# Getting Started Welcome to our Learn with the Patch My PC Engineer Team channel! We launched in April 2021 expect more guides every couple weeks. # Content Troubleshooting This deep dive covers how to troubleshoot content location issues on the client and server-side in Configuration Manager. ## Video: Content Troubleshooting Deep Dive (Full Video) {% embed url="" %} Watch the Video Guide for Content Troubleshooting {% endembed %} ### Video: Content Troubleshooting Video Timeline * Meet the Patch My PC Team!: ([0:00](https://www.youtube.com/watch?v=3cu5_ZtTK60\&t=0s)​) * Scenario 1 - What happens on a successful content lookup in SCCM: ([1:35](https://www.youtube.com/watch?v=3cu5_ZtTK60\&t=95s)​) * Review valid boundary, boundary group, and content distribution: ([2:32](https://www.youtube.com/watch?v=3cu5_ZtTK60\&t=152s)​) How to Enable Verbose Logging in ConfigMgr/SCCM Client: ([3:40](https://www.youtube.com/watch?v=3cu5_ZtTK60\&t=220s)​) * Client logs for content location request in SCCM: ([4:30](https://www.youtube.com/watch?v=3cu5_ZtTK60\&t=270s)​) * Review Client Log Files CAS.log CIAgent.log CIDownloader.log CIStateStore.log ClientLocation.log CMBITSManager.log ContentTransferManager.log DataTransferService.log DCMAgent.log LocationServices.log StateMessage.log UpdatesDeployment.log : ([4:50](https://www.youtube.com/watch?v=3cu5_ZtTK60\&t=290s)​) * CCIStateStore::GetCIState - Client is requesting CI ModelName: ([6:45](https://www.youtube.com/watch?v=3cu5_ZtTK60\&t=405s)​) * \===== CacheManager: Content for Content\_{guid} was NOT found cache. =====: ([7:45](https://www.youtube.com/watch?v=3cu5_ZtTK60\&t=465s)​) * Client location request in CAS.log ContentLocationRequest: ([8:00](https://www.youtube.com/watch?v=3cu5_ZtTK60\&t=480s)​) * Review MP\_Location.log on the management point and the stored procedure MP\_GetContentDPInfo: ([9:20](https://www.youtube.com/watch?v=3cu5_ZtTK60\&t=560s)​) * DataTransferService.log creating a bits download request: ([11:10](https://www.youtube.com/watch?v=3cu5_ZtTK60\&t=670s)​) * Review downloaded update in the CCMCache folder: ([12:40](https://www.youtube.com/watch?v=3cu5_ZtTK60\&t=760s)​) * Review the MP\_GetContentDPInfo stored procedure in the ConfigMgr database: ([14:30](https://www.youtube.com/watch?v=3cu5_ZtTK60\&t=870s)​) * Scenario 2 - Boundary Groups Misconfigured: ([17:25](https://www.youtube.com/watch?v=3cu5_ZtTK60\&t=1045s)​) * Client is not in a boundary group in SCCM: ([17:48](https://www.youtube.com/watch?v=3cu5_ZtTK60\&t=1068s)​) * Attempt application install in SCCM when the client isn't in boundary group: ([18:45](https://www.youtube.com/watch?v=3cu5_ZtTK60\&t=1125s)​) * Application installed fails with error code 0x87D00607 in SCCM/ConfigMgr: ([21:18](https://www.youtube.com/watch?v=3cu5_ZtTK60\&t=1278s)​) * Enable fallback for content in the configuration manager site: ([28:12](https://www.youtube.com/watch?v=3cu5_ZtTK60\&t=1692s)​) * Troubleshooting content distribution failures in Configuration Manager (SCCM): ([34:45](https://www.youtube.com/watch?v=3cu5_ZtTK60\&t=2085s)​) * Content corruption in SMSContentLib directory: ([38:44](https://www.youtube.com/watch?v=3cu5_ZtTK60\&t=2324s)​) * Wrapping up: ([48:40](https://www.youtube.com/watch?v=3cu5_ZtTK60\&t=2920s)​) ## Scenario 1: Succesful Content Lookup Workflow ### Pre-Conditions 1. Healthy ConfigMgr client. 2. The client is in a boundary. 3. There is a Distribution Point associated with the boundary group. 4. The content is distributed successfully to the DP. 5. The software / update / package is deployed to the device. 6. Enable verbose logging on the site system with the MP role and the client ![We enabled Verbose logging on the cient and management point](/files/-MZOfCMAI2vsyMqtQE3f) ### Successful Content Lookup Flow There are many moving parts when a content location request is sent to the management point and processes by a ConfigMgr client. Here are some key snippets of how this happens. | Log File | Log Text | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | CCIStateStore.log | CCIStateStore::GetCIState - Client is requesting CI ModelName ScopeId\_CA3F999B-7A81-43BF-912C-56E267C1E565/RequiredApplication\_4894a05f-49c0-4836-a22f-50526dba27c4, Revision 1 for User: S-1-5-21-1880864260-2612682489-34998949-6112 | | CIDownloader.log | CDownloadPayloadInfo::AddCI - CI with ModelName ScopeId\_CA3F999B-7A81-43BF-912C-56E267C1E565/DeploymentType\_677dac51-d2a2-4bbd-aeb0-4b845aa288cd, Version 1 is already available. Requested Model:VersionSpecific will be downloaded. | | CAS.log | ===== CacheManager: Content for Content\_8ba1768d-abc6-4e42-919d-1e421fe610f0.1 was NOT found cache. ===== | | CAS.log | ContentLocationRequest : \\\\\\\\\\\\\\\\\\ | | UpdatesHandler.log | Starting download on action (INSTALL) for Update (9c93cbee-aabc-4daf-996a-4580daa09c87) | | UpdatesHandler.log | Content Text = \\\ | | ContentTransferManager |

Submitted CTM job {​C17823B5-A8A9-48F8-8375-64CFC55869CB}​ to download Content 9c93cbee-aabc-4daf-996a-4580daa09c87.1 under context System - ContentTransferManager |

CTM job {​​​​​​​C17823B5-A8A9-48F8-8375-64CFC55869CB}​​​​​​​ (corresponding DTS job {​​​​​​​C54E37D3-BFDE-4629-AC82-32E6CE733750}​​​​​​​) started download from 'http://DEMO1.CONTOSO.LOCAL/SMS_DP_SMSPKG$/9c93cbee-aabc-4daf-996a-4580daa09c87' for full content download.

| | DataTransferService.log |

DTSJob {​​​​​​​C54E37D3-BFDE-4629-AC82-32E6CE733750}​​​​​​​ created to download from 'http://DEMO1.CONTOSO.LOCAL:80/SMS_DP_SMSPKG$/9c93cbee-aabc-4daf-996a-4580daa09c87' to 'C:\Windows\ccmcache\1'.

UpdateURLWithTransportSettings(): NEW URL - http://demo1.contoso.local:80/SMS_DP_SMSPKG$/9c93cbee-aabc-4daf-996a-4580daa09c87/sccm?/debcf2da-e7da-4c50-b718-fc95ffe40c9d_1.cab

| | DataTransferService.log | Total content size from the downloaded manifest is 79417630 | | DataTransferService.log | Creating root directory... | | DataTransferService.log | Directory 'C:\Windows\ccmcache\1' already exists. | | DataTransferService.log | Starting BITS job '{​​​​​​​97C9975B-820F-467A-9A0D-366C70F28EEC}​​​​​​​' for DTS job '{​​​​​​​C54E37D3-BFDE-4629-AC82-32E6CE733750}​​​​​​​' under user 'S-1-5-18'. | | DataTransferService.log | BITS compatible path: http://DEMO1.CONTOSO.LOCAL:80/SMS\_DP\_SMSPKG$/9c93cbee-aabc-4daf-996a-4580daa09c87/sccm?/debcf2da-e7da-4c50-b718-fc95ffe40c9d\_1.cab | | DataTransferService.log | BITSHelper, remote name = http://DEMO1.CONTOSO.LOCAL:80/SMS\_DP\_SMSPKG$/9c93cbee-aabc-4daf-996a-4580daa09c87/sccm?/debcf2da-e7da-4c50-b718-fc95ffe40c9d\_1.cab, local name = C:\Windows\ccmcache\1\debcf2da-e7da-4c50-b718-fc95ffe40c9d\_1.cab | | DataTransferService.log | Job: {​​​​​​​C54E37D3-BFDE-4629-AC82-32E6CE733750}​​​​​​​, Total Files: 1, Transferred Files: 0, Total Bytes: 79417630, Transferred Bytes: 262144 | | CAS.log | CContentAccessService::NotifyDownloadProgressEx - downloaded size 52480, total size 77556 | | CAS.log | The hash we are verifying is SDMPackage:\\\ | | CAS.log | Hash verification succeeded for content 9c93cbee-aabc-4daf-996a-4580daa09c87.1 downloaded under context System | | DataTransferService.log | Job: {​​​​​​​C54E37D3-BFDE-4629-AC82-32E6CE733750}​​​​​​​, Total Files: 1, Transferred Files: 1, Total Bytes: 79417630, Transferred Bytes: 79417630 | | DataTransferService.log | DTSJob {​​​​​​​C54E37D3-BFDE-4629-AC82-32E6CE733750}​​​​​​​ successfully completed download. DataTransferService 4/27/2021 8:21:18 AM 2612 (0x0A34) | | DataTransferService.log | DTS job {​​​​​​​C54E37D3-BFDE-4629-AC82-32E6CE733750}​​​​​​​ has completed: | | DataTransferService.log | Elapsed time : 5 seconds | | ContentTransferManager | CCTMJob::EvaluateState(JobID={​​​​​​​C17823B5-A8A9-48F8-8375-64CFC55869CB}​​​​​​​, State=Success) | {% hint style="success" %} **Tip**: You can **open all content logs at once in CMTrace.exe** by adding the following files: "CAS.log" "CIAgent.log" "CIDownloader.log" "CIStateStore.log" "ClientLocation.log" "CMBITSManager.log" "ContentTransferManager.log" "DataTransferService.log" "DCMAgent.log" "LocationServices.log" "StateMessage.log" "UpdatesDeployment.log" {% endhint %} ![Merge all content logs in CMTrace.exe](/files/-MZOiLFcqykYq0Ep62N6) ### Snippets of Location Request Example of the management point **MP\_Location.log** calling the stored procedure **MP\_GetContentDPInfo** ```markup DEMO1.CONTOSO.LOCAL ,SMSUpdate,00000000,CONTOSO.LOCAL,CONTOSO.LOCAL, , ) ``` {% hint style="success" %} **Tip**: The Fallback="0" or Fallback="1" controls if fallback is allowed. To learn more about fallback see this [Microsoft Doc](https://docs.microsoft.com/en-us/mem/configmgr/core/servers/deploy/configure/boundary-groups#fallback). {% endhint %} Example of a content location request from the client sent to the management point in **CAS.log** ```markup ``` Example of Content location reply from the management point to the client in the client's **CAS.log** ```markup 9040 DEMO1.CONTOSO.LOCAL SERVER ``` Here's a snippet of the download options for a software update download request in **UpdatesDeploymentAgent.log** ```markup Foreground 10 604800 86400 0 0 true false false ``` A point of interest is **DPLocality** flag determines how the client obtains distribution points, according to distribution point locality. Possible values are: | Value | UInt32 | | ----------------------------- | ------ | | DP\_DOWNLOAD\_FROM\_LOCAL | 4 | | DP\_DOWNLOAD\_FROM\_REMOTE | 6 | | DP\_NO\_FALLBACK\_UNPROTECTED | 17 | | DP\_ALLOW\_WUMU | 18 | | DP\_ALLOW\_METERED\_NETWORK | 19 | {% embed url="" %} ## Scenario 2: Failed Content Lookup Due to Boundary Misconfiguration ### Pre-Conditions 1. Healthy ConfigMgr client. 2. The client is NOT in a boundary. 3. There is a Distribution Point associated with the boundary group the client is NOT in. 4. The content is distributed successfully to the DP. 5. The software / update / package is deployed to the device. 6. Enable verbose logging on the site system with the MP role and the client ![Client is not in boundary group](/files/-MZOh8ctUylJD8n5Kevz) ### Notable Ways to Identity when a Client is Not in Boundary Group If a client is not in a boundary group here are some snippets that can be helpful. | Log File | Log Description | | -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | | LocationServices.log | Client is not in any boundary group and ConfigMgr is no longer managing WindowsDO GPO. Set WindowsDO GPO to default values. Mode = LAN. GroupID = empty | | CAS.log | The number of discovered DPs(including Branch DP and Multicast) is 0 | In the content location request in the **CAS.log**, you will also notice the **BoundaryGroup** element doesn't contain the fields **GroupID**, **GroupGUID,** or **GroupFlag**. ![ContentLocationRequest comparison](/files/-MZOjvDHTcpscZyjlzuL) {% hint style="success" %} **Tip**: Search the text "**ContentLocationRequest**" in the CAS.log to find location requests performed on the client-side logs. {% endhint %} In the **CAS.log** here is an example of a response from the management point when the client is in no boundary group, and fallback is disabled, and no content was found. ```markup ``` We can compare this to the response received in the **CAS.log** when the **content was found and the client is in a boundary group**. ```markup 9040 DEMO1.CONTOSO.LOCAL SERVER ``` If the content is not found, you will be able to note the following line in **StateMessage.log** > State message(State ID : **5003**) with TopicType **1702** and TopicId ScopeId\_CA3F999B-7A81-43BF-912C-56E267C1E565/DeploymentType\_677dac51-d2a2-4bbd-aeb0-4b845aa288cd/1 has been recorded for S-1-5-21-1880864260-2612682489-34998949-6112 {% embed url="" %} ![StateMessage ID 5003 with TopicType 1702](/files/-MZOmlGTDXOPmwwBMIl-) ## Scenario 3: Download Failure Due to Content Distribution Failure This scenario covers some of the basics in troubleshooting content that has failed to distribute to a distribution point. ### Log Files for Troubleshooting Content Distribution in ConfigMgr | Log File | Log Text | | -------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | distmgr.log | Records details about package creation, compression, delta replication, and information updates. It can also include other activities from the distribution manager component. For example, installing a distribution point, connection attempts, and installing components. For more information on other functionality that uses this log, see Service connection point and OS deployment. | | PkgXferMgr.log | Records the actions of the SMS\_Executive component that is responsible for sending content from a primary site to a remote distribution point. | {% embed url="" %} ### Example of Error if the Source Folder Doesn't Exist or the Site Server Doesn't Have Access | Log File | Log Text | | ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | distmgr.log | The source directory \\\demo3\Sources\Applications\Igor Pavlov\7-Zip (x64) - MSI Install\aad16824-5471-4dd8-ae69-f71167d7051d\ doesn't exist or the SMS service cannot access it, **Win32 last error = 2** | | distmgr.log | Failed to take snapshot of one or more contents in package DM300013 | ## Scenario 4: Download Failure Due to Invalid Content For scenario 4, we delete a file directly from the **FileLib** and modify a file directly in the **FileLib**. We will cover the [content library ](https://docs.microsoft.com/en-us/mem/configmgr/core/plan-design/hierarchy/the-content-library)in a future video. This builds off of scenario 3 by showing specific failure scenarios. The fix for this type of scenario may be as simple as performing an 'update content' or 'redistribute' the content which is failing. Other times you may have to validate antivirus exclusions on your endpoints and servers. Using the log files to identify what type of error is occurring will be key to resolving the issue and determine where the issue lies. ### Example of Error if the Hash of the Downloaded File Does Not Match the Expected Hash | Log File | Log Text | | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------- | | CAS.log | Failed to do hash verification with preference : 4. Try to verify at next hash algorithm | | CAS.log | Download failed for content Content\_ebb608a6-a6a7-4384-b168-63a0f446b7fb.1 under context S-1-5-21-1880864260-2612682489-34998949-6112, error 0x80091007 | | DCMAgent.log | appState: DownloadFailed | The above log files and lines would be helpful from the client when determining if there is a hash mismatch issue. It is good to note that the hash mismatch may not be due to a corrupt file in the Content Library, but it is still worth investigating. This can also commonly be due to Antivirus on the endpoint which lacks the prover exclusions for example. ### Example of Error if a File is Missing from the Content Library When a Client Requests It | Log File | Log Text | | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DataTransferService.log | \[CCMHTTP] ERROR: URL=, Port=80, Options=224, Code=0, Text=**CCM\_E\_BAD\_HTTP\_STATUS\_CODE** | | DataTransferService.log | Successfully queued event on HTTP/HTTPS failure for server 'DEMO4.CONTOSO.LOCAL'. | | DataTransferService.log | Error sending DAV request. HTTP code 404, status 'Not Found' | | DataTransferService.log | GetDirectoryList\_HTTP('') failed with code **0x800705b4**. | | DataTransferService.log | Error retrieving manifest (**0x800705b4**). | | IIS Logs on DP | 2021-04-29 02:25:19 **192.168.10.22 PROPFIND** /SMS\_DP\_SMSPKG$/Content\_ac0256aa-503f-48f1-bfa0-972d685cf50d.1 - 80 CONTOSO\DEMO4CLIENT$ 192.168.10.38 SMS+CCM+5.0 - **404** 0 0 1704 2 | ## Log Files for Troubleshooting ### Client Logs | Log File | Description | | -------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | CAS.log | The Content Access service. Maintains the local package cache on the client. | | CIAgent.log | Records details about the process of remediation and compliance for compliance settings, software updates, and application management. | | CIDownloader.log | Records details about configuration item definition downloads. | | CIStateStore.log | Records changes in state for configuration items, such as compliance settings, software updates, and applications. | | ClientLocation.log | Records tasks that are related to client site assignment. | | CMBITSManager.log | Records information for Background Intelligent Transfer Service (BITS) jobs on the device. | | ContentTransferManager.log | Schedules the Background Intelligent Transfer Service (BITS) or Server Message Block (SMB) to download or access packages. | | DataTransferService.log | Records all BITS communication for policy or package access. | | DCMAgent.log | Records high-level information about the evaluation, conflict reporting, and remediation of configuration items and applications. | | LocationServices.log | Records the client activity for locating management points, software update points, and distribution points. | | StateMessage.log | Records details about software update state messages that are created and sent to the management point. | | UpdatesDeployment.log | Records details about deployments on the client, including software update activation, evaluation, and enforcement. Verbose logging shows additional information about the interaction with the client user interface. | ### Server Logs | Log File | Description | | ---------------- | ------------------------------------------------------------------------------------------------ | | MP\_Location.log | Records location request and reply activity from clients. | | IIS Logs | Built-in IIS logging - useful for all IIS based ConfigMgr roles. Log location and name may vary. | # Understanding How ConfigMgr Interacts with WSUS This deep dive covers how Configuration Manager interacts with WSUS to set up a software update point and synchronize data between WSUS and ConfigMgr. ## Video Guide {% embed url="" %} {% hint style="success" %} Tip: To get the most from this guide, we recommend watching the video guide and then using this doc as a reference throughout the video. {% endhint %} ## Scenario 1: Installing a New Software Update Point When you install a new software update point, the following will take place! ### The Install Flow of new Software Update Point (SUP) | Component/Log | Log Line Text | | ------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | sitecomp.log | Starting service SMS\_SERVER\_BOOTSTRAP\_DEMO1 with command-line arguments "DM1 D:\Program Files\Microsoft Configuration Manager /install D:\Program Files\Microsoft Configuration Manager\bin\x64\rolesetup.exe SMSWSUS "... | | SUPSetup.log | SMSWSUS Setup Started.... | | SUPSetup.log | Supported WSUS version found | | SUPSetup.log | Installation was successful. | | WSUSCtrl.log | Attempting connection to local WSUS server | | WSUSCtrl.log | Successfully connected to local WSUS server | | WCM.log | WSUS Server configuration has been updated. Updating Group Info. | | WCM.log | Subscribed Update Categories \\~\~\\~\~ | | WCM.log | Configuration successful. Will wait for 1 minute for any subscription or proxy changes | | WCM.log | Setting new configuration state to 2 (WSUS\_CONFIG\_SUCCESS) | Once the software update point installation is completed, a list of **products/categories won't happen until the first successful SUP sync**. ![Incomplete WSUS catalog after initial setup](/files/-M_QpXppbEoPJDH0AU6L) You can **right-click All Software Updates** and click **Synchronize Software Updates** to start the first sync. ![Sync software update point in ConfigMgr](/files/-M_Qok1q0v6EzEOBlCBU) {% hint style="warning" %} The **first synchronization** can take a while to complete! {% endhint %} The table below lists the flow to verify the first synchronization and population of the WSUS catalog/categories. **Note**: The log lines below are with debug and verbose logging enabled. You log lines may not contain this level of data. ### First SUP Synchronization Flow | Component/Log | Log Line Text | | ------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | wsyncmgr.log | Starting Sync | | wsyncmgr.log | Synchronizing WSUS server DEMO1 ... | | wsyncmgr.log | sync: Starting WSUS synchronization | | wsyncmgr.log | sync: WSUS synchronizing categories | | wsyncmgr.log | Synchronizing SMS database with WSUS, default server is DEMO1.CONTOSO.LOCAL | | wsyncmgr.log | Synchronizing SMS database with WSUS server DEMO1 ... | | wsyncmgr.log | sync: Starting SMS database synchronization | | wsyncmgr.log | sync: SMS synchronizing categories | | wsyncmgr.log | sync: SMS synchronizing categories, processed 0 out of 246 items (0%) | | wsyncmgr.log | sync: SMS synchronizing categories, processed 246 out of 246 items (100%) | | wsyncmgr.log | declare @refd xml = N'\\\\...... | | wsyncmgr.log | Done synchronizing SMS with WSUS Server DEMO1 | | wsyncmgr.log | Set content version of update source {891B2E1B-4873-4092-B1FD-7EAADE75A3D3} for site DM1 to 10 | {% hint style="success" %} **Tip**: During the first sync, the longest part will be WSUS pulling the catalog for Microsoft Update. {% endhint %} ![WSUS performing first sync from Microsoft update catalog](/files/-M_Qqd51I8g8SR7G48uE) ## Scenario 2: How ConfigMgr Database Sync from WSUS Database The ConfigMgr database pulls the update catalog from the WSUS database. Below, you can find more details about how this happens. ### Sync Flow for ConfigMgr Sync from WSUS In our example below, we manually triggered a sync using the step above. | Component/Log | Log Line Text | | ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | wsyncmgr.log | Wakeup by inbox drop | | wsyncmgr.log | select cat.CategoryInstance\_UniqueID, cat.CategoryInstanceName from fn\_ListUpdateCategoryInstances(9) cat where cat.AllowSubscription=1 and cat.IsSubscribed=1 and cat.IsParentSubscribed=0 order by 1 | | wsyncmgr.log | Read SUPs from SCF for DEMO2.CONTOSO.LOCAL | | wsyncmgr.log | Synchronizing SMS database with WSUS, default server is DEMO2.CONTOSO.LOCAL | | wsyncmgr.log | Synchronizing SMS database with WSUS server DEMO2 ... | | wsyncmgr.log | Syncing updates arrived after 03/05/2021 21:07:43 | | wsyncmgr.log | Requested categories: Company=Patch My PC, Product=Windows 10, version 1903 and later, UpdateClassification=Security Updates, UpdateClassification=Updates, UpdateClassification=Critical Updates | | wsyncmgr.log | sync: SMS synchronizing categories, processed 378 out of 378 items (100%) | | wsyncmgr.log | sync: SMS synchronizing updates | | wsyncmgr.log | sync: SMS synchronizing updates, processed 0 out of 30 items (0%) | | wsyncmgr.log | select CI\_UniqueID, RevisionNumber, LastModifiedDate=convert(nvarchar, DateLastModified, 126)+N'Z', IsDeployed\~from v\_UpdateCIs\~where CIType\_ID in (1,8) and IsExpired=0 and UpdateSource\_ID=16777217 and CI\_UniqueID='6ec13d2d-306c-41fe-83bf-9789346721bf' | | wsyncmgr.log | insert vCI\_ConfigurationItems (CI\_UniqueID, CIVersion, ModelID, CIType\_ID, PolicyVersion, Precedence, DateCreated, DateLastModified, LastModifiedBy, CreatedBy, ContentSourcePath, PermittedUses, IsBundle, IsHidden, IsUserDefined, IsEnabled, IsExpired, SourceSite, ApplicabilityCondition, CI\_CRC, IsTombstoned) values ('6ec13d2d-306c-41fe-83bf-9789346721bf', 200, 16780004, 8, 1, 0, '05/11/2021 18:15:49', '05/11/2021 18:15:49', N'', N'', N'', 0, 1, 0, 0, 1, 0, 'DM2', '\\6ec13d2d-306c-41fe-83bf-9789346721bf\\\{CA3F999B-7A81-43BF-912C-56E267C1E565}\\9\\\b3c75dc1-155f-4be4-b015-3f1a91758e52\\', 'c02abc2', 0) | | wsyncmgr.log | insert into CI\_DocumentStore (DocumentIdentifier, Body, IsVersionLatest, DocumentType) values ('c344e7f6-f83b-4693-8c02-41b2e072127e', '', 0, 0)\~;select SCOPE\_IDENTITY() | | wsyncmgr.log | sync: SMS synchronizing updates, processed 30 out of 30 items (100%) | | wsyncmgr.log | sync: SMS performing cleanup | | wsyncmgr.log | Done synchronizing SMS with WSUS Server DEMO2 | | wsyncmgr.log | Updated 60 items in SMS database, new update source content version is 9 | Here's an example of us querying an update in the ConfigMgr database that was synchronized: ```sql select * FROM CI_DocumentStore where DocumentIdentifier = 'c344e7f6-f83b-4693-8c02-41b2e072127e' ``` ## Scenario 3: WSUS Cleanup in ConfigMgr Below are some key points mentioned in the video related to the cleanup. ### Key Point for WSUS Maintenance in ConfigMgr The setting in the **Supersedence Rules** tab determines **how long an update needs to be superseded before it will be expired**. ![](/files/-M_XfPtC3w0yWTLZb9kG) This setting in the **WSUS Maintenance** tab will determine if expired updates should be declined (improves WSUS performance and health) ![](/files/-M_Xfg6uy1aRQNQEC-GW) ### Log Files for ConfigMgr Cleanup Task for WSUS | Component/Log | Log Line Text | | ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | wsyncmgr.log | sync: SMS performing cleanup | | wsyncmgr.log | Removed 54 unreferenced updates | | wsyncmgr.log | Starting cleanup on WSUS, default server DEMO2.CONTOSO.LOCAL | | wsyncmgr.log | Cleaning up WSUS server DEMO2 ... | | wsyncmgr.log | nclLocalizedPropertyID Index Already exists in column LocalizedPropertyID on table tbLocalizedPropertyForRevision. Did Not Create Index.Server: DEMO2, DataBase: SUSDB | | wsyncmgr.log | nclSupercededUpdateID Index Already exists in column SupersededUpdateID on table tbRevisionSupersedesUpdate. Did Not Create Index.Server: DEMO2, DataBase: SUSDB | | wsyncmgr.log | Done Indexing SUSDB. Custom indexes were created if they didn't exist previously. DEMO2 | | wsyncmgr.log | sync: SMS performing cleanup | | wsyncmgr.log | Cleanup processed 57 total updates and declined 27 | | wsyncmgr.log | Done Declining updates in WSUS Server DEMO2 | | wsyncmgr.log | Starting Deletion of ObseleteUpdates | | wsyncmgr.log | 0 update(s) were deleted from SUSDB in Server: DEMO2 Database: SUSDB | | wsyncmgr.log | Deletion Completed | | wsyncmgr.log | Updated 54 items in SMS database, new update source content version is 11 | ## Scenario 4: View Update Views in the Database in Relationships ### Determining Compliance Quick dive into getting compliance data. The below query is an example of how you can retrieve the compliance status of updates for all machines in SQL. This view pulls from a few different points of interest. | View Name | Purpose | | --------------------------- | ------------------------------------------------------------- | | v\_Update\_ComplianceStatus | Get compliance state for a CI\_ID and a ResourceID (filtered) | | v\_UpdateInfo | Get real world Update Info | | v\_StateNames | Get the human