Who or what restarted the SCCM system

I get this question quite often and in big SCCM environments it can be a lot of things that restarts a system but this is how I troubleshoot:

1. First I check the "RebootCoordinator.log" and try to find if it's a package or user that initiated the restart.

2. If it was a package and the reboot was in a bad time check it MW is set in any of the collections where the system is shown.

3. Next option is that a user has done the restart and this is a little more tricky but impossible or hard, no! :)

Check the "smscliui.log" and look for the SID for the user who accepted a reboot after Software Updates for example.

Download the PsGetSid tool from here (link to Microsoft).

Run the command with the sid as parameter and you wil get the username who restarted the system in cleartext.

Create Dynamic SCCM 2007 Collection with all N/A and Not Approved Clients

Even if you have the "Approve all" site setting in SCCM 2007 there are still some clients that are "N/A" or "Not Approved" by different reasons.

Step1: At my customer I created a dynamic collection that pulled all resources from ALL SYSTEMS collection that had N/A or Not Approved status..

Create a new collction and built a query based rule

Paste these lines into the "Query statement:" field and save/close it.

select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_CM_RES_COLL_SMS00001 on SMS_CM_RES_COLL_SMS00001.ResourceId = SMS_R_System.ResourceId where SMS_CM_RES_COLL_SMS00001.IsApproved not like '1'

Now you have a dynamic SCCM collection with all systems that has some issue with boundaries or just needs to be manually approved. Select all systems in the collection, right click and approve them.

Step2 is to automatically approve all these systems with a script but I am posting that later..

Query to Find Which Netbios Name uses the GUID

Often when you troubleshoot SCCM status message errors you get the non-readable GUID on the system reporting the error.

I created this simple console query that shows which netbios name that uses the GUID look for (prompted value):

select distinct SMS_G_System_SYSTEM.Name, SMS_R_System.SMSUniqueIdentifier, SMS_R_System.SMSUUIDChangeDate from  SMS_R_System inner join SMS_G_System_SYSTEM on SMS_G_System_SYSTEM.ResourceID = SMS_R_System.ResourceId where SMS_R_System.SMSUniqueIdentifier = ##PRM:SMS_R_System.SMSUniqueIdentifier##

Feel free to use it! Create a new query, select "Show Query Language" and paste in the query in bold above!

I use this query every day to find the bad guys :D