by Mark | Feb 27, 2016 | How To, SCCM
SCCM Log files for Software Updates
System Center Configuration Manager (SCCM) is a powerful tool used by administrators for managing large-scale deployments. SCCM software updates provide a simple way to keep client systems up to date with the latest security and feature updates. SCCM log files contain valuable information about the software updates deployment process and can help administrators troubleshoot issues. In this article, we will discuss the important SCCM log files for software updates and how to analyze them to troubleshoot issues.
SCCM Log files overview
What are SCCM Log files?
SCCM log files are text files that contain information about the various processes and actions taken by SCCM. These log files are created by SCCM components during their operation and provide valuable insights into the workings of SCCM.
Why are SCCM Log files important?
SCCM log files are crucial for troubleshooting issues that may arise during software updates deployment. They contain detailed information about the actions taken by SCCM components and can help administrators identify the root cause of an issue.
SCCM Log files for Software Updates
The following are the important SCCM log files for software updates:
| Log Name |
Description |
Server Side or Client Side |
CcmExec.log
|
Records actions taken by the SCCM client on the local machine, such as software deployments, inventory scans, and software update installations. |
Client Side |
UpdatesDeployment.log
|
Records details of the deployment process for software updates, including whether they were successfully installed or failed. |
Client Side |
WUAHandler.log
|
Records the communication between the SCCM client and Windows Update Agent (WUA), which is responsible for checking for and installing updates. |
Client Side |
PatchDownloader.log
|
Records the download process for software updates, including the location from which updates were downloaded and whether they were successfully downloaded. |
Client Side |
SiteComponentManager.log
|
Records the status of SCCM components and their installation or uninstallation. This log is useful for troubleshooting SCCM server component issues. |
Server Side |
SMS_AZUREAD_CONNECTOR.log
|
Records actions taken by the SCCM Azure Active Directory (AAD) Connector, which is responsible for syncing user and device data between SCCM and AAD. This log is useful for troubleshooting AAD sync issues. |
Server Side |
CAS.log
|
Records actions taken by the SCCM Central Administration Site (CAS), which is responsible for managing multiple primary sites. This log is useful for troubleshooting issues that affect multiple primary sites. |
Server Side |
MP_Location.log
|
Records actions taken by the SCCM Management Point (MP), which is responsible for managing client communications and data. This log is useful for troubleshooting MP issues. |
Server Side |
Wsyncmgr.log
|
Records the synchronization process for software updates between the SCCM server and the WSUS server. This log is useful for troubleshooting update synchronization issues. |
Server Side |
DataTransferService.log
|
Records the transfer of data between the SCCM server and client machines, including software updates and packages. This log is useful for troubleshooting issues related to data transfer. |
Client Side |
UpdatesHandler.log
|
Records actions taken by the SCCM software update handler, which is responsible for coordinating the download and installation of software updates on the client machine. This log is useful for troubleshooting update installation issues. |
Client Side |
UpdatesStore.log
|
Records the location and status of software updates stored on the client machine. This log is useful for troubleshooting issues related to software update storage. |
Client Side |
UpdatesAssignments.log
|
Records details of software update assignments, including which updates are assigned to which client machines. This log is useful for troubleshooting update assignment issues. |
Server Side |
ContentTransferManager.log
|
Records the transfer of content between the SCCM server and client machines, including software updates and packages. This log is useful for troubleshooting issues related to content transfer. |
Client Side |
RebootCoordinator.log
|
Records actions taken by the SCCM reboot coordinator, which is responsible for coordinating system reboots after software update installations. This log is useful for troubleshooting reboot-related issues. |
Client Side |
Supersedence.log
|
Records details of software update supersedence, including which updates supersede which other updates. This log is useful for troubleshooting update supersedence issues. |
Server Side |
PolicyEvaluator.log
|
Records actions taken by the SCCM policy evaluator, which is responsible for enforcing client policies and settings. This log is useful for troubleshooting policy-related issues. |
Client Side |
Analyzing SCCM Log files
Analyzing SCCM log files is crucial for troubleshooting issues related to software updates deployment. Here are the steps for analyzing SCCM log files:
- Identify the relevant log file(s) for the issue at hand.
