MEM-Zone / MEM.Zone

Our ♡ collection of PowerShell scripts and Endpoint Management related stuff 🐵
https://MEM.Zone/GIT
GNU General Public License v3.0
97 stars 10 forks source link

Skipping virtually all cached items #13

Closed snicoara closed 1 year ago

snicoara commented 2 years ago

I'm hoping this isn't a simple mistake on my part but running this script on a device with administrative access and 35 separate items in the ccmcache results in only 2 being visible when the script is run. I have tried modifying the thresholds as I want it to be fairly aggressive in it's cleanup but it will not spot the remaining 33 items.

No errors logged, results below:

PS C:\sparke\scripts> .\Clean-CMClientCache.ps1 -verbose VERBOSE: [03-08-2022 16:45:11.436] [Main:Initialization] [Clean-CMClientCache] :: Start VERBOSE: [03-08-2022 16:45:11.530] [Main:Initialization] [Clean-CMClientCache] :: Should Run test passed VERBOSE: [03-08-2022 16:45:11.530] [Main:Initialization] [Clean-CMClientCache] :: Stop VERBOSE: [03-08-2022 16:45:11.546] [Remove-CCMCachedApplications] [Clean-CMClientCache] :: Start VERBOSE: [03-08-2022 16:45:11.561] [Get-CCMCachedApplications] [Clean-CMClientCache] :: Start VERBOSE: [03-08-2022 16:45:11.655] [Clean-CMClientCache] :: Stop VERBOSE: [03-08-2022 16:45:11.671] [Remove-CCMCachedApplications] [Clean-CMClientCache] :: Stop VERBOSE: [03-08-2022 16:45:11.682] [Remove-CCMCachedPackages] [Clean-CMClientCache] :: Start VERBOSE: [03-08-2022 16:45:11.687] [Get-CCMCachedPackages] [Clean-CMClientCache] :: Start VERBOSE: [03-08-2022 16:45:11.735] [Get-CCMCachedPackages] [Clean-CMClientCache] :: Stop VERBOSE: [03-08-2022 16:45:11.735] [Remove-CCMCachedPackages] [Clean-CMClientCache] :: Stop VERBOSE: [03-08-2022 16:45:11.751] [Clean-CMClientCache] :: Start VERBOSE: [03-08-2022 16:45:11.751] [Get-CCMCachedUpdates] [Clean-CMClientCache] :: Start VERBOSE: [03-08-2022 16:45:13.235] [Get-CCMCachedUpdates] [Clean-CMClientCache] :: Stop VERBOSE: [03-08-2022 16:45:13.235] [Remove-CCMCachedUpdates] [Clean-CMClientCache] :: Stop VERBOSE: [03-08-2022 16:45:13.250] [Remove-CCMOrphanedCache] [Clean-CMClientCache] :: Start VERBOSE: [03-08-2022 16:45:13.409] [Remove-CCMOrphanedCache] [Clean-CMClientCache] :: Stop [03-08-2022 16:45:13.425] [Main:CleanupResult] [Clean-CMClientCache] ::

FullName : Name : 5009469 Location : C:\WINDOWS\ccmcache\1r LastReferenceTime : 1/03/2022 2:33:08 AM Size(MB) : Status : Needed

FullName : Name : 5008880 Location : C:\WINDOWS\ccmcache\1s LastReferenceTime : 1/03/2022 2:33:57 AM Size(MB) : Status : Needed

TotalDeletedSize: 0 VERBOSE: [03-08-2022 16:45:13.425] [Main:CleanupResult] [Clean-CMClientCache] :: Stop PS C:\sparke\scripts>

Any idea's what may be going on here?

Ioan-Popovici commented 2 years ago

Hi,

That script needs a re-write.

What types of cache items are not detected?

And what are the exact parameters you used?

Ioan

snicoara commented 2 years ago

I thought it may have been an age thing. In the above example the only parameter that was changed was setting the cleanupactions to all. Essentially I want to remove anything and everything that has not been referenced in the last 60 days. This script is a bit of overkill but I may end up having use for a few of the other features so would love to get it working. Running the latest version of SCCM (2111).

