Better understanding of 'Unknown Clients'

[JacobE]

Hi all,

 

For a while now I've been trying to figure out and get my head around a better understanding of 'Unknown' Clients within SCCM along with trying to eliminate them. We have adjusted our clean up rules for older machines which has reduced this down a lot, but I would like to figure out why we keep getting odd ones here and there. This will help with our monthly stats.

 

For example, on our Baseline configuration we are currently seeing this:

 

 

So I'm assuming 'Client check passed/Inactive' means these are machines which were previously responding to SCCM but are currently switched off, unplugged, offline etc. IE basically defunct old machines or currently not in use and will be removed from SCCM within 30 days.

 

What I don't understand is the 'Client check passed/Active' column. The machines are online, pinging, the SCCM client appears to be functioning correctly from what I can see yet we are still seeing these 24 machines.

 

Can anyone offer an explanation to why this could happening, or suggestions on where to check to work on resolving this please? I'm going to guess that ideally we would have X amount of machines as inactive and won't be older than 30 days and then 0 as 'active' in the unknown tab.

Thanks in advance!

Jake

 

 

EDIT: To add to this, just looking at another deployment on the same collection and now seeing this result.

 

 

This is something that baffles me even more, why are these unknown clients not consistent even though it's looking at the same collection?

[Steve G.]

This is something I see a lot of with Patch Tuesday deployments. My takeaway is that "Unknown" is something of a misnomer. For each system, a deployment's status starts as "Unknown", moves to "In-Progress", and finishes as "Compliant". What's missing from the UI that ought to have been included is a "Pending" or "Waiting" status. This is vexing because in 2007, you could easily open a log that aggregated all client messages in one place, and would display the advertisement status at every step. You would get a notification as to why it hadn't started yet.

 

In 2012, on the other hand, a computer that has not yet kicked off the deployment remains in the hellish limbo of being "Unknown", with no details provided at this step. If you want to know why, I'm afraid you must strap on your pit helmet and start digging through client logs one at a time. If active clients are remaining in an unknown status for a long time for a required deployment, that may indicate that they are processing some other deployment, with a likely hold-up being a pending restart (at least on mine, as we don't force workstations to reboot after updates).