We have a new company requirement for workstations to have an uptime of no more than “N” days, and to force a reboot when machines are non-compliant. To enforce this, I decided the best way to evaluate computer uptime was with a compliance script.
The Compliance Script
- Create a new compliance item named Computer Uptime, and select the Supported Platforms appropriate for your environment.
- On the Settings tab, click New… and add a setting:
Name: Uptime Days
Setting type: Script
Data type: Integer
- Under the Discovery Script section, click Add Script… and add the following Windows Powershell script:
- Under Compliance Rules, add a new compliance rule:
Name: Need Reboot
Selected Setting: Computer Uptime \ Uptime Days
Must comply with the following rule: Value returned is less than N (N is the integer of days for maximum uptime)
- Save the Compliance Item.
- Create a new Compliance Baseline named Computer Uptime, and add the CI to it.
- Note the CI ID NNNNN of the new Compliance Baseline you created – for the baseline, not the CI! If you cannot see the CI ID, then add the CI ID column (while in Configuration Baselines, right click the columns, and check CI ID).
The Reboot Package
I could have simply used shutdown.exe to force a reboot of the machine, or initiated it using a PowerShell command as a remediation script. However, since our end users are used to seeing the Config Manager restart dialog for Software Updates and other installs that require a restart, I decided to keep their experience the same.
- Create a new package named Reboot Computer. No source files will be needed. Save it.
- Create a new program:
Command line: cmd /c
Program can run: Whether or not a user is logged on
After Running: Configuration Manager restarts computer
The Target Collection
Now we need a target collection of non-compliant machines to get the reboot deployment.
- Create a new collection named Non-compliant Computer Uptime.
- Add a membership rule query, with two criteria:
Compliance Item Compliance State.CIID is equal to NNNNN (from the baseline you created above)
Configuration Item Compliance State.Compliance State Name is equal to “Non-Compliant”
- Evaluation should be a few times a day (every few hours), or set to use incremental updates if you [sparingly] use those in your environment.
- Deploy the Computer Uptime Compliance Baseline to the machines that need to comply with the uptime policy. Set the evaluation to run every four hours, and no need to remediate since you are doing that outside of the compliance item.
- Deploy the Reboot program to your Non-compliant Computer Uptime collection:
Recurring installation (occurs every 1 day)
Rerun behavior: Always Rerun
If you are using maintenance windows, consider checking to perform both the installation and the reboot outside of maintenance windows.
Sit back and wait for the evaluations to happen. Once a machine is up at least N days, then it will end up in the target collection, get the deployment to reboot, and be removed from the collection after re-evaluating again. Users that are logged in will get the familiar restart warning message before the restart is enforced.
Some things to consider for the choices to make on evaluation frequencies, compliance rule values, and deployment settings:
- Whether or not maintenance windows exist in the environment
- The Computer Restart options set in Client Settings