Loushius

Ok, so I ended up referencing some CBT Nuggets about creating views again in SQL. It ended up being really easy. I figured I'd post some screenshots of my view and the ending result of the WQL Query in case someone else ends up viewing the post in the future. I ended up getting all the different versions of coupon related software installed on machines. Now I can get it all uninstalled! My view inside SQL: http://imgur.com/mOGGqUI My WQL: http://imgur.com/SmyGiv0 How simple the statement ended up being: http://imgur.com/APkiGWL

I'm pretty new to building queries and am currently trying to familiarize myself with SQL and the SQL Views to further help run queries. I've been having a hard time trying to build a collection of computers that have one of our inventoried software items on it. Within Inventoried Software, I have several products with different names all containing the word Coupon. Coupon toolbars, programs, etc. These are all security threats, and I have positive software counts for each. I'd like to create a collection (or run a report) of all machines with this software installed so I can remove the software. I've tried different variations of criteria in my query statement without success. Installed software, installed application, etc. each with the product name or publisher name return no results. I'll paste my most recent attempt below: select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_INSTALLED_SOFTWARE on SMS_G_System_INSTALLED_SOFTWARE.ResourceId = SMS_R_System.ResourceId where SMS_G_System_INSTALLED_SOFTWARE.ProductName like "Coupon" Any help would be appreciated!

I've been noticing an odd occurrence on my system lately. I have an ADR setup to deploy Forefront Updates, set to install outside of MW and not prompt the user for anything. All has been well. For whatever reason, we now have a version mismatch between the clients and SCCM. The ADR still seems to be pushing updates, even though they don't install, but is also notifying users of updates constantly. I checked my endpoint log, and see this: EP 4.2.223.1 is installed, version is higher than expected installer version 4.1.522.0. EndpointProtectionAgent 6/27/2013 7:23:00 AM 7816 (0x1E88) Check and enforce EP Deployment state. EndpointProtectionAgent 6/27/2013 7:23:00 AM 7816 (0x1E88) EP Client is already installed, will NOT trigger reinstallation. EndpointProtectionAgent 6/27/2013 7:23:00 AM 7816 (0x1E88) Sending message to external event agent to test and enable notification EndpointProtectionAgent 6/27/2013 7:23:00 AM 7816 (0x1E88) Sending message to endpoint ExternalEventAgent EndpointProtectionAgent 6/27/2013 7:23:00 AM 7816 (0x1E88) EP Policy Antimalware Policy is already applied. EndpointProtectionAgent 6/27/2013 7:23:00 AM 7816 (0x1E88) Firewall provider is installed. EndpointProtectionAgent 6/27/2013 7:23:00 AM 7816 (0x1E88) Installed firewall provider meet the requirements. EndpointProtectionAgent 6/27/2013 7:23:00 AM 7816 (0x1E88) start to send State Message with topic type = 2001, state id = 3, and error code = 0x00000000 EndpointProtectionAgent 6/27/2013 7:23:00 AM 7816 (0x1E88) Skip sending state message due to same state message already exists. EndpointProtectionAgent 6/27/2013 7:23:00 AM 7816 (0x1E88) Endpoint is triggered by message. EndpointProtectionAgent 6/27/2013 10:39:00 AM 6356 (0x18D4) File C:\Windows\ccmsetup\SCEPInstall.exe version is 4.1.522.0. EndpointProtectionAgent 6/27/2013 10:39:00 AM 6356 (0x18D4) If I install the EP client off of my distribution point, the version is correct. One of the windows updates pushed out by SCCM is a newer version of the EP client, as I see it in the installed updates. Since it pushed this new version out, I get constant mismatches. There are now constant notifications that updates are available on user machines, and they're always for Forefront, even though my ADR says to hide all notifications. How should I go about correcting this? I haven't had much luck finding others with the issue yet, and most places I've posted at looking for some insight yield no responses.

I'm starting to have this issue in my environment as well. Created an account just to reply to this thread. I haven't found an answer yet. What I've noticed so far is the version on my management point is 4.1.522.0. If I manually install this version, I get my definition updates correctly. However, one of the windows updates pushed out is the newer version of the SCEP Client, 4.2.223. Once this version is installed, I get constant pop-ups for definition updates over and over. Even though my ADR says to disable all notifications, and install the definition updates outside of a maintenance window, the installs are failing. I was wondering if maybe there was a way to update the SCEP file on the management point itself?