Endpoint Protection won't run from SCCM

I go to my test device collection in sccm 2012 r2 --> right click --> Endpoint Protection --> Full Scan

I checked on the client computer, the endpoint was not running.

I waited for awhile and checked it again --> still same no action.

I checked in sccm Monitoring --> client operations --> Full Scan task went grayed out with expired status. It has client (1), success (0), Failed (0), Offline (1), Unknown (0).

That computer was not offline. Did I miss or doing anything wrong here? Please advise. I need to scan about 35 computers in other city office.

Thanks in advance!

January 29th, 2015 9:58pm

Hi,

Make sure that the clients can communicate with the MP on port 10123 which is the port used for the "fast channel" that is used. you can also check on the MP or client using Netstat that the client in question is connected to the MP over that port. that is where I would start.

Regards,
Jrgen 

Free Windows Admin Tool Kit Click here and download it now
January 30th, 2015 12:44am

I netstat on the MP and found TCP 10123 was there Listening.

I telnet form the client computer to MP server with that port and it went in.

One other thing I have been noticing is - the CCM Notification Agent which is at Disabled status on client computers. I don't know if that causing it.

Please advise. Thanks!

January 30th, 2015 1:55am

Hi,

>>the CCM Notification Agent which is at Disabled status on client computers.

This could be the cause. Is there any information in CcmNotificationAgent.log on the client?

You could also check the blog below.

Fast Channel for System Management - Client Notification in System Center 2012 Configuration Manager SP1

http://blogs.technet.com/b/configmgrteam/archive/2012/09/27/fast-channel-for-system-management.aspx

Best Regards,

Joyce

Free Windows Admin Tool Kit Click here and download it now
January 30th, 2015 12:23pm

I did go through that great technet blog page. I have all the settings in place but whenever I tried to right click on the computer in the console - Client Notification - Download Computer Policy, I receive the error "The client you selected is not online. Click OK to send the notification or click Cancel."

I always been noticing CCM Notification Agent in client applet which is at Disabled status. Thanks for letting me know that is major portion involves in this case.

The highlighted items in the CcmNotificationAgent.log are:

Bgb client agent is disabled

TCP Listener is disabled.

I am researching online for the similar topics but still haven't found the solution yet.

Thanks



  • Edited by Mecoy Friday, January 30, 2015 8:47 PM
January 30th, 2015 11:46pm

Hi,

Have you checked the General Actions and Site tab in Configuration Manager Properties? Do they show correctly as a working client?

Please also check the client health via logs, such as CcmExec.log, CcmEval.log.

Best Regards,

Joyce

Free Windows Admin Tool Kit Click here and download it now
February 2nd, 2015 6:10am

Everything under General and Actions tab are fine. All the items listed. The correct version 5.00.7958.1401 shows under General Tab.  All 9 actions listed under Action Tab. Software pushes and remote have been working well too. For some reasons, components under Components Tab show with two different versions. CCM Framework has the correct recent version but the CCM Policy Agent shows with earlier version 5.00.7958.1000 differently and CCM Notification Agent is also with that earlier version and status is disabled.

 Here are the CcmExec.log and CcmEval.log where I excluded some duplicate lines to keep them short here -

CcmExec.log
Notifying endpoint 'updatesmgr' of __InstanceDeletionEvent settings change on object SMS_MaintenanceTaskRequests.TaskID="{1CE74123-2121-512B-7745-12CBBE74ABF4A}" for user 'S-1-5-18'.
CCMEXEC 2/1/2015 23:17
608 (0x0260)
 *** System is now free to go to sleep CcmExec
2/1/2015 23:17 3088 (0x0C10)
 Notifying endpoint 'ExternalEventAgent' of __InstanceModificationEvent settings change on object AntimalwareHealthStatus=@ for user 'S-1-5-18'.
CCMEXEC 2/1/2015 23:19
608 (0x0260)
 No logged on cached user during monitor task, trying to select.
CcmExec 2/1/2015 23:21
4968 (0x1368)
 Notifying endpoint 'ExternalEventAgent' of __InstanceModificationEvent settings change on object AntimalwareHealthStatus=@ for user 'S-1-5-18'.
CCMEXEC 2/2/2015 0:19
4340 (0x10F4)
 *** Keep the system awake CcmExec
2/2/2015 0:20 4536 (0x11B8)
 Notifying endpoint 'updatesmgr' of __InstanceModificationEvent settings change on object SMS_MaintenanceTaskRequests.TaskID="{1CE74123-2121-512B-7745-12CBBE74ABF4A}" for user 'S-1-5-18'.
CCMEXEC 2/2/2015 0:21
4532 (0x11B4)
 No logged on cached user during monitor task, trying to select.
CcmExec 2/2/2015 0:21
4152 (0x1038)
 Notifying endpoint 'ExternalEventAgent' of __InstanceModificationEvent settings change on object AntimalwareHealthStatus=@ for user 'S-1-5-18'.
CCMEXEC 2/2/2015 0:21
2960 (0x0B90)
 CancelTask failed with error 87d00215 CcmExec
2/2/2015 0:22 2504 (0x09C8)
 Notifying endpoint 'ExternalEventAgent' of __InstanceModificationEvent settings change on object AntimalwareHealthStatus=@ for user 'S-1-5-18'.
CCMEXEC 2/2/2015 0:22
2960 (0x0B90)
 Notifying endpoint 'updatesmgr' of __InstanceDeletionEvent settings change on object SMS_MaintenanceTaskRequests.TaskID="{1CE74123-2121-512B-7745-12CBBE74ABF4A}" for user 'S-1-5-18'.
CCMEXEC 2/2/2015 0:22
2960 (0x0B90)
 *** System is now free to go to sleep CcmExec
2/2/2015 0:22 4536 (0x11B8)
 Notifying endpoint 'ExternalEventAgent' of __InstanceModificationEvent settings change on object AntimalwareHealthStatus=@ for user 'S-1-5-18'.
CCMEXEC 2/2/2015 0:23
2960 (0x0B90)
 No logged on cached user during monitor task, trying to select.
CcmExec 2/2/2015 0:31
4776 (0x12A8)
 Notifying endpoint 'ExternalEventAgent' of __InstanceModificationEvent settings change on object AntimalwareHealthStatus=@ for user 'S-1-5-18'.
CCMEXEC 2/2/2015 0:43
4476 (0x117C)
 No logged on cached user during monitor task, trying to select.
CcmExec 2/2/2015 0:51
3752 (0x0EA8)
 Notifying endpoint 'ExternalEventAgent' of __InstanceModificationEvent settings change on object AntimalwareHealthStatus=@ for user 'S-1-5-18'.
CCMEXEC 2/2/2015 0:58
4992 (0x1380)
 No logged on cached user during monitor task, trying to select.
CcmExec 2/2/2015 1:01
3988 (0x0F94)
 *** Keep the system awake CcmExec
2/2/2015 2:14 1728 (0x06C0)
 *** System is now free to go to sleep CcmExec
2/2/2015 2:15 1728 (0x06C0)
 Notifying endpoint 'EndpointProtectionAgent' of __InstanceModificationEvent settings change on object CCM_AntiMalwarePolicyPlaceHolder.SiteSettingsKey="{5e88e693-0fae-4fcc-9a5a-864a626d88de}" for user 'S-1-5-18'.
CCMEXEC 2/2/2015 2:15
1312 (0x0520)
 No logged on cached user during monitor task, trying to select.
CcmExec 2/2/2015 2:21
