ConfigMgr Client Provisioning Mode

Update 8/14/2019 – SEE MORE INFO AT BOTTOM… – MS created official Docs for Prov Mode & 1902 pulls machines out of Prov Mode automatically after 48 hours – Docs HERE

Update 8/3/2018 – With ConfigMgr 1806, The client no longer goes into Provisioning Mode if you run a Compatibility Scan.  Confirmed in my lab!

Update 3/15/2018 – Ran several more tests to learn what actions are available to run during Provisioning mode.  Scroll to bottom for updates.

Original Post:

I’ve been doing a lot of testing with Provisioning Mode.  I needed to know what was going on when a system was in provisioning mode.

Quick Overview of what works and what is difference. (As I continue testing, I’ll continue to update this list)

  1. Works Normally
    1. Software Center
      1. Lists all Deployments available & required it knew about before entering provisioning mode
      2. Can Install any of those by clicking “Install”
    2. ConfigMgr Control Panel
      1. You can still trigger actions, or change cache size
        1. By Triggering Actions, you can get deployments to install if they are past deadline
  2. Differences
    1. Policy doesn’t update Automatically
    2. Does NOT report to CM (Inventory)
    3. Does NOT run Required Deployments automatically once deadline hits.

Basics: (Enter Provisioning Mode & Exit Commands) – More info HERE @ scconfigmgr.com

Enter Provisioning Mode:
PowerShell:
Invoke-WmiMethod -Namespace "root\ccm" -Class "SMS_Client" -Name "SetClientProvisioningMode" $true
CommandLine:
WMIC /namespace:\\root\ccm path sms_client CALL SetClientProvisioningMode "True" /NOINTERACTIVE

Exit Provisioning Mode:
PowerShell:
Invoke-WmiMethod -Namespace "root\ccm" -Class "SMS_Client" -Name "SetClientProvisioningMode" $false
CommandLine:
WMIC /namespace:\\root\ccm path sms_client CALL SetClientProvisioningMode "False" /NOINTERACTIVE

*2018.06.18 – I’ve added the command line using WMIC (Thanks Ryan Ephgrave [@EphingPosh]) removing the PowerShell requirement… expect a blog from Mike Terrill or myself in the future about how to use this during IPU as a safe guard.  Whenever possible in a TS, use the most simple method to run a command.

To Check Status: HKLM\SOFTWARE\Microsoft\CCM\CcmExec
Provisioning Mode: False (Not in Provisioning Mode)

Provisioning Mode: True (In Provisioning Mode)

In the CcmExec.log, once you tell the machine go into provisioning mode, you’ll see it shutting down CCMEXEC and move into Provisioning Mode State, but it never actually says it’s entering into provisioning mode.

Learned from Testing (while in Provisioning Mode)

  1. Client will not pull down any new CM Policies
    1. Provisioning mode has NO connection to Group Policy.  Group Policies still process while in Provisioning mode
  2. When a deployment reaches it’s deadline, it will change status to “Past Due” but does not start the installs.
    1. Tested with both Application Deployments & Software Updates.  Neither started installing when reached their deadlines, only Status changed from “Scheduled for XX Time” to “Past Due”
  3. When client is removed from Provisioning mode, machine policy is updated nearly immediately, and past due installations start ASAP.

When is the client set to Provisioning mode (When is it supposed to be)?   If it is in provisioning mode outside of these scenarios, it’s probably an issue and you’ll want to look into it

  1. During OSD, once the Client is installed, it is set to provisioning mode and stay in provisioning mode until the end of the TS. For context of how close to the end it is, it’s set after all of the steps in the TS, but right before the SMSTSPostAction
    image
  2. In Place Upgrade
    1. Once the TS reaches “Upgrade Operating System” Step, it enters provisioning mode, and stops ccmexec service (Software Center closes if you still had that open) – It enters Provisioning Mode before the TS even downloads the Upgrade Media. unless you tell the TS to download all content before starting, this is a good reason to precache!
      image
    2. After the upgrade process is complete, even if it fails like in my test, it will take the client back out of provisioning mode and restart the services.
      image
  3. In Place Upgrade (Compat-Scan Only Mode)
    1. Identical process to Upgrade, even though it doesn’t actually upgrade.  This has been raised as a bug / uservoice item, and in a future release, the upgrade process, if running compat / scan only mode, it will not put the system into provisioning mode.

