PowerShell Script: SCCM Health Check

Written by Tao Yang

30/01/2012: This script has been updated to version 3.5. Details can be found HERE. The download link on this article has also been updated to version 3.5.

26/05/2011: Version 3.3 has been posted here. The download link to the script on this post is also updated to the new version 3.3.

21/04/2011: Please be advised that I have posted a newer version of the script here. The existing script download link on this page has also been updated to point to the newer version. For the chanages in newer version, please refer to my updated post.

Over the last few months, I have been working on a PowerShell script to perform some health check activities for a customer’s entire SCCM environment. This is to provide a snapshot of health state of some elements of SCCM environment at a point of time since there is no SCOM in that environment to monitor SCCM at this stage.

Download the script here

The script checks the following:

  1. Ping check all servers in the SCCM infrastructure
    • If first ping fails, wait for number of seconds (defined in XML file) then attempts to ping few more times (Number of retries defined in XML file).
    • if returns any successful pings, ping test is classified as success.
  2. DNS name resolution check for all servers in SCCM infrastructure
    1. forward lookup check
    2. reverse lookup check
    3. compare DNS A record with the FQDN that’s set on the server
  3. All site systems in warning or critical state
  4. All site components in warning or critical state
  5. All package distribution with issues
  6. Checks all Non-PXE boot image packages in PXE DP share
  7. Checks any inboxes that contain number of files that’s over the threshold (threshold is set in the XML file)
  8. Checks availability of Inbox folders on all primary site servers
  9. Checks SCCM site backups on all primary sites within the “DaysToCheck” that’s set in XML file.
  10. Checks any errors in SQL server and SQL agent logs
  11. Checks Application logs on SQL servers for any SQL related errors.

What’s included in this script:

image

  1. SCCM-HealthCheck.ps1: the actual PowerShell script
  2. Health-Check.xml: contains all configuration settings for the script. this file needs to be modified to suit your environment before running the script.
  3. DIRUSE.exe: This is from Windows 2000 Resource Kit (http://support.microsoft.com/kb/927229). it is used to retrieve SCCM inboxes information. I have chosen to use this rather than the native PowerShell cmdlet Get-ChildItem because DIRUSE.EXE retrieves the information much faster against remote servers than Get-ChildItem.

Configuring the script:

The health check script reads all the settings from Health-Check.xml which is located in the same folder as the script.

You’ll need to Configure the XML according to the following:image

Note: If you are having trouble reading the text on above image, this image can be download here

Output:

  1. The script has the option to email out the health check report (can be switched on and off in XML file)
  2. The email body is in HTML format that contains the overall status of each check.
  3. The detailed report is in TXT format and it is attached to the email. it is also located in the same folder as the script with the timestamp. if emailing is turned off, the detailed report can be located there.

Below is a sample HTML email body generated from my test environment:

email report

Security Requirement:

  1. The PowerShell execution policy on the computer that’s running the script needs to be set to at RemoteSigned or Unrestricted.
  2. The account used to run this script needs to have:
    1. local admin rights on Central site server, Central site provider server (if not the site server itself)
    2. In the SQL servers, sysadmin rights or at least access to the master DB on all SQL servers to be able to read SQL server and agent logs.
    3. SMS admin access on all primary sites
    4. NTFS read permission to “inboxes” folders on all primary site servers.
  3. Scheduling the script in Windows Task Scheduler:
    1. “Allow log on as batch job” rights is required for the user account to run scheduled jobs.
    2. if scheduling in Windows 2008 or later, please make sure “Run with highest privileges” is ticked to bypass UAC (User Account Control)

Other Requirements:

  1. The operating system for SQL servers has to be Windows 2008 or later. This is because Get-WinEvent is used to read event log rather than using Get-EventLog because Get-EventLog does not support server side filtering. Therefore Get-WinEvent is used to improve performance when reading remote event logs. However, Get-WinEvent only works on Vista and later version of Windows.
  2. PowerShell Version 2 is required to run the script.

What’s Next?

I’m planning to re-write some part of the script to give us an option to utilise PowerShell Remoting wherever is suitable. This will greatly improve the performance of the script (especially when gathering inboxes information across the WAN link). When this is done, Get-ChildItem can be used and executed locally on each site servers and eliminate the needs for DIRUSE.EXE.

I’ll get this done in the next few weeks and post it here once it’s done.

26 comments on “PowerShell Script: SCCM Health Check

  1. Great work and very useful! Thank you for your time and efforts!

  2. Awesome as usual.

  3. Pingback: SCCM health check script | - danovich.com.au -

  4. Pingback: Updated: SCCM Health Check PowerShell Script | Tao Yang's System Management Blog

  5. Pingback: SCCM Health Check PowerShell Script Updated to Version 3.3 | Tao Yang's System Management Blog

  6. Nice job!! Could you also include “Disk Space” and “System Performance” in future version? 🙂

  7. Pingback: SCCM Health Check Script Updated: Version 3.5 | Tao Yang's System Management Blog

  8. I have remote signed set but the script says it cannot run I am new to power shell could I be doing something wrong. My Central site is win 2008 sp2.

  9. How do you enable PSRemoting on site servers? We have Windows Server 2008 R2 servers.

  10. Pingback: PowerShell Script: SCCM Health Check | Tao Yang’s System Management Blog « trumby87

  11. Hi TAO, Hatts off, you are the real master of power shell, i am great fan of yours, keep rocking..

    Can i get script to compare AD machines against SCCM machines, tried below blog but no luck.. 🙁 , please help me

    http://powershell.com/cs/media/p/14814.aspx

  12. Dear Tao Yang,

    Good Job.

    But i have couple of issues.

    The first one is, the inboxes size check states that..
    “C:\Program Files\Microsoft Configuration Manager
    \inboxes\ “is not Accessible. please check”.

    The second issue is, the report shows that.. the numbers of Errors, Warnings and Information records are not similar like Site Status in the SCCM console.

    Note: i tested the script on multiple servers in a different domain sites.

    Please provide assistance.
    Best Regards

    • Hi Khaled,

      For the problem with inbox size check, please make sure the account that you are running this script under has NTFS permission to the inboxes folder.

      As for your second issue, it’s not really an issue. In the XML, we specify “DaysToCheck”, by default, it’s set to 1 day. in the script, I set the Tally Interval to the previous day. In SCCM console, the default Tally Interval is set to “Since 12:00:00 AM” (This is under Site Management\\Site Settings\Status Summary). For more information about Tally Interval can be found here: http://msdn.microsoft.com/en-us/library/cc144112.aspx

      I hope this helps.

  13. My company uses SCCM for patch management purpose and the reporting feature in SCCM does not suit our needs. Would you be able to create a script that can retrieve the current patch level of all SCCM clients so that I can have a monthly report to check on the patch status.

    • Paul,
      As far as I know, you can turn on Win32_QuickFixEngineering class in sms_def.mof so the updates information is collected via hardware inventory. You will then be able to create such reports. However, I believe Win32_QuickFixEngineering only contains updates for the operating system. I don’t know if there is a way to collect meaningful information of application related updates / hot fixes via WMI.

  14. Very Nice one 🙂

  15. Does this script work with 2012R2 SCCM?

  16. Hi Tao,

    I have found an issue executing the script in SCCM 2012 R2 over Windows 2012 R2:

    En C:\Users\xxxxx\Desktop\SCCM-Health-Check-v3.5\SCCM-HealthCheck.ps1: 1030 Carácter: 71
    + Out-File -FilePath $output -InputObject “SCCM Health Check Report – $strDate:” …
    + ~~~~~~~~~
    La referencia de variable no es válida. El carácter ‘:’ no va seguido de un carácter de nombre de variable válido.
    Considere la posibilidad de usar ${} para delimitar el nombre.
    + CategoryInfo : ParserError: (:) [], ParseException
    + FullyQualifiedErrorId : InvalidVariableReferenceWithDrive

    Sorry about having that in spanish. It seems the error comes in because of $strDate is having a “:” just after the variable. I added a space in between and the problem was solved.

    Regards.

  17. Hi Tao, I’m getting this message, I’m running script on 2012 Sp1. Please advise.
    C:\Users\xxxxx\Desktop\SCCM-Health-Check-v3.5\SCCM-HealthCheck.ps1: 1030 Carácter: 71
    + Out-File -FilePath $output -InputObject “SCCM Health Check Report – $strDate:” …

    • Hi Tao,
      Thanks for the script. Nice job.

      Hi HK,

      To run this script in SCCM 2012 server, you just need to modify $strDate with using brackets like

      Out-File -FilePath $output -InputObject “SCCM Health Check Report – $($strDate):” -Append

  18. Hi Tao Yang,

    Encountered the below for the ping portion.

    Exception calling “Send” with “1” argument(s): “An exception occurred during a Ping request.”
    At C:\Users\admin\Downloads\SCCM-Health-Check-v3.5\SCCM-Health-Check-v3.5\SCCM-HealthCheck.ps1:758 char:2
    + $PingResult = $ping.send($computer)
    + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : PingException

    You cannot call a method on a null-valued expression.
    At C:\Users\admin\Downloads\SCCM-Health-Check-v3.5\SCCM-Health-Check-v3.5\SCCM-HealthCheck.ps1:759 char:6
    + if ($PingResult.Status.Tostring().ToLower() -eq “success”)
    + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull

    Would you be able to point me to the correct direction please.
    Thanks!

  19. Hi Does the script work on 2012? We have been using this on 2007 and this has been very helpful it catching issues before its been logged

  20. Am getting a bunch of errors! 🙁

    PS C:\Users\A0853> E:\PSTools\SCCM-Health-Check-v3.5\SCCM-Health-Check-v3.5\SCCM-HealthCheck.ps1
    At E:\PSTools\SCCM-Health-Check-v3.5\SCCM-Health-Check-v3.5\SCCM-HealthCheck.ps1:1030 char:71
    + Out-File -FilePath $output -InputObject “SCCM Health Check Report – $strDate:” …
    + ~~~~~~~~~
    Variable reference is not valid. ‘:’ was not followed by a valid variable name character. Consider using ${} to
    delimit the name.
    + CategoryInfo : ParserError: (:) [], ParseException
    + FullyQualifiedErrorId : InvalidVariableReferenceWithDrive

Leave a Reply