Unable to trigger SCCM commands unless user logged on

[Kevin Hyland]

Hi

I have an issue where I need to uninstall software which was installed accidentally across 400 odd users. I made a multi-step Job Queue in BatchPatch to uninstall the software once the user was logged off, do a restart, wait for the host to come back online, then force an SCCM Machine Policy Retrieval Cycle and then Application Deployment Evaluation Cycle using WMIC commands (WMIC /namespace:\rootccm path sms_client CALL TriggerSchedule “{00000000-0000-0000-0000-000000000121}” /NOINTERACTIVE and 000000000001) then once the software is shown up as being deployed, deploy a small update batch of files.

The reason why I’m using WMIC commands to force SCCM deployment is that if the user starts up Outlook, it locks the files that are needed for the software to deploy correctly. So I was hoping to do the install with the user logged off

However, even though the script runs through and says Success the deployment does not actually start until the user logs on. If I run the SCCM part of the script when a user is logged on then it all completes successfully.

As these laptops are scattered across multiple sites, I can’t use autologin credentials to logon so the SCCM script completes, and I don’t want the user to login because no matter how I ask them, they will still try to start up Outlook!

I know BatchPatch has the SCCM but not sure how they tie in with the Configuration Manager Actions or how to use them in an Action

Any suggestions on how I can do this?

Any assistance appreciated

Thank you

Kevin

[doug]

Hi Kevin – In BatchPatch under ‘Tools > SCCM client triggers’ all of the WMIC commands are hardcoded. You can see the complete list here: Triggering ConfigMgr (SCCM) Client Actions Remotely

They’re WMIC commands just like the ones that you are already executing, so I wouldn’t expect them to produce a different result than what you’re currently seeing unless you use a different trigger (there are a total of 49, if I’m remembering correctly). The only thing I would note is that according to any documentation I have seen, the two commands that you are executing are:

{00000000-0000-0000-0000-000000000001} Hardware Inventory

{00000000-0000-0000-0000-000000000121} Application manager policy action

not:

Machine Policy Retrieval Cycle

Application Deployment Evaluation Cycle

I don’t know if this means that you are really wanting to execute different commands, or if you are executing the correct commands, but in either case I don’t think you’re dealing with a BatchPatch problem, as it’s essentially just the messenger delivering the command. The command is clearly being executed. We know this not only because of the ‘SUCCESS’ response but because when the user logs on the deployment starts. So I think the real question is why does this SCCM trigger not do anything until the user logs on. I don’t know if this is something that could be answered by a SCCM guru somewhere or if there is a different client trigger that would do what you need/want. However, from the BatchPatch angle I don’t think there is anything else we can do.

[Kevin Hyland]

Hi Doug

The two triggers are the same – I took the name from the Configuration Manager on the remote computers but the WMIC is the same string.

I’m not sure why the SCCM is not deploying until the user logs on as its a per machine installation and if I leave it long enough it does install on its own before the user logs on. Its not my deployment package but I’ll try pulling it apart later.

In the meantime, is there a BP trigger for when a user logs on? If there is I can change the script to continue once the user logs on, lock out Outlook, force the SCCM triggers and then deploy the patches.

Thank you

Kevin

[doug]

BP doesn’t have a trigger for when a user logs on, but you could incorporate that kind of a check into your script if you really wanted. The easiest way would be to use the Win32_Process class to search for running instances of explorer.exe. Generally you would only have an explorer.exe process running if a user is logged-on. If the script doesn’t find it then it can wait a minute and check again.

Here are a few examples of script integration into BP:

advanced-script-integration-with-batchpatch

advanced-script-integration-with-batchpatch-part-2

batchpatch-custom-script-integration-install-windows-updates-only-after-stopping-a-specified-service

Another option would be to perform the deployment through BP instead of through SCCM. Then you wouldn’t have the issue of the command not executing at the desired time. A BP deployment would execute at the time you choose to execute it.

-Doug

[Author]

Posts