Tevura

Oh absolutely. It was my last resort since I ran out of things to try without diving deep into SQL which I'm not comfortable with by any means.

Figured it out with a little Microsoft loving support. Posting my solution here in case it can help anyone else with a very similar/same problem. CAUSE The problem here is dupe entries attempting to insert in the 'dbo.CI_CurrentComplianceStatus' table. This is being blocked by the index for the table called 'CI_CurrentComplianceStatus_AK_AS_idx' Note this issue only fails and presents itself during BCP-IN (bulk copy process). Regular DRS replication via SQL Broker will auto resolve and drop these dupe values while processing. RESOLUTION 1. Drop the index that is blocking the duplicate entries from inserting. 2. Identify the replication group that failed and force BCP reinit so link goes back active a. update RCM_DrsInitializationTracking set InitializationStatus = 7 where InitializationStatus = 99 < - This will force the BCP process to try again. 3. Run query to identify the dupes a. SELECT Count(*), ModelID, CIVersion, ItemKey, UserID FROM CI_CurrentComplianceStatus GROUP BY ModelID, CIVersion, ItemKey, UserID Having count(*)>1 4. Disable the Trigger that forces the table to be read only. 4. Delete the duplicate entries found in step 3 5. Re-add the index that we dropped. 6. Re-enable the Trigger.

So the solution that got 4 out of 5 back into a healthy state was running a query in SQL Studio to push my CAS out of ReplicationMaintenance. They all began talking and behaving normally. One of the primaries still refuses and when I attempt to reinitialize it, the CAS goes back into a maintenance state. Logs show the following error: CSqlBCP::BCPIN: bcp_exec failed. SMS_REPLICATION_CONFIGURATION_MONITOR 9/16/2015 12:27:47 PM 3572 (0x0DF4) *** DRS_Init_BCPIN() failed SMS_REPLICATION_CONFIGURATION_MONITOR 9/16/2015 12:27:47 PM 3572 (0x0DF4) *** BCP fails due to internal sql error. Check if this table has a trigger failed to execute. SMS_REPLICATION_CONFIGURATION_MONITOR 9/16/2015 12:27:47 PM 3572 (0x0DF4) CBulkInsert::DRS_Init_BCPIN : Failed to BCP in SMS_REPLICATION_CONFIGURATION_MONITOR 9/16/2015 12:27:47 PM 3572 (0x0DF4) BCP in result is 2147500037. SMS_REPLICATION_CONFIGURATION_MONITOR 9/16/2015 12:27:47 PM 3572 (0x0DF4) Error: Failed to BCP in for table CI_CurrentComplianceStatus with error code 2147500037. SMS_REPLICATION_CONFIGURATION_MONITOR 9/16/2015 12:27:47 PM 3572 (0x0DF4) Error: Failed to apply BCP for all articles in publication General_Site_Data. SMS_REPLICATION_CONFIGURATION_MONITOR 9/16/2015 12:27:47 PM 3572 (0x0DF4) The only thing I can see in ConfigMgr is that under Replication Status, General_Site_Data is stuck and causing the failure. The Replication Link Analyzer also states that its unable to initialize the package between this site and my CAS "For the replication groups: General_Site_Data (Tables: CI_CurrentComplianceStatus)" and can't remediate. Absolutely everything else reports green healthy checks across the board except for this. Screenshot below. Any thoughts that might steer me in the right direction would be greatly appreciated.

Got another one I'm stumped on. So this past Friday I upgraded my hierarchy from CU4 to CU5. I discovered on Saturday that my CAS entered ReplicationMaintenance while all of my Primary sites remain active. It's showing a Link Failed on all under Site Data Replication Status. Great! So I run the Replication Link Analyzer and get this: Not very helpful and it does this regardless of which site I run it on through their respective consoles. So my next step is to check rcmctrl.log. All primary sites look clean except for one and the CAS. Both of these are stuck with the following log info that has just been looping since I first checked Saturday: The basic gist is that I see one error and a couple other items that stand out: Error: Replication group "General_Site_Data" has failed to initialize for subscribing site C01, setting link state to Error. SMS_REPLICATION_CONFIGURATION_MONITOR 9/14/2015 3:25:55 PM 8120 (0x1FB8) Site is NOT active, so not calling the DrsActivation procedures on DRSSite queue. SMS_REPLICATION_CONFIGURATION_MONITOR 9/14/2015 3:25:35 PM 3492 (0x0DA4) <- This one is present on the CAS but not the Primary. No connector role installed SMS_REPLICATION_CONFIGURATION_MONITOR 9/14/2015 10:25:08 PM 7508 (0x1D54) <- This one is on the Primary and not present on the CAS. I've tried to reinitialize General_Site_Data by placing a .pub file in the rcm inbox and it looks like it starts to do things but then fails and ends up right back where we're at. Running the Exec spdiagdrs query on the CAS SQL Studio yields results showing all Site Data as failed to replicate across the servers but Global Data is fine. Also, the only site not Active is my CAS. I've also tried the basics like rebooting the servers, restarting services and even reinstalling CU5. No changes. Seriously stumped and on the verge of contacting Microsoft for assistance but figured I'd reach out here in case anyone has an "Ah ha!" fix.

