Software Update Compliance Reports – Detection State Unknown
I have been working with a number of customers recently that have had issues running their monthly Software Update compliance reports due to a high number of “DETECTION STATE UNKOWN” results reporting back long after the update deployment has successfully run.
As usual the first thing we want to identify is whether it is on the client side or server side.
State Message IDs are used to define specific state messages for each topic type. For our issue a State Message for a Software Updates has a TopicType=500 which has status Message ID state of 0, 1, 2 or 3 which would then depict the actual state of the given update on a client machine as below:
Topic Type |
State Message ID |
State Message Description |
500 |
0 |
Detection state unknown |
500 |
1 |
Update is not required |
500 |
2 |
Update is required |
500 |
3 |
Update is installed |
To determine what information your clients are sending back to your Management Point we can use WMI queries to see what is happening on the client.
1. Open wbemtest with elevated permissions
2. Connect to the WMI Namespace: root\CCM\StateMsg
3. Select Query and run the query SELECT * FROM CCM_StateMsg
Find any software update deployment which can be determined by looking for “TopicType=500” and what we want to check is the below values in yellow as this will determine if the client has indeed sent a message back to the MP and if so what it sent back, If we see it sent back a “0” and confirm that the KBs are installed then we know it is something on the client side, we would expect to see 1, 2 ,3 pending the state listed above
Example below:
instance of CCM_StateMsg
{ Criticality = 0;
MessageSent = TRUE; Message is sent
MessageTime = "20101027211908.749000+000"; UTC Time
ParamCount = 1;
StateDetails = "";
StateDetailsType = 0;
StateID = 2; Update is required
TopicID = "9d4681d5-46fa-4250-bedc-480ac7bce3aa";
TopicIDType = 3;
TopicType = 500; Update Detection
UserFlags = 0;
UserParameters = {"102"};
Hope this helps..