We are still 2012 R2. I am looking at the logs now. I’ll post what I can find.
From: [email protected] [mailto:[email protected]] On Behalf Of Conrad Jones Sent: Wednesday, January 27, 2016 11:03 AM To: [email protected] Subject: Re: [mssms] RE: Deployments just kicking off on their own?(SCCM 2012 R2) I had an available deployment auto install yesterday. On 27 Jan 2016 3:59 p.m., "Lindenfeld, Ivan" <[email protected]<mailto:[email protected]>> wrote: David, I think we had this happen to us yesterday. Just for reference, we just deployed SCCM 1511 clients the night before and 1511 on the 13th. This deploys .Net 4.5. Then the update re-eval occurred, some clients showed Non-Compliant and started downloading .Net 4.5 patches. We allow downloads anytime (thanks to Adaptiva OneSite). We have a closed maintenance window for workstations from 7am to 7pm Weekdays (local time.) A few workstations rebooted, even though Reboot Coordinator said there wasn’t an open window. The Reboot Coordinator did say: MTC allowed us to reboot RebootCoordinator 1/26/2016 2:31:48 PM 9452 (0x24EC) MTC is Maintenance Coordinator. At that time Maintenance Coordinator states this, which tells me nothing, but could be meaningful to others: Adding task for client "RebootCoord": id - "fde8a4e1-84cc-40ee-9309-b624c41830e5", pri - 0, service window - 0, max time for sw - 0. MaintenanceCoordinator 1/26/2016 2:31:48 PM 9452 (0x24EC) Signaled task 'fde8a4e1-84cc-40ee-9309-b624c41830e5' (agent 'RebootCoord'). MaintenanceCoordinator 1/26/2016 2:31:48 PM 9452 (0x24EC) Done scheduling task. Winning task 'fde8a4e1-84cc-40ee-9309-b624c41830e5' (agent 'RebootCoord') MaintenanceCoordinator 1/26/2016 2:31:48 PM 9452 (0x24EC) Task "fde8a4e1-84cc-40ee-9309-b624c41830e5" (agent 'RebootCoord') is reporting back on starting. MaintenanceCoordinator 1/26/2016 2:31:48 PM 9452 (0x24EC) Successfully started task 'fde8a4e1-84cc-40ee-9309-b624c41830e5' (agent 'RebootCoord'). MaintenanceCoordinator 1/26/2016 2:31:48 PM 9452 (0x24EC) This is the only .Net patch that requested the reboot, from WUAHandler.log Please note that our workstation patch window was last week ago so cause and effect is clear: 1. Update (Missing): Security Update for Microsoft .NET Framework 4.5, 4.5.1 and 4.5.2 on Windows 7, Windows Vista and Windows Server 2008 x86 (KB3098781) (affacd18-2944-40c2-a361-aebf64be244c, 204) WUAHandler 1/26/2016 1:58:27 PM 10028 (0x272C) Was it the same update for you? Could we have a bad update? Are you on 1511 and it’s a bug? Ivan Lindenfeld From: [email protected]<mailto:[email protected]> [mailto:[email protected]<mailto:[email protected]>] On Behalf Of David McSpadden Sent: Wednesday, January 27, 2016 10:06 AM To: [email protected]<mailto:[email protected]> Subject: [mssms] RE: Deployments just kicking off on their own?(SCCM 2012 R2) Perfect. Will review and see what’s up From: [email protected]<mailto:[email protected]> [mailto:[email protected]] On Behalf Of Qadri, Syed Sent: Wednesday, January 27, 2016 9:39 AM To: [email protected]<mailto:[email protected]> Subject: [mssms] RE: Deployments just kicking off on their own?(SCCM 2012 R2) Check the updatesdeployment.log. it will give you the exact information as to which deployment initiated the reboot. Also look for the windowsupdate.log. reboot coordinator.log will give you info about the reboot. These logs are on the client machine. Syed. From: [email protected]<mailto:[email protected]> [mailto:[email protected]] On Behalf Of David McSpadden Sent: Wednesday, January 27, 2016 7:57 PM To: [email protected]<mailto:[email protected]> Subject: [mssms] RE: Deployments just kicking off on their own?(SCCM 2012 R2) Which logs can I look at either on the server or client to see why it took the install and then rebooted? From: [email protected]<mailto:[email protected]> [mailto:[email protected]] On Behalf Of Gushue, William Sent: Wednesday, January 27, 2016 9:22 AM To: [email protected]<mailto:[email protected]>; Patch Management Mailing List ([email protected]<mailto:[email protected]>) <[email protected]<mailto:[email protected]>> Subject: [mssms] RE: Deployments just kicking off on their own?(SCCM 2012 R2) I don’t know the cause, and this is not exactly the same as your situation, but I have seen some clients (and usually the number is small, as you are seeing) run even regular advertisements before the scheduled time. I had checked the clock on those workstations and the time was okay. A simple reinstall of the SCCM client fixed it though. From: [email protected]<mailto:[email protected]> [mailto:[email protected]] On Behalf Of David McSpadden Sent: Tuesday, January 26, 2016 7:48 PM To: Patch Management Mailing List ([email protected]<mailto:[email protected]>) <[email protected]<mailto:[email protected]>> Cc: [email protected]<mailto:[email protected]> Subject: [mssms] Deployments just kicking off on their own?(SCCM 2012 R2) We have a strong test group and we are getting our patching to production workstation all set up. Last week we set 50 % of our workstations up with a deadline the same day and the deployment date. Today out of 133 machine in the deployment about 6 of them required a restart during the middle of the day. We have a maintenance window of 7pm-7am And Client settings are actually default 5am-10pm business our. Do not interrupt presentation is enabled and automagically install in disabled. We do not understand why this is happened to a few clients and don’t understand why it waited a week (1/19/2016) to show up? Both of us admins of SCCM were busy doing other things today so neither of us made any changes but right around 3:00 pm users started calling stating they had 15 minutes until reboot. I am pretty sure I know which Deployment it was to this collection but is looks the same as the other deployments that are just sitting there waiting on the maintenance window. What logs should I start with and what will tell me why they are triggering restarts during business hours and outside of maintenance windows? David McSpadden System Administrator Indiana Members Credit Union P: 317.554.8190<tel:317.554.8190> [Description: Description: imcu email icon]<http://imcu.com/> [Description: Description: facebook email icon] <https://www.facebook.com/IndianaMembersCU> [Description: Description: twitter email icon] <https://twitter.com/IndMembersCU> [Description: Description: email logo] [http://www.amuletsolutions.com/images/mcp.gif]<http://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&cad=rja&uact=8&ved=0ahUKEwjFztf-tePJAhXK5iYKHcPtAxEQjRwIBw&url=http://www.amuletsolutions.com/awards.aspx&bvm=bv.110151844,d.amc&psig=AFQjCNHkrx8CednTEOOq4zUxYyrRUGzUsg&ust=1450459757284499> This e-mail and any files transmitted with it are property of Indiana Members Credit Union, are confidential, and are intended solely for the use of the individual or entity to whom this e-mail is addressed. If you are not one of the named recipient(s) or otherwise have reason to believe that you have received this message in error, please notify the sender and delete this message immediately from your computer. Any other use, retention, dissemination, forwarding, printing, or copying of this email is strictly prohibited. Please consider the environment before printing this email. ________________________________ ******************************************************************** This e-mail message is privileged, confidential and subject to copyright. Any unauthorized use or disclosure is prohibited. Le contenu du présent courriel est privilégié, confidentiel et soumis à des droits d'auteur. Il est interdit de l'utiliser ou de le divulguer sans autorisation. ******************************************************************** This e-mail and any files transmitted with it are property of Indiana Members Credit Union, are confidential, and are intended solely for the use of the individual or entity to whom this e-mail is addressed. If you are not one of the named recipient(s) or otherwise have reason to believe that you have received this message in error, please notify the sender and delete this message immediately from your computer. Any other use, retention, dissemination, forwarding, printing, or copying of this email is strictly prohibited. Please consider the environment before printing this email. This message contains information that may be privileged or confidential and is the property of the Capgemini Group. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message. This e-mail and any files transmitted with it are property of Indiana Members Credit Union, are confidential, and are intended solely for the use of the individual or entity to whom this e-mail is addressed. If you are not one of the named recipient(s) or otherwise have reason to believe that you have received this message in error, please notify the sender and delete this message immediately from your computer. Any other use, retention, dissemination, forwarding, printing, or copying of this email is strictly prohibited. Please consider the environment before printing this email. ________________________________ NOTICE: The information contained in this message is proprietary and/or confidential and may be privileged. If you are not the intended recipient of this communication, you are hereby notified to: (i) delete the message and all copies; (ii) do not disclose, distribute or use the message in any manner; and (iii) notify the sender immediately. This e-mail and any files transmitted with it are property of Indiana Members Credit Union, are confidential, and are intended solely for the use of the individual or entity to whom this e-mail is addressed. If you are not one of the named recipient(s) or otherwise have reason to believe that you have received this message in error, please notify the sender and delete this message immediately from your computer. Any other use, retention, dissemination, forwarding, printing, or copying of this email is strictly prohibited. Please consider the environment before printing this email.
