Exercise Overview:

Earlier you saw how Alarm Clocks and Maintenance Windows can be defined in a Power Policy to wake clients up at a defined time. Both features use the WakeUp components of NightWatchman Enterprise. In this lab, you will learn about the role of the Primary and Alternate agents in each subnet. You will then observe the WakeUp process using the NightWatchman console to initiate the wakeup of a specific computer. You will also discover how integration with ConfigMgr ensures computers that have been targeted with a deployment are powered on when the advertisement is scheduled to run.

In this lab, you will learn about the following:

  • The role of the Primary agent and its relationship with the Alternate Agent
  • How we ensure there is always one agent available on each subnet (Last Man Standing)
  • How computers can be woken up from the NightWatchman console
  • How WakeUp integrates with ConfigMgr to ensure targeted computers are on when a deployment is scheduled to execute

Working with the Primary and Alternate Agents

The WakeUp Server identifies a Primary Agent in each subnet that it uses to broadcast the WakeUp packets destined for that subnet. It will also attempt to identify an Alternate Agent. In this exercise, you will learn how to identify the Primary and Alternate agents and observe how they interact to ensure that there is always one agent available on the subnet.

Identifying the Primary and Alternate Agents

In this task, you will use the WakeUp Console to identify the Primary and Alternate Agents registered to the WakeUp server on the ConfigMgr Primary Site server.

All client workstations

  1. Shut down all client workstations that are currently running
  2. The easiest way to do this is to suspend them through the SkyTap console


  1. Log on to 1ETRNCM as 1ETRN\SCCMAdmin and start the WakeUp Console
  2. In the 1E WakeUp Console – Connect to Server dialog box connect to the local server
  3. In the 1E WakeUp Console select the Agents tab from the list on the left
  4. The Agent List shows each of the subnets managed by this particular WakeUp server. There are three subnets in this lab – and The Primary and Alternate agents for each subnet are identified by in the Agent and Alternate Agent columns respectively. You should only see and

If you initiated a wakeup of any machine earlier in the labs via the ConfigMgr console, you will see that subnet and agents registered to it.

Finding Primary and Alternate Agents

When WakeUp Server is implemented in NWMMC Strategy, over time it will scan each of the inventoried subnets within its defined boundaries and attempt to identify a Primary and Alternate Agent. This is managed by the Agent State Manager feature.

In ConfigMgr Strategy, this background scanning of subnets does not occur – the WakeUp server will scan for a Primary and Alternate agent the first time a WakeUp is attempted in any given subnet. If no attempt has been made to wake up a client in a given subnet, that subnet will not appear in the Agents tab unless it is manually added using the Add Subnet button. 
In either scenario, once subnets appear in the Agents tab of the WakeUp console, the Agent State Manager will periodically re-scan the subnet for a Primary and Alternate agent

1ETRNW71 and 1ETRNW101

  1. Start 1ETRNW71 and 1ETRNW101
  2. Log on to each of these workstations as 1ETRN\user, and open the C:\Windows\CCM\Logs\WakeUpAgt.log


  1. Launch the ConfigMgr console from the tool bar at the bottom. Under the Assets and Compliance workspace, select Device Collections
  2. Right click on the Lab Workstations collection, and initiate Send Wakeup via the 1E Wakeup option
  3. Since we are in ConfigMgr strategy, agents won't be registered until a wakeup is initiated. Have a look at the 1ETRNAP server, the wakeup console will have agents registered for both of our client subnets, because in NWMMC strategy, the wakeup server will proactively scan subnets in its database to look for agents to register.
  4. From the Agents tab in the 1E WakeUp Console click Refresh

Open C:\ProgramData\1E\WakeUpSvr\WakeUpSvr.log and search for the following

  1. You should now see two of 1ETRNW71, 1ETRNW73 and 1ETRNW101 as the Primary and Alternate Agents on subnet, with a green light against each indicating the agents are active (make a note of which is the Primary Agent)
  2. The only two machines on the subnet will, 1ETRNW72 and 1ETRNW102 will be registered on that subnet
  3. In preparation for the next steps, we need to increase the WakeUp Agent logging level. Log on to the two workstations registered on as 1ETRN\user, start regedit and increase the default WakeUp Agent logging level by setting the following registry value to 0x1F (31 decimal)
  4. HKEY_LOCAL_MACHINE\Software\1E\WakeUpAgt\Debug

Observing Interaction Between the Primary and Alternate Agents

In this task, you will observe the interaction between the Primary and Alternate Agents to ensure that one agent is always active on the subnet (known as the Last Man Standing).


  1. To make observation of the WakeUp Server log file easier for this exercise, from the WakeUp Console select the Logging/Control tab on the left and uncheck Advertisement List and click Apply
  2. Advertisement List is enabled by default and records all active deployments every time the server polls the ConfigMgr database. You'll be looking at this behavior in another exercise shortly


  1. Stop the 1E Client Service on whichever client is currently registered as the Primary Agent for subnet (you identified this in the previous task)
  2. We are mimicking a shutdown by stopping the WU service. We can also issue an actual shutdown but this is quicker and will display what we want to see.
  3. Observe the WakeUpAgt.log as the service shuts down. Note that it notifies the WakeUp server (1ETRNCM) and also broadcasts a special "LASTMAN" packet for the Alternate Agent (identified by its MAC address)

Your log should look like this

Alternate Agent
  1. Now switch to the workstation that was the Alternate Agent and observe the Wakeup Agent log at the point where the Primary agent shut down

Your log should look like this


Switch to the WakeUp Server (1ETRNCM) and observe the actions in WakeUpSvr.log as the Primary Agent service shuts down and the Alternate agent assumes the Primary Agent role

  1. Return to the 1E WakeUp Console, select the Agents tab, select the subnet in the Agents tab and click Refresh
  2. The Primary Agent and the Alternate Agents will have reversed, with the Alternate having a yellow light indicating it is not active.

Note that the workstation that was previously the Alternate Agent has now become the Primary Agent, and the original Primary agent has become the Alternate Agent, but has a yellow light indicating the agent is not active. Whenever the Primary agent is taken offline, if there is an Alternate Agent defined, it will become the Primary agent. In this scenario, the current Primary Agent is identified as the Last Man Standing – there are no other agents active on the subnet.
Primary agent
  1. On whichever agent is now Primary agent (and in this case the Last Man Standing), stop the 1E Client service and observe the WakeUpAgt.log file

Your log should look like this 

Note that when the Primary agent is the Last Man Standing and is shut down, it broadcasts a magic packet with the MAC address of the registered Alternate Agent – one last attempt to rouse its comrade as it dies. In a physical network environment, this would cause the Alternate Agent to be started up and become the Primary agent; however, virtual network adapters cannot be woken using magic packets.
Primary and Alternate agents
  1. Restart the 1E Client service on both machines

Observing NightWatchman Behavior on the Primary Agent

In this task, you will observe the behaviour of a NightWatchman scheduled power-down on a client that is the designated Primary Agent.

You might have already seen this in the previous lab, where the machine you were applying NightWatchman policy to was rebooting as opposed to shutting down. We'll dig into this in more detail now.
Before starting this exercise, it is important that the Primary agent is properly registered. This would happen naturally over time, but to expedite and clean up after the last exercise we will de-register any agents in the WakeUp console and run the Check Agents process to ensure we get the Primary Agent properly registered.

  1. In the Agents tab of the WakeUp console, select the subnet and click De-Reg Alt (if an Alternate Agent is shown) and then De-Reg Agent. The subnet should now show an orange question mark
  2. In the wakeup console, navigate to the Agent Finder tab, and change the Subnet Rescan Delay from 300 to 30 and click Apply

  3. If this setting remains at 300, it will take 5 minutes before a subnet rescan will occur. While in a production environment this is fine, we want to get our agents reregistered quickly, and making this change will execute the reregistering in 30 seconds.
  4. Switch back to the Agents tab. Highlight the subnet in the list, and click Check Agents. Click Refresh. Ensure agents are registered

Primary agent

  1. Start a command prompt as Administrator from the start menu and change directory to C:\Program Files\1E\NightWatchman
  2. Run the following command, replacing day with the short name of the current day (e.g. MON, TUE, WED) and hh:mm(24 hour clock) with a time 3 or 4 minutes ahead of the current system time on the client
  3. Nightwatchman -scheduledactions="day(hh:mm,POWEROFF,ACTIVE)" –useractivitymaxidlemins=0
    We are resetting useractivitymaxidlemins to zero, which we had set to 2 minutes in a previous exercise. If this change isn't made, NightWatchman will observe user activity on the machine and abort the power down. Therefore, we are turning off that functionality to see the expected results in this exercise.
  4. Open the NightWatchman.log so you can watch the shutdown activity
  5. Observe the computer as the scheduled power down time passes. When the NightWatchman countdown dialog box appears note that the message and buttons indicate the machine is going to restart, whereas the scheduled action was POWEROFF
  6. Allow the countdown to complete and the computer to restart
  7. NightWatchman will convert a power off to a restart if it detects the client is the last man standing. This ensures that a machine remains powered on for each subnet in the environment, as we need a machine to process the wakeups sent by the server for that subnet. This behavior can be turned off in an environment, which has vPro-provisioned machines. Ask your instructor for further information on this if you are interested.

Observing the WakeUp Process

In this exercise, you will attempt to wake up a client first from the NightWatchman Console, then because of a scheduled ConfigMgr deployment, and observe the process of each method. As these are virtual clients, the WakeUp will not actually work (you can't start a virtual machine with a WakeUp packet), but you will be able to observe the process that would normally occur via the logs.

Waking a Computer From the Nightwatchman Console


  1. On 1ETRNAP open the NightWatchman Management Center service log (C:\ProgramData\1E\NightWatchmanManagementCenter\NWM.ServiceHost.exe.log)
  2. Open the NightWatchman Console and find  1ETRNW73 Right click on and select On-demand WakeUp
  3. In the NightWatchman log, observe that the NightWatchman Management Center service has sent a WakeUp job to the WakeUp Server on 1ETRNCM

Your log should look like this

  1. On the WakeUp Server (1ETRNCM) open C:\ProgramData\1E\WakeUpSvr\WakeUpSvr.log
  2. Observe the activity as the server receives the WakeUp job from the NightWatchman Management Center server and generates a wakeup job for the subnet

Your log should look like this

Primary agent
  1. On the primary agent identified in the WakeUp Console, open the WakeUp Agent log
  2. Observe the activity as the Primary Agent receives the wakeup job from the WakeUp server. A short while after it has sent the magic packet (Sent HELLOWAK…), you would see acknowledgement of the response from 1ETRNW73 (JUSTWOKE) as the WakeUp service starts if it were a physical machine. You can see where the alternate agent replies with a WASAWAKE and three minutes after the HELLOWAK was sent, you can see where the results are sent to the WakeUp server (TCP WUREZULT)

Your log should look like this

Waking a Computer for a ConfigMgr Deployment

In this task, you will observe the behavior of WakeUp when an Application Deployment is scheduled to run on a collection of ConfigMgr clients.


  1. Open the 1E WakeUp Console, select the Logging/Control tab on the left, check Advertisement List and click Apply
  2. Open the System Center Configuration Manager console and select the Software Library workspace
  3. Expand the Application Management node in the top left and select Applications
  4. Right-click Adobe Reader 9 and select Deploy to start the Deploy Software Wizard
  5. On the General page click Browse to select the target collection
  6. Change User Collections on the left to Device Collections and select the Lab Workstations Collection as the target and click OK to return to the General page. Click Next
  7. On the Content page note that the content has already been distributed to the Distribution Point on 1ETRNCM. Click Next
  8. On the Deployment Settings page, change the Purpose to Required and then select Send wake-up packets. Click Next
  9. WakeUp will only wakeup a client if a required deployment is due. Available deployments require the user to initiate the deployment, so there's no point waking the computer up. The Send wake-up packets is a standard ConfigMgr setting – we simply read this setting and invoke 1E WakeUp if it is set.
  10. On the Scheduling page click Summary to use the default settings for the remaining pages
  11. Note the default schedule for the installation deadline is As soon as possible
  12. On the Summary page review the settings and click Next. Close the wizard on completion
  13. Open WakeUpSvr.log and observe the activity as the scheduled time approaches
  14. The WakeUp server polls the database every 30 seconds by default to determine if there are any deployments scheduled to run within the next polling interval.
  15. As the scheduled time arrives, the WakeUp server sends WakeUp messages to the Primary Agents in each subnet

Your log should look like this 


  1. Identify the Primary agent on the subnet in the WakeUp Console on 1ETRNCM
  2. On the Primary Agent open the WakeUp Agent log
  3. Observe the activity as the Primary Agent receives the wakeup job from the WakeUp server

Your log should look like this

Note that as the process was initiated because of a scheduled Application Deployment, the wakeup job includes MAGICPKT and CYCLESMS. CYCLESMS will cause each of the clients that are already powered on to request policy from the ConfigMgr Management Point, therefore receiving the instruction to process the deployment immediately, rather than waiting for the normal polling interval.

Lab Summary

In this lab, you have seen how WakeUp can be initiated interactively from the NightWatchman console. In this scenario, the NightWatchman Console Service generates the WakeUp request that is sent to the WakeUp server registered for the subnet that the target client is in. The WakeUp server then forwards a wakeup list to the registered primary agent on the target subnet. The Primary agent broadcasts the wakeup packet and then listens for a broadcast response from the client, which it then returns to the WakeUp server for reporting.
You have also seen that WakeUp can be integrated into ConfigMgr software deployments to ensure clients targeted with a software deployment are woken up in time to process the deployment at the scheduled time. In this case, the wakeup is initiated by the WakeUp Server, which regularly polls the ConfigMgr database for pending deployment schedules, generates the WakeUp lists from the target Collection and then forwards these lists to the Primary agent in each targeted subnet.

Next Page

Ex 6 - NWM v7.3 - Using - Exploring the NightWatchman Reports