Troubleshooting ‘Unknown’ software and update status, ‘Not yet contacted’ and lack of hardware and software inventory
Sorry about the long title, but I wanted to help you find this article if you’re searching for assistance with a common environment issue that affects your ability to manage computers with System Center Essentials Essentials.
If while looking at computers in the Computers workspace in the Essentials console, if you notice a managed computer with any of these symptoms:
- Hardware and software inventory is displayed as ‘Unknown’
- Software and Update status is ‘Unknown’
- Last Contacted is ‘Not yet contacted’
the managed computer is not being fully managed by Essentials. Essentials uses the Operations Manager agent to provide monitoring and remote task execution on managed computers, and the Windows Update agent to provide software distribution, update management and inventory collection on managed computers. In this case, the Windows Update agent on the managed computer is not properly reporting to the Essentials server, which is why the status for these areas is ‘Unknown’.
We’ve added monitoring in Essentials 2010 to alert you when managed computer are affected by this issue, but it also can be easily detected by looking at managed computers in the Computers workspace. Here are screenshots of how this issue is displayed in both Essentials 2007 and Essentials 2010.
Essentials 2007
Essentials 2010
Note: The description, asset tag and BIOS serial number properties are collected via the Ops Mgr attribute discovery process instead of via Windows Update agent inventory collection.
Troubleshooting Configuration: Group Policy
Essentials uses group policy to configure the Windows Update agent on the managed computer to report to the Essentials server. The first area to investigate is whether the managed computer is receiving and applying this policy.
Troubleshooting Steps
On the managed computer that is not reporting to the Essentials server, open Registry Editor and navigate to:
HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate
and verify that the WUServer and WUStatusServer values are set to:
https://<FQDN of your Essentials server>:8531
If its set to the Essentials server, jump to Windows Update log section, else continue to step 2.
If you have configured the Essentials server to use domain group policy, verify that the managed computer is a member of the ‘SCE Managed Computer <management group name>’ Security Group located in the Users container in your Active Directory domain. If the computer is not a member, add the computer object to the security group, and restart the managed computer.
If you have configured the Essentials server to use domain group policy, run ‘gpresult.exe /v’ on the managed computer to determine if the computer is receiving the ‘SCE Managed Computer <management group name>’ group policy. If the computer is not applying the policy, use the Troubleshooting Group Policy in Microsoft Windows Server guide to assist you: https://www.microsoft.com/downloads/details.aspx?familyid=b24bf2d5-0d7a-4fc5-a14d-e91d211c21b2&displaylang=en
If you have configured Essentials to use local policy, a scheduled task runs once per day that configures the local group policy object on the managed computer. Use Resultant Set of Policy (rsop.msc) to investigate if there is an Active Directory group policy (which has a higher order of precedence) that is overriding the Windows Update agent configuration in the local group policy object.
Troubleshooting Connectivity: Windows Update log
Now that you’ve verified that the Windows Agent is configured to report to the Essentials server, the next step is to check out the Windows Update log on the managed computer to verify its attempting to contact the Essentials server and is successful.
- Open the Windows Update log on the managed computer; the log can be found at %windir%\windowsupdate.log.