4620 (0x120C)
 Notifying endpoint 'ExternalEventAgent' of __InstanceModificationEvent settings change on object AntimalwareHealthStatus=@ for user 'S-1-5-18'.
CCMEXEC 2/2/2015 3:12
3880 (0x0F28)
 No logged on cached user during monitor task, trying to select.
CcmExec 2/2/2015 3:21
4708 (0x1264)
 Notifying endpoint 'ExternalEventAgent' of __InstanceModificationEvent settings change on object AntimalwareHealthStatus=@ for user 'S-1-5-18'.
CCMEXEC 2/2/2015 7:42
1568 (0x0620)
 No logged on cached user during monitor task, trying to select.
CcmExec 2/2/2015 7:51
4172 (0x104C)
 Added CCM (user, session) is: (S-1-5-21-57989841-261478967-725345543-46592,2).
CCMEXEC 2/2/2015 8:09
2376 (0x0948)
 New CCM (user, session) is: (S-1-5-21-57989841-261478967-725345543-46592,2).
CCMEXEC 2/2/2015 8:09
2376 (0x0948)
 SystemTaskProcessor::QueueEvent(Logon, 0) CCMEXEC
2/2/2015 8:09 2376 (0x0948)
 BEGIN ExecuteSystemTasks('Logon') CcmExec
2/2/2015 8:09 2376 (0x0948)
 Invoking system task 'FileBITSLogon' via ICcmSystemTask2 interface.
CcmExec 2/2/2015 8:09
3048 (0x0BE8)
 Invoking system task 'ExecmgrLogon' via ICcmSystemTask2 interface.
CcmExec 2/2/2015 8:09
3048 (0x0BE8)
 Invoking system task 'SchedulerLogon' via ICcmSystemTask2 interface.
CcmExec 2/2/2015 8:09
3048 (0x0BE8)
 Invoking system task 'SrcUpdateLogon' via ICcmSystemTask2 interface.
CcmExec 2/2/2015 8:09
3048 (0x0BE8)
 Invoking system task 'UserAffinityTaskLogon' via ICcmSystemTask2 interface.
CcmExec 2/2/2015 8:09
3048 (0x0BE8)
 Invoking system task 'DTSLogon' via ICcmSystemTask2 interface.
CcmExec 2/2/2015 8:09
3952 (0x0F70)
 Invoking system task 'SCUpdateMgrLogOn' via ICcmSystemTask2 interface.
CcmExec 2/2/2015 8:09
2648 (0x0A58)
 Invoking system task 'PolicyEvaluator_Logon' via ICcmSystemTask2 interface.
CcmExec 2/2/2015 8:09
2648 (0x0A58)
 Invoking system task 'RebootCoordLogon' via ICcmSystemTask2 interface.
CcmExec 2/2/2015 8:09
4052 (0x0FD4)
 Invoking system task 'PwrAgentLogonTask'. CcmExec
2/2/2015 8:09 2648 (0x0A58)
 Invoking system task 'UpdatesDeploymentLogonTask' via ICcmSystemTask2 interface.
CcmExec 2/2/2015 8:09
4648 (0x1228)
 Invoking system task 'DCMAgent_Logon' via ICcmSystemTask2 interface.
CcmExec 2/2/2015 8:09
4648 (0x1228)
 Invoking system task 'SCLogOn' via ICcmSystemTask2 interface.
CcmExec 2/2/2015 8:09
4052 (0x0FD4)
 END ExecuteSystemTasks('Logon') CcmExec
2/2/2015 8:09 2376 (0x0948)
 Check and install Wakeup Proxy hotfix CcmExec
2/2/2015 8:10 4648 (0x1228)
 Retry Wakeup Proxy install/uninstall #1 CcmExec
2/2/2015 8:10 4648 (0x1228)
 Wakeup Proxy disabled, service not installed -> Remove timer
CcmExec 2/2/2015 8:10
4648 (0x1228)
 Sending State Message with topic type = 2100, state id = 1, run state = 0, and error code = 0x73934428
CcmExec 2/2/2015 8:10
4648 (0x1228)
 Skip sending state message due to same state message already exists.
CcmExec 2/2/2015 8:10
4648 (0x1228)
 Notifying endpoint 'ExternalEventAgent' of __InstanceModificationEvent settings change on object AntimalwareHealthStatus=@ for user 'S-1-5-18'.
CCMEXEC 2/2/2015 8:10
3256 (0x0CB8)
 *** Keep the system awake CcmExec
2/2/2015 8:10 4648 (0x1228)
 *** System is now free to go to sleep CcmExec
2/2/2015 8:10 4648 (0x1228)

