2

wondering if anyone has got any ideas here. I have a task sequence that was deployed last week. The deployment settings are;

  • Action:Install
  • Purpose: Available
  • Available to the following: ConfigMgr clients, media, and PXE The Schedule is just from the date and time it was deployed.

SO the TS should be available to install, but not automatically deploy, right?

However, today one of our machines was found to be running the Task Sequence over lunch. The Owner claims he didn't start the update, and I can see from the SMSPXE log that nothing was requested though PXE.

I suspect the Owner of the laptop went into the Software center and updated it themselves but, I'm looking for a log file to help me prove this.

The SMSTS logs on the laptop don't start until the machine starts to image. There is no PXE request. Now, I thought there was a log file that would say if a deployment was manually triggered - but I can't remember the name or if it actually exists.

It's been around 8 years since I last had to look after an SCCM environment and I was using 2007 at that point.

Does anyone know If this log exists or if there is somewhere else that can tell me what started the Task sequence.

Another thing to note is the Machines Configuration Manager Client was updated last wee and is in the Pre-Production Client group, so I need to make sure this isn't due to that either as I would very much like to push out the new client across the fleet.

Thanks for the help and advice.

environment information:

  • SCCM V 1511
  • Console Version: 5.0.8325.1000
  • Site Version: 5.00.8634.1000
  • Production client: 5.00.8577.1108
  • Pre-Production client: 5.00.8634.1010
Improve this question
4
  • I don't know of any log for user input but I will check if I missed something and there is indeed one. In the meantime what happened from my experience is that the user got a popup "new software available" checked software center, though "new software is always good" and just installed it. We got plenty of cases like this in our company. We had to disable the "new software available" message at one point because people installed just everything they found in the software center without thinking...
    – Syberdoor
    Jul 17, 2018 at 10:43
  • 1
    So the log that has all executions is probably execmgr.log (in C:\windows\ccm\logs") and it will have something like an OnOptionalExecution Request but that does not really tell you what your users did imo. Usernames are not mentioned there nor is whether it was triggered via software center so it is a lot of guesswork still)
    – Syberdoor
    Jul 17, 2018 at 11:10
  • @Syberdoor Thanks for the information, I highly suspect you are correct about just clicking on the pop up, whilst most of my experience is in 2007 I know it's not likely a TS would just install itself! And thanks for the suggestion with that execmgr.log log, I'll check it out it may just help.
    – BFosterCDV
    Jul 18, 2018 at 13:19
  • Windows' event viewer could probably tell you which user was working on the machine at that very time the execmgr.log tells.
    – Hupfauer
    Nov 8, 2018 at 11:40

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .