2.CI_ID=css.CI_ID INNER join v_CategoryInfo catinfo2 on catall2.CategoryInstance_UniqueID = catinfo2.CategoryInstance_UniqueID JOIN dbo.v_R_System AS vrs ON vrs.ResourceID = css.ResourceID outer apply ( select Deadline=min(a.EnforcementDeadline) from v_CIAssignment a join v_CIAssignmentToCI atc on atc.AssignmentID=a.AssignmentID and atc.CI_ID=css.CI_ID ) cdl WHERE vrs.Name0=@PC and css.Status=2 group by CAST(DATEPART(yyyy,ui.DatePosted) AS varchar(255)) + '-' + RIGHT('0' + CAST(DATEPART(mm, ui.DatePosted) AS VARCHAR(255)), 2), ui.BulletinID,ui.ArticleID,ui.Title,ctm.ResourceID,css.Status,ui.InfoURL,ui.DateLastModified,cdl.Deadline ,ui.IsSuperseded,ui.IsExpired,ui.DatePosted,ui.ci_uniqueID ORDER BY 1

Hi Eswar, I love your blog! It helps with my work all the time. One question.. I ran this query to try and see what software updates I need to install to get a computer in my company from Non-compliant to compliant state running the Software Update- Compliance A report. I ran this query against a compliant machine and against a non-compliant machine. In both cases, there are numbers that indicate that there are required updates for both and are not approved. How do I figure what software updates a particular machine needs to get to compliance state?

I would assume when running this query against a compliant machine, then no rows should show, but that wasn't the case.

Thanks in advance!

This is a great information you shared with us. I have one query can you please send me all the steps of Software update point and Software distribution in SCCM 2012 with all logs files associated with.

what all steps do you need ? you can go through the microsoft document (newly formatted) which has all the information nicely written. http://www.docs.microsoft.com/sccm

In SCCM 2012 auto client deploy is not working in Suprface pro 4 and desktops.Can you please give the solution. When i installed through SCCM client is installing,but when i connect new machine is not able to install sccm client default.

Hi, Did you enable automatic site wide client push installation as described here http://www.windowsnetworking.com/articles-tutorials/common/sccm-2012-client-deployment-part3.html ? what does the log (ccm.log) says ?

thanks, Eswar

In my company environment we are using SCCM 2012 R2 Sp1 CU2 (5.0.8239.1301), recent days I am facing a weird issue, we have disabled software updates deployment (crossed deadline) which has been deployed for a collection, due to an issue we had to rollback the patches from installed server manually, however the members of the collection getting the software updates installed automatically, the behavior looks like a bug? is there any fix available for this issue? anyone facing similar issue? any help much appreciated.

Hi Sudarsan, can you check the logs as mentioned in the blog post to see what software update group is deploying the patches ? pick one server and check if that server is member of any other collection that has patches deployed ? client logs can help you to find more information.

Can u explain me how to use the power shell script to advertise the client. IF possible with screenshot.

regards, sree

here is step by step instructions to deploy powershell script https://blogs.technet.microsoft.com/scotts-it-blog/2015/02/23/refreshing-state-messages-in-system-center-configuration-manager-2012/

very useful information..

Hi Eswar, Thank you for great article. Hopefully I am not too late to follow up and if possible get a couple of answers. 1. I am preparing Windows updates deployments with SCCM in medium size company - around 500 computers. In my test environment I deployed Windows updates for last 6 months, more than 200 definitions got updated but a couple failed temporarily on some machines. When I mentioned temporarily they are installed after retry in software center. Challenge is the notification in status bar which shows that update failed, even though more than 200 updates got installed notification points to couple of failing updates. I can hide all notifications when I configure settings for deployment and keep only end user notified for computer restart. This will probably bypass failing updates notification but will not install required (failed) updates. If I keep this notification then end users will generate numerous tickets for Help Desk assuming updates are not installing. I can't send introductory email to 500 people with something like: "If you notice you have a couple of updates which failed please hit retry and they will get installed"

What are the best practices in the industry? 2. Second thing would be restart policy with SCCM. We can configure in Administration/Client Settings/Default Client Settings ( or create a custom client settings)/Computer Restart option to reboot computer max 24hours after updates are installed. This will make sure updates got installed and computer is compliant. But it's not that simple as it seems. VIP people don't want to be forced to reboot their computers after 24 hours if they are in the middle of presentation or on meeting. It's really hard to plan and reboot computer prior to important events but there is no option to postpone. If we don't make reboot mandatory than computers will be vulnerable. There are 3rd party tools on the market, like shutdown tool from deploymentresearch group but not sure if this would be desirable as it may reboot computers which are not even patched by mistake after 7 days. I have to test it. Any advice, the best solutions out there? Thanks, Blaf

have you ever tried the Maintanance Window for collection ? this should answer all your questions. have a look at it what maintenance Window does http://blog.configmgrftw.com/maintenance-windows-oh-maintenance-windows/

VERY GOOD TROUBLESHOOTING ARTICLE

Can you please help me on the below mentioned issue? I am not able to find the solution yet.

https://social.technet.microsoft.com/Forums/en-US/4c088ce4-e7c2-4f81-8963-ee7bb2534c21/wsus-sup?forum=configmanagersecurity

Regards TechMan

replied to technet link. you should look at windowsupdate.log and wuahandler.log for troubleshooting.

thanks for sharing information

good and very useful article sir,

sir I had an issue, as mentioned I renamed the c:\windows\software distribution folder and tried to install the failed update (Adobe activeX update), it installed sucessfully. but on the next day again it is showing the update as failed in software center.

my WUAhandler.log shows: Failed to download updates to the WUAagent datastore. ERROR: 0x800b0109,

the error lookup description is: A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.

the same update is sucessful in 70% of machines and is failed in remaining machines, all are in the same location.

please guide me sir...

Superb job. Very useful information.

thanks Rajesh.

Hello and thanks for the informations. Just a little question. How to check the policy version of the sotware update group on the server ? thank you

this is stored in the database .have you looked at the Software update deployment by right click properties and select Version ID ?

i don't see this tab. Could you show me a screenshot of this ? thank you

ok ,I could not able to find what I said earlier but may I know why are you looking for that info ? for client troubleshooting to know if the particular deployment has updated on the client or not ,you can simply check UpdatesDeployment.log for number of updates as I described in the blog.

master in troubleshooting.. nice article.

You simply rock dude, I like your interest in sharing the information...!!!

Leave a Reply Cancel reply

This site uses Akismet to reduce spam. Learn how your comment data is processed .

Type above and press Enter to search. Press Esc to cancel.

SCCM Clients not receiving updates

Having software update issues since this past weekends patch deployments.

Deadline was set for this past Friday for clients to receive updates and reboot. Majority of clients still in unkown/Client passed status

All I see in the WUAHandler on my clients is:

OnSearchComplete - Failed to end search job. Error = 0x80244022. WUAHandler 5/4/2017 8:57:42 AM 20060 (0x4E5C) Scan failed with error = 0x80244022. WUAHandler 5/4/2017 8:57:42 AM 20060 (0x4E5C) Removed Update Source ({3843D746-FDB5-4804-B83E-6A9B395B76ED}) of content type: 2 WUAHandler 5/4/2017 9:17:45 AM 6824 (0x1AA8) CWuaHandler::SetCategoriesForStateReportingExclusion called with E0789628-CE08-4437-BE74-2495B842F43B;E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for leaves and E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for bundles WUAHandler 5/4/2017 9:17:45 AM 6824 (0x1AA8) CWuaHandler::SetCategoriesForStateReportingExclusion called with E0789628-CE08-4437-BE74-2495B842F43B;E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for leaves and E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for bundles WUAHandler 5/4/2017 9:25:43 AM 1316 (0x0524) CWuaHandler::SetCategoriesForStateReportingExclusion called with E0789628-CE08-4437-BE74-2495B842F43B;E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for leaves and E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for bundles WUAHandler 5/5/2017 3:38:50 AM 7016 (0x1B68) CWuaHandler::SetCategoriesForStateReportingExclusion called with E0789628-CE08-4437-BE74-2495B842F43B;E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for leaves and E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for bundles WUAHandler 5/6/2017 5:27:57 AM 6540 (0x198C) CWuaHandler::SetCategoriesForStateReportingExclusion called with E0789628-CE08-4437-BE74-2495B842F43B;E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for leaves and E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for bundles WUAHandler 5/10/2017 2:40:42 AM 1868 (0x074C) CWuaHandler::SetCategoriesForStateReportingExclusion called with E0789628-CE08-4437-BE74-2495B842F43B;E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for leaves and E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for bundles WUAHandler 5/26/2017 3:09:46 PM 6168 (0x1818) CWuaHandler::SetCategoriesForStateReportingExclusion called with E0789628-CE08-4437-BE74-2495B842F43B;E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for leaves and E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for bundles WUAHandler 5/29/2017 5:16:47 PM 13048 (0x32F8) CWuaHandler::SetCategoriesForStateReportingExclusion called with E0789628-CE08-4437-BE74-2495B842F43B;E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for leaves and E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for bundles WUAHandler 6/6/2017 4:04:13 AM 24212 (0x5E94) CWuaHandler::SetCategoriesForStateReportingExclusion called with E0789628-CE08-4437-BE74-2495B842F43B;E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for leaves and E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for bundles WUAHandler 6/11/2017 5:38:38 AM 6628 (0x19E4) CWuaHandler::SetCategoriesForStateReportingExclusion called with E0789628-CE08-4437-BE74-2495B842F43B;E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for leaves and E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for bundles WUAHandler 6/14/2017 4:19:43 AM 7212 (0x1C2C) CWuaHandler::SetCategoriesForStateReportingExclusion called with E0789628-CE08-4437-BE74-2495B842F43B;E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for leaves and E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for bundles WUAHandler 6/30/2017 1:00:16 PM 7216 (0x1C30) CWuaHandler::SetCategoriesForStateReportingExclusion called with E0789628-CE08-4437-BE74-2495B842F43B;E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for leaves and E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for bundles WUAHandler 7/5/2017 5:19:42 AM 7244 (0x1C4C) CWuaHandler::SetCategoriesForStateReportingExclusion called with E0789628-CE08-4437-BE74-2495B842F43B;E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for leaves and E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for bundles WUAHandler 7/12/2017 5:17:11 AM 6448 (0x1930) CWuaHandler::SetCategoriesForStateReportingExclusion called with E0789628-CE08-4437-BE74-2495B842F43B;E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for leaves and E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for bundles WUAHandler 7/24/2017 12:25:21 PM 4092 (0x0FFC) CWuaHandler::SetCategoriesForStateReportingExclusion called with E0789628-CE08-4437-BE74-2495B842F43B;E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for leaves and E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for bundles WUAHandler 7/24/2017 12:31:04 PM 12196 (0x2FA4) CWuaHandler::SetCategoriesForStateReportingExclusion called with E0789628-CE08-4437-BE74-2495B842F43B;E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for leaves and E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for bundles WUAHandler 7/24/2017 12:34:16 PM 7132 (0x1BDC) CWuaHandler::SetCategoriesForStateReportingExclusion called with E0789628-CE08-4437-BE74-2495B842F43B;E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for leaves and E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for bundles WUAHandler 7/25/2017 11:26:00 AM 6924 (0x1B0C) CWuaHandler::SetCategoriesForStateReportingExclusion called with E0789628-CE08-4437-BE74-2495B842F43B;E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for leaves and E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for bundles WUAHandler 8/6/2017 4:13:02 AM 2728 (0x0AA8) CWuaHandler::SetCategoriesForStateReportingExclusion called with E0789628-CE08-4437-BE74-2495B842F43B;E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for leaves and E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for bundles WUAHandler 8/11/2017 2:13:36 AM 6468 (0x1944) CWuaHandler::SetCategoriesForStateReportingExclusion called with E0789628-CE08-4437-BE74-2495B842F43B;E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for leaves and E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for bundles WUAHandler 8/13/2017 4:31:36 AM 6688 (0x1A20) CWuaHandler::SetCategoriesForStateReportingExclusion called with E0789628-CE08-4437-BE74-2495B842F43B;E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for leaves and E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for bundles WUAHandler 8/17/2017 4:20:32 PM 7712 (0x1E20) CWuaHandler::SetCategoriesForStateReportingExclusion called with E0789628-CE08-4437-BE74-2495B842F43B;E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for leaves and E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for bundles WUAHandler 8/17/2017 4:24:18 PM 17024 (0x4280) CWuaHandler::SetCategoriesForStateReportingExclusion called with E0789628-CE08-4437-BE74-2495B842F43B;E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for leaves and E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for bundles WUAHandler 8/17/2017 4:32:19 PM 14248 (0x37A8) CWuaHandler::SetCategoriesForStateReportingExclusion called with E0789628-CE08-4437-BE74-2495B842F43B;E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for leaves and E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for bundles WUAHandler 9/15/2017 2:23:26 AM 8152 (0x1FD8) CWuaHandler::SetCategoriesForStateReportingExclusion called with E0789628-CE08-4437-BE74-2495B842F43B;E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for leaves and E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for bundles WUAHandler 9/17/2017 4:40:23 AM 8064 (0x1F80) CWuaHandler::SetCategoriesForStateReportingExclusion called with E0789628-CE08-4437-BE74-2495B842F43B;E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for leaves and E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for bundles WUAHandler 10/3/2017 2:11:41 AM 4476 (0x117C) CWuaHandler::SetCategoriesForStateReportingExclusion called with E0789628-CE08-4437-BE74-2495B842F43B;E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for leaves and E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for bundles WUAHandler 10/3/2017 2:15:00 AM 20520 (0x5028) CWuaHandler::SetCategoriesForStateReportingExclusion called with E0789628-CE08-4437-BE74-2495B842F43B;E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for leaves and E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for bundles WUAHandler 10/3/2017 2:23:40 AM 10160 (0x27B0) CWuaHandler::SetCategoriesForStateReportingExclusion called with E0789628-CE08-4437-BE74-2495B842F43B;E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for leaves and E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for bundles WUAHandler 10/3/2017 2:23:53 AM 4684 (0x124C) CWuaHandler::SetCategoriesForStateReportingExclusion called with E0789628-CE08-4437-BE74-2495B842F43B;E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for leaves and E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for bundles WUAHandler 10/13/2017 3:11:34 AM 7188 (0x1C14) CWuaHandler::SetCategoriesForStateReportingExclusion called with E0789628-CE08-4437-BE74-2495B842F43B;E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for leaves and E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for bundles WUAHandler 10/15/2017 4:14:27 AM 5372 (0x14FC) CWuaHandler::SetCategoriesForStateReportingExclusion called with E0789628-CE08-4437-BE74-2495B842F43B;E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for leaves and E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for bundles WUAHandler 10/16/2017 10:07:35 AM 7604 (0x1DB4) CWuaHandler::SetCategoriesForStateReportingExclusion called with E0789628-CE08-4437-BE74-2495B842F43B;E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for leaves and E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for bundles WUAHandler 11/17/2017 2:14:34 AM 7496 (0x1D48) CWuaHandler::SetCategoriesForStateReportingExclusion called with E0789628-CE08-4437-BE74-2495B842F43B;E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for leaves and E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for bundles WUAHandler 11/19/2017 4:12:46 AM 3436 (0x0D6C) CWuaHandler::SetCategoriesForStateReportingExclusion called with E0789628-CE08-4437-BE74-2495B842F43B;E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for leaves and E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for bundles WUAHandler 11/28/2017 5:40:08 PM 1800 (0x0708) CWuaHandler::SetCategoriesForStateReportingExclusion called with E0789628-CE08-4437-BE74-2495B842F43B;E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for leaves and E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for bundles WUAHandler 12/7/2017 5:08:28 PM 16496 (0x4070) CWuaHandler::SetCategoriesForStateReportingExclusion called with E0789628-CE08-4437-BE74-2495B842F43B;E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for leaves and E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for bundles WUAHandler 12/7/2017 5:08:47 PM 1588 (0x0634) CWuaHandler::SetCategoriesForStateReportingExclusion called with E0789628-CE08-4437-BE74-2495B842F43B;E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for leaves and E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for bundles WUAHandler 12/7/2017 5:18:28 PM 12912 (0x3270) CWuaHandler::SetCategoriesForStateReportingExclusion called with E0789628-CE08-4437-BE74-2495B842F43B;E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for leaves and E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for bundles WUAHandler 12/7/2017 5:22:35 PM 19732 (0x4D14) CWuaHandler::SetCategoriesForStateReportingExclusion called with E0789628-CE08-4437-BE74-2495B842F43B;E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for leaves and E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for bundles WUAHandler 12/7/2017 5:22:49 PM 11476 (0x2CD4) CWuaHandler::SetCategoriesForStateReportingExclusion called with E0789628-CE08-4437-BE74-2495B842F43B;E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for leaves and E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for bundles WUAHandler 12/15/2017 2:20:21 AM 7936 (0x1F00) CWuaHandler::SetCategoriesForStateReportingExclusion called with E0789628-CE08-4437-BE74-2495B842F43B;E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for leaves and E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for bundles WUAHandler 12/18/2017 1:12:02 PM 8816 (0x2270) CWuaHandler::SetCategoriesForStateReportingExclusion called with E0789628-CE08-4437-BE74-2495B842F43B;E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for leaves and E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for bundles WUAHandler 1/16/2018 5:43:09 AM 8140 (0x1FCC) CWuaHandler::SetCategoriesForStateReportingExclusion called with E0789628-CE08-4437-BE74-2495B842F43B;E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for leaves and E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for bundles WUAHandler 1/30/2018 5:37:10 PM 4616 (0x1208)

Any advice would be appreciated.

I am going round and round in circles trying to find articles that don’t fix it or are not relevant and there are no proxies defined for our network.

NO WSUS errors. IIS pool is started

Unknown means the client has not reported in, it is likely the client on the PC is misconfigured, boundary groups are wrong etc.etc.etc.

The basics of how software updates get to the client, assuming it is reporting correctly

By default The Software Update Scan only runs every 7 days.

You can verify this by going to

\Administration\Overview\Client Settings

and check the default client settings/Software Updates and the software updates and software deployment re-evaluation schedule

(there may be another client setting that overrides this)

Secondly, if you just synced WSUS to download the updates and pushed them out straight away, it will take the 7days for all clients to check in.

If you want that quicker, then you can create a Client setting to set it to 1 day and deploy it to a collection.

It is best to keep the default client settings standard and deploy your own client settings. You will see the default client settings priority is 10,000 so if your new setting has a higher priority it will be applied instead

Relax and try installing ManageEngine Desktop Central, which work independent of WSUS. Manage client updates both automatically and manually, while you are searching articles to fix the same, try using Desktop Central.

Know why Desktop Central is better than SCCM here- Why Desktop Central is the best SCCM alternative - ManageEngine Blog

Desktop Central- ManageEngine Endpoint Central | Unified Management and Security Solution for endpoints

If you are interested in the same, please feel free to DM me.

I have set the client setting to check for software updates every day. The problem I am seeing is that only 1 or 2 clients a day seem to be getting these updates and I currently have over 1200 workstations in the collection it is being deployed to. I have verified the DP’s have received the content. Im lost as to what else I may need to look into.

Ok so start with SSRS reports

Compliance 3 - Update group (per update) - Report Manager

Home > ConfigMgr_xxx > Software Updates - A Compliance > Compliance 3 - Update group (per update)

What is the ratio of installed/required/not required/unknown Have you solved the “unknown” problem yet?

Other health checks

\Monitoring\Overview\System Status\Site Status is everything green \Monitoring\Overview\System Status\Component Status is everything green

\Monitoring\Overview\Distribution Status\Content Status check your Deployment packages are successfully deployed

\Monitoring\Overview\System Status\Status Message Queries

All Status Messages for the last day and filter on message ID 10025

withteh powershell here you can translate back to teh KB it was having trouble downloading

Attached photo of Software update status. As you can see there are a lot of unknown clients which i know are missing this update.

Everything under site status is green.

SMS_MP_control_manager is showing warnings and throwing off these errors for different GUIDs:

MP has rejected policy request from Client(SMSID = GUID:52DE0931-BBA2-494F-A907-EF9F21E8065D) because this SMSID is marked as blocked.

SMS_State_system is showing warnings like this:

Component Status Summarizer set the status of component “SMS_STATE_SYSTEM” running on computer “ @ #&#(*#&(” to Warning.

Possible cause: The component is experiencing a problem. Solution: Diagnose and fix the problem by:

• Examine the status messages that the component reports.
• Correcting the problem.
• Instructing Component Status Summarizer to reset the counts of Error, Warning, and/or Informational status messages reported by the component. To reset the counts, right-click Reset Counts on the component in the Component Status summary in the Configuration Manager Console. When the counts are reset, Component Status Summarizer will change the status of the component to OK. This might take some time if site “123” is a child site.
• Deleting any unwanted status messages from the site database, if necessary.
• Monitor the component occasionally to verify the problem does not reoccur.

