SCCm Client Not Running Properly - No Logon/Logoff Information
We are using SCCM Client on our machines and I noticed that in some machines SCCM does not seem to detect any user logon/logoff information. Execmgr does not have the logoff/logon information. In machines that have the SCCM working properly i noticed that everytime I logon/logoff the following entries show up in ccmecxec.log: SystemTaskProcessor::QueueEvent(Logoff, 0)CCMEXEC1/23/2009 11:30:25 AM5572 (0x15C4)BEGIN ExecuteSystemTasks('Logoff')CcmExec1/23/2009 11:30:25 AM5572 (0x15C4)Invoking system task 'FileBITSLogoff' via ICcmSystemTask2 interface.CcmExec1/23/2009 11:30:25 AM3092 (0x0C14)Invoking system task 'ExecmgrLogoff'.CcmExec1/23/2009 11:30:25 AM3092 (0x0C14)Invoking system task 'SchedulerLogoff' via ICcmSystemTask2 interface.CcmExec1/23/2009 11:30:25 AM3092 (0x0C14)Invoking system task 'SrcUpdateLogoff'.CcmExec1/23/2009 11:30:25 AM3092 (0x0C14)Invoking system task 'RebootCoordLogoff'.CcmExec1/23/2009 11:30:25 AM3092 (0x0C14)Invoking system task 'UpdatesDeploymentLogoffTask'.CcmExec1/23/2009 11:30:26 AM3092 (0x0C14)END ExecuteSystemTasks('Logoff')CcmExec1/23/2009 11:30:26 AM5572 (0x15C4)SystemTaskProcessor::QueueEvent(Logon, 0)CCMEXEC1/23/2009 11:31:06 AM5572 (0x15C4)BEGIN ExecuteSystemTasks('Logon')CcmExec1/23/2009 11:31:06 AM5572 (0x15C4)Invoking system task 'FileBITSLogon' via ICcmSystemTask2 interface.CcmExec1/23/2009 11:31:06 AM3092 (0x0C14)Invoking system task 'ExecmgrLogon'.CcmExec1/23/2009 11:31:06 AM3092 (0x0C14)Invoking system task 'SchedulerLogon' via ICcmSystemTask2 interface.CcmExec1/23/2009 11:31:07 AM3092 (0x0C14)Invoking system task 'SrcUpdateLogon'.CcmExec1/23/2009 11:31:07 AM3092 (0x0C14)Invoking system task 'DTSLogon'.CcmExec1/23/2009 11:31:07 AM5808 (0x16B0)Invoking system task 'NetworkProxyLogonTask'.CcmExec1/23/2009 11:31:07 AM5808 (0x16B0)Invoking system task 'PolicyEvaluator_Logon'.CcmExec1/23/2009 11:31:07 AM4976 (0x1370)Triggered update of logged-on user settingsCcmExec1/23/2009 11:31:07 AM4976 (0x1370)Invoking system task 'LSLogon'.CcmExec1/23/2009 11:31:07 AM4976 (0x1370)Invoking system task 'RebootCoordLogon'.CcmExec1/23/2009 11:31:07 AM5808 (0x16B0)Notifying endpoint 'SrcUpdateMgr' of __InstanceModificationEvent settings change on object SMS_MPProxyInformation=@ for user 'S-1-5-18'.CCMEXEC1/23/2009 11:31:07 AM1700 (0x06A4)Notifying endpoint 'LS_ScheduledCleanup' of __InstanceModificationEvent settings change on object SMS_MPProxyInformation=@ for user 'S-1-5-18'.CCMEXEC1/23/2009 11:31:07 AM1564 (0x061C)Notifying endpoint 'SrcUpdateMgr' of __InstanceModificationEvent settings change on object SMS_MPProxyInformation=@ for user 'S-1-5-18'.CCMEXEC1/23/2009 11:31:07 AM1700 (0x06A4)Notifying endpoint 'LS_ScheduledCleanup' of __InstanceModificationEvent settings change on object SMS_MPProxyInformation=@ for user 'S-1-5-18'.CCMEXEC1/23/2009 11:31:07 AM1564 (0x061C)Notifying endpoint 'SrcUpdateMgr' of __InstanceModificationEvent settings change on object SMS_LocalMP=@ for user 'S-1-5-18'.CCMEXEC1/23/2009 11:31:07 AM1700 (0x06A4)Invoking system task 'UpdatesDeploymentLogonTask'.CcmExec1/23/2009 11:31:07 AM3092 (0x0C14)END ExecuteSystemTasks('Logon')CcmExec1/23/2009 11:31:07 AM5572 (0x15C4) Execmgr.log shows: The user has logged off.execmgr1/23/2009 8:58:07 AM4332 (0x10EC)Execution Manager timer has been fired.execmgr1/23/2009 8:59:07 AM4152 (0x1038)A user has logged on.execmgr1/23/2009 8:59:25 AM3804 (0x0EDC) These entries do not show up at all on the 'problem' machines. The weird thing is everything seems to be working on these 'problem'machines - hardware inventory, software inventory, software updates, and advertisements that do not require user logon. However, for advertisements that require user logon or one that requires going to 'Run Advertised Program' they cannot be run. An error on the execmgr says, "user xxx\xxxx is not logged on". I know that this is not a server problem because it is not happening on all the client machines. Most machines are running properly. I also cannot find any pattern with the problem machines. All our machines are Windows XP 2 & 3. I already tried the following but they did not help the problem: -uninstall/reinstall sccm-deleted smscfg.ini-repair wmi-disabled firewall-applied all required microsoft updates I am running out of ideas and resetting up all the problem machines is not possible right now. Anyone has any idea how to fix this ?
January 23rd, 2009 7:59pm

Hello there, It might be worth checking the audit policy on those 'problem' machines. I'm not sure how the client logon/off detection works, but it may belooking for a specific security event log message IDs. Matt.
Free Windows Admin Tool Kit Click here and download it now
January 27th, 2009 2:04pm

This has already been discussed here in the forums.http://support.microsoft.com/kb/905794/en-usmight help (although it's for SMS 2003; "more information" contains additional information).
January 27th, 2009 2:28pm

I forgot to mention that I did look at that kb article and did evrything that was suggested but still did not work.
Free Windows Admin Tool Kit Click here and download it now
January 27th, 2009 6:35pm

I forgot to mention that I did look at that kb article and did evrything that was suggested but still did not work. I am having the same problem on some of our client machines, and so far I have not found the cause of the problem. Uninstall and re-install of the client is not an option for some of them; and didn't work where I have tried it.The KB article referenced above does have some information, but I haven't figured out how to use it to track down whythe user logon and logoff events NEVER appear in the execmgr.log file. I'm not sure I can understandabout the timing of a user logon versus the service startup - but I have been testing for a little whileon a client exhibiting the problem, andno user logon/logoff events are recorded in the execmgr.log file at any point, regardless of how long I wait until logging on.So, the only information that I have so far is that the clients that will not run logoff or logon dependent task sequences also do not show any user logon or logoff events in the execmgr.log file, while those that do run those sameadvertised task sequences as expected (and when expected) do show the user logon and logoff events in the execmgr.log file.This is very frustrating - has anyone any suggestions for troubleshooting?Where should I start digging next?
May 27th, 2009 12:29am

You should consider calling CSS to get help as this topic is too complex to be solved in the forums IMHO.
Free Windows Admin Tool Kit Click here and download it now
May 27th, 2009 10:24am

I did open a support call with Microsoft. I worked with the support for 1 week and support could not resolve the problem either. On top of that, support broke our server when she changed some setting in the server. I had to create another call to have another support fix the server problem.Anybody out there has a solution to this issue?
July 31st, 2009 8:50pm

I can offer this - it isn't a security audit log policy from what I've seen. The current customer I am working with doesn't have the security audit log configured (security is empty in even log) - I'm working to change that. In any case the execmgr.log on a system in this environment shows "User Logged on" and "User Logged off".This doesn't solve your issue but it is at least more info to keep you from tracking down in the wrong direction. I'll do some thinking on this one also.
Free Windows Admin Tool Kit Click here and download it now
July 31st, 2009 9:12pm

On the systems affected, do they happen to be logging in locally by chance?
July 31st, 2009 9:21pm

Yes, they are logged in locally.
Free Windows Admin Tool Kit Click here and download it now
July 31st, 2009 9:52pm

What happens when they logon to the domain? That could be the issue actually.
July 31st, 2009 11:18pm

login scripts run (for connection to appropriate shared drives)group policy runs
Free Windows Admin Tool Kit Click here and download it now
August 3rd, 2009 9:06pm

What I mean is does SCCM work as expected? My experience, if you are logging in locally SCCM will not do what you want it to do and you need to be logged into the domain. Does the problem go away if the user is logged into the domain instead of logged on to the computer directly as a local computer account?
August 5th, 2009 6:46am

Oh, ok, I misinterpreted what you meant. Let me correct what I said then. When I said the machines are logged in locally I meant they are logged in to the domain locally not remotely thru VPN. So yes, when they are logged in to the domain, the problem is there but the rest of SCCM works fine. Again, this is not happening on all machines, unfortunately, one of the users having this problem is the head of the IT department.
Free Windows Admin Tool Kit Click here and download it now
August 5th, 2009 6:02pm

Can I get client log off report from SCCM?
February 1st, 2010 1:33pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics