Windows Client Health integrated product pack
Integrated Product Pack used to create the Windows Client Health instruction set and Windows Client Health policy.
For more information, please refer to Windows Client Health Policy.
Windows Client Health integrated product pack
Integrated Product Pack used to create the Windows Client Health instruction set and Windows Client Health policy.
For more information, please refer to Windows Client Health Policy.
Over time Windows devices can develop performance problems related to device or service availability. This policy verifies the available storage capacity on devices, notifies of application crashes, monitors WMI health and service function, and also checks the behavior of core Windows services.
The Windows client health policy covers all of the following:
Manages Windows devices and service availability performance problems
Safeguards disk space integrity, ensuring sufficient storage capacity
Ensures optimum performance of the Configuration Manager client and that WMI is active and integrated
Notifies of application crashes and remediation assists. Investigates root cause for specific issues.
Note
This policy is intended for deployment to Windows devices only.
Instructions
The following table shows the instructions included in the Integrated Product Pack. Unless already uploaded, the following instructions are added to an Instruction set named: Windows Client Health
Readable Payload | Type | Description | Name | Version |
|---|---|---|---|---|
Question | List application crashes. Returns an aggregated list of applications which have crashed and the number of times each of them crashed, including the application module which caused the crash, and application and module versions. The drill-down shows each device which suffered the crash, the file paths of the faulting application and module, the exception code and offset, and the time of the crash. | 3 | ||
Question | List application crashes for a specific application. | 3 | ||
Question | Retrieve the content of a specified log file. | 3 | ||
Action | Start the Windows Management Instrumentation (WMI) service. | 3 |
Policies
The following table shows the policies included in the Integrated Product Pack.
Name | Description |
|---|---|
The Windows Client Health policy ensures that the health of the Windows operating system is compliant with a reference baseline. |
Rules
The following table shows the rules included in the Integrated Product Pack.
Note
Any parameter values shown in the Check and Fix fragments, Triggers and Precondition fragment columns are specifically set in the rules when the pack is uploaded. These may be different to the default values shown in the Windows Client Health Integrated Product Pack - Fragments table. You can modify these if required.
Name | Type | Description | Check and Fix fragments | Triggers | Precondition fragment |
|---|---|---|---|---|---|
Check | Check that an application has not crashed excessively. NoteBy default, this check is not assigned to the policy. | 1E-GuaranteedState-WindowsClientHealth-Check-ApplicationCrashes
NoteApplicationName is case insensitive but is required to be the filename of the executable for example unreliableapp.exe (without the path). |
| 1E-GuaranteedState-General-PreCondition-WindowsDevice
| |
Check | Check that the system disk has at least 5 Gb of free space. (changed from 2 to 5 Gb in v5.0) | 1E-GuaranteedState-WindowsClientHealth-Check-SystemDriveFreeSpace
|
| 1E-GuaranteedState-General-PreCondition-WindowsDevice
| |
Check | Check that the WMI repository is in a healthy state. | 1E-GuaranteedState-WindowsClientHealth-Check-WmiBasicHealth
|
| 1E-GuaranteedState-General-PreCondition-WindowsDevice
| |
Fix | Ensure that the WMI service is running. NoteBy default, this fix is disabled, and not assigned to the policy. | 1E-GuaranteedState-General-Check-ServiceState
1E-GuaranteedState-WindowsClientHealth-Fix-StartWMIService
| TriggerTemplate-ServiceStatusChange
| 1E-GuaranteedState-General-PreCondition-WindowsDevice
|
Fragments
The following table shows the fragments included in the Integrated Product Pack.
Note
The Parameters column in the following table shows the ranges and default values for the parameters. The default values are used when you create custom rules using these fragments, unless you select alternative values.
Name | Type | Readable Payload and summary | Parameters |
|---|---|---|---|
Precondition | Run if <SoftwareTitle> is installed Uses the Software.GetInstallations to see if SoftwareTitle is installed. NoteThe Software Title parameter can be a partial string such as SQL Server which will match on the first SQL Server title that is found installed on the device. NoteNot used by any policy rules by default. | SoftwareTitle
| |
Precondition | Run if device is Windows <MinimumVersion> Uses Agent.GetSummary method to get MinimumVersion, and passes if it matches the given parameter.
NoteNot used by any policy rules by default. | MinimumVersion
| |
Precondition | Run if operating system is <OsText> Uses the Agent.GetSummary method to get OsText, and passes if it matches the given parameter. NoteNot used by any policy rules by default. | OsText
(default empty) | |
Precondition | Run if operating system is <OsText> and <SoftwareTitle> is installed Uses the Agent.GetSummary method to get OsText. Uses the Software.GetInstallations to see if SoftwareTitle is installed. | OsText
SoftwareTitle
| |
Precondition | Determine if device is running Windows Is Operating System type = Windows. Uses the Device.GetSummary method. | No parameters | |
Check | Check that service "<ServiceName>" is <State> Uses the OperatingSystem.GetServiceInfo method to check the specified service is in the specified state. You specify the service by its short name. NoteService names are listed under registry HKLM\CurrentControlSet\Services. You can determine the short name of a service using the PowerShell cmdlet: The above example will return NlaSvc, whch is the short name you specify in the <ServiceName> parameter. Another example is WindDefend, which is the short name of the Microsoft Defender Antivirus Service. | ServiceName
State
| |
Check | Check that application <ApplicationName> has not suffered more than <MaxCrashCount> crashes for the last <Days> days <Days> is Days back from now. <ApplicationName> is case insensitive but is required to be the filename of the executable, for example unreliableapp.exe (without the path). This fragment queries the root\cimv2 WMI space with the query "SELECT * FROM Win32_NTLogEvent WHERE (logfile='Application') AND (type='Error') AND (EventCode=1000) AND (Message LIKE '%name: %ApplicationName%,%')" in order to retrieve the event log entries relating to application crashes for a specific application. If the count of events exceeds the parameter <MaxCrashCount> then compliance failure is returned. | ApplicationName
MaxCrashCount
Days
| |
Check | Check that system drive has at least <ThresholdGb> Gb of free space <ThresholdGb> is free space in gigabytes. This fragment runs the WMI query "Select DeviceId, FreeSpace from Win32_LogicalDisk" and filters the results to include just the system drive. It then determines whether the reported free space exceeds the <ThresholdGb> parameter and returns compliance failure if it does not. | ThresholdGb
| |
Check | Check that Windows WMI repository is consistent and can process basic query This fragment first verifies repository integrity by issuing the command winmgmt /verifyrepository. If this reports that the repository is ok, the WMI query "Select Name from Win32_computerSystem" is issued against the root\cimv2 namespace. If this also succeeds, the fragment returns success, otherwise it returns failure, with the Data column containing one of the following depending on whether the consistent check or the subsequent query failed:
| No parameters | |
Fix | Start the WMI service This fragment uses the OperatingSystem.ControlService method to set the action of the Winmgmt (WMI) service to Start. It then enumerates running services and if the service is now running, it returns compliance success otherwise failure. The data column in the response always contains the value winmgmt. | No parameters |
Trigger templates
The following table shows the trigger templates included in the Windows Client Health Integrated Product Pack.
Note
The Parameters column in the following table shows the ranges and default values for the parameters. The default values are used when you create custom rules using these templates, unless you select alternative values.
Name | Readable Payload and summary | Parameters |
|---|---|---|
Every <intervalHours> hours Periodic (hours) | Interval Hours
| |
Every <intervalMinutes> minutes Periodic (minutes) | Interval Minutes
| |
Every <intervalSeconds> seconds Periodic (seconds) | Interval Seconds
| |
On crash of process "<executable>" When a process crashes (Windows only) Monitors the Windows Application Event Log for event 1000. NoteExecutable is case insensitive but is required to be the whole filename without the folder path, such as unreliableapp.exe A partial string such as unreliableapp will not trigger on a crash of unreliableapp.exe. | Executable
| |
On change of running state of the "<serviceName>" service When the state of the named Windows service changes NoteYou can determine the short name of a service using the PowerShell cmdlet get-service -DisplayName "Network Location Awareness" This will return NlaSvc in the above example. It is this short name you specify in the <ServiceName> parameter. | Service Name
| |
On Windows"<channel>"; event log entry matching "<query>" (debounce for <debounce> seconds) When an event log entry is created (Windows only) NoteA channel is an event sink, example standard channel names are Application or Security. To determine the available event channels execute the following PowerShell command: Get-WinEvent -ListLog * Or to view the event channels on a remote computer: Get-WinEvent -ListLog * -ComputerName <hostname> Similarly to view event log entries for a given channel either use Event Viewer or from PowerShell for example: Get-EventLog application | where {($_.EntryType -Match "Error")
-or ($_.EntryType -Match "Warning")}Or: [dateTime]$oneWeekAgo = (get-date).addDays(-7) Get-EventLog -LogName Application
-After $oneWeekAgo -computerName . | ? {$_.EventID -eq 1000}NoteA query is used to filter the event log messages for a given channel. Examples can be found at https://docs.microsoft.com/en-us/windows/win32/wes/consuming-events. For example to query all OneNote application crashes error log messages: *[System[(Level=2) and (EventID=1000)]] and *[EventData[Data='onenote.exe']] Debounce is a settling period to ensure that in the case of multiple events, only a single event is registered within the space of a given time period. | Channel
Query
Debounce Time Seconds
| |
(added in 5.0) | On change of registry values in "<hive>\<subkey>" (include subkeys=<includeSubkeys>) When the value of a Windows registry key changes. | Hive, which must be one of:
Subkey : free text string, default empty. Include Sub Keys : 1/0 default 0. |