meatning of state values | ```sql SELECT CASE WHEN v_Update_ComplianceStatus.Status = '0' THEN 'UNKNOWN' WHEN v_Update_ComplianceStatus.Status = '1' THEN 'NOT REQUIRED' WHEN v_Update_ComplianceStatus.Status = '2' THEN 'NON COMPLIANT' WHEN v_Update_ComplianceStatus.Status = '3' THEN 'COMPLIANT' ELSE 'NA' END AS 'PatchStatus' , v_Update_ComplianceStatus.Status , v_Update_ComplianceStatus.CI_ID , v_Update_ComplianceStatus.resourceID , v_Update_complianceStatus.LastStatusCheckTime , v_StateNames.StateName , v_stateNames.StateDescription FROM v_Update_ComplianceStatus LEFT OUTER JOIN v_UpdateInfo on v_Update_ComplianceStatus.CI_ID = v_UpdateInfo.CI_ID LEFT OUTER JOIN v_StateNames on v_Update_ComplianceStatus.Status = v_StateNames.StateID WHERE v_UpdateInfo.CIType_ID = '8' and v_StateNames.TopicType = '500' ``` The other side of the coin when you get ALL the data. | View Name | Purpose | | ------------------------------ | -------------------------------------------------------- | | v\_Update\_ComplianceStatusAll | Get compliance stat for a CI\_ID and a ResourceID (ALL) | {% hint style="info" %} Note the query below can return a **massive** data set when run in production. {% endhint %} ```sql SELECT CASE WHEN v_Update_ComplianceStatusAll.Status = '0' THEN 'UNKNOWN' WHEN v_Update_ComplianceStatusAll.Status = '1' THEN 'NOT REQUIRED' WHEN v_Update_ComplianceStatusAll.Status = '2' THEN 'NON COMPLIANT' WHEN v_Update_ComplianceStatusAll.Status = '3' THEN 'COMPLIANT' ELSE 'NA' END AS 'PatchStatus' , v_Update_ComplianceStatusAll.Status , v_Update_ComplianceStatusAll.CI_ID , v_Update_ComplianceStatusAll.resourceID , v_Update_ComplianceStatusAll.LastStatusCheckTime , v_StateNames.StateName , v_stateNames.StateDescription FROM v_Update_ComplianceStatusAll LEFT OUTER JOIN v_UpdateInfo on v_Update_ComplianceStatusAll.CI_ID = v_UpdateInfo.CI_ID LEFT OUTER JOIN v_StateNames on v_Update_ComplianceStatusAll.Status = v_StateNames.StateID WHERE v_UpdateInfo.CIType_ID = '8' and v_StateNames.TopicType = '500' ``` ### Software Update Group Relationships Software update groups are typically what we filter against as we typically have a group that we are targetting for a specific month. \ \ Get Software Update Group Names, and their CI's. ```sql SELECT v_UpdateInfo.CI_ID , v_UpdateInfo.Title FROM v_UpdateInfo WHERE v_UpdateInfo.CIType_ID = '9' ``` Mapping the relationship of all updates in a software update group. ```sql WITH SUGInfo AS ( SELECT v_UpdateInfo.CI_ID FROM v_UpdateInfo WHERE v_UpdateInfo.CIType_ID = '9' ) SELECT v_CIRelation.FromCIID , v_CIRelation.ToCIID FROM SUGInfo LEFT OUTER JOIN v_CIRelation ON SUGInfo.CI_ID = v_CIRelation.FromCIID ``` ### Stringing it all together. ![](/files/-M_Rz-NsOhOoGAqh2V8O) # Understanding the Software Update Chain Understanding the software update process from clients to servers. ## Video Guide {% embed url="" %} ## Scenario 1: Configuring Software Update Policy When you first start off with configuration manager and software updates there are always a lot of questions, what options should l use, how do they work and more. ![Software Update Policy](/files/-MbgjAG-4M0mDTNIMGuD) ### Software Update Scan Schedule When does this REALLY Happen * Anytime a NEW software update group is assigned AND machine policy Runs * Anytime a scheduled instance of Software Update Scan Schedule Hits * Anytime a Deployment is completed * Sometimes after a reboot is completed - Depends on assignment configuration * After a servicing stack update ### Schedule Deployment Re-evaluation * This does NOT contact WSUS * Uses the existing locally stored policies in WMI WMI Explorer is a fantastic tool to review the classes that are involved in all of this {% embed url="" %} | What is It | WMI Path | | ----------------------- | ---------------------------------------------------------------------------------- | | Software Update Objects | \MACHINENAME\ROOT\ccm\ClientSDK:CCM\_SoftwareUpdate | | Update Manager | \MACHINENAME\ROOT\ccm\ClientSDK:CCM\_SoftwareUpdatesManager | | Update CI Assignment | \MACHINENAME\ROOT\ccm\Policy\Machine\ActualConfig:CCM\_UpdateCIAssignment | | Maintenance Windows | \MACHINENAME\ROOT\ccm\Policy\Machine\ActualConfig:CCM\_ServiceWindow | | Cient Policy | \MACHINENAME\ROOT\ccm\Policy\Machine\ActualConfig:CCM\_SoftwareUpdatesClientConfig | ### Enable Third Party Updates {% embed url="" %} {% hint style="success" %} When you set this option to **Yes**, it sets the policy for **Allow signed updates for an intranet Microsoft update service location** and installs the signing certificate to the Trusted Publisher store on the client. {% endhint %} ### Delta Updates Explanation from microsoft.com {% embed url="" %} Set this option to **Yes** to allow clients to use delta content files. This setting allows the Windows Update Agent on the device to determine what content is needed and selectively download it. * Before enabling this client setting, ensure Delivery Optimization is configured appropriately for your environment. For more information, see [Windows Delivery Optimization](https://docs.microsoft.com/en-us/mem/configmgr/sum/deploy-use/optimize-windows-10-update-delivery#windows-delivery-optimization) and the [Delivery Optimization client setting](https://docs.microsoft.com/en-us/mem/configmgr/core/clients/deploy/about-client-settings#delivery-optimization). * This