Client health and inactive clients checklist

Symptoms to confirm

• Monitoring › Client Status shows a growing share of inactive clients or failed client checks.
• Devices show Inactive in the Client Activity column of Assets and Compliance › Devices, or a failed client check in the details pane.
• Deployments to those devices stay in Unknown and their inventory is weeks old.
• The same computer appears twice, one record marked obsolete.

Likely causes

Configuration Manager tracks three different things, and mixing them up is the most common mistake:

• So inactive means the site hasn't heard from the device, while a failed check means the device reported something broken. An active client can fail its check, and a device that died months ago can still show its last Passed.

Checklist

1. 1

   Separate the dead from the broken

   In Monitoring › Client Status, select Client Activity or Client Check, scope the charts to a collection and drill into a category to list devices. For a reusable list, create a collection with this query:

   select SMS_R_System.ResourceID, SMS_R_System.ResourceType, SMS_R_System.Name,
     SMS_R_System.SMSUniqueIdentifier, SMS_R_System.ResourceDomainORWorkgroup, SMS_R_System.Client
   from SMS_R_System
   inner join SMS_G_System_CH_ClientSummary on SMS_G_System_CH_ClientSummary.ResourceId = SMS_R_System.ResourceId
   where SMS_G_System_CH_ClientSummary.ClientActiveStatus = 0

2. 2

   Read the client check on the device

   CcmEval runs from a scheduled task under Microsoft › Configuration Manager in Task Scheduler. It logs to C:\Windows\CCM\Logs\CcmEval.log (CcmEvalTask.log covers the scheduled runs) and writes results to C:\Windows\CCM\CcmEvalReport.xml, which you need an elevated prompt to copy. The main checks:

   Check	If it fails
   Client installed correctly; prerequisites listed in C:\Windows\ccmsetup\ccmsetup.xml present	Reinstall the client
   More than 1% free space on drive C:	Free up disk space
   SMS Agent Host (CcmExec) exists, is automatic and running	CcmEval fixes startup type and state; if the service is missing, reinstall
   WMI repository integrity and the client's WMI event sink	Event sink: restart CcmExec. Repository: step 3
   Antimalware service and Windows Update (wuauserv) startup types	Reset the startup type, then find the Group Policy or tool that keeps changing it
   Microsoft Policy Platform service (lppsvc)	Let CcmEval remediate; reinstall the client if it keeps failing

3. 3

   Repair WMI carefully

   cmd

   winmgmt /verifyrepository
   winmgmt /salvagerepository

   Run the first command. If the repository is consistent, leave WMI alone: the problem is elsewhere.

4. 4

   Reset or reinstall the client

   A client left in provisioning mode by a failed task sequence doesn't process policy and drifts towards inactive. Check and clear it:

   powershell

   Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\CCM\CcmExec' | Select-Object ProvisioningMode
   Invoke-CimMethod -Namespace root\ccm -ClassName SMS_Client -MethodName SetClientProvisioningMode -Arguments @{ bEnable = $false }

5. 5

   Clean up records that won't come back

   In Administration › Site Configuration › Sites, select the site and choose Site Maintenance on the ribbon. The three tasks that matter here are disabled by default in a primary site:

   Task	What it does	Default age
   Delete Inactive Client Discovery Data	Deletes discovery data for clients marked inactive by your client status settings	90 days
   Delete Obsolete Client Discovery Data	Deletes records marked obsolete, usually replaced by a newer record for the same device	7 days
   Clear Install Flag (Clear Undiscovered Clients in the docs)	Clears the installed flag for clients with no heartbeat in the rediscovery period, so client push can reinstall them	21 days

Verify

• CcmEval.log shows a completed run, and every check in the report passed.
• Trigger a heartbeat (discovery data collection cycle) and a machine policy request so the site hears from the device:
  powershell

  Invoke-CimMethod -Namespace root\ccm -ClassName SMS_Client -MethodName TriggerSchedule -Arguments @{ sScheduleID = '{00000000-0000-0000-0000-000000000003}' }
  Invoke-CimMethod -Namespace root\ccm -ClassName SMS_Client -MethodName TriggerSchedule -Arguments @{ sScheduleID = '{00000000-0000-0000-0000-000000000021}' }

• After the site next refreshes client status, the device shows Active with a passed client check, and the percentages in Monitoring › Client Status improve.

Key takeaways

• Inactive means a communication problem or a dead record; a failed check means a local problem.
• Add alerts on important collections (collection Properties › Alerts) for low client check, activity or remediation rates.
• Enable the cleanup tasks with sensible ages, and keep Active Directory tidy.
• Don't push WMI reset scripts fleet-wide; verify, salvage, then reinstall.