(I tried on multiple computer in the day time so I know they are not at asleep)

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

CcmEval.log
==========[ ccmeval started in process 3636 ]====================================
CcmEval 2/2/2015 12:58:26 AM
4464 (0x1170)
 ccmeval version: 5.0.7958.1000 CcmEval
2/2/2015 12:58:26 AM 4464 (0x1170)
 Loading manifest file: C:\WINDOWS\CCM\CcmEval.xml  CcmEval 2/2/2015 12:58:26 AM
4464 (0x1170)
 Successfully loaded ccmeval manifest file. CcmEval
2/2/2015 12:58:26 AM 4464 (0x1170)
 Begin evaluating client health rules. CcmEval
2/2/2015 12:58:26 AM 4464 (0x1170)
 Successfully retrieved all client health checks.  CcmEval 2/2/2015 12:58:26 AM
4464 (0x1170)
 Evaluating health check rule {4AB7D77D-3BB0-4EAB-BEFD-7C0F7DA10296} : Verify WMI service exists.
CcmEval 2/2/2015 12:58:26 AM
4464 (0x1170)
 Evaluating health check rule {518C0699-03F8-4F38-85C4-4D319EAEFC05} : Verify/Remediate WMI service startup type.
CcmEval 2/2/2015 12:58:26 AM
4464 (0x1170)
 Evaluating health check rule {7F4B6E15-2221-455B-9615-93C379E470D5} : Verify/Remediate WMI service status.
CcmEval 2/2/2015 12:58:26 AM
4464 (0x1170)
 Evaluating health check rule {14E6774A-1795-4E09-B17D-B6F36A124205} : WMI Repository Read/Write Test.
CcmEval 2/2/2015 12:58:26 AM
4464 (0x1170)
 Evaluating health check rule {690A959D-6210-4930-865F-E3BB82F02133} : Verify/Remediate client WMI provider.
CcmEval 2/2/2015 12:58:28 AM
4464 (0x1170)
 Evaluating health check rule {A81778B5-9A1E-4A52-9C6E-6939CEFAA118} : WMI Repository Integrity Test.
CcmEval 2/2/2015 12:58:29 AM
4464 (0x1170)
 Evaluating health check rule {5CC6C949-5001-4765-84B4-DD4FDC1E6940} : Verify BITS exists.
CcmEval 2/2/2015 12:58:29 AM
4464 (0x1170)
 Evaluating health check rule {C6E29CF5-F9B2-450B-AE61-C4B256A75023} : Verify/Remediate BITS startup type.
CcmEval 2/2/2015 12:58:29 AM
4464 (0x1170)
 Evaluating health check rule {2F373187-6295-4CBB-BE9E-8E43C459883A} : Verify/Remediate client prerequisites.
CcmEval 2/2/2015 12:58:29 AM
4464 (0x1170)
 Evaluating health check rule {AD9CAF50-6602-4857-A9F4-64864EA30BDF} : Verify/Remediate client installation.
CcmEval 2/2/2015 12:58:30 AM
4464 (0x1170)
 Evaluating health check rule {8883C683-04C8-4228-BB76-2EDD666BA781} : Verify SMS Agent Host service exists.
CcmEval 2/2/2015 12:58:30 AM
4464 (0x1170)
 Evaluating health check rule {13F46523-5B82-417d-A363-A644E80CAD76} : Verify/Remediate SMS Agent Host service startup type.
CcmEval 2/2/2015 12:58:30 AM
4464 (0x1170)
 Evaluating health check rule {70BECB51-44A1-4b46-8A23-6EA3D345B677} : Verify/Remediate SMS Agent Host service status.
CcmEval 2/2/2015 12:58:30 AM
4464 (0x1170)
 Evaluating health check rule {C35E790D-4C05-40A8-BB46-A68578966D19} : WMI Event Sink Test.
CcmEval 2/2/2015 12:58:30 AM
4464 (0x1170)
 Evaluating health check rule {0614757F-7AA6-4933-965B-06D6A8243D0B} : Microsoft Policy Platform WMI Integrity Test.
CcmEval 2/2/2015 12:58:30 AM
4464 (0x1170)
 Evaluating health check rule {7EF00FDD-3DF0-496A-A999-AADD1B3016C1} : Verify/Remediate Microsoft Policy Platform Service Existence.
CcmEval 2/2/2015 12:58:30 AM
4464 (0x1170)
 Evaluating health check rule {D9D0245D-0617-4C2F-8837-84A397AC5B22} : Verify/Remediate Microsoft Policy Platform service startup type.
CcmEval 2/2/2015 12:58:30 AM
4464 (0x1170)
 Evaluating health check rule {09886543-BE8B-431F-BC00-7D917632E22C} : Verify/Remediate Antimalware service startup type.
CcmEval 2/2/2015 12:58:30 AM
4464 (0x1170)
 Evaluating health check rule {5B50566C-363E-4F1C-8A7D-6F2D2A51B142} : Verify/Remediate Antimalware service status.
CcmEval 2/2/2015 12:58:30 AM
4464 (0x1170)
 Evaluating health check rule {6BC824B4-BD8C-4779-BB10-ABDBCD5AFAEB} : Verify/Remediate Network Inspection service startup type.
CcmEval 2/2/2015 12:58:30 AM
4464 (0x1170)
 Evaluating health check rule {D6CB32EA-423D-44CB-9C58-97CE55D2148E} : Verify/Remediate Windows Update service startup type.
CcmEval 2/2/2015 12:58:30 AM
4464 (0x1170)
 Evaluating health check rule {E8030BE0-B773-4742-B6A1-0870CF139117} : Verify/Remediate Windows Update service startup type on Windows 8.
CcmEval 2/2/2015 12:58:30 AM
4464 (0x1170)
 Result: Not Applicable, ResultCode: 0, ResultType: 0, ResultDetail:
CcmEval 2/2/2015 12:58:30 AM
4464 (0x1170)
 Evaluating health check rule {9040BA8C-580D-4FCA-8846-BBD5F5BB1597} : Verify/Remediate Configuration Manager Remote Control service startup type.
CcmEval 2/2/2015 12:58:30 AM
4464 (0x1170)
 Evaluating health check rule {9DCD49EF-E021-46FF-A777-49210B558527} : Verify/Remediate Configuration Manager Remote Control service status.
CcmEval 2/2/2015 12:58:30 AM
4464 (0x1170)
 Evaluating health check rule {934F12E3-295E-4BA0-AE0F-09859685720F} : Verify/Remediate Configuration Manager Proxy service startup type.
CcmEval 2/2/2015 12:58:30 AM
4464 (0x1170)
 Result: Not Applicable, ResultCode: 0, ResultType: 0, ResultDetail:
CcmEval 2/2/2015 12:58:30 AM
4464 (0x1170)
 Evaluating health check rule {43029EED-EB9D-4E35-A5F7-7FDD93EC8C57} : Verify/Remediate Configuration Manager Proxy service status.
CcmEval 2/2/2015 12:58:30 AM
4464 (0x1170)
 Result: Not Applicable, ResultCode: 0, ResultType: 0, ResultDetail:
CcmEval 2/2/2015 12:58:30 AM
4464 (0x1170)
 Evaluating health check rule {7B9F8FF6-EDF7-42CA-A67F-073A2E161C19} : Verify/Remediate SQL CE database is healthy.
CcmEval 2/2/2015 12:58:30 AM
4464 (0x1170)
 Successfully evaluated all client health rules.  CcmEval 2/2/2015 12:58:30 AM
4464 (0x1170)
 Client is set to use HTTPS when available. The current state is 224.
CcmEval 2/2/2015 12:58:30 AM
4464 (0x1170)
 Client is set to use HTTPS when available. The current state is 224.
CcmEval 2/2/2015 12:58:30 AM
4464 (0x1170)
 Raising event:

 instance of CCM_CcmHttp_Status
 {
ClientID = "GUID:491cdbc1-4214-2c3a-cb4b-fa174c421cfa";
DateTime = "20150202085831.004000+000";
HostName = "siteserver.company.com";
HRESULT = "0x00000000";
ProcessID = 3636;
StatusCode = 0;
ThreadID = 4464;
 };
CcmEval  2/2/2015 12:58:31 AM 4464 (0x1170)
 Client's current MP is http://siteserver.company.com and is accessible
CcmEval 2/2/2015 12:58:31 AM
4464 (0x1170)
 MP check succeeded CcmEval
2/2/2015 12:58:31 AM 4464 (0x1170)
 Send previous report if needed. CcmEval
2/2/2015 12:58:31 AM 4464 (0x1170)
 Previous report was successfully sent, no need to resend.
CcmEval 2/2/2015 12:58:31 AM
4464 (0x1170)
 Previous site code CRT, current site code CRT  CcmEval 2/2/2015 12:58:31 AM
4464 (0x1170)
 Report is built but not necessary to send CcmEval
2/2/2015 12:58:31 AM 4464 (0x1170)
 ==========[ ccmeval finished normally in process 3636 ]==========================
CcmEval 2/2/2015 12:58:31 AM
4464 (0x1170)

Thanks

  • Edited by Mecoy 8 hours 1 minutes ago
February 2nd, 2015 11:51am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics