Automatic Uninstall of Packages

A common method of application deployment is to configure a collection to query an AD group and treat the members as members of the collection.

Logically if a resource is no longer in a group then the software should be removed.  This allows the AD group to be an accurate indicator of the number of installations.

In SCCM, installation deployments override uninstall deployments.  This fact can be used to easily make an uninstall configuration arrangement which can be incorporated into the standard for the setup of the original deployment configuration.  Of course, it can also be be applied retrospectively if necessary.

The install deployment is deployed to the install collection.  Any collection membership method can be used.  The uninstall deployment is deployed to the uninstall collection.  The uninstall collection members is set to a very wide collection such as All Workstations but it also includes an exclude of the install collection.

calling SCCM actions

Codes for triggering SCCM client actions

Application Deployment Evaluation Cycle
Discovery Data Collection Cycle
File Collection Cycle
Hardware Inventory Cycle
Machine Policy Retrieval Evaluation Cycle
Software Inventory Cycle
Software Updates Deployment Evaluation Cycle
Software Updates Scan Cycle
User Policy Retrieval Evaluation Cycle

Trigger Codes:

{00000000-0000-0000-0000-000000000001} Hardware Inventory
{00000000-0000-0000-0000-000000000002} Software Inventory
{00000000-0000-0000-0000-000000000003} Discovery Inventory
{00000000-0000-0000-0000-000000000010} File Collection
{00000000-0000-0000-0000-000000000011} IDMIF Collection
{00000000-0000-0000-0000-000000000012} Client Machine Authentication
{00000000-0000-0000-0000-000000000021} Request Machine Assignments
{00000000-0000-0000-0000-000000000022} Evaluate Machine Policies
{00000000-0000-0000-0000-000000000023} Refresh Default MP Task
{00000000-0000-0000-0000-000000000024} LS (Location Service) Refresh Locations Task
{00000000-0000-0000-0000-000000000025} LS (Location Service) Timeout Refresh Task
{00000000-0000-0000-0000-000000000026} Policy Agent Request Assignment (User)
{00000000-0000-0000-0000-000000000027} Policy Agent Evaluate Assignment (User)
{00000000-0000-0000-0000-000000000031} Software Metering Generating Usage Report
{00000000-0000-0000-0000-000000000032} Source Update Message
{00000000-0000-0000-0000-000000000037} Clearing proxy settings cache
{00000000-0000-0000-0000-000000000040} Machine Policy Agent Cleanup
{00000000-0000-0000-0000-000000000041} User Policy Agent Cleanup
{00000000-0000-0000-0000-000000000042} Policy Agent Validate Machine Policy / Assignment
{00000000-0000-0000-0000-000000000043} Policy Agent Validate User Policy / Assignment
{00000000-0000-0000-0000-000000000051} Retrying/Refreshing certificates in AD on MP
{00000000-0000-0000-0000-000000000061} Peer DP Status reporting
{00000000-0000-0000-0000-000000000062} Peer DP Pending package check schedule
{00000000-0000-0000-0000-000000000063} SUM Updates install schedule
{00000000-0000-0000-0000-000000000071} NAP action
{00000000-0000-0000-0000-000000000101} Hardware Inventory Collection Cycle
{00000000-0000-0000-0000-000000000102} Software Inventory Collection Cycle
{00000000-0000-0000-0000-000000000103} Discovery Data Collection Cycle
{00000000-0000-0000-0000-000000000104} File Collection Cycle
{00000000-0000-0000-0000-000000000105} IDMIF Collection Cycle
{00000000-0000-0000-0000-000000000106} Software Metering Usage Report Cycle
{00000000-0000-0000-0000-000000000107} Windows Installer Source List Update Cycle
{00000000-0000-0000-0000-000000000108} Software Updates Assignments Evaluation Cycle
{00000000-0000-0000-0000-000000000109} Branch Distribution Point Maintenance Task
{00000000-0000-0000-0000-000000000110} DCM policy
{00000000-0000-0000-0000-000000000111} Send Unsent State Message
{00000000-0000-0000-0000-000000000112} State System policy cache cleanout
{00000000-0000-0000-0000-000000000113} Scan by Update Source
{00000000-0000-0000-0000-000000000114} Update Store Policy
{00000000-0000-0000-0000-000000000115} State system policy bulk send high
{00000000-0000-0000-0000-000000000116} State system policy bulk send low
{00000000-0000-0000-0000-000000000120} AMT Status Check Policy
{00000000-0000-0000-0000-000000000121} Application manager policy action
{00000000-0000-0000-0000-000000000122} Application manager user policy action
{00000000-0000-0000-0000-000000000123} Application manager global evaluation action
{00000000-0000-0000-0000-000000000131} Power management start summarizer
{00000000-0000-0000-0000-000000000221} Endpoint deployment reevaluate
{00000000-0000-0000-0000-000000000222} Endpoint AM policy reevaluate
{00000000-0000-0000-0000-000000000223} External event detection

