One of the most time consuming tasks for a SCCM administrator is Client Health.  This task can be cumbersome and tedious.  SCCM 2012+ has introduced new self-healing features, but at the core there is always going to be client health troubleshooting.  Often I find support groups will not attempt to troubleshoot client health issues due to the complexity of the SCCM logs.  Log locations, names, and quantity often shy away our first tier support teams from performing basic troubleshooting.  Knowledge articles help, as well as third party client tools such as “Client Center” and Cireson’s “ConfigMgr Remote Manage App”, but there is still a dependency on the technician knowing how to locate and parse the log.

To help technicians troubleshoot and retrieve the correct logs, I have created a Self-Service automated offering.  This offering will automatically retrieve the SCCM logs in relation to the symptom of the client.  The client and server logs will be copied to a central location and also contain other important information about the client’s health, such as available disk space, client connectivity, etc.  If you are using Service Manager, you can automatically attach these logs to a ticket.  Let’s see the process flow of this Self-Service offering:

SCSM/Cireson Portal–>Orchestrator–>Configuration Manager–>File Share or Ticket

First the Technician will select the client from SCSM’s portal or for this example Cireson’s IT Service Portal.  I have also included tasks such as “Repair SCCM Client”, “Reset Machine Policy”, and Pinging the client from the SCCM Server using both IP and Hostname to validate connectivity and DNS. “Log Type” will determine what logs are selected on the next menu.


SCSM /Cireson Portal Basic Troubleshooting


Since “Client Discovery” is the issue we are troubleshooting, all logs pertaining to “Client Discovery” are automatically selected.



SCSM / Cireson Portal Log Files


Client Discovery Logs that will be retrieved.


Client Discovery


Now SCSM will “feed” the information selected to Orchestrator.  Orchestrator now kicks of multiple functions based on these selections.


SCORCH Runbook


Lets take a look at what PowerShell Orchestator is performing in this Runbook.


Repair Client PowerShell properties


*This is for SCCM 2012 R2 SP1 client, 1511+ may need to be updated.



Repair Client PowerShell code



Reset Machine Policy Properties



Reset Machine Policy PowerShell code



Connect to the SCCM server from the client using IP



Connect to the SCCM server from the client using name



Client Discovery PowerShell Properties



Client Discovery PowerShell code





File Share containing logs from both client and sccm server with connectivity logs.



Connectivity Logs



Include Drive Space information and create an SCSM Incident with the log files uploaded to the ticket.


Drive Space info and Incident Creation with logs



Disk_Space.txt log



We have created a process to centralize both client and server logs.  There is no longer a need to manually hop between the client and server to retrieve logs or use knowledge articles to track down the appropriate logs.  Simply select the “Log Type” and all logs relevant will be captured.  In addition to SCCM logs we have built in Client Repair, Reset Machine Policy, Connectivity troubleshooting, Drive Space availability, and the ability to create a ticket from this Self-Service automated offering.


I have uploaded the Runbooks and scripts here.