- Open the log file using a text editor such as Notepad++.
- Search for the relevant error or warning messages in the log file.
- Analyze the messages to identify the root cause of the issue.
- Take the necessary actions to resolve the issue based on the root cause identified.
Common SCCM Update issues and their resolutions
Here are some common issues related to software updates deployment in SCCM and their resolutions:
- Software updates are not showing up in the SCCM console: Check the synchronization status of the software update point and ensure that the latest software updates are synchronized.
- Software updates are failing to install on client systems: Check the relevant log files to identify the root cause of the issue and take the necessary actions to resolve it.
- Software updates are getting stuck in the downloading phase: Check the ContentTransferManager.log and PatchDownloader.log files to identify the root cause of the issue and take the necessary actions to resolve it.
SCCM Logs FAQs
What is SCCM software updates deployment?
SCCM software updates deployment is a process of deploying the latest software updates to client systems in a managed environment.
What are SCCM log files?
SCCM log files are text files that contain information about the various processes and actions taken by SCCM components.
Why are SCCM log files important?
SCCM log files are important for troubleshooting issues related to software updates deployment in SCCM.
How do I analyze SCCM log files?
To analyze SCCM log files, you need to identify the relevant log file(s), open them using a text editor, search for the relevant error or warning messages, and analyze the messages to identify the root cause of the issue.
What are some best practices for analyzing SCCM log files?
Some best practices for analyzing SCCM log files include using a log file viewer, taking regular backups of the log files, and understanding the structure and messages contained in the log files.
How can I automate a Snapshot prior to deploying patches to my virtual servers?
Use SnaPatch to automate the whole update process to your virtual machines.
Where are the SCCM Log files located?
The SCCM (System Center Configuration Manager) log files are located in different directories on the SCCM server and client computers. On the SCCM server, the log files are typically located in the “Logs” folder within the SCCM installation directory. The default installation directory is “C:Program FilesMicrosoft Configuration ManagerLogs”.
On the client computers, the log files are located in the “CCMLogs” folder within the Windows directory. The default path is “C:WindowsCCMLogs”. The log files are named according to the component or feature they relate to. For example, the “ClientLocation.log” file logs information about the client’s location, while the “SoftwareCenter.log” file logs information about the Software Center feature.
SCCM Logs – Conclusion
SCCM log files are crucial for troubleshooting issues related to software updates deployment. In this article, we discussed the important SCCM log files for software updates and how to analyze them to troubleshoot issues. We also discussed some common issues related to software updates deployment in SCCM and their resolutions. By following the best practices for SCCM log file analysis, administrators can ensure a smooth and successful software updates deployment process.
by Mark | Feb 27, 2016 | How To, SCCM
SCCM Clients failing to install windows updates
Microsoft System Center Configuration Manager (SCCM) is a popular tool used for managing and deploying updates to Windows clients in an organization. However, sometimes SCCM clients can encounter issues while installing Windows updates, resulting in failed installations. This can be a frustrating experience for IT professionals who are responsible for maintaining a secure and up-to-date environment. In this article, we will explore common causes of SCCM clients failing to install Windows updates and provide solutions to troubleshoot and resolve these issues.
Common Causes of SCCM Clients Failing to Install Windows Updates:
There can be various reasons why SCCM clients may fail to install Windows updates. Here are some common causes:
- Inadequate Disk Space: If the SCCM client has insufficient disk space, it may fail to install updates.
- Connectivity Issues: The SCCM client must have a stable and reliable connection to the network and the SCCM server to download and install updates. Any connectivity issues can cause the installation to fail.
- Corrupted Update Files: Sometimes, the update files downloaded by the SCCM client can become corrupted, leading to a failed installation.
- Incorrect Permissions: If the user account used to run the SCCM client does not have sufficient permissions to install updates, the installation may fail.
- Conflicting Software: Sometimes, other software installed on the client machine can interfere with the installation of Windows updates.
Troubleshooting SCCM Clients Failing to Install Windows Updates:
Now that we have identified some common causes of SCCM clients failing to install Windows updates, let’s look at some troubleshooting steps to resolve these issues.
- Check Disk Space: Verify that the SCCM client has sufficient disk space to install updates. Clear any unwanted files or increase the disk space if needed.
- Check Connectivity: Ensure that the SCCM client has a stable network connection to the SCCM server. Check for any firewall or network configuration issues that may be affecting the connection.
- Clear the Software Distribution Folder: Sometimes, clearing the contents of the Software Distribution folder on the SCCM client can help resolve update installation issues. To do this, stop the Windows Update service, delete the contents of the C:WindowsSoftwareDistribution folder, and then restart the Windows Update service.
- Verify Permissions: Ensure that the user account used to run the SCCM client has sufficient permissions to install updates. The user account should be a member of the local Administrators group on the client machine.
- Uninstall Conflicting Software: If other software is interfering with the installation of Windows updates, uninstall the software and attempt the update installation again.
The most common cause of Windows Update Failures
If you find no issues while looking at the Client and SCCM server Windows Updates logs and you determine that it isnt something else (as above), it maybe worth checking the following on the clients with the issues.
If you have issues with SCCM client machines during an update deployment, an issue that could be causing the problem is a proxy value has been set within the registry.
Open Regedit and navigate to the following key location
HKEY_LOCAL_MACHINE – SOFTWARE – Microsoft – Windows – CurrentVersion – Internet Settings – Connections – WinHttpSettings
Delete the WinHttpSettings value
Close Regedit and reboot the server.
FAQs
How can I tell if an SCCM client failed to install updates?
You can check the SCCM console to view the update deployment status. If the update installation has failed, you will see an error message with details of the failure.
What should I do if an SCCM client repeatedly fails to install updates?
Try the troubleshooting steps mentioned in this article to resolve the issue. If the issue persists, you may need to investigate further and seek assistance from Microsoft support.
What should I do if an SCCM client reports a download failure for an update?
First, check the client’s internet connectivity and ensure that there is no firewall or proxy server blocking the download. If the issue persists, try clearing the Software Distribution folder or restarting the Windows Update service on the client machine.
How can I troubleshoot an SCCM client that is stuck in “Downloading” or “Installing” updates?
Check the client’s connectivity to the SCCM server and ensure that there is enough disk space on the client machine. You can also try clearing the Software Distribution folder or restarting the Windows Update service on the client machine.
What are some common errors that occur when SCCM clients fail to install updates?
Some common errors include “Failed to install updates,” “Error 0x80070003,” and “Error 0x8007000e.” The specific error message can provide clues to the underlying issue.
How can I troubleshoot an SCCM client that is reporting a Windows Update error?
Check the client’s internet connectivity, ensure that there is enough disk space on the client machine, and verify that the user account used to run the SCCM client has sufficient permissions to install updates. You can also try restarting the Windows Update service or clearing the Software Distribution folder on the client machine.
How can I prevent SCCM clients from failing to install Windows updates in the future?
Ensure that the client machines are regularly maintained and have enough disk space available. Keep the SCCM server up-to-date with the latest updates and patches. Additionally, consider implementing a regular update schedule and enforcing compliance policies to ensure that updates are installed on a timely basis.
Conclusion:
SCCM clients failing to install Windows updates can be a frustrating issue to deal with, but with the right troubleshooting steps, it can be resolved. In this article, we have outlined some common causes of update installation failures and provided solutions to troubleshoot and resolve these issues. By following these steps, you can ensure that your SCCM clients stay up-to-date and secure.
by Mark | Feb 16, 2016 | SCCM
SCCM – version 1511 New Features
The latest version of Microsoft’s System Centre Configuration Manager has been released. (SCCM 1511). While we all expected this to be called SCCM 2016, it is in fact now called SCCM 1511. The new versioning is due to the fact that SCCM update cycle will be frequent. Every new version will be named as SCCM YYMM (Year and Month). Version 1511 was released on the 15th of November, hence 1511.
The new features as part of this release are as follows;
Windows 10
- Windows 10 servicing
- Sideloading apps in Windows 10
- Compliance settings for Windows 10
Infrastructure
- Preferred management points
- Single Primary site supports up to 150k clients and 700k client in a hierarchy
- Support for Microsoft Azure virtual machines
- Diagnostics and Usage Data
- Service a server cluster
- Support for SQL Server AlwaysOn for highly available databases
- Integration with Windows Update for Business
Console
- Natively manage Office 365 desktop client update
- Deploy Windows Business Store applications
- Support for multiple Automatic Deployment Rules
- Client deployment status in console monitoring
- Schedule and run the WSUS clean up task from the Configuration Manager console
- Updates and servicing
- Client piloting to preproduction
- Software Center
Operating System Deployment
- Windows 10 in-place upgrade task sequence
- Windows PE Peer Cache
Mobile Device Management
- Mobile device management (MDM) feature parity between Intune stand-alone and Configuration Manager
- Mobile Application Management
- Data protection for mobile devices
- On-premises mobile device management (MDM)
- App deployment to Windows 10 devices with on-premises MDM
- Certificate provisioning is supported for Windows 10 devices that you manage using on-premises mobile device management.
- Improved workflow for creating mobile device configuration items
- Bulk enrollment of Windows 10 devices with on-premises MDM
- Wipe and retire for on-premises mobile device management
A perfect addon for SCCM patching deployment to your virtual machines, is our product known as SnaPatch. Click here to see how SnaPatch can help you reduce the risk of patch deployment.
by Mark | Feb 10, 2016 | How To, Patch Management, Patch Releases, SCCM
The following thirteen Patch Tuesday updates / patches have been released by Microsoft for the Febuary 2016 Update deployment.
Are you ready to start deploying and remove the patching risk using SnaPatch Patch Management Software?
MS16-009 – Critical
Cumulative Security Update for Internet Explorer (3134220)
This security update resolves vulnerabilities in Internet Explorer. The most severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
MS16-011- Critical
Cumulative Security Update for Microsoft Edge (3134225) This security update resolves vulnerabilities in Microsoft Edge. The most severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Microsoft Edge. An attacker who successfully exploited the vulnerabilities could gain the same user rights as the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
MS16-012 – Critical
Security Update for Microsoft Windows PDF Library to Address Remote Code Execution (3138938) This security update resolves vulnerabilities in Microsoft Windows. The more severe of the vulnerabilities could allow remote code execution if Microsoft Windows PDF Library improperly handles application programming interface (API) calls, which could allow an attacker to run arbitrary code on the user’s system. An attacker who successfully exploited the vulnerabilities could gain the same user rights as the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights. However, an attacker would have no way to force users to download or open a malicious PDF document.
MS16-013 – Critical
Security Update for Windows Journal to Address Remote Code Execution (3134811)
This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if a user opens a specially crafted Journal file. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
MS16-014 – Important
Security Update for Microsoft Windows to Address Remote Code Execution (3134228) This security update resolves vulnerabilities in Microsoft Windows. The most severe of the vulnerabilities could allow remote code execution if an attacker is able to log on to a target system and run a specially crafted application.
MS16-015 – Important
Security Update for Microsoft Office to Address Remote Code Execution (3134226) This security update resolves vulnerabilities in Microsoft Office. The most severe of the vulnerabilities could allow remote code execution if a user opens a specially crafted Microsoft Office file. An attacker who successfully exploited the vulnerabilities could run arbitrary code in the context of the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
MS16-016 – Important
Security Update for WebDAV to Address Elevation of Privilege (3136041) This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow elevation of privilege if an attacker uses the Microsoft Web Distributed Authoring and Versioning (WebDAV) client to send specifically crafted input to a server.
MS16-017 – Important
Security Update for Remote Desktop Display Driver to Address Elevation of Privilege (3134700)
This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow elevation of privilege if an authenticated attacker logs on to the target system using RDP and sends specially crafted data over the connection. By default, RDP is not enabled on any Windows operating system. Systems that do not have RDP enabled are not at risk.
MS16-018 – Important
Security Update for Windows Kernel-Mode Drivers to Address Elevation of Privilege (3136082)
This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow elevation of privilege if an attacker logs on to an affected system and runs a specially crafted application.
MS16-019 – Important
Security Update for .NET Framework to Address Denial of Service (3137893) This security update resolves vulnerabilities in Microsoft .NET Framework. The more severe of the vulnerabilities could cause denial of service if an attacker inserts specially crafted XSLT into a client-side XML web part, causing the server to recursively compile XSLT transforms..
MS16-020 – Important
Security Update for Active Directory Federation Services to Address Denial of Service (3134222)
This security update resolves a vulnerability in Active Directory Federation Services (ADFS). The vulnerability could allow denial of service if an attacker sends certain input data during forms-based authentication to an ADFS server, causing the server to become nonresponsive.
MS16-021 – Important
Security Update for NPS RADIUS Server to Address Denial of Service (3133043)
This security update resolves a vulnerability in Microsoft Windows. The vulnerability could cause denial of service on a Network Policy Server (NPS) if an attacker sends specially crafted username strings to the NPS, which could prevent RADIUS authentication on the NPS.
MS16-022 – Important
Security Update for Adobe Flash Player (3135782) This security update resolves vulnerabilities in Adobe Flash Player when installed on all supported editions of Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, and Windows 10.
by Mark | Jan 13, 2016 | Features, Patch Management, Patch Releases, SCCM
Microsoft’s January 2016 Patch Releases
The following nine Patch Tuesday updates / patches have been released by Microsoft for the January 2016 Update deployment.
MS16-001 – Critical
Cumulative Security Update for Internet Explorer (3124903)
This security update resolves vulnerabilities in Internet Explorer. The more severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
MS16-002- Critical
Cumulative Security Update for Microsoft Edge (3124904)
This security update resolves vulnerabilities in Microsoft Edge. The vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Microsoft Edge. An attacker who successfully exploited the vulnerabilities could gain the same user rights as the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
MS16-003 – Critical
Cumulative Security Update for JScript and VBScript to Address Remote Code Execution (3125540)
This security update resolves a vulnerability in the VBScript scripting engine in Microsoft Windows. The vulnerability could allow remote code execution if a user visits a specially crafted website. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
MS16-004 – Critical
Security Update for Microsoft Office to Address Remote Code Execution (3124585)
This security update resolves vulnerabilities in Microsoft Office. The most severe of the vulnerabilities could allow remote code execution if a user opens a specially crafted Microsoft Office file. An attacker who successfully exploited the vulnerabilities could run arbitrary code in the context of the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
MS16-005 – Critical
Security Update for Windows Kernel-Mode Drivers to Address Remote Code Execution (3124584)
This security update resolves vulnerabilities in Microsoft Windows. The more severe of the vulnerabilities could allow remote code execution if a user visits a malicious website.
MS16-006 – Critical
Security Update for Silverlight to Address Remote Code Execution (3126036)
This security update resolves a vulnerability in Microsoft Silverlight. The vulnerability could allow remote code execution if a user visits a compromised website that contains a specially crafted Silverlight application. An attacker would have no way to force users to visit a compromised website. Instead, an attacker would have to convince users to visit the website, typically by getting them to click a link in an email or instant message that takes users to the attacker’s website.
MS16-007 – Important
Security Update for Microsoft Windows to Address Remote Code Execution (3124901)
This security update resolves vulnerabilities in Microsoft Windows. The most severe of the vulnerabilities could allow remote code execution if an attacker is able to log on to a target system and run a specially crafted application.
MS16-008 – Important
Security Update for Windows Kernel to Address Elevation of Privilege (3124605)
This security update resolves vulnerabilities in Microsoft Windows. The vulnerabilities could allow elevation of privilege if an attacker logs on to an affected system and runs a specially crafted application.
MS16-010 – Important
Security Update in Microsoft Exchange Server to Address Spoofing (3124557)
This security update resolves vulnerabilities in Microsoft Exchange Server. The most severe of the vulnerabilities could allow spoofing if Outlook Web Access (OWA) fails to properly handle web requests, and sanitize user input and email content.