Possible cause: The component is OK and you were unnecessarily alerted because the Component Status Thresholds are set too low for the component. Solution: Increase the Component Status Thresholds for the component using the Thresholds tab of the Component Status Summarizer Properties dialog box in the Configuration Manager Console.

Possible cause: The component is “flooding” the status system by rapidly reporting the same message repeatedly. Solution: Diagnose and control the flood of status messages by:

• Verifying that the component is actually flooding the status system. View the status messages reported by the component, and verify that the same message is continually reported every several minutes or seconds.
• Noting the Message ID of the flooded status message.
• Creating a Status Filter Rule for site “123” that instructs Status Manager to discard the flooded status message when component “SMS_STATE_SYSTEM” on computer “& ^ & &( &*(&” reports it.
• Verifying that your sites’ databases were not filled up by the flooded status message. Delete any duplicate status messages from the site database, if necessary.
• Refer to the Microsoft Knowledge Base for further troubleshooting information.

Ok , in the SCCM console go to

\Assets and Compliance\Overview\Devices

add the columns “Approved” and “ID” and “Blocked”

The add the criteria of “Blocked” equals yes and hit the search button

If you have about 1300 items in the state of “blocked” then that will be your reason

The only device that shows up as “blocked” is my Primary Site Server which im sure is by default. Please correct me if I am wrong.

Mine is not blocked, I only have one site , one primary site server and half a dozen distribution points.

I have never dealt with anything that has been blocked, so cannot advise

I have unblocked The Primary Site Server and will see if anything changes. I have close to 28 distribution points on my end.

Knock knock joke

SCCM: Knock knock

ME: Who’s there?

ME: SCCM Who?

for those that may not of got the joke… Once you do something in SCCM it make take forever (or it feels like it) before SCCM appears actually tells you its is doing something

I also call it “hurry up and wait mode”

Probably your best check to see if this has fixed it, is to run that report every hour or so and see if the unknown number comes down

Failing that select an “unknown” device and use CMtrace to read the client logs. have a look at http://eskonr.com/2014/04/sccm-configmgr-2012-client-actions-and-its-description/ and check the logs listed to see if you can get any insight

specifically

**Software updates deployment evaluation Cycle:**This action will initiate scan for software updates compliance. Evaluates the state of new and existing deployments and their associated software updates. This includes scanning for software updates compliance, but may not always catch scan results for the latest updates. This is a forced online scan and requires that the WSUS server is available for this action to succeed. This action results will be logged into couple of log files on the client: scanagent.log (scan requests for software updates), UpdatesStore.log (Status of patches like missing,Installed), UpdatesDeployment.log (update activation, evaluation, and enforcement,notify about reboot) etc.

Often the logs refer to the unique update id of the patch and you can add that column in \Software Library\Overview\Software Updates\All Software Updates so you can search for the UUID and refer to the KB

So after logging a support ticket with Microsoft it seems as though my updates were failing due to the fact that I didnt have my Primary Site Server (which is also my central Software update Point) set up as a boundary group reference. Once we added that server into the group updates immediately started deploying to clients. Not one article Ive read has stated this. Has anyone else had to do the same?

ah, I ,ok I think I know this one.

After a SCCM RAP we got pinged for multiple boundary groups having the site assignment checkbox ticked.

You can only have 1 boundary group with site assignment checked

So (at SCCM 2012 R2 level) I setup a boundary group with the primary server in it and ticked the site assignment check box.

For the rest of the boundary groups i made sure it was unchecked

Now I just checked by boundary groups and now (we are now at SCCM CB 1702) i have a new boundary group called “Default-Site-Boundary-Group” and it also has the site assignment checkbox check AND the primary and ALL DPs are included AND I am not able to untick the check box

Looks like a call to MS…for me

What version of SCCM are you on?

Related Topics

Deep Dive SCCM Application Model Troubleshooting – Client End

Hello, I’m  Nitin Chhabra .  I worked as a Microsoft support engineer specializing in SCCM Application Deployment technology for several years. I am an SME in Application deployment, Software Update deployment and OSD.

This post will focus on the SCCM Application Deployment on the client side and continue my previous blog to dive deep into the SCCM Application Model Troubleshooting (Server Side).

The application model in SCCM is CI (Configuration Item) based, which provides us with a lot of flexibility in customization, planning, and rolling out software in an Enterprise environment. However, this flexibility can complicate troubleshooting a failed deployment.

This post will help you learn the client-side flow for application deployment. To understand each component’s functionality, let us take the “Notepad++” application deployment as an example.

Please follow my previous post to learn how to dive deep into a background process while creating an application on the SCCM console.

• Learn SCCM Troubleshooting Steps for Newbies with Flowcharts
• SCCM Logs and Quick Tips to Read Logs
• SCCM Troubleshooting Tips on Reporting Server SSRS Issues ConfigMgr Endpoint Manager
• Fix SCCM Report Server Cannot Open A Connection Error
• SCCM Troubleshooting Tool -Support Center ConfigMgrSupportCenter.exe

Major Components Involved in SCCM Application Model Client-Side Troubleshooting

The SCCM client will run the “Machine Policy Retrieval and Evaluation Cycle” to download the assigned policies to the machine. The Policy Agent is the component responsible for downloading the policy. We will discuss each component in detail.

Policy Agent

This component fetches the policies from the Management Point by building an assignment request. This request includes client GUID, Policy Source, NetBios Name, and Policy Type (machine or user). The log file associated with this component is PolicyAgent.log.

CCM Messaging

Policy Agent will pass the control to CCM Messaging, which initiates a remote sync message for the Management Point. This component performs almost every communication from the SCCM client to MP. It initiates the BITS session to connect to MP; the connection is made on port 80/443 as per the client configuration.

The log file associated with this component is CCMMessaging.log . If you have any connection issues with MP, like firewall port blocking, network packet drop, or MP host-name not being resolvable, you will see error messages in this log file.

MP Policy Manager

On the Management point, the MP Policy Manager will service the client’s policy request by providing a new/updated set of policies.

After receiving a request from the client , this component fetches the policies from the SCCM Database (Primary/Secondary site database). The log file associated with this component is MP_Policy.log.

If you scroll down this log after you see the client request, you will see the new policy details for the client. This includes Policy ID , which is your Deployment ID , Policy Type (Machine/User), Policy Category, etc.

Data Transfer Service

Policy Agent will initiate Data Transfer Service to start the download of Policy from Management Point. All the download, which the SCCM client does, uses Data Transfer Service for that.

We will see the request initiation in PolicyAgent.log and the actual download details in DataTransferService.log.

Data Transfer Service will download the policy and place it in the “ CCM\Temp ” directory. DTS will check if the directory is present and create the same if not found.

Policy Evaluator

After the policy is downloaded, the Policy Evaluator is initiated, compiling and applying the policy. This component is responsible for adding the evaluated policy in the actual config of the WMI( \\root\ccm\policy\machine\actualconfig ).

The log file for this component is PolicyEvaluator.log . I have trimmed some of the lines in the log to focus on the pointers of interest.

Once the policy is evaluated, the CI (Configuration Item) components activate and process the application’s deployment on the client machine.

