reports

SCCM-Compliance Setting Script error 0x87d00321

Hi All, When working with Compliance Settings, I normally end up using scripts and often, I get the error 0x87d00321. If you use CMTrace, you’ll see that the error is: The script execution has timed out. Source: System Center Configuration Manager —– Now, we need to understand how it works and how to change. The script timeout information is saved under the class SMS_SCI_ClientComp, Component Name Configuration Management Agent on a lazy property called ScriptExecutionTimeout. The default values is 60, it means that the script will be timed out after 60 seconds of execution. The value, can be seen when using the following powershell script  

  Now the trick part, how to change? As you can imagine, not that trick if you have PowerShell. The script below changes the default 60 seconds to 600 seconds,  

  if you want this behaviour to be changed or have…

SCCM 2012-SW Update Group for Reporting

Hi All, often, when i go to customers, i need to create and update a software update group for reporting so they can get a easy way to know if they are compliance with the deployed update groups… ps. you ay need to change the CategoryInstance_UniqueID to add the products and classifications you have in your environment.

 

SCCM 2012-Find TS Reference without AutoInstall settings

Hi All, it is a common problem when using OSD to install apps, to forget to select the “Allow this program to be installed from the Install Software task sequence without being advertised” application setting. same for the packages/programs, where people forget to select the “Allow this program to be installed from the Install Package task sequence without being deployed” on the program settings. When this happen, you will normally see the Task Sequence failing with error 0x80004005 and looking at the logs, you’ll see No matching policy assignments received. Policy download failed, hr=0x80004005 When this happen, you need to enable the setting and start it again, but you easily lost couple of hours doing it already. Microsoft has a good blog post on how to enable it here, however, it does not show you what apps or packages/program you need to change. So i created a simple (and dirty)…

SCCM 2012 R2 – Who dun it?! What have your admins been doing?

Players, A client of mine started slowly but surely getting more and more of his staff to start using SCCM 2012 R2. I created some custom RBA for his team, but as soon as I left … it seemed that some of the guys got lazy and just started adding people into the administrators group … So some admins had access over stuff in SCCM that they really should be allowed to touch … Long story short … some collections were deleted (by accident) and we needed to understand why and by whom. The guy wasnt in trouble, we just needed to identify who the admin was, so we can train them on how to manage collections correctly. Now there are many ways of doing this … My client wanted the “easiest way possible” to see “who dun it” in SCCM. So, there are actually some inbuilt reports in SCCM that…

SCCM 2012 R2 SQL Query Issues

Players, A client of mine had a issue with a custom SCCM query we created to find malicious software, he wanted to edit it, something went wrong and the console crashed. So we wanted to delete it and start again as we had the query backed up anyway. When we tried to delete it, we got a random error message and it simply wouldn’t move. So we ripped it out of SQL, here’s how we did it. Connect to your SCCM Database (CM_Sitecode), 1. Expand tables2. then right click “dbo.queries” and edit the to 200 rows3. Selected “Custom Query NAME”  then right click and then delete it. You’re also able to edit the query should you need to for SQL it self. Enjoy 🙂

SCCM 2012 – Uninstall not used application

Hi All, I often get asked questions about license management. SCCM, with the help of Asset Intelligence, can generate reports of licenses for Microsoft and non-Microsoft. Microsoft license is easy, it automatically connect to Volume License website and sync the data down, it means it will download your license information and not upload it. For non-Microsoft software, you can create a csv file and import it into the SCCM, easy isn’t it. However, SCCM will not do anything else, it means it will not automatically deny access to an application because you don’t have enough licenses as well as it will not automatically uninstall a not-used application, you need to do this management. Of course, the 1st is quite easy, for all paid apps (of course you’ll not do it for non-paid apps), you create a deployment that require authorisation. Once done, you can create a script do authorise only…

SCCM 2012 – Disable Maintenance Configurator

Hi All, Following Johan blog post about disabling Maintenance Configurator because it is EVIL, i decided to create a baseline for it. The reason is simple, you need to know where it is enabled and disable it if needed, get reports, etc… And how exactly you do that? the answer is simple, you use Configuration Manager DCM (or Compliance Settings on SCCM 2012) Well…it is really easy to do. the 1st thing you need to do is to create a script CI (Configuration Item). add the following powershell script to the discovery part and the following to the remediation part once done, you need to add compliance rule Done. now you need to add it to a baseline (or create a new one and deploy it to a collection)

SCCM 2012 – Software Updates

Hi All, Today I’m going to talk a bit aobut software updates. As you may be aware, softwre update is a “simple” task however, the process behind the software update can be a bit complex. And the reason is simple, what happen if I do this? Well…i don’t want this post to be dealt as “best practices” but a guidance on how to do software update and the reason is simple, many people know how to do, but always want a bit more guidance on what would be better….and remember…not best practices. I always refuse to talk about best practices because it always depends. Let’s imagine the scenario where you have a remote site with 3k users. Should you put a local DP there? maybe a secondary site? Let’s assume that as best practices, you would add a distribution point, but on this scenario, every single server should only be…

SCCM 2012 – CM12R2RegistrationRequest

Hi All, while ago, i created the ConfigMgrRegistrationRequest . This tool was written in C# and used the beta/RC version of the CM12 SP1 SDK. Since then, i started to move all my scripts from any language (vbscript, c#, etc) to powershell and today i’m happy to announce the beta version of the CM12R2RegistrationRequest. If you don’t know what this tool is, let me explain: This tool allow you create fake clients in the configuration manager enviornment. but you may be thinking why someone wants that? Easy.. 1- size of your database 2- test reports 3- load Once you run the tool, it will open a file called Import.csv (where you need to change the domain, site code, ip address, etc) and create a new record for each new PC. It will also send a DDR, request policy and send a test hardware inventory. As you may notice, there are…

SCCM 2012 – Unable to view reports via SCCM, Log on failed

Hi All, recently i was at a customer site trying to run reports from the SCCM console and it was failing with login failed. Looking at the reporting logs, i saw the following “ERROR: Throwing Microsoft.ReportingServices.Diagnostics.Utilities.LogonFailedExecution: Logon attempt for user ‘xxxxxx’ failed., Microsoft.ReportingServices.Diagnostics.Utilities.LogonFailedException: Log on failed. Ensure the user name and password are correct. –> System.ComponentModel. Win32Exception: Logon failure: the user has not been ranted the requested logon type at this computer. And looking at the error, it seems obvious, i typed the wrong username/password. I’ve checked it and tested and everything should be working, however, I was not sure about the AD replication. Anyway, i waited many hours just to be sure and the issue was still there. After this, i used rsop.msc to check what policies where being applied and noticed that the Logon Locally policy was set and looking at the membership rules, i noticed that the…