      Uservoice: https://configurationmanager.uservoice.com/forums/300492-ideas/suggestions/33036856-don-t-set-ccmclient-to-provisioning-mode-if-runnin

Issues I’ve run into with Provisioning Mode.  During CompatScan Only mode TS running, I’ve had users reboot the machine, leaving the machine in provisioning mode when it came back up.  While the window for this happening is small, 5 – 20 minutes, it has happened.  We have the CompatScan Only TS running in the background unknown to the users, so it’s not really their fault if they reboot it during the process.  To work around this, I create a run once command to take a machine out of provisioning mode, if the process completes successfully, I delete the run once key as all is well, however, if the user does happen to reboot during the process, the next logon on, it will remove itself from provisioning mode thanks the turn run once key. (as shown in the twitter image of the TS Steps above)

TESTS RUN:

Collection with Required Deployments: 2 apps & software updates.  Deadline for 6:30PM Client Time.

Machine is already in Provisioning Mode when Deployments are Created.  Results:  The Required Deployments never show up in the Software Center.

Deployments Created on Machine NOT in provisioning Mode, they show up in software Center with Deadline time. Then after the machine has the updated Policy, I placed it into Provisioning Mode.  Sorry, this machine is already patched, so it doesn’t show any of the MS Updates, but I have confirmed on other tests that Software Updates also respect Provisioning Mode and do NOT install.

After the Deadline, “Nothing” happens.  Status changes from Scheduled… to Past Due, but the installs do NOT start.
So 2.5 hours past deadline, still no change.

Then I run command to take machine out of provisioning mode (which closes the software center).  I then reopen Software Center and see those two Apps are already installing.

So, provisioning mode, hopefully this helps demystify what it is, and the effects it has on the ConfigMgr client.

Update 3.15.2018

When Client is in provisioning Mode, you can trigger actions and the client will kick in and perform those actions.

Example Scenario. Client is set into provisioning mode, client has several deployments that reach their deadline, provisioning mode prevents those from running. UNLESS… a policy update is triggered.  From the ConfigMgr Console, if you right click a machine and tell it to run a Machine Policy Update, it will run and get that information, HOWEVER, it will NOT act on it, it only gets the policy.  If you have added deployments to that machine, it will NOT show up in software center, even if you run a machine policy update.
To trigger Applications or Software Updates to actually install while in provisioning Mode

  1. Right Click Machine -> Client Notification -> Trigger “Evaluate Application Deployments” (Application Model ONLY)
  2. Right Click Machine -> Client Notification -> Trigger “Evaluate Software Update Deployments” (Software Updates ONLY)

I was not able to trigger a package program using any of the built in Client Notifications.

Two ways to remove a client from Provisioning Mode Remotely using Configuration Manager

  1. Application
    1. Create Application
      1. No Content – Command Line =
        powershell.exe Invoke-WmiMethod -Namespace “root\ccm” -Class “SMS_Client” -Name “SetClientProvisioningMode” $false
      2. Detection Mode = Registry = HKLM\Software\Microsoft\CCM\CCMExec  provisioningmode = false
    2. Deploy to Collection with Machine
    3. Right Click Machine -> Client Notification -> Trigger “Download Machine Policy”
    4. Right Click Machine -> Client Notification -> Trigger “Evaluate Application Deployments
  2. Run Script
    1. Create new “Run Script” with same Command line as Application
    2. Right Click on Machine -> Run Script -> Choose the One you just created to remove machine from Provisioning Mode.

Updates 2019.08.14 – More Testing with new Changes to Provmode in 1902.  New Reg Keys, etc.

Straight from the docs: “Starting in version 1902, the task sequence sets a timestamp when it puts the client in provisioning mode. Every 60 minutes, a client in provisioning mode checks the duration of time since the timestamp. If it’s been in provisioning mode for more than 48 hours, the client automatically exits provisioning mode and restarts its process.

48 hours is the default provisioning mode timeout value. You can adjust this timer on a device by setting the ProvisioningMaxMinutes value in the following registry key: HKLM\Software\Microsoft\CCM\CcmExec. If this value doesn’t exist or is 0, the client uses the default 48 hours.”

So what does that mean?  It means during the Task Sequence, there are built in steps that call the client to go into Provisioning Mode.  Doing so sets the key “ProvisioningEnabledTime” (TimeStamp) for the client go check against every 60 minutes.
Does only the TS trigger this Key? No. From my testing, if you place the client into prov mode via the powershell command, it to will update that registry key.

New Keys:

  1. ProvisioningEnabledTime
    1. Time Info is in Epoch (thanks for that), so you need to use an Epoch Converter, unless you you’re one of those special types that live in Epoch time. https://www.epochconverter.com/
    2. This was set the last time a TS enabled Provisioning Mode.  In the image below, the date works out to being the original OSD date when I built this VM.
    3. If I run IPU, it will update the time when the Upgrade Step runs.
  2. ProvisioningMaxMinutes
    1. This is the Key that YOU create manually, it is NOT there by default and the system assumes 48 Hours.

Note, this image blow, the ProvisingEnabledTime = Tuesday, June 25, 2019 3:42:34 (When I build the VM)

Test: Same Machine as image above.  Trigger Prov Mode via PowerShell.
It updates the Keys:

You can see I set the MaxMinutes to 5, which basically means 60.  The Client only checks every 60 minutes, so anything under 60 is too much.  Typically, unless you have a special need, leaving it at 48 hours (not creating the key) is probably a good way to go.

Here you can see, after 1 hour, it automatically pulled it out of Provisioning mode

Script for Getting Provisioning Mode, then checking when Provisioning mode was enabled, and when it will auto disable. (Requires CM Client 1902+)

Function Convert-FromUnixDate ($UnixDate) {[timezone]::CurrentTimeZone.ToLocalTime(([datetime]'1/1/1970').AddSeconds($UnixDate)) }
 $TimeUTC = [System.DateTime]::UtcNow
 $TimeCLT = get-date
 Write-Host "  Current Client Time: $TimeCLT" -ForegroundColor Green
 Write-Host "  Current Client UTC: $TimeUTC" -ForegroundColor Green
 $ProvMode = Get-ItemPropertyValue 'HKLM:\SOFTWARE\Microsoft\CCM\CcmExec' 'ProvisioningMode' -ErrorAction SilentlyContinue
 $CCMexecKeys = Get-Item -Path 'HKLM:\SOFTWARE\Microsoft\CCM\CcmExec'
 if ($provmode -eq "True") 
     {
     Write-Host "  ProvMode Status: $ProvMode" -ForegroundColor Red
     if ($CCMexecKeys.GetValue('ProvisioningMaxMinutes') -ne $Null){$ProvModeMaxMin = $CCMexecKeys.GetValue('ProvisioningMaxMinutes')}
     Else {$ProvModeMaxMin = 2880}
     $ProvModeEnabledTime = Get-ItemPropertyValue 'HKLM:\SOFTWARE\Microsoft\CCM\CcmExec' 'ProvisioningEnabledTime'
     $ProvModeEnabledConvert = Convert-FromUnixDate $ProvModeEnabledTime
     Write-Host "  Time ProvMode Enabled: $ProvModeEnabledConvert UTC" -ForegroundColor Yellow
     $ProveModeTimeDiff = $TimeUTC - $ProvModeEnabledConvert
     $ProveModeTimeDiffHours = $ProveModeTimeDiff.TotalHours
     $ProveModeTimeDiffHoursRound = ([Math]::Round($ProveModeTimeDiffHours,2))
     Write-Host "  Time ProvMode Enabled $ProveModeTimeDiffHoursRound Hours ago" -ForegroundColor Yellow
     $TimeLeftInProvMode = $ProvModeMaxMin - $ProveModeTimeDiff.TotalMinutes
     $TimeLeftInProvModeHours = ([Math]::Round($TimeLeftInProvMode,0)/60)
     $TimeLeftInProvModeHoursRound =([Math]::Round($TimeLeftInProvModeHours,2))
     Write-Host "  Time Before ProvMode Auto Disables: $TimeLeftInProvModeHoursRound Hours" -ForegroundColor Yellow
     }
Output from Script. Gives you current Time, Provisioning Mode Status, When it was enabled, and when it will auto disable.

If you find any other information, please let me know. – Gary

25 thoughts on “ConfigMgr Client Provisioning Mode”

  1. Awesome article, Gary. When we were having a lot of trouble with Prov. mode sticking after OSD (back in cm2012 days), we created a step late in the TS that modified %windir%\ccmsetup\MobileClient.TCF, removing the line SMSPROVISIONINGMODE=1 if present. On a restart, this removed the computer from provisioning mode.
    I honestly like your wmi solution much better.
    Thanks so much for sharing all your research.

    Reply
  2. A couple comments on the Application at the end of the article.
    If this is to be run as a command line, should it be the following?
    powershell.exe -command “Invoke-WmiMethod -Namespace “root\ccm” -Class “SMS_Client” -Name “SetClientProvisioningMode” $false”

    Note the $false instead of $true in your example.
    I hope I haven’t got this backward.

    Reply
    • You are correct, you need to add powershell.exe in front of the command. I did not need the extra -command options when I ran my test. Updated post to reflect the command I used. Thanks!

      Reply
    • I was thinking about this, and you’d have to inventory that registry key, the run a scheduled task to run hardware inventory weekly since it does not run when the client is in provisioning mode. At this point, it would just be easier to have a scheduled task that runs weekly to run the powershell command to remove it from provisioning mode, even if it is not in provisioning mode. Or make it part of the domain login script to check that key and run the command if needed.

      Reply
  3. I like the post ..instead of MOF modification would prefer to handle via CI item to correct it. indeed a nice sharing. Thanks once again

    Reply
  4. Great work Gary. I did some testing also, and found that Configuration Items do not run when in provisioning mode, but the new Run Scripts feature of ConfigMgr does work. So you can use that to take computers out of provisioning mode if you can identify them.

    Reply
  5. If I were to to do a run script on a collection, and say that a device was legitimately in provisioning mode IE running IPU. Do you know if that will cause the IPU to fail? I suppose I can test this, was just curious if you knew already 🙂

    Reply
  6. What’s the best way (assuming there is a way) to exit provisioning mode at the end of OSD (but prior to user logon) so that inventories will run and required deployments and updates will install? Our OSD TS just sits there on a screen that basically says “I’m finished!!” until the tech/user clicks OK and logs on. Which could be the next day, wasting a lot of time that could be used to update the machine.

    Reply
  7. Gary, do you guys use setup.exe to do the compatibility scan in command line mode? From your MMS session, it looked like you used something different for the command, but maybe I am just remembering it wrong. It wasn’t on the slide deck.

    Reply
  8. Gary, any idea what would prevent a client from entering provisioning mode? We are rolling out an IPU to 1709. We have one system that shows failed to put client into provisioning mode.

    Setting the client into provisioning mode OSDUpgradeWindows 7/24/2018 4:03:42 PM 10216 (0x27E8)
    getPointer()->ExecMethod( BString(pszObject), BString(pszMethod), 0, 0, pInParams, ppOutParams, 0 ), HRESULT=80004005 (..\WmiNamespace.cpp,1391) OSDUpgradeWindows 7/24/2018 4:08:51 PM 10216 (0x27E8)
    ns.ExecMethod( c_szWmiClass_SmsClient, c_szSetProvisioningMode, inParams, &outParams ), HRESULT=80004005 (..\ProvisioningMode.cpp,64) OSDUpgradeWindows 7/24/2018 4:08:51 PM 10216 (0x27E8)
    Could not execute WMI method SMS_Client.SetClientProvisioningMode OSDUpgradeWindows 7/24/2018 4:08:51 PM 10216 (0x27E8)
    Exiting SetClientProvisioningMode 0x80004005 OSDUpgradeWindows 7/24/2018 4:08:51 PM 10216 (0x27E8)
    CCM::Utility::SetClientProvisioningMode(true), HRESULT=80004005 (upgradewindows.cpp,704) OSDUpgradeWindows 7/24/2018 4:08:51 PM 10216 (0x27E8)
    Failed to put client in provisioning mode (0x80004005) OSDUpgradeWindows 7/24/2018 4:08:51 PM 10216 (0x27E8)

    The machine has since been rebooted and we tested running the powershell command manually and it worked.

    Invoke-WmiMethod -Namespace “root\ccm” -Class “SMS_Client” -Name “SetClientProvisioningMode” $true

    Was going to try the upgrade again, but curious your thoughts.

    Reply
    • I’ve seen the same issue, haven’t gotten to the bottom of it. It’s rare that it happens, and I honestly can’t recall if it cleared up by itself, or if we had to repair the Client and WMI.

      Reply
    • Going From 1607 to 1703 we ran into that issue A LOT! For me it was caused because I was putting a reboot at the beginning of the TS to clear any pending patching reboots (from another application) and after the reboot, the TS was running the upgrade task faster then the client seem to initialize . Adding a 2.5min delay fixed the issue.

      Now we are going from 1703 to 1709 and that issue is rearing it;s ugly head, I’ve already bumped it to 3mins and some machine are still erroring out. I’m hoping something more permanent will be found as I can’t just keep increasing the timeout…

      Reply
      • I ended up opening a ticket with MS. I was informed it is a bug in SCCM 1802 and is fixed in 1806. We are upgrading SCCM next week so I will test it out.

        In the mean time, they provided me the following work around as the issue has to do with the smstsmgr service being dependent on the SMS client service.

        cmd.exe /c sc.exe config “smstsmgr” depend= “/”

        Reply
  9. We are targeting 100 machines per week. This is week 3 and out of the 300 targeted, 203 upgraded and were successful. 8 others have tried, but failed with this error. Still not sure what is causing it. Hoping I can figure it out and exclude them prior to targeting until it’s resolved.

    Reply
  10. complete non sequitur:

    Love your blog posts:
    Maybe not a quick question but is there any scripted way you know how to make a Windows 10 TS proceed or mandate a deadline.

    Reply
    • You mean you want to make a TS available to a collection, but then use a script to trigger it instead of just setting a deadline on the Deployment? Yes, you can do that. If I’m not following you, hit me up on twitter with more details. @gwblok

      Reply
  11. Not sure if they changed this in the newest build, but i can not get anything to run on clients in provisioning mode. Scrips don’t work, Tasksequences won’t work and Applications don’t work either…

    They all work fine as soon as i get a client out of provisioning mode. But then i don’t need it anymore 😉

    Reply
  12. Gary, Have you seen where you take client out of provision mode but the task sequence is still stuck with installing status in software center?

    Reply

Leave a Comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.