Hello all,
I'm facing a problem here, where our SCCM 2012 v. 5.0.7711.0 isn't running the automatic deployments for the definitions updates of the SCEP 2012 antivirus.
The problem goes like this:
1) I create the auto. dep. rule in the Automatic Deployment Rules tab underSoftware library.
2) Everything is set up according to this guide Step 4: windows-noob.com/forums/index.php?/topic/4466-using-sccm-2012-rc-in-a-lab-part-5-enable-the-endpoint-protection-role-and-configure-endpoint-protection-settings
3) There are other minor differences in our internal settings, like we don't use alerts and we sort the updates by"Udate Classification"
4) Then, I check if there are any new definitions updates in the "All Software Updates" tab in SCCM. There are new ones, so - I don't want to wait and I run the newly created automatic deployment by clicking on"Run Now"
5) Then, the auto deployment rule starts working, grabs the new updates, puts them in the package. The package then start distributing the content to our distribution points and clients get updated, as I watch the compilance number growing on the deployment
of that package.
6) So, the auto deployment rule is working fine I think and I want to wait until7:20 AM where we have scheduled the rule to run.
7) The next day, the auto deployment rule doesn't run / stops at weird state as I check the ruleengine.log
Here are some notes I took from the log this morning:
FindNextEventTime found next event for RuleID 16777221 as :9/10/2013 7:20:00 AM
RuleSchedulerThred: Timeout Signalled. RuleEngine needs to run one or more of the Rules...
Marked RuleID 16777221 for Evaluation. Updated Next Occurence as :9/11/2013 7:20:00 AM
FindNextEventTime found next event for RuleID 16777217 as :9/11/2013 7:15:00 AM
RuleEngine: 1435 minutes is greater than MAX_TIME of 15 minutes, will sleep for MAX_TIME
Found notification file D:\APPS\ConfigMgr\inboxes\RuleEngine.box\16777221.RUL
SMS_RULE_ENGINE
9/10/2013 7:20:10 AM
4940 (0x134C)
Refreshed ScheduleList instance for Rule (16777221) from schedule string (50E99AC000100008) with next occurence (9/11/2013 7:20:00 AM)
I have skipped some gibberish from the log and extracted the important stuff. (at least I think)
If I take a look at this, I think, that there might be problem with other jobs being executed at the same time, or running simultaneously with the Definitions Update rule.
8) Just to be sure, that there were new updates this morning, I wrote down the number from the time, the last version was installed and then check the last available update version in "All Software Updates" - and there was a new update,
so the rule should have executed the update process.
9) At last, I have checked the date, when the Software Update Group for these updates was updated, and it resembles the date, when I ran the Auto Deployment Rule by hand.
10) To be completly sure, I've also checked the Antimalware policies and the policy for update source and the only one, that is checked is the "Updates Distributed from Configuration Manager" - as I understand it, this is the right option for the
clients to get the from the SCCM and not from the internet.
I'm out of ideas. I have tried to recreate the rule several times and still doesn't work.
Please help... I'll be glad for any idea, that might help resolving this issue.
Thank you in advance for your knowledge.
- Jiří Š.