Solved it! By shear happenstance, I noticed it's client was blocked in the console. Unblocked it. Ran Machine Policy, and Update Scan/Evaluations and magically, update city. Unsure how it got blocked in the first place but I'll take a win when I can get it.

So I gave it some thought and client machines are receiving everything they need from this server. I decided to look at it as a client receiving updates and checked the softwaredistribution.log. There's a tremendous amount of errors all similar to as follows: UTCWarning w3wp.40 SoapUtilities.CreateException ThrowException: actor = https://myprimaryserver:8531/ClientWebService/client.asmx, ID=e769f25b-d908-483d-a61e-ad05bc4e0f12, ErrorCode=ConfigChanged, Message=, Client=36ce4e18-cccd-4115-afdf-8db2aeadcb0d UTCWarning w3wp.45 DBConnection.OnReceivingInfoMessage Invalid event dropped. EventInstanceID=FB41B745-8A83-4E96-A8AD-61C241FBBA11, ComputerID=595c3943-8246-4eac-a79e-6ba685308574. Invalid EventID.

Thanks for taking the time here! To answer your questions; yes its able to and successfully sync the same software updates. There are 3 lines however that show up around 12-1am local about once a week on wsyncmgr.log as follows: Sync failed: Unknown: NullReferenceException: Object reference not set to an instance of an object.~~at Microsoft.UpdateServices.ServerSync.CatalogSyncAgentCore.FilterNeededUpdates(UpdateIdentity[] allUpdates, ServerSyncFilter filter). Source: Microsoft.SystemsManagementServer.SoftwareUpdatesManagement.WsusSyncAction.WSyncAction.SyncWSUS STATMSG: ID=6703 SEV=E LEV=M SOURCE="SMS Server" COMP="SMS_WSUS_SYNC_MANAGER" SYS=MyFQDNsiteserver SITE=001 PID=3552 TID=6352 GMTDATE=Wed Aug 26 08:28:02.569 2015 ISTR0="Microsoft.SystemsManagementServer.SoftwareUpdatesManagement.WsusSyncAction.WSyncAction.SyncWSUS" ISTR1="Unknown: NullReferenceException: Object reference not set to an instance of an object.~~at Microsoft.UpdateServices.ServerSync.CatalogSyncAgentCore.FilterNeededUpdates(UpdateIdentity[] allUpdates, ServerSyncFilter filter)" ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=0 Sync failed. Will retry in 60 minutes After that the logs look clean and on retry it succeeds with no errors. The Software Update Groups do consist of the same software updates on all servers and the current SUP sync schedule is set daily and the rule runs after any SUP synchronization.

So this is a weird one I'm trying to wrap my head around. For the most part, the ADRs are doing exactly what they need to be doing to maintain compliance in my network. My System Center environment is large and contains a CAS with 4 primary site and a DP. One of the primary sites does most of the heavy lifting as the other three are used for remote locations. On this particular 2012 R2 server, its only receiving part of it's required software updates and missing about half. I've got my server ADRs broken down into the following: Server 2012 ADR: This only looks for servers that are Server 2012, 2012 R2, no supersedence and Security Updates for its Updates Classification. Server - Critical Updates: Targets all Windows Server versions, no supersedence, and Critical Updates for its Updates Classification. Server - Updates: Targets all Windows Server versions, no supersedence, and Updates for its Updates Classification. This set up method repeats for Feature Packs, Service Packs, Tools, Definition Updates and Update Rollups. I've checked every relating log file and see no errors indicating a problem with it receiving these and by all accounts, it looks like it got everything until I run a compliance report for our InfoSec team. Specifically the Compliance 1 - Overall compliance report built into SCCM with a target collection of Windows Server 2012. Its here that I see the missing updates. Also, if I manually check for updates on this machine, the missing ones show up but I never see them in Software Center no matter how many times I try running the Machine Policy and Windows Update action items from the client app. The rest of my hierarchy doesn't experience this at all and receive all their updates. Any thoughts that might help point me where to look would be greatly appreciated!

Hi all, First off, I've been a lurker who's benefited a great deal by the knowledge thrown around on these forums for a little bit so thank you! Long story short, I'm a junior admin in training who's been given the responsibility of managing SCCM in my workplace. My senior administrator has tasked me with creating a solution of granting and managing local admin rights to users who request such elevated permissions and are approved for it. These are his requirements below: 1. Requests for Administrator access are subject to an approval process. 2. Users should be able to install the permissions on their own once approved. 3. Users can only install the permission on their own computer. 4. If the permission is revoked, the permission should be removed from any computer where it is installed. I'm really new to both SCCM so my knowledge on functioning solutions is limited, hence why I'm reaching out for possible solutions. I've Googled extensively for any ideas but nothing seems to remotely fit this criteria. The only thing I've been able to think of is creating a script and deploying it as an Application requiring approval. I'd also imagine device affinity and a GPO should be in place to answer 3 and 4. Any additional thoughts or suggestions would be incredibly appreciated!