CI State Store

This is the first component triggered after the policy is successfully compiled. It further initiates CCMSqlCE to check the details of the CI. Each client machine maintains a small database for application CIs, known as ccmstore.sdf, which is located in the client’s install directory.

CCMSqlCE is the component that helps in opening a session with this DB and getting the required information. The associated log file is CIStateStore.log .

This component works in conjunction with the CI State Store and lists information about CI. It checks whether the application deployment is for the user or the system. The associated log file is CIStore.log .

CI Agent & CI Downloader

Once the client has validated the details of the CIs, the CI Agent is triggered to download the complete content of the CI and related SDM packages. The CI Agent will create a job for the CI Downloader to start the CI download, which further uses the Data Transfer Service to perform the actual download. The log files associated with these components are CIAgent.log and CIDownloader.log .

Data Transfer Service downloads the CI content in a staging directory ( C:\Windows\ccm\CIDownloader\Staging )

Once CIs are completely downloaded, the TransitionState will be updated, and the same is listed in CIAgent.log . Policy Platform client (a prerequisite of the SCCM client) will process the SDM packages downloaded for the CI’s.

Note: The SDM (Service Definition Model) package uses the SML (Service Definition Language).

App Discovery

After the CI’s of the application are downloaded and processed, the App Discovery component takes the command to detect the application on the client machine. It initiates the Expression Solver component , which will run the detection logic defined in the deployment type to determine the status of the application. The log file associated with this component is AppDiscovery.log.

Expression Solver

This component runs the detection logic defined in an Application deployment type. Depending on the detection logic evaluation, it gives a Boolean output value (True/False). The log file for this component is ExpressionSolver.log .

Once we have the result from Expression Solver(which is set to False), App Discovery marks the application as not discovered and triggers the App Intent Eval component.

App Intent Eval

This component will evaluate the application’s intended state and check for any requirement, supersedence, or dependency defined in the Application. The log file associated with this component is AppIntentEval.log.

The output from the APP Intent Eval will be given to the CI State Store and CI Agent and added to the CCMStore.sdf. After this, the CI Agent sets the TransitionState to “CompletedSdmMethodInvocation.”

The steps mentioned above will happen when the machine gets the policy for a new application. Till now, we have not started any installation from the Software Center.

We will see the deployment details if we connect to the client machine’s WMI and check the CCM_ApplicationCIAssignment class.

Now let’s trigger the application install from the Software Center and study the components involved.

CCM SDK Provider

CCM SDK Provider will mark the initiation of the install from the Software Center, and the CI Agent job is created for the client machine. All the CI transitioned from evaluation, then download, and finally, the DCM agent logged enforcement. The associated log file is CCMSDKProvider.log.

After this, we will see the App Discovery is triggered again to check the application state on the machine, so the same process mentioned above will be repeated for App Discovery, Expression Solver, and App Intent Eval.

Once the application is not found installed, CAS (Content Access Service) is called to download content for the application.

Content Access Service is the component responsible for providing the application’s content. It starts a job for Content Transfer Manager according to the DP location received from the client machine’s boundary. The log file for this component is CAS.log .

If the CAS can find the content in the local cache, it will match the content version with the required one. Otherwise, a CTM (Content Transfer Manager) job would be created, which would then create a DTS (Data Transfer Service) job to start downloading the data from the Distribution Point.

App Enforce

Once the content is downloaded, this component is triggered, which starts the application’s enforcement or initiates the installation. However, it will check whether the application is already installed before installing. This is confirmed using App Discovery, and the above cycle repeats again.

Finally, the command line is triggered using the account type(system/user) mentioned in the deployment type. App Enforce keeps track of the command’s exit code. Based on the exit code, the application is marked as successful or failed. AppEnforce.log will list the activity performed by this component.

After the application installation, the exit code is returned to App Enforce, checking if the defined code is listed as a success in the Application configuration.

App Discovery is triggered to detect the Application on the machine if it succeeds, which completes the Enforcement. After this, a state message is raised mentioning the deployment’s compliance.

This completes the application’s enforcement. At each enforcement step, a state message is raised, which helps us report deployment compliance.

I hope you will find this post interesting and helpful in day-to-day troubleshooting.

• Deep Dive SCCM Application Model Troubleshooting
• SCCM Inbox File Types Extensions and Associated Components

We are on WhatsApp . To get the latest step-by-step guides and news updates, Join our Channel.  Click here  – HTMD WhatsApp .

Nitin Chhabra has worked as a Microsoft support engineer specializing in SCCM Application Deployment technology for several years. He is considered an SME in Application, Software Update, and OSD deployment.

2 thoughts on “Deep Dive SCCM Application Model Troubleshooting – Client End”

Excellent writeup. These kinds of deep dive into the full process flow of SCCM functionality are incredibly useful, and very much appreciated.

Great article with nice details. Excellent!

Leave a Comment Cancel reply

This site uses Akismet to reduce spam. Learn how your comment data is processed .

Fix SCCM Application Deployment Error 0X87D00213

Let’s see how to fix the SCCM application deployment error 0X87D00213. If your ConfigMgr application deployment is failing with error 0X87D00213, there is a sure shot solution to it.

An application deployment in SCCM can fail due to several reasons. In most cases, either the application install command is incorrect or the actual issue is on the client computer.

The error 0x87D00213 is observed when you are deploying large size applications in SCCM. This includes applications like Maya, AutoCAD, and software programs that require downloading additional files during the setup.

In some cases, the application download may be stuck at 0%, and it results in multiple errors. Read how to fix SCCM application download stuck at 0% in Software Center .

In my case, the 0X87D00213 deployment error was observed during Office 365 application deployment in a remote site. Whenever you encounter error 0X87D00213, always refer to the AppEnforce.log for more details.

A similar issue was reported in SCCM forums where the user complained about application deployment error 0X87D00213. However, the issue was with the deployment script and not the application.

The SCCM application deployment error 0X87D00213 translates to “ Timeout Occurred “. The error 0X87D00213 is resolved by increasing the Maximum allowed run time (minutes) for the application.

The below screenshot shows SCCM application deployment error 0X87D00213. The complete error description and the associated solution is as follows:

0x87D00213 Error Message: Additional information for error resolution: Increase the Maximum allowed run time (minutes) for the application. Ensure that the maintenance window on the client is large enough to support the runtime.

Let’s understand why do you get the error 0X87D00213 ? Every application that you install via Software Center, requires some time to install. If the application fails to install in the given time, it results in error 0X87D00213.

When you create an application in SCCM , on the User Experience tab of application deployment type window you see two options.

• Maximum allowed run time (minutes)  – Specify maximum run time for application installation.
• Estimated installation time (minutes)  – The estimated installation time displays to the user when the application installs.

By default, the  Maximum allowed run time (minutes)  is set to 120 minutes for every application you create in SCCM. Here is the guide that explains how to change the Maximum allowed run time based on your requirement.

If an application requires more time to install than the limit you’ve specified, the application installation fails with error code 0X87D00213.

Sometimes the admins modify the Maximum allowed run time (minutes) and set a shorter installation time which results in application deployment error 0X87D00213.

In remote sites, where the bandwidth is slow, the clients may take more time to download the content even though the distribution point is in the same site or remote.

Hence, the application deployment error 0X87D00213 is commonly seen in remote sites while the same application installs fine in SCCM primary sites.

ConfigMgr provides free error lookup tools that can translate error codes to error messages. In this case, none of the tools were able to decode the 0x87D00213 error. But keep using those tools to decode other errors.

I hope this article helps to you fix the ConfigMgr application deployment error 0X87D00213. In case something else worked for you, let me know in the comments section below.

Need more help?

If you need further assistance on the above article or want to discuss other technical issues, check out some of these options.

Prajwal Desai is a Microsoft MVP in Intune and SCCM. He writes articles on SCCM, Intune, Windows 365, Windows Server, Windows 11, WordPress and other topics, with the goal of providing people with useful information.

Get the Reddit app

All things System Center Configuration Manager...

Update Scan Error: Job error 0x87d00692 / GPO conflict

By continuing, you agree to our User Agreement and acknowledge that you understand the Privacy Policy .

Enter the 6-digit code from your authenticator app

You’ve set up two-factor authentication for this account.

Enter a 6-digit backup code

Create your username and password.

Reddit is anonymous, so your username is what you’ll go by here. Choose wisely—because once you get a name, you can’t change it.

Reset your password

Enter your email address or username and we’ll send you a link to reset your password

Check your inbox

An email with a link to reset your password was sent to the email address associated with your account

Choose a Reddit account to continue

Register a free account today to become a member! Once signed in, you'll be able to participate on this site by adding your own topics and posts, as well as connect with other members. Please post your questions in the correct category.

• Microsoft Cloud
• Configuration Manager

SOLVED   SCCM 1802 Update And Servicing Issue

• Thread starter Thread starter tata789
• Start date Start date Dec 3, 2018

Well-Known Member

• Dec 3, 2018
• \ConfigMgrUsageData
• \ConfigMgrUpdatePacks

Youssef Saad

• Dec 10, 2018

You need to enable early update on your console to have 1810, download this script and run it with administrator privilege from your site server, run again the scan from Update & servicing.  

• Thread Starter

hello can you please let me know step how to run this PS1 script thank you Arun  

like to thank you, I madid to work thanks' for help thank you Arun  

Good, resolved.  

yes it did resolved, thank you  

Latest posts

• Latest: pedro.lopes
• Friday at 6:01 PM

• Latest: Prajwal Desai
• Friday at 4:21 PM
• Latest: XorOne
• Friday at 2:52 PM
• Friday at 12:12 AM
• Latest: jimy_MDM
• Thursday at 9:13 PM

Trending content

• Maithri_Bangalore
• Wednesday at 12:08 AM
• arranda saputra
• Nov 1, 2016
• Apr 3, 2020
• Daniel Broz
• Apr 24, 2017
• Patson Bass
• Oct 23, 2015

Forum statistics

Follow along with the video below to see how to install our site as a web app on your home screen.

Note: This feature may not be available in some browsers.

This browser is no longer supported.

Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.

Application installation common error codes reference

• 5 contributors

Applications can be installed on clients by creating deployments from the Configuration Manager console or by targeting applications to tenant attached devices from the Microsoft Intune admin center . Use the information in this article to assist with troubleshooting application installation errors.

General troubleshooting tips

Generally, if an application installs successfully on a device with the given command line in the system context, it will install successfully through Configuration Manager and from the Microsoft Intune admin center. You can simulate this by using PSExec .

• Open an administrative command prompt.
• Change directory to where you saved PSExec .
• Type in psexec -accepteula -s -i cmd .
• This opens a new command prompt window running interactively in the system context. Check that you're in the system context by running a whoami command.
• Run the install from the new windows with the installation command line. For example, msiexec /i "My App.msi" /q would be a quiet install of the "My App" msi file.

You may also find that searching through multiple files for a specific string is useful. For instance, you might want to search all the client .mof files for a specific class, or you might want to search logs for a specific ID. Using a specific ID when searching can give you an understanding of how components are related to each other. Use the select-string cmdlet in those instances.

Configuration Manager errors

General Configuration Manager troubleshooting tips

When an application fails to install and the error source is Configuration Manager , typically, following the application troubleshooting guide and using the general troubleshooting tips helps you resolve the error. You may also want to use Support Center for Configuration Manager to help troubleshoot and review information about your clients.

Message : Service is shutting down

Additional information for error resolution : Verify that the Configuration Manager client is running on the target device. Verify the client is running by:

• Reviewing the CCMExec.log on the device
• Verifying that the SMS Agent Host service is running on the device

Message : Parsing error

Additional information for error resolution : This error generally occurs in one of the Configuration Manager components when a piece of data is invalid. This error could stem from something missing for the application, an old package version, or a number of other general errors. Follow the application troubleshooting guide to help locate the error and resolve it. It may be necessary to review additional logs for components that support application installation. Searching for specific IDs or error codes in the logging may help you identify the problem. For more information, see general troubleshooting tips .

Message : Timeout occurred

Additional information for error resolution : Increase the Maximum allowed run time (minutes) for the application. Ensure that the maintenance window on the client is large enough to support the runtime. For more information, see the application troubleshooting guide to help resolve the error.

Message : Item not found

Additional information for error resolution : Verify that the following exist and are accessible to the client:

• The application deployment exists and the client sees the policy.
• The application content exists and is available to the client

For more information, see the application troubleshooting guide to help resolve the error.

Message : Syntax error occurred while parsing

Message : The object or subsystem has not been initialized

Message : CI documents download timed out

Additional information for error resolution : The CI documents activity can be tracked in CIAgent.log , CIDownloader.log , and DataTransferService.log . For more information, see the CI Agent section of the application troubleshooting guide.

Message : Failed to decompress CI documents

Message : CI Version Info timed out

Additional information for error resolution : Typically this error occurs when a change was made to the application and the client doesn't have the new information for it. Verify that the client is getting the policy and it knows about any updated revisions to the application.

Message : The script execution has timed out

Additional information for error resolution : Check the AppEnforce.log for details. You may need to increase the Maximum allowed run time (minutes) for the application. Ensure that the maintenance window on the client is large enough to support the run time. For more information, see the application troubleshooting guide to help resolve the error.

Message : The application was not detected after installation completed

Additional information for error resolution : Review the AppDiscovery.log and the CIAgent.log . Once an installation is completed, the application detection is used again to verify the installation .

Message : Application was still detected after uninstall completed

Additional information for error resolution : Verify the correct uninstall command was used in the AppEnforce.log . Review the AppDiscovery.log and the CIAgent.log . Once an uninstall is completed, the application detection is used again to verify the uninstall .

Message : Script is not signed

Additional information for error resolution : Verify the PowerShell execution policy client setting for the device. The default for this client setting is AllSigned so an unsigned script will cause a failure.

Message : Application requirement evaluation or detection failed

Additional information for error resolution : Review the AppIntentEval.log to discover dependencies and supersedence rules for the application and their states. For more information, see Application deployment evaluation .

