Intune – We couldn’t complete the provisioning process in the required time

Posted on by Leave a comment

On occasion we get this error, this post covers off how to identify where the issue is and in this case the application installation that is causing the error.

Read more: Intune – We couldn’t complete the provisioning process in the required time

Yes that luverly red screen of disappointment….

So the first thing you need to do is to grab a USB stick and plug it into the device and click on : View diagnostics
Create a folder on your USB drive and save the diagnostics to that folder
This will create a Zip file of all the goodness you need to help diagnose the issue.
Also if you have access to Microsoft Support, this ZIP file is what they will request in the first instance

Device Setup Pre-Provisioning – Quick Guide

The device setup process is divided into four main parts:

  1. Security Policies
  2. Certificates
  3. Network
  4. Apps

The Apps section is where all the required apps are installed on the device. If any app fails to install, the whole setup may stop and show a red error screen.

How to Find Out What Went Wrong

To check what failed:

  1. Plug in your USB drive and unzip the file you saved earlier.
    You’ll see about 50 files inside.
  2. Focus on these important files:
    • microsoft-windows-shell-core-operational.evtx
    • AppWorkload*.log – {note the * as there can be more then one}
  3. Open the .evtx file using the Event Viewer.
    Search through the logs to find out which of the four setup steps (Security Policies, Certificates, Network, or Apps) failed.
Get-WinEvent -Path "microsoft-windows-shell-core-operational.evtx"  | Where-Object { $_.Message -match 'bootstrapstatus: subcategory id = devicesetup'}

Diagnosing Which App Failed

The AppWorkload.log file will show you which app failed during installation.
Keep in mind:

If one app fails, any apps listed after it will not be installed.

Apps are installed one after another (sequentially).

Get-Content -Path "appworkload*.log"|select-string -Pattern "Updating ESP tracked install status from InProgress to error"

In the example below , it was a PowerShell script packaged up to disable offline files

The PowerShell script was probably not returning the correct exit code.

 

CMPIVOT 101

Posted on by Leave a comment

CMPivot is a tool in MEMCM (SCCM) that is under-rated or misunderstood by people. Its power is amazing, due to the fact it can live query machines in a collection, that are online, but also where devices are offline, use last known information from the MEMCM database

It uses the Kusto Query Language, so if you are familiar with basic SQL queries you can use this cheatsheet here https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/sqlcheatsheet

If you are familiar with PowerShell then you recognise the Pipe operator | taking the output from one “cmdlet” and piping it to the next “cmdlet”

The following example shows how you can use two queries and join them and then only select the columns you want. So were are getting the Firmware information from each device where secureboot is false

then joining that information to the computersystem information

Then we are projecting the resultant object to only deliver 5 columns -device,Manufacturer,Model,Secureboot,UEFI.

Project is similar to SELECT in SQL or Select-Object in PowerSshell

Firmware | where SecureBoot == false | join (computersystem )| project device,Manufacturer,Model,Secureboot,UEFI

Here are some links on how to use the admin service to code these queries using powershell.

You can call CMPivot from the ConfigMgr Admin Service.

https://www.asquaredozen.com/2019/02/12/the-system-center-configuration-manager-adminservice-guide/

Here’s a post that goes into how you can query CMPivot over CMG. https://www.asquaredozen.com/2019/06/18/configmgr-1906-technical-preview-testing-cmpivot-over-cmg-using-adminservice/

Adam has a bunch of (somewhat working) scripts that you can see examples of usage for AdminService

https://github.com/AdamGrossTX/PowershellScripts/tree/master/ConfigMgr/AdminService