PENDING A number of servers will not patch correctly

[SAS_Mark]

Hi All,

I currently have around 100 Servers (Server 2016 and Server 2022) but have an issue with 4 not patching correctly. Quick overview:

We have 4 device groups (1st Wed, 2nd Wed, 3rd Wed, 4th Wed)
Devices are added to these via an AD security group
All devices are showing correctly in the device group apart from these 4
Previously these 4 servers were just added to the device groups manually.
I have tried deleting these servers from SCCM, ran the AD scan, the server would be readded and added to the correct device groups.
When the SCCM client was pushed to the server and the heartbeat would run it would delete it from the device group.
Checked through the boundary groups and all seems correct (All ranges within the same boundary group)
Checked over the MP which they connect to and followed the logs from the problem server to the database.

Any help would be greatly appreciated,
Mark

 

[Prajwal Desai]

Can you check if the client agent is installed on these problematic servers?

 

[SAS_Mark]

Can you check if the client agent is installed on these problematic servers?

Hi,

Yes the agent has been fully reinstalled on the servers and heartbeat being sent back to the server.

(Also thanks for all your posts over the years, they have been super helpful)

 

[khluz]

Hi,

Yes the agent has been fully reinstalled on the servers and heartbeat being sent back to the server.

(Also thanks for all your posts over the years, they have been super helpful)

Hi SAS_Mark

Did you check whether these 4 Servers have the same SMBiosGuid or the same SCCM-Guid (myabe by cloning in VSphere or similar virtuel enivronement).

khluz

 

[SAS_Mark]

Hi SAS_Mark

Did you check whether these 4 Servers have the same SMBiosGuid or the same SCCM-Guid (myabe by cloning in VSphere or similar virtuel enivronement).

khluz

Hi Kluz,

Thank you for your reply, the 4 servers are 1 Physical, 2 Microsoft Hyper V machines and 1 Azure VM. All very different. I checked the to running on Microsoft Hyper V and they have different SMBiosGuids.

Cheers
Mark

 

[vshewale]

Hi Kluz,

Thank you for your reply, the 4 servers are 1 Physical, 2 Microsoft Hyper V machines and 1 Azure VM. All very different. I checked the to running on Microsoft Hyper V and they have different SMBiosGuids.

Cheers
Mark

Are these servers in same AD OU and getting the same group policies?

 

[SAS_Mark]

Are these servers in same AD OU and getting the same group policies?

Hi,

3 of the servers are in the same OU with same group policies. They are also in the same OU as another 80 odd servers which are patching fine. One problem server is in a slightly different OU but its still with other servers which are patching fine.

I maybe barking up the wrong tree and all 4 have separate issues. But seems very strange how all 4 wont add to the correct device groups as they should be (Picked up from AD security groups). They show in the right groups until i install the client agent, get a heartbeat and then they are removed. Even when added to the correct patching device groups manually still wont patch.

 

[khluz]

Hi,

3 of the servers are in the same OU with same group policies. They are also in the same OU as another 80 odd servers which are patching fine. One problem server is in a slightly different OU but its still with other servers which are patching fine.

I maybe barking up the wrong tree and all 4 have separate issues. But seems very strange how all 4 wont add to the correct device groups as they should be (Picked up from AD security groups). They show in the right groups until i install the client agent, get a heartbeat and then they are removed. Even when added to the correct patching device groups manually still wont patch.

Hi SAS_Mark
Could you post the WMI Query of these Device Collections?
khluz

 

[khluz]

Hi SAS_Mark
Could you post the WMI Query of these Device Collections?
khluz

And could you add the hostnames and the DNS-Entries for these Machines?

 

[SAS_Mark]

Hi SAS_Mark
Could you post the WMI Query of these Device Collections?
khluz

select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System where SMS_R_System.SystemGroupName = "XXXX\\SCCM MW Servers A - 2nd Wed"

All four device groups have the same style query, any machines in a security group.

 

[Garth]

select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System where SMS_R_System.SystemGroupName = "XXXX\\SCCM MW Servers A - 2nd Wed"

All four device groups have the same style query, any machines in a security group.

This query will use Heartbeat discovery to populate the collections. How often is heartbeat discovery running? Also keep in mind that it will not show up until after the device knows that it belongs to a sec group (reboot) and heartbeat discovery take place.