The items that are not seen are virtually anything. The systems I'm testing on have several packages and updates, maybe a couple applications. Doesn't seem to find any of them.

Ioan-Popovici commented 2 years ago

``

        ## Initialize the CCM resource manager com object
        [__comobject]$CCMComObject = New-Object -ComObject 'UIResource.UIResourceMgr'

        ## Get ccm cache info
        $CacheInfo = $($CCMComObject.GetCacheInfo().GetCacheElements())

        ## Get ccm application list
        $Applications = Get-CimInstance -Namespace 'Root\ccm\ClientSDK' -ClassName 'CCM_Application' -Verbose:$false

        ## Count the applications
        $ApplicationCount = $($Applications | Measure-Object).Count

$CacheInfo $ApplicationCount $Applications ``

Can you run this, we need to check if the number of cached apps is correct

snicoara commented 2 years ago

Running this against a different device today but the same issue is occurring with the script.

Result below: PS C:\WINDOWS\system32> $CacheInfo

ContentId : SH1001C6 ContentVersion : 1 Location : C:\WINDOWS\ccmcache\1b LastReferenceTime : 15/12/2021 10:54:06 PM ReferenceCount : 0 ContentSize : 302217 CacheElementId : {4C0D6AFD-FA5E-4AD5-AFBE-1F3C7BB04C7C}

ContentId : 17168932-6310-4ebc-9879-7dd672565509 ContentVersion : 1 Location : C:\WINDOWS\ccmcache\13 LastReferenceTime : 28/11/2021 3:21:02 AM ReferenceCount : 0 ContentSize : 642504 CacheElementId : {035B7BCD-9F23-4F91-B87B-52B257445C7E}

ContentId : af5b0642-bb9c-489b-9ead-90d088d11eb7 ContentVersion : 1 Location : C:\WINDOWS\ccmcache\4f LastReferenceTime : 8/03/2022 3:59:24 AM ReferenceCount : 0 ContentSize : 22 CacheElementId : {4E2C3E94-3B5C-40CC-9F60-5A7063BD08D2}

ContentId : 360ada10-8d6e-483c-b73f-e64fe33a4de9 ContentVersion : 1 Location : C:\WINDOWS\ccmcache\41 LastReferenceTime : 31/01/2022 4:22:22 AM ReferenceCount : 0 ContentSize : 56716 CacheElementId : {AF875584-66A7-49C1-9B36-66CC17C6AA82}

ContentId : SH1001BE ContentVersion : 1 Location : C:\WINDOWS\ccmcache\40 LastReferenceTime : 13/01/2022 5:13:14 AM ReferenceCount : 0 ContentSize : 4961 CacheElementId : {0F9DFC95-7650-49B3-AEE7-4A3802CBFADB}

ContentId : SH100003 ContentVersion : 12 Location : C:\WINDOWS\ccmcache\2o LastReferenceTime : 11/01/2022 11:15:37 AM ReferenceCount : 0 ContentSize : 5969 CacheElementId : {A7201791-649D-4C7E-A586-7D671088ED21}

ContentId : SH1001C1 ContentVersion : 1 Location : C:\WINDOWS\ccmcache\15 LastReferenceTime : 2/12/2021 2:35:13 AM ReferenceCount : 0 ContentSize : 21651 CacheElementId : {D20CF2E2-093E-4E69-A63B-B16D158C70F8}

ContentId : SH1001CD ContentVersion : 2 Location : C:\WINDOWS\ccmcache\43 LastReferenceTime : 21/01/2022 2:57:43 AM ReferenceCount : 0 ContentSize : 54830 CacheElementId : {071613BE-C73B-41BB-B063-AD8886CA61FC}

ContentId : cdc72fc5-fac3-40c1-a11f-ad7e575c68c5 ContentVersion : 1 Location : C:\WINDOWS\ccmcache\14 LastReferenceTime : 28/11/2021 3:23:53 AM ReferenceCount : 0 ContentSize : 38406 CacheElementId : {E6B3727B-64A0-4B99-A039-EBDDF754DED5}

ContentId : SH1001D6 ContentVersion : 1 Location : C:\WINDOWS\ccmcache\48 LastReferenceTime : 31/01/2022 3:29:10 AM ReferenceCount : 0 ContentSize : 2439 CacheElementId : {6376156A-B069-48C6-ADB4-3F181A630754}

ContentId : SH1001CF ContentVersion : 1 Location : C:\WINDOWS\ccmcache\42 LastReferenceTime : 19/01/2022 4:39:25 PM ReferenceCount : 0 ContentSize : 1071437 CacheElementId : {8D6C2D78-A9D9-40F9-9F7B-CC2CA4245C65}

ContentId : SH1001C8 ContentVersion : 3 Location : C:\WINDOWS\ccmcache\1k LastReferenceTime : 17/12/2021 1:17:53 AM ReferenceCount : 0 ContentSize : 816415 CacheElementId : {C1B09D23-BC0F-4DA9-8461-EE42900964AE}

ContentId : SH1001C5 ContentVersion : 1 Location : C:\WINDOWS\ccmcache\18 LastReferenceTime : 15/12/2021 5:28:56 AM ReferenceCount : 0 ContentSize : 302215 CacheElementId : {E8348D92-8065-4D19-8801-322C2D77F0F3}

ContentId : SH1001C7 ContentVersion : 1 Location : C:\WINDOWS\ccmcache\47 LastReferenceTime : 31/01/2022 3:19:03 AM ReferenceCount : 0 ContentSize : 2439 CacheElementId : {BCBFD5D6-5442-4AB7-8CF2-F181225E2ACB}

ContentId : SH100190 ContentVersion : 1 Location : C:\WINDOWS\ccmcache\10 LastReferenceTime : 19/11/2021 12:46:58 AM ReferenceCount : 0 ContentSize : 4961 CacheElementId : {B519B1E5-2A79-4B63-A102-D99B74EC415B}

ContentId : 2ad4a9bc-18cb-4def-8572-a8c42e371ea5 ContentVersion : 1 Location : C:\WINDOWS\ccmcache\49 LastReferenceTime : 31/01/2022 4:23:41 AM ReferenceCount : 0 ContentSize : 66809 CacheElementId : {AF13C661-D635-4244-8807-23CC26EC60BC}

ContentId : 51225f6b-6823-485d-b379-8e5a13c6c16c ContentVersion : 1 Location : C:\WINDOWS\ccmcache\4c LastReferenceTime : 13/02/2022 9:06:32 PM ReferenceCount : 0 ContentSize : 656090 CacheElementId : {4A2AE00D-4658-44E6-988E-5C844EA9AB50}

ContentId : 82d72e15-4b45-4982-81b4-6f6fc8e7df62 ContentVersion : 1 Location : C:\WINDOWS\ccmcache\21 LastReferenceTime : 11/01/2022 5:04:45 AM ReferenceCount : 0 ContentSize : 38374 CacheElementId : {D67CDEF4-0540-400E-A96F-2786F6432259}

ContentId : 77906a53-1e47-4d57-8f9e-85b843855326 ContentVersion : 1 Location : C:\WINDOWS\ccmcache\4a LastReferenceTime : 31/01/2022 4:40:28 AM ReferenceCount : 0 ContentSize : 650701 CacheElementId : {395BC5DD-E9EB-46E8-AE84-33FD01FD7DB2}

ContentId : a6b8cb2e-d044-4ee6-8dda-9c52d73f6a98 ContentVersion : 1 Location : C:\WINDOWS\ccmcache\4b LastReferenceTime : 31/01/2022 4:26:42 AM ReferenceCount : 0 ContentSize : 41425 CacheElementId : {92981C2E-7F97-4C53-AE78-8807F20FC7B7}

ContentId : aa662e9d-2680-4780-90bd-977014925054 ContentVersion : 1 Location : C:\WINDOWS\ccmcache\4d LastReferenceTime : 27/02/2022 12:47:57 AM ReferenceCount : 0 ContentSize : 67067 CacheElementId : {EBD666C1-B92E-447D-8272-062D18093619}

ContentId : 1ab42de6-b2d8-4c45-b36c-2a69eabc7343 ContentVersion : 1 Location : C:\WINDOWS\ccmcache\r LastReferenceTime : 7/11/2021 12:23:24 AM ReferenceCount : 0 ContentSize : 66777 CacheElementId : {C479A008-70A8-4F19-85E2-4BDDDD1A1173}

ContentId : ba58605d-9f53-461e-83e8-f46728f6b34e ContentVersion : 1 Location : C:\WINDOWS\ccmcache\12 LastReferenceTime : 28/11/2021 3:10:00 AM ReferenceCount : 0 ContentSize : 66887 CacheElementId : {E010AD76-1514-4BE4-B665-50306DE2958A}

ContentId : 8ca3e07a-422b-4785-8a02-39e6f278a66f ContentVersion : 1 Location : C:\WINDOWS\ccmcache\20 LastReferenceTime : 11/01/2022 5:04:55 AM ReferenceCount : 0 ContentSize : 648795 CacheElementId : {314B9809-C7A9-46AE-939C-EEA0DADB0959}

PS C:\WINDOWS\system32> $ApplicationCount 0 PS C:\WINDOWS\system32> $Applications PS C:\WINDOWS\system32>

snicoara commented 2 years ago

It seems that the get-ciminstance line isn't returning anything when searching the clientsdk, regardless of the classname.

Ioan-Popovici commented 2 years ago

The Get-CimInstance -Namespace 'Root\ccm\ClientSDK' -ClassName 'CCM_Application' should return all applications deployed to the machine. Are you sure that you are running powershell as an admin?

If you say that there are applications deployed that are still in the cache they should show up here too. This is needed in order to detect if an app is still needed in the cache or not.

If a cache item is not referenced in WMI then it will be removed by the Orphaned cache cleanup but if it's in the WMI as with the ones above they will not get 'Detected'.

Ioan-Popovici commented 2 years ago

Can you also run this?

## Get ccm package list
$Packages = Get-CimInstance -Namespace 'Root\ccm\ClientSDK' -ClassName 'CCM_Program' -Verbose:$false

## Count the packages
$PackageCount = $($Packages | Measure-Object).Count

## Get ccm update list
$Updates = Get-CimInstance -Namespace 'Root\ccm\SoftwareUpdates\UpdatesStore' -ClassName 'CCM_UpdateStatus' -Verbose:$false

## Count the updates
$UpdateCount = $($Updates | Measure-Object).Count

$PackageCount
$UpdateCount
snicoara commented 2 years ago

Definitely running as admin. I've added proof below.

I'm assuming that the package model packages also show up under the application classname? We only really use packages deployed to machines, we don't really use the application model or user based deployment.

Results:

PS C:\WINDOWS\system32> $currentPrincipal = New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent()) PS C:\WINDOWS\system32> $currentPrincipal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator) True PS C:\WINDOWS\system32> ## Get ccm package list PS C:\WINDOWS\system32> $Packages = Get-CimInstance -Namespace 'Root\ccm\ClientSDK' -ClassName 'CCM_Program' -Verbose:$false PS C:\WINDOWS\system32> PS C:\WINDOWS\system32> ## Count the packages PS C:\WINDOWS\system32> $PackageCount = $($Packages | Measure-Object).Count PS C:\WINDOWS\system32> PS C:\WINDOWS\system32> ## Get ccm update list PS C:\WINDOWS\system32> $Updates = Get-CimInstance -Namespace 'Root\ccm\SoftwareUpdates\UpdatesStore' -ClassName 'CCM_UpdateStatus' -Verbose:$false PS C:\WINDOWS\system32> PS C:\WINDOWS\system32> ## Count the updates PS C:\WINDOWS\system32> $UpdateCount = $($Updates | Measure-Object).Count PS C:\WINDOWS\system32> PS C:\WINDOWS\system32> $PackageCount 0 PS C:\WINDOWS\system32> $UpdateCount 106 PS C:\WINDOWS\system32>

Ioan-Popovici commented 2 years ago

No, the packages should show the the 'CCM_Program' class. Maybe if packages do bot have a program? I need the check the CM SDK again. If you say you are using packages the package count should not be 0.

Ioan-Popovici commented 2 years ago

The things starting with SH should be packages and the ones with { are updates I think. Let me check and I'll get back to you

Ioan-Popovici commented 1 year ago

Merged with https://github.com/MEM-Zone/MEM.Zone/issues/7