Policies not updating after collection updated by dynamically add new resources
I've got an issue on SCCM 2007 SP3 with a collection and software advertisments. The collection is set to update at 50 minutes past the hour with a dynamic query. I have also selected the option to dynamically add new resources to the collection. Which adds new computers after around five minutes as expected. The problem is that advertisements are not being sent to the client, even though I'm checking for new machine policies on the client every few minutes. As soon as I check for new machine policies once the automated collection update runs (at 50 minutes past the hour), the packages deploy to the client. I can see the clients being added to the collection dynamically in the colleval.log file. I can also see in the policypv.log that it seems to evaluate policy assignments every 60 minutes. This is the issue I am seeing, computer assigned to the collect on the hour, has to wait at least 50 minutes before it gets it's assignments. Any idea if I can speed up the policy assignment? I would have thought that should run after it dynamically updated the collection. Thanks in advance, Adam
May 31st, 2012 8:24am

Policypv should kick off as soon as there were any changes, not only every 60 minutes. Do you see the advertisement listed if you bring up the properties of a client after it was added to the collection? Is this a single site or a hierarchy?Torsten Meringer | http://www.mssccmfaq.de
Free Windows Admin Tool Kit Click here and download it now
May 31st, 2012 9:07am

I can see the advertisement listed in the client properties, so it has mapped it. The client is a WES 7 client which I'm getting to check for policy updates every 2 minutes after the build process. It's stand-alone in a workgroup. Connect in fine to the SCCM server which is in Mixed mode in a single site. Snippets below from the logs to show that SCCM has seen it and also the policy log which shows not much going on. If I wait another 30 minutes policypv.log will show that it's found a resource to policy mapping. Adam CollEval.log MonitorCollectionsIncremental - 1 changed resources are awaiting evaluation. SMS_COLLECTION_EVALUATOR 31/05/2012 15:15:54 7020 (0x1B6C) Incrementally refreshing results for collection H010002F SMS_COLLECTION_EVALUATOR 31/05/2012 15:15:54 7020 (0x1B6C) Results refreshed for collection H010002F, 0 entries changed. SMS_COLLECTION_EVALUATOR 31/05/2012 15:15:54 7020 (0x1B6C) Incrementally refreshing results for collection H0100030 SMS_COLLECTION_EVALUATOR 31/05/2012 15:15:54 7020 (0x1B6C) Results refreshed for collection H0100030, 1 entries changed. SMS_COLLECTION_EVALUATOR 31/05/2012 15:15:55 7020 (0x1B6C) COLLEVALTHREAD- Succeeded in incremental monitor collections. Will monitor again in 4 minutes SMS_COLLECTION_EVALUATOR 31/05/2012 15:15:55 7020 (0x1B6C) Policypv.log Waiting for changes... SMS_POLICY_PROVIDER 31/05/2012 14:56:44 5892 (0x1704) File notification triggered. SMS_POLICY_PROVIDER 31/05/2012 15:19:09 6412 (0x190C) --Process Collection Changes SMS_POLICY_PROVIDER 31/05/2012 15:19:19 6412 (0x190C) Building Collection Change List from Collection Change Notification files SMS_POLICY_PROVIDER 31/05/2012 15:19:19 6412 (0x190C) Detected member change for collection 59. SMS_POLICY_PROVIDER 31/05/2012 15:19:19 6412 (0x190C) --WaitForEvents SMS_POLICY_PROVIDER 31/05/2012 15:19:19 6412 (0x190C) Waiting for changes for 60 minutes SMS_POLICY_PROVIDER 31/05/2012 15:19:19 6412 (0x190C) File notification triggered. SMS_POLICY_PROVIDER 31/05/2012 15:19:19 6412 (0x190C) --Process Collection Changes SMS_POLICY_PROVIDER 31/05/2012 15:19:29 6412 (0x190C) Building Collection Change List from Collection Change Notification files SMS_POLICY_PROVIDER 31/05/2012 15:19:29 6412 (0x190C) --WaitForEvents SMS_POLICY_PROVIDER 31/05/2012 15:19:29 6412 (0x190C) Waiting for changes for 60 minutes SMS_POLICY_PROVIDER 31/05/2012 15:19:29 6412 (0x190C)
May 31st, 2012 10:28am

A few comments here: - Policies are never "sent" to the client. Everything in ConfigMgr is client pull and policies are only pulled by a client based upon the machine policy polling interval. - Clients aren't actually part of a collection until the collection updates. - Dynamic Collection updates only take into account brand new resources, not those that existed before - "I would have thought that should run after it dynamically updated the collection". Why? Clients no nothing about what goes on on the server and must wait until their policy interval (see the first point above). What you've described above is normal and expected behavior. To speed this process up, you can decrease the machine polic polling interval (do not decrease this below 15 minutes though) or you can manually initiate the policy poll after the collection has been updated so that it includes resources that fullfill the query.Jason | http://blog.configmgrftw.com | Twitter @JasonSandys
Free Windows Admin Tool Kit Click here and download it now
May 31st, 2012 12:03pm

Hi Jason, I understand that SCCM doesn't push policies to clients, and that they need to pull them down. As my first posting state, I am pulling a policy refresh every two minutes (through a script). As for the "I would have thought that should run after it dynamically updated the collection", I mean that when my client pulls the policy once its object has been added to the collection, it should see the advertisement. For some reason the SCCM server isn't firing off a policy evaluation once a client is added to the collection using dynamic additions. Even if I force an update collection and then pull the policy it doesn't refresh the policy until the scheduled "60 minute" refresh. Adam
May 31st, 2012 12:30pm

What does "dynamic additoins" mean? Are you using Dyanmic Queries? Are you using new dynamic collection updates feature from R3? Refreshing a policy every two minutes on a client is way excessive and will cause you problems. Policy refreshes on clients are far from instaneous and take time to process proportional to how many things you have advertised to it. Polling too often does not allow this policy refresh to fully complete. How are you initiaing the policy refresh on the client side?Jason | http://blog.configmgrftw.com | Twitter @JasonSandys
Free Windows Admin Tool Kit Click here and download it now
May 31st, 2012 12:43pm

Yes, I am using dynamic queries with the new dynamic collection update feature from R3. I have a VBscript script that runs and calls the CCM applet, finds the machine policy update task and then initiate the action. I can turn down the frequency of how often I call this to every five minutes but this won't change much. The client finishes processing within the two minutes as it doesn't have much to do (can tell from the logs). Even if I refresh the policies manually every 5-10 minutes I am seeing the same issue. Adam
June 6th, 2012 5:05am

I've managed to resolve my issue. It seems as though you can set the policy refresh interval on a collection, this is 60 minutes by default. I have reduced this to 10 minutes for the single collection. Info was found on MS site. http://technet.microsoft.com/en-us/library/bb932185.aspx Adam
Free Windows Admin Tool Kit Click here and download it now
June 22nd, 2012 10:43am

Every two minutes is way too aggressive and is probably why you were seeing issues. It often takes a client more than two minutes to fully download and (more importantly) process all of the policies available for it. Refreshing policies that frequently will make the client policy engine step all over itself. 10 minutes is an absolute minimum anyone will every recommend and most will recommend never going below 15 (including Microsoft).Jason | http://blog.configmgrftw.com | Twitter @JasonSandys
June 22nd, 2012 1:59pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics