Absolute DDS and Microsoft SCCM TECHNOTE Maintaining Microsoft SCCM Health with Absolute DDS absolute.com
The challenges with managing Microsoft SCCM Microsoft Systems Center Configuration Manager (SCCM) is a widely used systems management solution. SCCM includes remote control, patch management, software distribution, operating system deployment, and inventory capabilities for Windows devices. This functionality has evolved considerably since Microsoft first introduced what was then known as Systems Management Server in 1994, but the principal design still relies on a client and server architecture. Any systems administrator that uses SCCM will be familiar with the common occurrence of SCCM agent corruption. As a result, relying on the SCCM client and associated file types for device information and to perform critical systems management tasks such as patching, is a risky proposition. With the number of devices now operating off the corporate network, the inability to see a device let alone remediate security vulnerabilities or distribute critical software presents numerous challenges. Historically, there has been no way for IT to know when SCCM clients stopped working when devices were off network. At Absolute, an important part of delivering additional value is actively listening to our customers. Through numerous interviews and in collaboration with our Customer Advisory Board and InTelligence Forums, we ve gathered feedback on specific challenges our customers encounter within their IT environments. One common pain point was the occurrence of SCCM files that were not working properly, either removed by the end user or installed improperly. In some instances, customers estimated that up to 20% of their device population was not visible due to issues with SCCM clients. SCCM Status Reporting with Absolute DDS As a result of this research, SCCM status reports were added to Absolute DDS (formerly Absolute Computrace ). SCCM Status reports show current and historical information about the status of the SCCM client installed on managed Windows devices. Absolute DDS leverages the reliable two-way connection Persistence technology provides. This ability to communicate with devices, regardless of user or location, provides timely device and event information, including the status of the SCCM client on each device even if it is off the network. Compatibility: SCCM Status reports are applicable for customers with all versions of SCCM 2012, excluding beta versions. Device support includes Windows 7, 8/8.1, and 10. Activation: Existing Absolute customers can activate this feature within the cloud-based Absolute DDS administrative console. This feature can be turned on for individual devices, or for all devices. Figure 1: Enabling SCCM status collection absolute.com P. 2
Implementation: When the SCCM status feature is turned on, the Absolute DDS agent detects the status of the SCCM client by running a script on the device. This script performs a series of healthcheck tests to determine if the SCCM client is present and functioning correctly. The script runs on a schedule outside of regular Absolute DDS agent communication. No user input or changes to an organization s existing SCCM environment are required. The results of these tests are collated and presented within the following Absolute DDS reports: SCCM Status Report: Provides information about the current status of the SCCM client installed on managed Windows devices. This report can indicate devices where the SCCM client is missing or not functioning correctly. The number of issues for the particular device are collated within the Issue Count column. Figure 2: SCCM Status Report SCCM Status History Report: Provides the status change history of SCCM clients on managed Windows devices. This allows an Administrator to determine whether the SCCM client is repeatedly experiencing issues that prevent it from functioning correctly. Figure 3: SCCM Status History Report absolute.com P. 3
The following SCCM status types are reported: Absent: The SCCM client is not currently installed on the device Needs attention: One or more of the health check tests failed. Additional steps to repair the client may be required. OK: All the healthcheck tests passed, and the SCCM client is functioning NOTES: 1. A change is reported if the SCCM status changes, even if the status type remains the same. For example, if a healthcheck showed two tests failed, the status will be set to Needs Attention. If these issues are not remediated and the healthcheck is performed again with three of the tests failing, the report will indicate a change in the SCCM status. 2. A device must have had an active SCCM client in order to return a status of Needs Attention. Devices that do not have the SCCM client currently installed or that have never had the SCCM client installed, will return a status of Absent. Data collected If Absolute DDS is set to monitor SCCM status on a device, the following data is collected: SCCM status SCCM status change date CCM install path: the directory where the Configuration Client Manager (CCM) is installed Assigned site: The primary SCCM site to which the device is assigned Management point: The site system role that provides policy and service location information to the SCCM client SCCM client version Domain: Current domain of device Cache information: Includes drive letter, location, total size of cache, and free size in cache folder Last hardware scan date by SCCM client Last software scan date by SCCM client Figure 4: SCCM Status Details absolute.com P. 4
Tests performed The SCCM Healthcheck is performed by a script that is sent to devices that have the SCCM Healthcheck functionality enabled. The scripts perform the following healthchecks: Windows Management Instrumentation (WMI): tests attempt to connect to WMI components and perform a simple query Presence of Admin share: used to deploy the SCCM software remotely by allowing administrative remote access to the disk volume over the network. Tests check if this share is present and enabled. Verify Local CCM path: tests check the path to the CCM component CCM service status: tests check that CCM component is running Verify Services: tests check the SCCM client service and its dependent services are running. The following services are checked winmgt, lanmanserver, rpss, wuauserv, bits, and ccmexc. Registry: tests check the registry to ensure that Distributed Component Object Model (DCOM) is a protocol and allows for remote client connections Client variables: tests check that the SCCM client variables can be received Assigned site: tests check the primary SCCM site Hardware inventory: tests check for the last hardware inventory date and time. If value cannot be retrieved or a hardware inventory scan has never been performed, the tests fail. Software inventory: tests check for the last software inventory date and time. If value cannot be retrieved or a software inventory scan has never been performed, the tests fail. SCCM Repair [Beta] with Absolute DDS Following the release of SCCM reporting, Absolute DDS also includes the ability to repair SCCM clients on a device, both on and off the network. Clients that are identified as requiring attention within the SCCM Status History Report are repaired with new, healthy components. This can either be performed manually by selecting clients for repair, or as an automated process. Through the same reliable two-way connection that Persistence technology provides, Absolute DDS can communicate with devices, regardless of user or location, and if necessary repair the health of SCCM clients on a device. Compatibility: SCCM Repair is applicable for customers with all versions of SCCM 2012, excluding beta versions. Device support includes Windows 7, 8/8.1, and 10. Availability: SCCM Repair is available to customers with Absolute DDS Premium & Professional, along with legacy Computrace Complete, One and Data Protection editions. SCCM Repair is currently a Beta feature. Activation: Existing customers can activate this feature within Absolute DDS, and by accepting the Beta agreement. absolute.com P. 5
Figure 5: Enabling SCCM repair Implementation: When the SCCM status feature is turned on, the Absolute DDS agent detects the status of a SCCM client by running a script on the device. This script performs a series of health check tests to determine if the SCCM client is present and functioning correctly. The script runs every six hours. If one of the tests indicate that the SCCM client does not contain the necessary components, it then automatically initiates an additional script to repair the components that have become corrupt or are missing. No user input or changes to an organization s existing SCCM environment are required for SCCM reporting or repair. However for the SCCM repair process to be initiated, SCCM is required to have been previously installed and functioning on the device. Dependent on the SCCM component that is missing or has become corrupt, the Absolute DDS agent will then perform an action on the device to remediate. This ranges from restarting or reregistering processes, restarting services, to testing the availability of required components. The results of these tests are shown within SCCM Status Details, available from Device Summary reports. Figure 6: SCCM Status History absolute.com P. 6
Figure 7: Results of SCCM Repair When a repair is performed, the device s SCCM status changes from Needs attention to Repair(s) Successful. When the next health check is performed, and the SCCM components remain intact, the SCCM status will then change to OK. Absent: The SCCM client is not currently installed on the device Needs attention: One or more of the health check tests failed. You may need to take steps to repair the devices SCCM client. Repair successful: A successful repair has been performed to SCCM components on the device OK: All the health check tests passed, and the SCCM client on the device is functioning correctly For more information on Absolute DDS and Microsoft SCCM reporting, please contact your Absolute sales representative, absolute.com/contact 2015 Absolute Software Corporation. All rights reserved. Computrace and Absolute are registered trademarks of Absolute Software Corporation. All other trademarks are property of their respective owners. ABT-DDS-SCCM-Technote-111715 absolute.com P. 7