Reference
https://blogs.technet.microsoft.com/charlesa_us/2015/03/07/triggering-configmgr-client-actions-with-wmic-without-pesky-right-click-tools/



keywords
trigger

SCCM Versions

https://www.systemcenterdudes.com/sccm-2012-version-numbers/

Release Dates

https://en.wikipedia.org/wiki/Microsoft_System_Center_Configuration_Manager

keywords
SCCM Version Versions

SCCM 2012 Configuration Manger Console may require the MDT

Could not load file or assembly file:///C:\Program Files (6)\Microsoft Configuration Manager\AdminConsole\bin\Microsoft,BDD.CM12.Actions.dll’ or one of its dependencies. The system cannot find the file specified.

The above occurs because files named Microsoft.BDD* are not present. These are not installed by the SCCM Admin Console installation but by the Microsoft Deployment Toolkit (MDT). The files then have to be copied over to the required folder shown in the error message

SCCM 2012 boundary groups

Several logs including this one http://www.trailingreboot.com/?p=60 suggest using one boundary group containing all ip subnet boundaries to do site assignment, then use additional boundary groups to define site servers (distribution points DPs) for ip subnets.

SCCM 2012 General

SCCM versions
http://blogs.technet.com/b/configmgrdogs/archive/2014/04/11/configmgr-2012-version-numbers.aspx

http://blogs.technet.com/b/neilp/archive/2013/03/28/determine-if-cu1-has-been-appropriately-applied-to-a-2012-configuration-manager-2012-sp1-site-admin-console-and-client-old.aspx

Management Point Affinity (CU3)
http://blogs.technet.com/b/jchalfant/archive/2014/09/22/management-point-affinity-added-in-configmgr-2012-r2-cu3.aspx

Note that with a Management point (MP) configuration in CU3,  restarting the SMS Agent Host service will cause the assigned MP to cycle round to the next value.

CU3 link
http://support.microsoft.com/kb/2994331

SCCM Client Installation Command Line parameters CCMSETUP.EXE
https://technet.microsoft.com/en-us/library/gg699356.aspx

Deploying SCCM updates
http://technet.microsoft.com/en-us/library/jj553405.aspx

SCCM 2012 Ports
http://technet.microsoft.com/en-us/library/hh427328.aspx


If packages are not downloading to the cache as expected, check the CAS.log file to verify the valid DPs have been identified.

CAS.log entries like "The number of discovered DPs(including Branch DP and Multicast) is 0"
and
ContentTransferManager.log entries like "Received empty location update for CTM job..."

These messages may indicate that the client is operating in a network location where no boundary group has been assigned!

SCCM 2012 Detection Methods

Be careful with the SCCM 2012 Detection Method.  It uses a similar WMI query to below to determine whether the specified ProductCode GUID is present on a machine.  If something somewhere does not match up it will play havoc with your deployments especially if this is incorrectly specified for prerequisite packages.

powershell command

Get-WmiObject -Namespace root\ccm\CIModels -Class CCM_MSIProduct | Sort-Object ProductName |Format-Table ProductName,ProductCode,ProductVersion


Spoofing Detection

It is possible to fool SCCM into thinking that an MSI in installed when it is not.  Effectively, this spoofs the SCCM MSI detection.

To do this you need to identify the remixed product code GUID that is used in the registry.  e.g.
This product code guid
{BD2F44B4-985B-4CCA-A4E7-A2B0AE45442B}
is remixed (rehashed?) to
4B44F2DBB589ACC44A7E2A0BEA5444B2
The coloring shows the related sections of the GUID and how they are remixed.


Install the MSI that SCCM is trying to detect on to a test machine.
Export the following registry keys to separate reg files.

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\<remixed GUID>

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\<remixed GUID>

Importing the above keys to a target machine will fool SCCM into thinking the MSI is installed.

These keys (x64) control the display in Programs and Features but they are not needed for detection spoofing.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BD2F44B4-985B-4CCA-A4E7-A2B0AE45442B}


Slightly odd:  If the spoofing keys are in place and you run a manual install from the same source specified in the spoof keys, then Windows Installer performs an UNINSTALL

The same install  command run again then runs an INSTALL.