Message : Content not found

Additional information for error resolution : Verify the content for the application is on a distribution point and that the distribution point is accessible to the client. For more information, see Application download in Configuration Manager .

Message : No current or future service window exists to install software updates

Additional information for error resolution : Ensure that the maintenance window on the client is large enough to support the Maximum allowed run time (minutes) for the application installation and that the client has received the policy for the window.

Message : Failed to verify the executable file is valid or to construct the associated command line

Additional information for error resolution : Verify that the executable file is installable on its own then verify it's installable with the given command line.

Message : Failed to access all the provided program locations. This program may retry if the maximum retry count has not been reached

Additional information for error resolution : The client is getting locations for the content, but can't reach the locations. Review the client's LocationServices.log for the Distribution Point= . Use ContentTransferManager.log and DataTransferService.log to monitor the download for errors.

Message : The content download cannot be performed because there is not enough available space in cache or the disk is full

Additional information for error resolution : Check that the machine has enough space on the drive. Compare the size of the ccmcache directory with the client cache settings and ensure the setting is adequate for the application's size.

Message : The content download cannot be performed because the total size of the client cache is smaller than the size of the requested content

Additional information for error resolution : Compare the size of the ccmcache directory with the client cache settings and ensure the setting is adequate for the application's size.

Message : A supported App-V client is not installed

Additional information for error resolution : Verify that a supported version of App-V is installed on the client.

Message : The App-V sftmime command returned failure

Additional information for error resolution : For information on sftmime commands, see Manage Virtual Applications by Using the Command Line .

Message : An error occurred when querying the App-V WMI provider

Additional information for error resolution : For information on the App-V WMI provider, see Application Virtualization Client WMI Provider .

Message : Error Unknown

Additional information for error resolution : Follow the application troubleshooting guide to help locate the error and resolve it. It may be necessary to review additional logs for components that support application installation. Searching for specific IDs or error codes in the logging may help you identify the problem. For more information, see general troubleshooting tips .

Message : Application was successfully installed

Additional information for error resolution : The application was successfully installed.

General MSI troubleshooting tips

When errors are encountered from MSI, typically you'll need to Enable Windows Installer logging . After the logging is enabled, you can retry the problem installation and Windows Installer will track the progress and post it to the %temp% folder. The new log's file name is random. However, the first letters are Msi and the file name has a .log extension.

The MsiExec.exe and InstMsi.exe Error Messages and Windows Installer Action Return Values lists are useful when reviewing a Windows Installer log as are the general troubleshooting tips .

Message : User cancel installation

Additional information for error resolution : The installation was canceled by the user. Ask the user to install the application fully. If possible, you can attempt to run the installation for the system rather than the user.

Message : Fatal error during installation

Additional information for error resolution : Enable Windows Installer logging and run the install again. When reviewing the installer log, typically an entry stating Return value 3 is located near the failure reason in the log. For more information on possible return values and their meaning, see Windows Installer Action Return Values .

Message : This action is only valid for products that are currently installed

Additional information for error resolution : Ensure that the product is installed before running a dependant install.

Message : Another program is being installed. Please wait until that installation is complete, and then try installing this software again

Additional information for error resolution : Wait for the prior installation to complete before running a new one. If the prior installation stops responding, you can attempt to stop the installation or terminate the process. Terminating a process might have undesired results.

Message : This installation package is not supported by this processor type. Contact your product vendor

Additional information for error resolution : Ensure that the device's processor architecture is appropriate for the software. Verify the target device meets or exceeds the minimum processor requirement for the application. Contact the product vendor if the device's processor meets the product's processor support specifications.

Message : Another version of this product is already installed. Installation of this version cannot continue. To configure or remove the existing version of this product, use Add/Remove Programs on the Control Panel

Additional information for error resolution : Uninstall the the unwanted version of the product. If you aren't using Configuration Manager, a script, or another management tool to uninstall, uninstall from the device manually. For Windows 10 or later clients, use Windows Settings > Apps to uninstall the unwanted version of the product. For earlier versions of Windows, use Programs and Features from the Control Panel to uninstall the unwanted version of the product.

Message : The upgrade patch cannot be installed by the Windows Installer service because the program to be upgraded may be missing, or the upgrade patch may update a different version of the program. Verify that the program to be upgraded exists on your computer and that you have the correct upgrade patch

Additional information for error resolution : Verify the device meets the product versioning prerequisites for the installation.

Windows errors

General Windows troubleshooting tips

Use the Windows system error codes list or Download the Microsoft Error Lookup Tool for looking up additional codes that aren't listed in this article. Using the Windows event logs and the general troubleshooting tips can also help identify the cause of these errors.

Message : Incorrect function

Additional information for error resolution : Review the Windows event logs around the time of the failure in combination with the installation logs to determine the possible cause of the error.

Message : The system cannot find the file specified

Additional information for error resolution :

• If the missing file is a system file, run the System File Checker tool to repair missing or corrupted system files . You can also use /scanfile=file or /verifyfile with the sfc command to scan the binary and check if there is any issue with that file.
• If the missing file is an application file, you can repair or uninstall and reinstall the application to replace the missing file.
• You can launch Process Monitor without capturing events and filters by using ProcMon.exe /NoConnect /NoFilter /AcceptEULA

Message : Debugger terminated process

Additional information for error resolution : Detach any debuggers attached to the process and retry the application installation.

Message : One or more arguments are invalid

0x80000007L

Message : Operation aborted

Additional information for error resolution : Use the installation logs and Configuration Manager application logs to determine why installation stopped. Merge the logs so you can easily review what happened before the 0x80000007L error. Use eventvwr.msc to review the Windows event logs for additional events that occurred around the time of the installation failure.

Message : General access denied error

Additional information for error resolution : If the issue isn't clear from the logs, using eventvwr.msc to review Windows event logs and Process Monitor can help identify problematic files or processes. If needed, use the Windows user interface or icacls to modify permissions on the problematic file.

Additional tips for file permissions in Windows operating systems:

• Deny permissions always take precedence over Allow permissions.
• Explicit permissions take precedence over inherited permissions.
• If NTFS permissions conflict, or example, if group and user permissions are contradictory, the most liberal permissions take precedence.
• Permissions are cumulative.

Message : Unspecified error

Additional information for error resolution : Use the installation logs and Configuration Manager application logs to determine why installation stopped. Merge the logs so you can easily review what happened before the 0x80004005 error. Use eventvwr.msc to review the Windows event logs for additional events that occurred around the time of the installation failure. Follow the application troubleshooting guide to help resolve the error. Process Monitor can also help identify the failure.

Message : Catastrophic failure

Message : Class not registered

Additional information for error resolution : This is typically a configuration-related DCOM error. Review DCOM configuration settings using dcomconfig . If there's a problematic .dll file, you can use regsvr32 to register the dll file and try the install again. A large number of problematic files could be a sign of an underlying issue that needs to be resolved before you can install the application.

Message : The hash value is not correct

Additional information for error resolution : The hash of a file isn't correct and the installation can't complete. Typically you will see this error in the CAS.log . Check to see if file contents for the application were recently updated. There may be an issue with the package, in some cases you may need to rebuild and redistribute it. This issue can also happen if there is a sharing violation on a file, such as a security application scanning the file. Configuration Manager expects exclusive access to the file during a hash check. You can identify the problematic process by running a Process Monitor and adding a filter. The condition to be met is if the Result contains Sharing Violation then Include the event.

Message : Initialization of the dynamic link library failed. The process is terminating abnormally

Additional information for error resolution : If there is a problematic .dll file, you can use regsvr32 to register the dll file and try again. A large number of problematic files could be a sign of an underlying issue that needs to be resolved before you can install the application.

Windows Management Instrumentation (WMI) errors

General WMI troubleshooting tips

Problematic namespaces can typically be found in the Configuration Manager log files and the WMI logging . WMI relies on Component Object Model (COM)/Distributed Component Object Model (DCOM), the registry, the file system, and Remote Procedure Call (RPC). DCOM registrations and permissions are critical for WMI operations to be successful. You can review DCOM configuration settings using dcomconfig .

When troubleshooting WMI problems, typically you start by verifying that the needed namespaces, classes, and instances exists in the WMI repository and can be accessed.

Verify the namespace exists on the target first by running wmimgmt.msc from an elevated command prompt. When WMI Control launches:

• Select Action then Properties .
• Select the Security tab to see all the namespaces.
• Navigate to the namespace in question.
• Verify the namespace exists and review the security on the namespace.

To connect WMI Control to another computer:

• Select Action then Connect to another computer .
• Select the option for Another computer: then supply the name.
• Select Properties to connect. The connection to the WMI repository on the remote computer doesn't occur until you select Properties .
• You may also wish to try to connect with the IP address too to verify that you can connect.

Verify the namespace exists on the target and that you can query it properly. Run the Windows Management Instrument Tester from an elevated command prompt by typing in wbemtest . When the Windows Management Instrument Tester launches:

• Select Connect...
• Type in the problematic namespace such as root\cimv2 or root\ccm and user credentials if needed. To connect to another machine, supply the name or the IP address such as \\Machine1\root\ccm and credentials if needed.
• Select Enum Classes... to verify you get classes listed for the problematic namespace.
• Set the superclass info to Recursive and select OK to verify classes list for the problematic namespace.
• If you're using the root\ccm namespace, select a class that starts with "CCM_" such as CCM_ClientIdentificationInformation.
• If you're using root\cimv2 , choose one that starts with "Win32_" such as Win32_BIOS.
• Select Instances to verify the instances of the selected class load. For some classes, it's ok if there aren't any instances, just make sure that the Query Result window states Done . Long running queries to list of instances or queries that never finish may indicate a problem.

Verify the repository:

• From an elevated command prompt, run winmgmt /verifyrepository . Verifying is typically useful for invalid class errors especially if you had to recently recompile a .mof file using mofcomp .
• If problems are found during verification, you can try to salvage using winmgmt /salvagerepository
• Typically, you won't use /resetrepository unless it's truly needed an no other alternative exists. Some namespaces won't automatically rebuild and you'll need to either reinstall the software associated with the missing namespace or mofcomp the application's .mof files to rebuild them.

WMI resources:

• Introduction to wbemtest
• Winmgmt service
• WMI Log Files
• Ensure you change the default log size to cover your troubleshooting session.
• Once you have finished troubleshooting, remember to disable the trace and debug logging.
• Setting namespace security with the WMI Control
• WMI troubleshooting
• Ask The Performance Team: WMI

Message : WBEM_E_FAILED

Additional information for error resolution : WBEM_E_FAILED is a generic WMI failure error. The error can be caused by a number of things. The error will sometimes tell you which method or instance failed. You'll probably also see related log entires around the same time if you merge logs together based on similar function. For instance, if you see the error related to content for an application, you may want to merge together CAS.log, ContentTransferManager.log and DataTransfer.log. If the error happened on a site server not a client, you may want to review SMSProv.log for additional information. Use the General WMI troubleshooting tips to help identify the issue along with the application installation logs.

Message : WBEM_E_NOT_AVAILABLE

Additional information for error resolution : The resource, in many cases a remote machine, isn't currently available. Verify the device is online. Use the General WMI troubleshooting tips to help verify connectivity to WMI on the device.

Message : WBEM_E_INVALID_NAMESPACE

Additional information for error resolution : The namespace specified could not be found. Verify the target computer can connect to WMI by following the General WMI troubleshooting tips . Verify namespace specified exists.

Windows Update Agent errors

General Windows Update Agent troubleshooting tips

The errors for the installation originated from the Windows Update Agent. In many cases, you can attempt to install these updates using the built-in software update management from Configuration Manager, Windows Update for Business, or Microsoft Update. In certain circumstances where it's not feasible to use your regular patching mechanism, the .msu package can be installed with the Windows Update Standalone Installer (wusa.exe) like an application. Use the Windows Update logging and general troubleshooting tips to help determine the cause of the issue.

Message : The update to be installed is already installed on the system

Additional information for error resolution : The update is already installed on the device.

Message : Operation was not performed because there are no applicable updates

Additional information for error resolution : The update isn't applicable to the device. Verify that the device meets the requirements of the update. In cases where a superseding update has been installed, it's very rare that the superseded update would be applicable to the device.

Was this page helpful?

Coming soon: Throughout 2024 we will be phasing out GitHub Issues as the feedback mechanism for content and replacing it with a new feedback system. For more information see: https://aka.ms/ContentUserFeedback .

Submit and view feedback for

Additional resources

MEMCM News, MEMCM New Futures, Security News, Jobs

News , Tools & Scripts

SCCM Error Codes

0x8007000d means that there is a file that is needed by Windows Update, but that file is either damaged or missing. This won’t let you install anyupdates for Windows or any drivers, and it also won’t let you upgrade Windows 10 in case a newer version is available.

Error Description:  Updates handler job was cancelled. Error Code:  0X87D00664 – Max Run Time

Installation job encountered some failures. Error = 0x80240022/0x8024401c Retrigger the job.

error 0x87D01201(-2016407039) not enough available space in cache or the disk is full

-2145123272 represents the DNS, will need to work with DNS team

If LastErrorCode says -2145123272

Which means user had tampered the Business hours on the machines and restricted not to install updates

Job error 0x800703ee Group policy issue.

LastErrorCode = -2016410107 meaning machine did not had SCCM client installed due to the machine is in exception group like digital signage

Group policy conflict’ LastErrorCode=’-2016409966’/0x87D00692 Force GP policy

Failed to Add Update Source for WUAgent of type (2) and id ({8FFB67E3-4F85-4EF5-9BF5-668CC65B85DA}). Error = 0x87d00692.

This problem may occur if one or more of the following conditions are true:

• The Windows Update database is corrupted.
• Antivirus software is configured to scan the %Windir%\SoftwareDistribution folder.
• The Background Intelligent Transfer Service (BITS) service does not receive a content link header.
• A required system file is registered incorrectly.
• Windows Installer encountered an error.
• The Component Based Servicing (CBS) manifest is corrupted.
• The Windows Update service stops during the installation process.
• There’s a file version conflict with Windows Update agent files.