O R G A N I C / F E R T I L I Z E R: 01.09

Jan 30, 2009

powershell w/ sccm for collections – part 1

while i’m working through a script i’m trying to create, here’s a list of commands discovered to work with collections.

retrieve a list of collections from a sccm server:

get-wmiobject -namespace 'root\sms\site_<sitecode>' -class 'sms_collection' | format-table collectionid, name


retrieve a list of members from a collection:

get-wmiobject -namespace 'root\sms\site_<sitecode>' -query 'select * from sms_cm_res_coll_SMS00001' | format-table resourceid, name

Jan 29, 2009

recurring schedule behavior in sms / sccm agents


while investigating long boot/logon cycles, i came to the realization that there really is no documented statement on how a sms agent behaves when set against a recurring schedule.  here’s a really brief summary of what i’ve discovered so far.

first of all, it turns out that regardless of the type of recurring situation, it’s always the same.  this means whether it’s inventory or software distribution the behavior is exactly alike.  i know there’s some confusion about this… but this is what i’m seeing.

basically when an agent does not miss its schedule, it runs as it should.  duh.  i don’t know why that took me so long to process, but i finally get it now!  really!  let me explain, if you still don’t follow.


inventory behavior

i have a computer named “myLaptop”.  myLaptop goes home in the evenings with me and stays off since i refuse to work outside of normal business hours.  because of this, when i log on the next morning, all kinds of things happen – whether i like it or not.  :|  squaring away our environmental details, here is what the schedule for myLaptop inventory times look like:

inventoryAction lastReportDate schedule
hardware 1/28/2009 11:32:51 AM once/day
software 1/26/2009 4:33:52 PM once/5 days
heartbeat 1/28/2009 4:42:46 PM once/day


while myLaptop is turned off, it misses the scheduled execution for hardware inventory and heartbeat discovery.  i fire up the laptop at 1/28/2009 5:01:00 PM --because of this, the agent runs both hardware and discovery in tandem.  now if i reboot or restart the agent at any point until its next scheduled time, the agent will NOT run the inventories again

since software inventory is every 5 days, the laptop hasn’t missed its scheduled execution.  therefore, software inventory does not execute again.  if i had started the laptop at 1/31/2009, it would have run all 3 since every scheduled inventory would have been missed.

when inventory does fire off, all of the lastReportDate time frames will be reset to the current datetime value.  therefore, the machine will not run the inventory cycles again until the new scheduled times.


software distribution behavior

software distribution behaves exactly as i’ve detailed above.  it makes more sense though with software distribution since you control the mandatory execution timeframe.  also, it never changes the time frame.  if it misses an execution and has to run it, it doesn’t go reset the next scheduled time.  it runs again when you’ve scheduled it to go.


additional information

if you’re not familiar with the inventories i’ve mentioned below, they exist in the wmi class InventoryActionStatus.  This class resides in the namespace “root\ccm\invagt”.

from within wbemtest, you can view the details of the schedules by executing the following query:

select * from inventoryactionstatus

keep in mind that running the query in wmi returns all date fields in cim_datetime format.  if you want to see it in a better output, try this powershell command:

get-wmiobject -Namespace 'root\ccm\invagt' -Query 'select * from inventoryactionstatus' | ft -property InventoryActionID, @{label="ReportDate";expression={$_.ConvertToDateTime($_.LastReportDate)}}


you’ll get a list of inventory action ids.  you can find their translation here.



thanks goes to mark mears.  :)

Jan 20, 2009

launching .msc files with psexec

ever try to launch a .msc w/ psexec?  it’s a frustrating experience unless you know how.  i found myself in this predicament a number of times but wasn’t interested in figuring out at the time since there were many other easier ways to get around it.

can’t let this one slip away.  i will certainly need this later.  as usual, let’s start with the wrong way.

c:\>psexec -u <domain>\<user> -p <password> dsa.msc

PsExec v1.94 - Execute processes remotely
Copyright (C) 2001-2008 Mark Russinovich
Sysinternals - www.sysinternals.com

PsExec could not start dsa.msc:
%1 is not a valid Win32 application.


how about this way?

c:\>psexec -u <domain>\<user> -p <password> mmc.exe dsa.msc

PsExec v1.94 - Execute processes remotely
Copyright (C) 2001-2008 Mark Russinovich
Sysinternals - www.sysinternals.com

PsExec could not start mmc.exe dsa.msc:
The parameter is incorrect.


the one above, you may or may not see depending on how your paths are setup.  the real secret is getting the mmc.exe to call dsa.msc.  to prevent any odd path problems from getting in the way, this is the way we should execute it.  by the way, i added –d so that we don’t keep the cmd shell in a holding pattern.

c:\>psexec -d -u <domain>\<user> -p <password> %windir%\system32\mmc.exe dsa.msc

PsExec v1.94 - Execute processes remotely
Copyright (C) 2001-2008 Mark Russinovich
Sysinternals - www.sysinternals.com

mmc.exe started with process ID <1234>


if you’re logged in via a RDP connection to a server, make sure you’re not running into problems with the console view.  i blogged about this awhile back in this entry.

Jan 16, 2009

new advertisement wizard completed with errors

depending on the context of the message, i wouldn’t worry too much about it.  we ran into it this week while trying to create an advertisement.  the tech created an ad for a bits test deployment.  he didn’t realize it went on to create his ad anyway, despite the error message.  oops!  good thing it was a test deployment.

the advertisement was created into the root container of advertisements instead of a subfolder.  it’s pretty easy to realize the permission issue once you see the context.  granting “manage folders” to the advertisements node, corrected this.

Errors (only detailing the relevant lines)

  • You do not have security rights to perform this operation.
  • ConfigMgr Error Object:
  • instance of SMS_ExtendedStatus
  • Description = User does not have permission to manage this folder;
  • ErrorCode = 1112017920
  • File = e:\\nts_sms_fre\\sms\\siteserver\\sdk_provider\\smsprov\\sspfolder.cpp
  • Operation = “PutInstance”;
  • ProviderName = “ExtnProv”;
  • StatusCode = 2147749889

here’s a screen shot as well: