Sorry about the long title, but I wanted to help you find this article if you’re searching for assistance with a common environment issue that affects your ability to manage computers with System Center Essentials Essentials.

If while looking at computers in the Computers workspace in the Essentials console, if you notice a managed computer with any of these symptoms:

• Hardware and software inventory is displayed as ‘Unknown’
• Software and Update status is ‘Unknown’
• Last Contacted is ‘Not yet contacted’

the managed computer is not being fully managed by Essentials. Essentials uses the Operations Manager agent to provide monitoring and remote task execution on managed computers, and the Windows Update agent to provide software distribution, update management and inventory collection on managed computers.  In this case, the Windows Update agent on the managed computer is not properly reporting to the Essentials server, which is why the status for these areas is ‘Unknown’.

We’ve added monitoring in Essentials 2010 to alert you when managed computer are affected by this issue, but it also can be easily detected by looking at managed computers in the Computers workspace.  Here are screenshots of how this issue is displayed in both Essentials 2007 and Essentials 2010.

Essentials 2007

Essentials 2010

Note:  The description, asset tag and BIOS serial number properties are collected via the Ops Mgr attribute discovery process instead of via Windows Update agent inventory collection.

Troubleshooting Configuration: Group Policy

Essentials uses group policy to configure the Windows Update agent on the managed computer to report to the Essentials server.  The first area to investigate is whether the managed computer is receiving and applying this policy.

Troubleshooting Steps

1. On the managed computer that is not reporting to the Essentials server, open Registry Editor and navigate to:
   
   HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate
   
   and verify that the WUServer and WUStatusServer values are set to:
   
   https://<FQDN of your Essentials server>:8531
   
   If its set to the Essentials server, jump to Windows Update log section, else continue to step 2.
   
   
   
2. If you have configured the Essentials server to use domain group policy, verify that the managed computer is a member of the ‘SCE Managed Computer <management group name>’ Security Group located in the Users container in your Active Directory domain.  If the computer is not a member, add the computer object to the security group, and restart the managed computer. 
3. If you have configured the Essentials server to use domain group policy, run ‘gpresult.exe /v’ on the managed computer to determine if the computer is receiving the ‘SCE Managed Computer <management group name>’ group policy.  If the computer is not applying the policy, use the Troubleshooting Group Policy in Microsoft Windows Server guide to assist you: http://www.microsoft.com/downloads/details.aspx?familyid=b24bf2d5-0d7a-4fc5-a14d-e91d211c21b2&displaylang=en
4. If you have configured Essentials to use local policy, a scheduled task runs once per day that configures the local group policy object on the managed computer.  Use Resultant Set of Policy (rsop.msc) to investigate if there is an Active Directory group policy (which has a higher order of precedence) that is overriding the Windows Update agent configuration in the local group policy object.

Troubleshooting Connectivity: Windows Update log

Now that you’ve verified that the Windows Agent is configured to report to the Essentials server, the next step is to check out the Windows Update log on the managed computer to verify its attempting to contact the Essentials server and is successful.

1. Open the Windows Update log on the managed computer; the log can be found at %windir%\windowsupdate.log.
2. Scroll to the bottom of the log file and look for the last attempt to contact.  A successful communication will look like this:

2010-02-24    08:13:04:445    1076    2450    PT    +++++++++++  PT: Synchronizing server updates  +++++++++++
2010-02-24    08:13:04:547    1076    2450    PT      + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = https://sceserver.contoso.com:8531/ClientWebService/client.asmx
2010-02-24    08:13:35:580    1076    2450    PT    WARNING: Cached cookie has expired or new PID is available
2010-02-24    08:13:35:587    1076    2450    PT    Initializing simple targeting cookie, clientId = 897ad25c-b27c-4124-a938-c3d609793c6c, target group = , DNS name = myclient.contoso.com
2010-02-24    08:13:35:587    1076    2450    PT      Server URL = https://sceserver.contoso.com:8531/ClientWebService/client.asmx
2010-02-24    08:13:41:980    1076    2450    PT    +++++++++++  PT: Synchronizing extended update info  +++++++++++
2010-02-24    08:13:41:980    1076    2450    PT      + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = https://sceserver.contoso.com:8531/ClientWebService/client.asmx
2010-02-24    08:13:42:280    1076    2450    Agent      * Found 0 updates and 53 categories in search; evaluated appl. rules of 437 out of 560 deployed entities
2010-02-24    08:13:42:357    1076    2450    Agent    *********
2010-02-24    08:13:42:357    1076    2450    Agent    **  END  **  Agent: Finding updates [CallerId = AutomaticUpdates]
2010-02-24    08:13:42:357    1076    2450    Agent    *************

An unsuccessful attempt will look like this:

2010-03-29    09:23:57:662    1132    1f80    Agent    *************
2010-03-29    09:23:57:662    1132    1f80    Agent    ** START **  Agent: Finding updates [CallerId = Windows System Health Agent Search]
2010-03-29    09:23:57:662    1132    1f80    Agent    *********
2010-03-29    09:23:57:662    1132    1f80    Agent      * Include potentially superseded updates
2010-03-29    09:23:57:662    1132    1f80    Agent      * Online = Yes; Ignore download priority = No
2010-03-29    09:23:57:662    1132    1f80    Agent      * Criteria = "IsInstalled=0 and CategoryIDs contains '0fa1201d-4330-4fa8-8ae9-b877473b6441'"
2010-03-29    09:23:57:662    1132    1f80    Agent      * ServiceID = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7} Managed
2010-03-29    09:23:57:662    1132    1f80    Agent      * Search Scope = {Machine}
2010-03-29    09:23:57:834    1132    1f80    PT    +++++++++++  PT: Starting category scan  +++++++++++
2010-03-29    09:23:57:834    1132    1f80    PT      + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = https://sceserver.contoso.com:8531/ClientWebService/client.asmx
2010-03-29    09:24:18:958    1132    1f80    Misc    WARNING: Send failed with hr = 80072ee2.
2010-03-29    09:24:18:958    1132    1f80    Misc    WARNING: SendRequest failed with hr = 80072ee2. Proxy List used: <(null)> Bypass List used : <(null)> Auth Schemes used : <>
2010-03-29    09:24:18:958    1132    1f80    PT      + Last proxy send request failed with hr = 0x80072EE2, HTTP status code = 0
2010-03-29    09:24:18:958    1132    1f80    PT      + Caller provided credentials = No
2010-03-29    09:24:18:958    1132    1f80    PT      + Impersonate flags = 0
2010-03-29    09:24:18:958    1132    1f80    PT      + Possible authorization schemes used =
2010-03-29    09:24:18:958    1132    1f80    PT    WARNING: StartCategoryScan failure, error = 0x80072EE2, soap client error = 5, soap error code = 0,

Notice the WARNING and error codes I’ve bolded in the log excerpt.  These are issues that are preventing the Windows Update agent from communicating with the Essential server.  Check out these article for specific guidance on how to troubleshoot these errors and warnings:

How to read the Windowsupdate.log file
http://support.microsoft.com/kb/902093

Windows Update Agent Result Codes
http://technet.microsoft.com/en-us/library/cc720442(WS.10).aspx

How the Windows Update client determines which proxy server to use to connect to the Windows Update Web site
http://support.microsoft.com/kb/900935

If you use image-based OS deployment: Troubleshooting duplicate SUSClient ID

If you have many managed computers that are not reporting to the Essentials server, and you use an image to install the operating system on computers, the most likely cause of this issue is that the managed computers are sharing the same SUSClientID.  The WSUS technology in Essentials uses the SUSClientID to uniquely identify each managed computer that contacts the Essentials server.  If more than one computer is using the same duplicate SUSClientID, only the first computer that reports to the Essentials server will be fully managed.

If this is the case in your environment, check out these articles for cleaning up this issue, and also fix your image so that you do not have to deal with this issue in the future.

A Windows 2000-based, Windows Server 2003-based, or Windows XP-based computer that was set up by using a Windows 2000, Windows Server 2003, or Windows XP image does not appear in the WSUS console
http://support.microsoft.com/kb/903262

Resolving the duplicate SUSClientID issue, or “Why don’t all my clients show up in the WSUS console?”
http://blogs.technet.com/sus/archive/2009/05/05/resolving-the-duplicate-susclientid-issue-or-why-don-t-all-my-clients-show-up-in-the-wsus-console.aspx

We’d appreciate your feedback on this article or your experiences troubleshooting this issue:

http://social.technet.microsoft.com/Forums/en-US/systemcenteressentials/thread/75ee711f-3de1-4719-aa11-082b7db142e3