- Scroll to the bottom of the log file and look for the last attempt to contact. A successful communication will look like this:
2010-02-24 08:13:04:445 1076 2450 PT +++++++++++ PT: Synchronizing server updates +++++++++++
2010-02-24 08:13:04:547 1076 2450 PT + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = https://sceserver.contoso.com:8531/ClientWebService/client.asmx
2010-02-24 08:13:35:580 1076 2450 PT WARNING: Cached cookie has expired or new PID is available
2010-02-24 08:13:35:587 1076 2450 PT Initializing simple targeting cookie, clientId = 897ad25c-b27c-4124-a938-c3d609793c6c, target group = , DNS name = myclient.contoso.com
2010-02-24 08:13:35:587 1076 2450 PT Server URL = https://sceserver.contoso.com:8531/ClientWebService/client.asmx
2010-02-24 08:13:41:980 1076 2450 PT +++++++++++ PT: Synchronizing extended update info +++++++++++
2010-02-24 08:13:41:980 1076 2450 PT + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = https://sceserver.contoso.com:8531/ClientWebService/client.asmx
2010-02-24 08:13:42:280 1076 2450 Agent * Found 0 updates and 53 categories in search; evaluated appl. rules of 437 out of 560 deployed entities
2010-02-24 08:13:42:357 1076 2450 Agent *********
2010-02-24 08:13:42:357 1076 2450 Agent ** END ** Agent: Finding updates [CallerId = AutomaticUpdates]
2010-02-24 08:13:42:357 1076 2450 Agent *************
An unsuccessful attempt will look like this:
2010-03-29 09:23:57:662 1132 1f80 Agent *************
2010-03-29 09:23:57:662 1132 1f80 Agent ** START ** Agent: Finding updates [CallerId = Windows System Health Agent Search]
2010-03-29 09:23:57:662 1132 1f80 Agent *********
2010-03-29 09:23:57:662 1132 1f80 Agent * Include potentially superseded updates
2010-03-29 09:23:57:662 1132 1f80 Agent * Online = Yes; Ignore download priority = No
2010-03-29 09:23:57:662 1132 1f80 Agent * Criteria = "IsInstalled=0 and CategoryIDs contains '0fa1201d-4330-4fa8-8ae9-b877473b6441'"
2010-03-29 09:23:57:662 1132 1f80 Agent * ServiceID = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7} Managed
2010-03-29 09:23:57:662 1132 1f80 Agent * Search Scope = {Machine}
2010-03-29 09:23:57:834 1132 1f80 PT +++++++++++ PT: Starting category scan +++++++++++
2010-03-29 09:23:57:834 1132 1f80 PT + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = https://sceserver.contoso.com:8531/ClientWebService/client.asmx
2010-03-29 09:24:18:958 1132 1f80 Misc WARNING: Send failed with hr = 80072ee2.
2010-03-29 09:24:18:958 1132 1f80 Misc WARNING: SendRequest failed with hr = 80072ee2. Proxy List used: <(null)> Bypass List used : <(null)> Auth Schemes used : <>
2010-03-29 09:24:18:958 1132 1f80 PT + Last proxy send request failed with hr = 0x80072EE2, HTTP status code = 0
2010-03-29 09:24:18:958 1132 1f80 PT + Caller provided credentials = No
2010-03-29 09:24:18:958 1132 1f80 PT + Impersonate flags = 0
2010-03-29 09:24:18:958 1132 1f80 PT + Possible authorization schemes used =
2010-03-29 09:24:18:958 1132 1f80 PT WARNING: StartCategoryScan failure, error = 0x80072EE2, soap client error = 5, soap error code = 0,
Notice the WARNING and error codes I’ve bolded in the log excerpt. These are issues that are preventing the Windows Update agent from communicating with the Essential server. Check out these article for specific guidance on how to troubleshoot these errors and warnings:
How to read the Windowsupdate.log file
https://support.microsoft.com/kb/902093
Windows Update Agent Result Codes
https://technet.microsoft.com/en-us/library/cc720442(WS.10).aspx
How the Windows Update client determines which proxy server to use to connect to the Windows Update Web site
https://support.microsoft.com/kb/900935
If you use image-based OS deployment: Troubleshooting duplicate SUSClient ID
If you have many managed computers that are not reporting to the Essentials server, and you use an image to install the operating system on computers, the most likely cause of this issue is that the managed computers are sharing the same SUSClientID. The WSUS technology in Essentials uses the SUSClientID to uniquely identify each managed computer that contacts the Essentials server. If more than one computer is using the same duplicate SUSClientID, only the first computer that reports to the Essentials server will be fully managed.
If this is the case in your environment, check out these articles for cleaning up this issue, and also fix your image so that you do not have to deal with this issue in the future.
A Windows 2000-based, Windows Server 2003-based, or Windows XP-based computer that was set up by using a Windows 2000, Windows Server 2003, or Windows XP image does not appear in the WSUS console
https://support.microsoft.com/kb/903262
Resolving the duplicate SUSClientID issue, or “Why don’t all my clients show up in the WSUS console?”
https://blogs.technet.com/sus/archive/2009/05/05/resolving-the-duplicate-susclientid-issue-or-why-don-t-all-my-clients-show-up-in-the-wsus-console.aspx
We’d appreciate your feedback on this article or your experiences troubleshooting this issue: