Integrated Product Pack used to create the MS SCCM Client Health instruction set and Microsoft SCCM Client Health policy.

For more information please refer to Microsoft SCCM Client Health Policy.

Many businesses rely on Configuration Manager to deploy software, patches and updates across their company networks. It is crucial that Configuration Manager is working effectively.

The Microsoft SCCM Client Health policy monitors Configuration Manager client health and performance. It checks for cache availability, inventory cycles, service availability and Configuration Manager WMI integrity - common causes of Configuration Manager client problems on devices.

The Microsoft SCCM Client Health policy covers all the following:

  • Manages Configuration Manager clients that are not functioning correctly and identifies root cause issues
  • Ensures optimum performance of the Configuration Manager client hierarchy
  • Checks Configuration Manager client reported inventory data in last X days
  • Confirms CcmExec services for effective change management
  • Checks the Configuration Manager client has registered base WMI classes
  • Checks the Configuration Manager client is using less than 50% of its content cache.

This policy is intended for deployment to Windows devices only.

On this page:

Instructions

Unless already uploaded, the following instructions are added to an Instruction set named: MS SCCM Client Health

Readable PayloadTypeDescriptionNameVersion

Start the ConfigMgr client service

ActionThis instruction starts the ConfigMgr client service (ccmexec). It will return an error if the service is not present on a device.
1E-Explorer-MSSCCMClientHealth-StartConfigMgrClientService
3

Stop the ConfigMgr client service

ActionThis instruction stops the ConfigMgr client service (ccmexec). It will return an error if the service is not present on a device.
1E-Explorer-MSSCCMClientHealth-StopConfigMgrClientService
3

Policies

The following table shows the policies included in the Integrated Product Pack.

NameDescription
Microsoft SCCM Client Health
The Microsoft SCCM Client Health policy ensures that the health of the ConfigMgr client is compliant with a reference baseline.

Rules

The following table shows the rules included in the above policy. Any parameter values shown in the Check and Fix fragments, Triggers and Precondition fragment columns are specifically set in the rules when the pack is uploaded. These may be different to the default values shown in the Fragments table. You can modify these if required.

NameTypeDescriptionCheck and Fix fragmentsTriggersPrecondition fragment
Check ConfigMgr client cache
CheckCheck that the ConfigMgr client is using less than 50% of its content cache.

1E-GuaranteedState-ClientHealth-Check-ConfigMgrClientCacheUsage

  • CacheUseThresholdPercent=50

TriggerTemplate-IntervalHours

  • Interval Hours=2

1E-GuaranteedState-ClientHealth-PreCondition-ConfigMgrClient

  • No parameters
Check ConfigMgr client inventory
CheckCheck that the ConfigMgr client has reported inventory data in last three days.

1E-GuaranteedState-ClientHealth-Check-ConfigMgrLastHardwareInv

  • DaysThreshold=7 (was 3 in v4.1)

TriggerTemplate-IntervalHours

  • Interval Hours=1

1E-GuaranteedState-ClientHealth-PreCondition-ConfigMgrClient

  • No parameters
Check ConfigMgr client is running
CheckCheck that the ConfigMgr client service (CCMExec) is running.

1E-GuaranteedState-General-Check-ServiceState

  • ServiceName=ccmexec
  • State=Running

TriggerTemplate-ServiceStatusChange

  • Service Name=ccmexec

1E-GuaranteedState-ClientHealth-PreCondition-ConfigMgrClient

  • No parameters
Check ConfigMgr client WMI registration
CheckCheck that the ConfigMgr client has registered base WMI classes.

1E-GuaranteedState-ClientHealth-Check-WmiExpectedClasses

  • Namespace=root\ccm
  • ExpectedClasses=CCM_Client,CCM_Authority,SMS_Client

TriggerTemplate-IntervalHours

  • Interval Hours=6

1E-GuaranteedState-ClientHealth-PreCondition-ConfigMgrClient

  • No parameters
Check ConfigMgr Discovery data collection cycles
CheckCheck that the ConfigMgr heartbeat discovery record has been reported in the last seven days.

1E-GuaranteedState-MSSCCMClientHealth-Check-ConfigMgrLastDiscoveryInv

  • Days Threshold=7

TriggerTemplate-IntervalHours

  • Interval Hours=24

1E-GuaranteedState-ClientHealth-PreCondition-ConfigMgrClient

  • No parameters
Check ConfigMgr Policy Retrieval
CheckCheck the ConfigMgr client has validated a machine policy from a management point in the last seven days.

1E-GuaranteedState-MSSCCMClientHealth-Check-PolicyRetrieval

  • Days Threshold=7

TriggerTemplate-IntervalHours

  • Interval Hours=24

1E-GuaranteedState-ClientHealth-PreCondition-ConfigMgrClient

  • No parameters
Check ConfigMgr Software inventory
CheckCheck that the ConfigMgr client has reported software inventory data in last seven days.

1E-GuaranteedState-MSSCCMClientHealth-Check-ConfigMgrLastSoftwareInv

  • Days Threshold=7

TriggerTemplate-IntervalHours

  • Interval Hours=24

1E-GuaranteedState-ClientHealth-PreCondition-ConfigMgrClient

  • No parameters
Ensure ConfigMgr client is running

(new in 5.0)

FixEnsure the ConfigMgr client service (CCMExec) is running.

1E-GuaranteedState-MSSCCMClientHealth-Fix-StartConfigMgrClientService

  • No parameters

TriggerTemplate-ServiceStatusChange

  • Service Name=ccmexec

1E-GuaranteedState-ClientHealth-PreCondition-ConfigMgrClient

  • No parameters

Fragments

The Parameters column in the following table shows the ranges and default values for the parameters. The default values are used when you create custom rules using these fragments, unless you select alternative values.

NameTypeReadable Payload and summaryParameters
1E-GuaranteedState-ClientHealth-PreCondition-ConfigMgrClient
Precondition

Run if the ConfigMgr client is installed

Uses the Device.GetSummary method to determine if the device is running Windows.

Uses the OperatingSystem.GetServiceInfo method to determine if the ConfigMgr client service (ccmexec) is installed, although not necessirily running.

No parameters
1E-GuaranteedState-ClientHealth-Check-ConfigMgrClientCacheUsage
Check

Check the ConfigMgr client cache has not exceeded more than <cacheUseThresholdPercent>% of its quota.

This fragment checks the root\CCM\SoftMgmtAgent WMI namespace and executes the query "SELECT * FROM CacheConfig" in order to retrieve Configuration Manager cache usage.

It will report an error if the WMI namespace does not exist on the device - typically, because the Configuration Manager client is not installed.

CacheUseThresholdPercent

  • 0 to 99, default 90.
1E-GuaranteedState-ClientHealth-Check-ConfigMgrLastHardwareInv
Check

Check the ConfigMgr client has reported a hardware inventory in a given time period

This fragment checks the root\CCM\InvAgt namespace and executes the query "SELECT * FROM InventoryActionStatus WHERE InventoryActionId = '{00000000-0000-0000-0000-000000000001}'" in order to retrieve the last hardware inventory date.

It then compares it with a DaysThreshold parameter. If the last hardware inventory date is older than this threshold, the fragment will return compliance failure.

It will report an error if the WMI namespace does not exist on the device (typically because the Configuration Manager client is not installed).

DaysThreshold

  • 0 to 99, default 7


1E-GuaranteedState-ClientHealth-Check-WmiExpectedClasses
Check

Check that WMI namespace <namespace> contains classes: <expectedClasses>

ExpectedClasses is a comma-delimited list of WMI class names.

This fragment checks to see if the specified class names exist within the WMI namespace specified. It will return a compliance failure if any class names do not exist in the namespace, regardless of whether or not the namespace is valid.

The "data" column in the returned schema will enumerate any missing classnames in the form "The following WMI classes are missing: <list>" where <list> is the comma-separated list of class names that cannot be found in the WMI namespace

If all classes are found in the namespace and the namespace is valid, then the Data column contains the message 'All expected WMI classes exist'.

Example: WMI namespace = "root\cimv2", class list = Win32_DeviceChangeEvent should return success as the single class in the list is present in the namespace.

Namespace

  • default empty

ExpectedClasses

  • default empty
1E-GuaranteedState-General-Check-ServiceState
Check

Check that service "<ServiceName>" is <State>

This fragment checks that the specified service is in the specified state. The <State> parameter is a value picker with the choices Running and Stopped. You specify the service by its short name.

You can determine the short name of a service using the PowerShell cmdlet

get-service -DisplayName "Network Location Awareness"

This will return NlaSvc in the above example. It is this short name you specify in the <ServiceName> parameter

ServiceName

  • default empty

State

  • Running
  • Stopped
1E-GuaranteedState-MSSCCMClientHealth-Check-ConfigMgrLastDiscoveryInv
Check

Check the ConfigMgr client has reported a discovery inventory in the last <daysThreshold> days.

This fragment checks the root\CCM\InvAgt namespace and executes the query "SELECT * FROM InventoryActionStatus WHERE InventoryActionId = '{00000000-0000-0000-0000-000000000003}'" in order to retrieve the last discovery inventory date.

It then compares it with a <daysThreshold> parameter. If the last discovery inventory date is older than this threshold, the fragment will return compliance failure.

It will report an error if the WMI namespace does not exist on the device (typically because the Configuration Manager client is not installed)

daysThreshold

  • 0 to 9, default 7
1E-GuaranteedState-MSSCCMClientHealth-Check-ConfigMgrLastSoftwareInv
Check

Check the ConfigMgr client has reported a software inventory in the last <daysThreshold> days.

This fragment checks the root\CCM\InvAgt namespace and executes the query "SELECT * FROM InventoryActionStatus WHERE InventoryActionId = '{00000000-0000-0000-0000-000000000002}'" in order to retrieve the last software inventory date.

It then compares it with a <daysThreshold> parameter. If the last software inventory date is older than this threshold, the fragment will return compliance failure.

It will report an error if the WMI namespace does not exist on the device (typically because the Configuration Manager client is not installed)

daysThreshold

  • 0 to 9, default 7
1E-GuaranteedState-MSSCCMClientHealth-Check-PolicyRetrieval
Check

Check the ConfigMgr client has validated a machine policy in the last <daysThreshold> days.

This fragment checks the root\CCM\Scheduler namespace and executes the query ""SELECT * FROM CCM_Scheduler_History WHERE ScheduleID = '{00000000-0000-0000-0000-000000000042}'" in order to retrieve the schedule history.

It then compares it with the <daysThreshold> parameter. If the most recent scheduler history date is older than this threshold, the fragment will return compliance failure.

It will report an error if the WMI namespace does not exist on the device (typically because the Configuration Manager client is not installed)

daysThreshold

  • 0 to 9, default 7
1E-GuaranteedState-MSSCCMClientHealth-Fix-StartConfigMgrClientService
Fix

Start the ConfigMgr client service

This fragment starts the ccmexec service. An error is returned if the service is not present (typically due to the Configuartion Manager client not being installed on the device).

Not used by any policy rules by default.

No parameters

Trigger templates

The following table shows the trigger templates included in the Nomad Client Health Integrated Product Pack.

The Parameters column in the following table shows the ranges and default values for the parameters. The default values are used when you create custom rules using these templates, unless you select alternative values.

NameReadable Payload and summaryParameters
TriggerTemplate-IntervalHours

Every <intervalHours> hours

Periodic (hours)

Interval Hours

  • 0 to 999 hours (approximately 42 days), default interval is 12 hours.
TriggerTemplate-IntervalMinutes

Every <intervalMinutes> minutes

Periodic (minutes)

Interval Minutes

  • 0 to 99,999 minutes (approximately 69 days), default interval is 30 minutes.
TriggerTemplate-IntervalSeconds

Every <intervalSeconds> seconds

Periodic (seconds)

Interval Seconds

  • 0 to 999,999 seconds (approximately 11 days), default interval is 3600 seconds (1 hour).
TriggerTemplate-ServiceStatusChange

On change of running state of the "<serviceName>" service

When the state of the named Windows service changes

You can determine the short name of a service using the PowerShell cmdlet

get-service -DisplayName "Network Location Awareness"

This will return NlaSvc in the above example. It is this short name you specify in the <ServiceName> parameter.

Service Name

  • Short name of service - for example NomadBranch.