client setting replaces **Enable installation of Express installation files on clients**. Set this option to **Yes** to allow clients to use express installation files. For more information, see [Manage Express installation files for Windows 10 updates](https://docs.microsoft.com/en-us/mem/configmgr/sum/deploy-use/manage-express-installation-files-for-windows-10-updates). * When this option is set, delta download is used for all Windows update installation files, not just express installation files. When using a CMG for content storage, the content for third-party updates won't download to clients if the **Download delta content when available** client setting is enabled. Deltaldownload.log - is the log file that tracks this behavior ### Maintenance Windows The feature, that used to be a bug - ish. {% embed url="" %} When you set this option to **Yes**, and the client has at least one "Software Update" maintenance window defined, software updates will install during an "All deployments" maintenance window. By default, this setting is set to **No**. This value uses the same behavior as before: **if both types exist, it ignores the window.** ## Scenario 2: Maintenance Windows ### Types of Windows | Value | Type | | ----- | -------------------------------- | | 1 | All Deployment Service Window | | 2 | Program Service Window | | 3 | Reboot Required Service Window | | 4 | Software Update Service Window | | 5 | Task Sequences Service Window | | 6 | Corresponds to non-working hours | ### How To Schedule a Maintenance Window ![](/files/-MbgrduAamEDkLlMk4lA) ### Finding Maintenance Windows in ConfigMgr ```sql SELECT sw.Name AS [MW Name], Sw.CollectionID, sw.Description, sw.StartTime, sw.Duration AS 'Duration Minutes', sw.IsEnabled AS 'MW Enabled', sys.Name0 AS ServerName, sys.Resource_Domain_OR_Workgr0, sys.Operating_System_Name_and0 AS OperatingSystem FROM dbo.v_ServiceWindow AS sw INNER JOIN dbo.v_FullCollectionMembership AS fcm ON sw.CollectionID = fcm.CollectionID INNER JOIN dbo.v_R_System sys ON fcm.ResourceID = sys.ResourceID WHERE (sys.Name0 = 'DEMO6') ORDER BY [MW Name], sys.Name0 ``` ### The not really maintenance window Business hours, and clients. {% embed url="" %} ### Log File on the Client {% embed url="" %} {% embed url="" %} # Understanding the ConfigMgr Application Model ## Notes Application features * Supersedance * dependencies * global conditions * detection * scripts - what to return * Differences between Packages and Applications * Applications added in 2012 * Main Differences Between Packages and Applications * Detection (is this app installed?) * Package * Content * (optional) Program(s) to run on that content * Apps always run from DP content (content is always downloaded from the dp) * Apps have requirements(via global conditions), supersedance and multiple dependencies * Applications have revisions * icons, customizations in SW center * ![](/files/-MfIzD7nZerQCKUHasuE) ![](/files/-MfIz5_kPzcVHJAECog0) Policy * WMI * Use Support Center to show grabbing of policy and processing * Support Center () * ConfigMgrInstallDirectory\Microsoft Configuration Manager\tools\SupportCenter * View Client Information and health * Deploy * Update Content right click * Important logs () * AppIntentEval * AppDiscovery * AppEnforce ## Flow 1. Notable high-level differences for Packages versus Applications 1. \[Package only] Copy the content to a package share on the DP 2. \[Package only] Can install software with the content directly from the DP without downloading 3. \[Application only] Detection 4. \[Application only] Custom requirements (global conditions) 5. \[Application only] Revisions 6. User experience in Software Center 7. Any one else on the call think of any that are high-level worth mentioning? 2. Convert Packages to Applications 1. Convert 7-Zip and C++ 2. Walk-through key Application functionality / features: 1. Software Center customisation 2. Dedicated install, uninstall and repair functions 3. Detection 1. Scripts and parentheses of operational precedence 4. Dependencies 1. In Packages too 5. Requirements and global conditions 1. Basic requirements in Packages too 6. Return codes 7. Supersedence 8. Revisions 9. Application Groups (pre-release) 1. Can't use in a task sequence! 3. Policy & Logs 1. ***\*** 2. Look at a client evaluating policy life using Support Center 3. Look at where the client stores applications in WMI 4. Logs 1. AppIntentEval, AppDiscovery and AppEnforce 5. Look at where the server stores applications in WMI 4. Final protips or gotcha's 1. Update Content 2. Script detection interprets particular outputs as particular results: # Possible Future Topics Do you have a future topics you want to see covered? ## Possible Future Deep Dives Ways to submit for topics! * Email: * Twitter: ### Relationship Between SUP and WSUS Deep dive into how ConfigMgr SUP interacts with WSUS. ### Client Policy Deep dive into client policy. Requested by email. ### # Patch My PC Power BI Queries When running a Power BI report, you are prompted to trust the SQL native queries. Here we provide the queries, and an explanation on their usage. ## SQL Queries ### Client Info Collection of information about devices including what version of the operating system they are running, and FQDN. Originally we used to gather this from a different view, however this caused numerous reports of duplicate values for large environments due to maintenance tasks not running quickly enough. Instead we dynamically build the content. We also have to handle duplicates caused by OS caption. ```sql WITH NewestOS AS ( SELECT GS_OS_Data.ResourceID , TimeStamp , Caption0 FROM v_GS_Operating_System as GS_OS_Data INNER JOIN (SELECT ResourceID , MAX(TimeStamp) as MaxDate FROM v_GS_Operating_System GROUP BY ResourceID ) MaxFilter on GS_OS_Data.ResourceID = MaxFilter.ResourceID and MaxFilter.MaxDate = GS_OS_Data.TimeStamp ) SELECT v_R_System.ResourceID , v_R_System.Name0 , v_R_System.Name0 + '.' + v_R_System.Full_Domain_Name0 as Resource_Names0 , v_R_System.Resource_Domain_OR_Workgr0 AS 'DOMAIN' , CASE v_R_System.Client0 WHEN 1 THEN 'INSTALLED' ELSE 'MISSING' END AS ClientStatus , v_R_System.Client_Version0 , v_R_System.Last_Logon_Timestamp0 , CASE NewestOS.Caption0 WHEN NULL THEN v_R_System.Operating_System_Name_and0 ELSE NewestOS.Caption0 END AS OSNAME , V_GS_System.SystemRole0 FROM v_R_System LEFT OUTER JOIN NewestOS on v_R_System.ResourceID = NewestOS.ResourceID LEFT OUTER JOIN v_GS_System ON v_R_System.ResourceID = v_GS_System.ResourceID WHERE v_R_System.Operating_System_Name_and0 LIKE '%Microsoft%' ``` ### Compliance Info Collect patch compliance data. Technically the 0 management is not required here, as 0 should never appear in `v_Update_ComplianceStatus` We also filter out some information to ensure we are avoiding accidentally capturing software update groups. ```sql SELECT CASE WHEN v_Update_ComplianceStatus.Status = '0' THEN 'UNKNOWN' WHEN v_UPDATE_ComplianceStatus.Status = '1' THEN 'NOT REQUIRED' WHEN v_Update_ComplianceStatus.Status = '2' THEN 'NON COMPLIANT' WHEN v_Update_ComplianceStatus.Status = '3' THEN 'COMPLIANT' ELSE 'NA' END AS 'PatchStatus' , v_Update_ComplianceStatus.CI_ID , v_UpdateInfo.CIType_ID , v_Update_ComplianceStatus.resourceID , v_Update_complianceStatus.LastStatusCheckTime FROM v_Update_ComplianceStatus LEFT OUTER JOIN v_UpdateInfo on v_Update_ComplianceStatus.CI_ID = v_UpdateInfo.CI_ID WHERE v_UpdateInfo.CIType_ID = '8' or v_UpdateInfo.CIType_ID = '1' ``` ### SUG Info This query gathers the names of each software update group, and creates a dummy row, for updates that are not in any software update group. This is done to handle a use case with Power BI. ```sql SELECT v_UpdateInfo.CI_ID , v_UpdateInfo.Title FROM v_UpdateInfo WHERE v_UpdateInfo.CIType_ID = '9' UNION ALL SELECT '0', '--- Not Limited by Sug ---' ``` ### SUG Relation Map This builds what we call the relation map, and tracks what updates are a member of what group. This is how we then are able to filter our report by software update groups. This data is used as a connection point in the PowerBI data model to join data together. ```sql WITH SUGInfo AS ( SELECT v_UpdateInfo.CI_ID FROM v_UpdateInfo WHERE v_UpdateInfo.CIType_ID = '9' ) SELECT v_CIRelation.FromCIID , v_CIRelation.ToCIID FROM SUGInfo LEFT OUTER JOIN v_CIRelation ON SUGInfo.CI_ID = v_CIRelation.FromCIID UNION ALL select '0' AS [FromCIID], CI_ID FROM v_UpdateInfo where CIType_ID != 9 ``` ### Collection Membership Collections, often represent logical groupings of machines we really care about. As a result, we use this query to build out what machines are a member of what collection so we can allow filtering based on the collection names. ```sql SELECT v_FullCollectionMembership.ResourceID , v_FullCollectionMembership.Name , v_FullCollectionMembership.ResourceType , v_Collection.CollectionID , v_Collection.Name AS 'CollectionName' FROM v_FullCollectionMembership LEFT OUTER JOIN v_Collection on v_FullCollectionMembership.CollectionID = v_Collection.CollectionId WHERE v_FullCollectionMembership.ResourceType <> '4' AND v_Collection.Name LIKE 'CollectionFilter' ``` ### Update Info While knowing a CI\_ID of an update is nice, you typically want more detailed information. This, collects data for things like the URL for information about the update, the date it was released, and more. ```sql SELECT v_UpdateInfo.CI_ID , v_UpdateInfo.CI_UniqueID , v_UpdateInfo.ArticleID , v_UpdateInfo.Title , v_UpdateInfo.InfoURL , v_UpdateInfo.DatePosted , v_UpdateInfo.DateCreated , CASE v_UpdateInfo.IsDeployed WHEN 1 THEN 'TRUE' ELSE 'FALSE' END AS DeploymentState FROM v_UpdateInfo WHERE v_UpdateInfo.ArticleID IS NOT NULL AND v_UpdateInfo.ArticleID !='' ``` ### Category Info Some times it really helps to be able to filter a report by the patching vendors. This section gathers who the original author of the patch was. ```sql WITH CATS as( select all SMS_UpdateCategoryInstance.LocaleID ,SMS_UpdateCategoryInstance.CategoryInstanceName ,SMS_UpdateCategoryInstance.CategoryInstance_UniqueID ,SMS_UpdateCategoryInstance.CategoryInstanceID from fn_ListUpdateCategoryInstances(1033) AS SMS_UpdateCategoryInstance where (SMS_UpdateCategoryInstance.CategoryTypeName = N'Company' AND SMS_UpdateCategoryInstance.AllowSubscription = 1) ) Select CATS.CategoryInstanceName , v_updateINfo.CI_ID from fn_ListCICategoriesAll(1033) as CI_LIST INNER Join CATS on CI_LIST.CategoryInstanceID = cats.CategoryInstanceID INNER JOIN v_updateinfo on v_updateinfo.ci_id = ci_list.ci_id ```