SCCM 2012 Client Tools

System Center 2012 R2 Configuration Manager Toolkithttp://www.microsoft.com/en-gb/download/details.aspx?id=36213

Client Center for ConfigurationManager

https://github.com/rzander/sccmclictr

SCCM 2012 and its client logs.

Abbreviated List of SCCM 2012 Client log files - see technet link below for full list.

Technical Reference for Log Files in Configuration Managerhttp://technet.microsoft.com/en-us/library/hh427342.aspx#BKMK_ClientLogs

AppIntentEval.log 
Records details about the current and intended state of applications, their applicability, whether requirements were met, deployment types, and dependencies.

AppDiscovery.log 
Records details about the discovery or detection of applications on client computers.

AppEnforce.log 
Records details about enforcement actions (install and uninstall) taken for applications on the client. 

CAS.log
Content Access service. Maintains the local package cache on the client.

Ccm32BitLauncher.log
Records actions for starting applications on the client marked as "run as 32bit".

CcmEval.log
Records Configuration Manager client status evaluation activities and details for components that are required by the Configuration Manager client.

CcmEvalTask.log
Records the Configuration Manager client status evaluation activities that are initiated by the evaluation scheduled task.

CcmExec.log
Records activities of the client and the SMS Agent Host service. This log file also includes information about enabling and disabling wake-up proxy.

CcmMessaging.log
Records activities related to communications between the client and management points.

Ccmsdkprovider.log
Records the activities of the application management SDK.

CcmRestart.log
Records client service restart activity.

CIDownloader.log
Records details about configuration item definition downloads.

CITaskMgr.log
Records tasks that are initiated for each application and deployment type, such as content download or install or uninstall actions.

ClientAuth.log
Records the signing and authentication activity for the client.

ClientLocation.log
Records tasks that are related to client site assignment and management point assignment.

CMHttpsReadiness.log
Records the results of running the Configuration Manager HTTPS Readiness Assessment Tool. This tool checks whether computers have a PKI client authentication certificate that can be used for Configuration Manager.

ContentTransferManager.log
Schedules the Background Intelligent Transfer Service (BITS) or the Server Message Block (SMB) to download or to access packages.

DataTransferService.log
Records all BITS communication for policy or package access.

execmgr.log
Records details about packages and task sequences that run on the client.  This log also shows domain\user which is logged on.

FileSystemFile.log
Records the activity of the Windows Management Instrumentation (WMI) provider for software inventory and file collection.

FSPStateMessage.log
Records the activity for state messages that are sent to the fallback status point by the client.

InventoryAgent.log
Records activities of hardware inventory, software inventory, and heartbeat discovery actions on the client.

LocationCache.log
Records the activity for location cache usage and maintenance for the client.

LocationServices.log
Records the client activity for locating management points, software update points, and distribution points.

MaintenanceCoordinator.log
Records the activity for general maintenance task activity for the client.

PolicyAgent.log
Records requests for policies made by using the Data Transfer service.

PolicyAgentProvider.log
Records policy changes.

PolicyEvaluator.log
Records details about the evaluation of policies on client computers, including policies from software updates.

PolicyPlatformClient.log
Records the process of remediation and compliance for all providers located in %Program Files%\Microsoft Policy Platform, except the file provider.

PolicySdk.log
Records activities for policy system SDK interfaces.

SCClient_<domain>@<username>_1.log
Records the activity in Software Center for the specified user on the client computer.

SCClient_<domain>@<username>_2.log
Records the historical activity in Software Center for the specified user on the client computer.

Scheduler.log
Records activities of scheduled tasks for all client operations.

SCNotify_<domain>@<username>_1.log
Records the activity for notifying users about software for the specified user.

SCNotify_<domain>@<username>_1-<date_time>.log
Records the historical information for notifying users about software for the specified user.

setuppolicyevaluator.log
Records configuration and inventory policy creation in WMI.

smscliui.log
Records usage of the Configuration Manager client in Control Panel.

Smsts.log
Records task sequence activities.

SrcUpdateMgr.log
Records activity for installed Windows Installer applications that are updated with current distribution point source locations.

StatusAgent.log
Records status messages that are created by the client components.

ScanAgent.log
Records details about scan requests for software updates, the WSUS location, and related actions.

SdmAgent.log
Records details about tracking of remediation and compliance. However, the software updates log file, Updateshandler.log, provides more informative details about installing the software updates required for compliance.
This log file is shared with compliance settings.


SoftwareCenterSystemTasks.log
Records the activities for Software Center prerequisite component validation.

UpdatesDeployment.log
Records details about deployments on the client, including software update activation, evaluation, and enforcement. Verbose logging shows additional information about the interaction with the client user interface.

UpdatesHandler.log
Records details about software update compliance scanning and about the download and installation of software updates on the client.

UpdatesStore.log Records details about compliance status for the software updates that were assessed during the compliance scan cycle.

WUAHandler.log

Records details about the Windows Update Agent on the client when it searches for software updates.

Client

SCCM 2012 Client Exit Codes

"The software change returned the error code"


0x87D00324 (-2016410844)
successful but detection method did not detect the software as installed.

0x87D00213 (-2016411117)
Install took longer than allowed.  If you see this, go back to the installation command line.  Is there a mistake?  If there is it could be causing the install call to just sit there and do nothing until the timeout.

08x87D00607 (-2016410105)
Unable to download the software.
(May not be on the DP yet or DP not reachable.)

All Time Amazing Error Code Page: <link updated May 2020>
https://www.anoopcnair.com/sccm-troubleshooting-intune-error-codes-table/

Check
https://hdkb.clemson.edu/phpkb/article.php?id=167

https://www.systemcenterdudes.com/sccm-client-installation-error-codes/

(-2147467259)
Failed as we may never execute due to Service Window Constraints.
This occurs if the job Maximum Runtime is set to longer than the available maintenance window.

https://technet.microsoft.com/en-us/library/bb693574.aspx
https://technet.microsoft.com/en-us/library/bb680462.aspx
https://technet.microsoft.com/en-us/library/bb694295.aspx

0x87D01106(-2016407290)
This error can occur when the installation command line does not relate to the associated installation files.  In our case the command line was referencing one MSI file name when the MSI file in the cache was called something else.  The source files had somehow been inadvertently been renamed.
Credits to Naj Qadir for discovering the cause on this one.

0x87D01107 (-2016407289)
This occurs if there is an installation assignment which tries to start, but before it can start, you delete the cached installation media.

0x80070057   An 800Mb App-V package was failing to arrive at a client.
In this case, Adaptiva was being used as part of the media distribution system.  It looked as though there was some problem with the SCCM link with Adaptiva.
The client ContentTransferManager.log contained:

CTM job {A5DE7D59-BB4F-4E2F-88ED-76A68F5956B1} encountered error 0x80070057 during download ('Content is not published in Adaptiva')- The error is non retriable.

Update Content was used in the Console.  The media arrived correctly at the clients (via the Adaptiva Cache hidden on C:\) soon afterward and installed correctly.

0087D0128F (-2016406897) The App-V sftmime command returned failure
This is a bit misleading because this came from an App-V 5 client where there is no sftmime (App-V 4.6 era)
So anyway you're gonna love this one:
In this case the clients had somehow been created with no 8.3 naming applied to the folder structure - type dir \x  at the root of C:    You should see Progra~1  Progra~2 etc.  If you don't there could be problems.  Here it affected the App-V client and prevented it installing App-V packages from SCCM.   The media all downloaded with nowhere to go !  doh.

0x87D00667 (-2016410009) No current or future service window exists to install software updates

Can occur in the following situation:
App-V 5 App is deployed as Required.  User Experience settings are
Display in Software Center, and show all notifications.
Software Installation NOT TICKED
System Restart........ NOT TICKED
Commit Changes at deadline........ NOT TICKED

Manually remove the App-V application which has already installed using a remove-appvclientpackage command

Start the Application Deployment Evaluation Cycle

This will attempt to put the application back, however if a maintenance window is in effect it will fail with this error.  The user can simply initiate a manual "retry" and it will be successful.

Using
Software Installation TICKED
Enables the application to re-install with or without a maintenance window in place.

Applications which are marked Hide in Software Center and all notifications
Software Installation NOT TICKED
will not install until the maintenance windows has ended.

0x80040322 (-2147220702) Rule is in conflict with other rules

A supersedence entry was stopping the install.  It looked like the supersedence entry was acting as a requirement instead of supersede if relevant.  Once the supersedence entry was removed the install downloaded and installed.

0x800704EC (-2147023636) This program is blocked by group policy.

An AppX deployment was being prevented by Applocker stopping powershell scripts running in the user context.

0x87D0128F (-2016406897) The App-V time command returned failure

This occurred on a client where the App-V package had been manually test installed.  When the SCCM deployment was setup SCCM removed the package from the computer because it was not in the deployment collection.  Once it was put back into the collection and install attempted from software center, the above error occurred.

The problem was corrected by restarting the Microsoft App-V Client service.

