In a recent transition from Citrix VDI to AVD (single and multi-session), the AVD devices are being efficiently managed by SCCM and Intune (co-management).
As part of routine maintenance, we have implemented a weekly reboot schedule for our AVD devices to ensure optimal performance and security.
To achieve this, I created a simple package with a command line (shutdown –r –f –t 300 “Rebooting the device as part of weekly maintenance”) for rebooting the devices weekly.
From the time, the weekly reboot job implemented, there were no issues until someone reported to team that AVD device was rebooting daily at 2 AM local time, contrary to our intended schedule.
I picked it up to investigate further to identify the root cause.
First thing is to look at the SCCM client logs specially execmgr.log for the advertisement status and it shows that, the specific package is being run daily at 2AM.
Next is to look deployment properties, if there were any changes to the schedule ? .... found it intact, set to run weekly as intended.
Further investigation, I have also verified that, the weekly schedule information can be seen from the client WMI class.
For that the following Powershell script will help you to get the schedule of specific advertisement applied to the device.
gwmi -Namespace root\ccm\policy\machine -class CCM_Scheduler_ScheduledMessage | where {$_.ScheduledMessageID-like "*ABC21452*"} | Select ScheduledMessageID,ActiveMessage,Triggers | fl *
ABC21452 = Advertisement ID
To convert the Schedule string, we can use Convert-CMSchedule cmdlet available in SCCM powershell module.
Login to SCCM server or a device that has installed with SCCM powershell module.
Import the SCCM powershell module and run the following with schedulestring.
Convert-CMSchedule 00A2AD40001B2000
As you can see from the above, the recurring schedule is same what we have configured it in the deployment.
Despite confirming that the deployment schedule remained unchanged (from SCCM deployment schedule properties), the device continued to reboot daily.
To further investigate deep dive, I have enabled the verbose logging (how to enable verbose logging) and post the reboot, reviewing the client logs reveals there is specific setting in software center that is causing the daily reboot behavior issue.
Software center –> Options –> Computer maintenance—>Automatically install or uninstall required software and restart the computer only outside of specified business hours
This setting is disabled by default.
After disabling the setting in software center, the daily reboot stopped and follow the weekly schedule (original schedule).
Disabling this setting rectified the issue, allowing the device to follow the original weekly schedule as intended. However, the logic behind this setting and its interaction with scheduled deployments remains unclear.
Is this a bug, or is there a deeper understanding required of the specific setting in the Software Center for this use case?
In continuation to our investigation, we will need to identify the list of devices that are having this specific setting enabled in software center that will impact daily reboot,
Software center setting details are stored in WMI class (CCM_SoftwareCenterSettings) hence we can use Powershell scripts feature in SCCM and run it on all target endpoints to see how many devices would expect daily reboot behavior.
$data=(gwmi -Namespace root\ccm\policy\machine -class CCM_SoftwareCenterSettings | Select AutoInstallRequiredSoftware).AutoInstallRequiredSoftware
if ($data)
{
write-host "Not Expected, require fix"
}
else
{
write-host "All Good"
}
Since the devices are managed by intune, it is time to move the legacy tasks Microsoft Intune for better management and flexibility.