0x0(0)

But that means success right? er no.  This can occur in the following scenario:

AppV app deployed to a user collection but the user policy is not enabled in the client settings "Enable user policy on clients = No"

The application is available in the software center but attempts to install it fail with 0x0(0)

0x642(1602)

Downgrade failure.
A later software version had been manually test installed, therefore detection not true of older SCCM deployment.  SCCM attempted install but failed because the MSI Install detected the later version already present.  To resolve - remove the machine from the deployment collection to prevent further doomed installation attempts.

0x87D00669 (-2016410007)  Not able to get software updates content locations at this time

Easy one this.  Ensure the content is on the relevant DPs

0x80070422 (-2147023838)  Seen with the failure of updates

Cause: Windows Update service was not running.

Setting up a SCCM 2007 package

This is really about naming conventions and keeping the environment consistant and easy to navigate as time goes by.  If even small differences in the process occur, the environment can become frustratingly varied make it difficult to check and find things.

Create the package
The important point here is to properly complete the Name, Manufacturer, Version fields.  The package names are listed using these fields to if you want the list to appear correctly in proper alphabetical order you must be consistant - preferably always using the Manufacturer field as this the first item used in the package list.

I think the preference here may be to use a tool to generate an SMS (package definition file) file which is then imported.  It can quickly populate the required fields consistantly - if the MSI has been created to standards!) - still worth checking text in the file before importing to make sure the fields are correct and as you wish them to appear in SCCM. 

Create the programs - install/uninstall
It is a very good idea to refer to the program type AND package name in the program title.  This is because the program title can be easily seen in the SCCM client infomation if it is interogated using the SCCM Client Center tool.  Be consistant: Manufacturer - App/Package/Product/Name -Version 
 e.g. Install - Adobe Acrobat Reader X 10.1.6
Consider using the import for the Windows Installer tab because this can provide the source location to repair from when the MSI installs on the target machine.

remember to Copy to Distribution Points :)

Create the AD Group.
If you are using AD groups queries from collections - Create the AD group. Be consistant: Manufacturer - App/Package/Product/Name -Version 

Create the Collection
Be consistant: Manufacturer - App/Package/Product/Name -Version 

Create the Advert
Be consistant: Manufacturer - App/Package/Product/Name -Version 
Put a - Install or a -Uninstall etc at the end of the advert name so that the purpose of the advert can be easily determined.

SCCM Client Center - App-V 4.6

Run the following command to install the SCCM Client Center to the Q: location.

Msiexec /i <Path>\SMSCliCtrV2_X64_Public.msi INSTALLDIR=”Q:\011537.V01\SCCM Tools\SCCM Client Center”

Once Monitoring has stopped. Ensure the Application is launched at the Configure Software Stage.

In the Files Tab of Editing mode mark the CSIDL_LOCAL_APPDATA and all the objects below it as User Data and tick the Override box.  Use the Apply button to confirm the setting.  This forces the user settings for the application to be kept inside the bubble in the user.config file.  If this is not done the settings are written to a file outside the bubble in %LOCALAPPDATA%\SCCM_Tools\SMSCliCtrV2.exe_Url_v2crw2edweequnwi2j3kxankklj4dxsn\2.0.4.0\user.config

App-V Package Adverts in SCCM

App-V package adverts in SCCM should NOT have mandatory assignments with "As soon as possible".

It is very important that App-V package advertisements are NOT set to “As soon as possible”. Advertisements with this setting will NOT rerun when the Update Package Wizard tick box to “Re-run advertisments with existing manditory assignments” is ticked.

SCCM SMS file options

http://technet.microsoft.com/en-us/library/cc723584.aspx

SCCM Package Path Length Analysis

SCCM Package Path Length Analysis

http://blogs.technet.com/b/mwiles/archive/2011/10/07/path-is-too-long.aspx

SCCM DP Update vs Refresh

SCCM 2007 DP Update vs Refresh

Summary: Use Update when the source changes, refresh to refresh the DPs e.g. in case corruption is suspected.

http://technet.microsoft.com/en-us/library/bb892806.aspx


SCCM 2012

Update Content:  When source changes have been applied.

Confusingly, when carrying out a Update Content operation the prompt says:

Are you sure that you want to refresh content for this deployment type?

Refreshing content will create a new revision of this application and may cause client to be updated.


Redistribute: to refresh the DPs e.g. in case corruption is suspected.
Application Properties>Content Location>Redistribute button

https://technet.microsoft.com/en-us/library/988b456a-efa8-45d1-89a6-894585dfca38#BKMK_UpdateContent