Appendix - Health Checks

Appendix for OneSite Health health checks

The following is a list of built-in health checks available to add to health polices.

Account Checks

Health Check	Description	Supports Remediation
User Account - Running Service	Verifies that a specific user account is running a specific service on the device.	Yes

Adaptiva Client Checks

Health Check	Description	Supports Remediation
Adaptiva Client – Not Integrated with SCCM	Checks and Remediates: Adaptiva Client is successfully integrated with the Configuration Manager client.	Yes
Adaptiva Client - Version	Verifies whether Adaptiva client version is equal to desired Adaptiva client version.	No

Background Intelligent Transfer Service (BITS) Health Checks

Health Check	Description	Supports Remediation
BITS – Service Running	Checks and Remediates: The BITS service is running, and its start mode is set to desired type.	Yes
BITS – Service Startup Failing	Checks and Remediates: Detects whether BITS startup is failing (it might be possible that BITS has become corrupted).	Yes
BITS - Version	Checks and Remediates: Ensure SCCM Clients have a recent version of BITS.	Yes

ConfigMgr Client Configuration Checks

Health Check	Description	Supports Remediation
ConfigMgr Client - Cache Available Space	Checks and Remediates: The specified amount of space is available in the client cache.	Yes
ConfigMgr Client - Cache Location	Checks and Remediates: The client cache location is correctly set.	Yes
ConfigMgr Client - Site Assignment	Checks and Remediates: The client is assigned to the specified site.	Yes
ConfigMgr Client - Site Auto Discovery	Verifies: Site auto discovery is working on the client.	No

ConfigMgr Client Health Checks

Health Check	Description	Supports Remediation
ConfigMgr Client – Cache Size	Checks and Remediates: The client cache size is set to desired value, or more.	Yes
ConfigMgr Client – CCM Folders	Checks and Remediates: There is no file named GURESIS.TXT in the C:\Windows\System32 folder, and there is no file named GURESIS.TXT in the Windows registry folder.	Yes
ConfigMgr Client – Download Provider	Verifies whether the specified download provider is present in the CCM_DownloadProvider class in WMI.	No
ConfigMgr Client – Duplicate GUID	Verifies: The client does not have a duplicate SMS GUID.	No
ConfigMgr Client – Installed	Checks and Remediates: The SCCM client agent is installed.	Yes
ConfigMgr Client – Management Point Location	Verifies: The client can correctly determine the location of the management point.	No
ConfigMgr Client– Orphaned Cache Folders	Verifies whether there are any folders in the ccmcache that the ConfigMgr client is not aware of. Remediation removes any that exist.	Yes
ConfigMgr Client – Provisioning Mode	Checks and Remediates: Cases where the Task Sequence Manager leaves software distribution disabled even after it has exited.	Yes
ConfigMgr Client – Service Running	Checks and Remediates: The SCCM client agent service is running, and its start mode is set to the desired type.	Yes
ConfigMgr Client – Version	Checks and Remediates: The specified version or later of SCCM agent is installed.	Yes

ConfigMgr Client Installation Checks

Health Check	Description	Supports Remediation
CCMSetup – DiscoveryStatus MOF	Checks and Remediates: If the event logs contain entries indicating CCMSetup failed due to a DiscoveryStatus MOF compile issue, compiles the MOF automatically if so.	Yes
CCMSetup – StatusAgentProxy DLL	Detects if the event logs contain entries indicating CCMSetup failed due to a StatusAgentProxy DLL issue.	No
CCMSetup – Visual C++ DLL	Checks and Remediates: If the size of the Visual C++ DLL is incorrect, the correct DLL is copied from the specified path.	Yes

ConfigMgr Client Status Checks

Health Check	Description	Supports Remediation
ConfigMgr Client Status – Hardware Inventory	Checks and Remediates: whether hardware inventory is working.	Yes
ConfigMgr Client Status – Heartbeat Discovery	Checks and Remediates: whether heartbeat discovery is working.	Yes
ConfigMgr Client Status – Management Point Ping	Checks and Remediates: The management point and distribution point of the management point can be pinged using ICMP echo.	No
ConfigMgr Client Status – Package Ping	Checks and Remediates: whether package download is working or not.	Yes
ConfigMgr Client Status – Policy Retrieval	Checks and Remediates: whether recently updated policy can be downloaded successfully by the client.	Yes
ConfigMgr Client Status – Software Distribution	Checks and Remediates: whether software distribution is working or not.	Yes
ConfigMgr Client Status – Software Inventory	Checks and Remediates: whether software inventory is working or not.	Yes
ConfigMgr Client Status – Status Message Submission	Checks and Remediates: whether status messages are being reported.	Yes

Data Execution Prevention Checks

Health Check	Description	Supports Remediation
DEP - Policy	Verifies that the Data Execution Prevention Policy is set to a specific setting.	Yes

DCOM Checks

Health Check	Description	Supports Remediation
DCOM – Remote Connection Enabled	Checks and Remediates: Whether remote connection is enabled or not.	Yes

Instant Inventory Checks

Health Check	Description	Supports Remediation
Instant Inventory - Disk Space	Returns any machines that have below the specified amount of available disk space.	No
Instant Inventory - File Contains Text	Returns any machines that have the specified text in a specified file.	No
Instant Inventory – File Exists	Returns any machines that have a specified file.	No
Instant Inventory – Folder Exists	Returns any machines that have a specified folder.	No
Instant Inventory – Process Running	Returns any machines that have a specified process running.	No
Instant Inventory – Service Started	Returns any machines that have a specified service that is in the started state.	No
Instant Inventory – Service Stopped	Returns any machines that have a specified service that is in the stopped state.	No

IP Address Scope Checks

Health Check	Description	Supports Remediation
IP – Permitted Scope	Verifies: Client's IP address is within the specified permitted IP address scopes.	No
IP – Prohibited Scope	Verifies: Client's IP address is not within the specified prohibited IP address scopes.	No

Network Checks

Health Check	Description	Supports Remediation
(Lanman) Server - Service Running	Verifies: The lanmanserver service is running, and its start mode is set to automatic.	Yes
Network - DNS Name Resolution	Verifies whether the local hostname resolves to the correct IP address in DNS. Remediation registers the current IP in DNS.	Yes
Network – DNS Settings	Checks and Remediates: If the Primary DNS suffix, Sync Domain with Membership, the Primary DNS Domain, the NIC DNS Domain and Enable Dynamic DNS Registration settings are set correctly; sets to the desired state if incorrect.	Yes
Network – Hosts file entries present	Checks and Remediates: If the hosts file contains the specified entries. If any specified hosts entry is not present, it is appended.	Yes

Operating System (OS) Health Checks

Health Check	Description	Supports Remediation
OS – Admin Share Available	Checks and Remediates: The admin$ share is published on the client.	Yes
OS – Clear Windows print queues	Clears the Windows printer queues.	Yes
OS – Computer Naming Convention	Detects whether the computer naming convention matches the specified regular expression.	No
OS – Delete Temp Folder Contents	Deletes all content from Temp folders.	No
OS – File Associations	Checks and Remediates: That a list of file extensions is present and matches the list. Corrects any that are incorrect and adds any that are missing.	Yes
OS - Group Policy Processing Errors	Verifies whether any errors are shown within the specified number of days when attempting to process Group Policy.	No
OS – Logon Server Correct	Detects whether the current Logon Server matches the desired name.	No
OS – Remote Desktop Settings	Checks and Remediates: Remote Desktop, Remote Assistance and Secure connection (Network Level Authentication) and sets if any are incorrect.	Yes
OS – Run Key Entries	Checks and Remediates: Both the x86 and x64 Run Key entries are in an allowed list; removes any that are not.	Yes
OS – Screen Saver Settings	Checks and Remediates: For each user, whether the screen saver is configured, whether it is set to password protected, the timeout and the path; if any are incorrect, they are corrected.	Yes
OS – Security Group Presence	Checks and Remediates: Local group membership for a specified local group to ensure that a specified member exists; if it does not exist, it is added.	Yes
OS - Version	Verifies that the client operating system version is one of the specified versions.	No
OS – Windows Explorer Settings	Checks and Remediates: The following - Show Hidden Files, Show Protected System Files, Hide Extensions for Known File Types, Compressed Files in a different color, Show Run on Start Menu, Hide Empty Drives; corrects any that are incorrect.	Yes
OS – Windows Licensing Compliance	Detects the current Windows licensing state.	No
Remote Registry Service Running (OS Specific)	Checks and Remediates: The Remote Registry service is running based on operating system, and its start mode is set to desired type.	Yes

PowerShell Health Checks

Health Check	Description	Supports Remediation
PowerShell – Set PowerShell Execution Policy	Checks and Remediates: The PowerShell execution policy. Choose between Restricted, AllSigned, RemoteSigned, Unrestricted, Bypass or Undefined and sets to the desired state if incorrect.	Yes
PowerShell - WinRM	Checks and Remediates: That WinRM is enabled or disabled on the machine. If in an incorrect state, changes it accordingly.	Yes

SCCM Miscellaneous Checks

Health Check	Description	Supports Remediation
SCCM – Client Actions must be Present	Verifies specific client actions are present.	Yes

Security Health Checks

Health Check	Description	Supports Remediation
Security - Bad Rabbit Immunisation	Verifies whether a system has already been infected by the Bad Rabbit ransomware. Remediation removes the infection and immunizes against future attack.	Yes
Security – BitLocker Drive Encryption	Checks and Remediates: If BitLocker drive encryption is enabled for either the OS Drive, All Drives or a Specific drive; enables if it is not already enabled (encrypts).	Yes
Security – Secure Boot	Detects whether Secure Boot is enabled or disabled in the BIOS/UEFI.	No
Security – User Access Control (UAC) Enabled	Checks and Remediates: If UAC is enabled; performed only on Windows operating systems.	Yes
Security – User Local Admin	Detects whether the currently logged on user is a local administrator.	No
Security - WannaCry Infection Detection	Verifies whether systems have already been infected by WannaCry by conducting a comprehensive evaluation of Indicators of Compromise (IOC) for this exploit. Machines that fail this health check are likely to be compromised and must be immediately isolated from the network. The business must then evaluate whether to reimage the affected systems or pay the ransom to retrieve data.	No
Security - WannaCry Vulnerability Assessment	Verifies whether systems are vulnerable to the WannaCry attack by evaluating whether the correct patches and system updates have been applied to the system. If a machine contains none of the specified patches, it is vulnerable to attack by WannaCry. The patch list can be easily updated by system administrators through a simple command line user interface to add additional patches to the health check as they become available.	Yes

Software Health Checks

Health Check	Description	Supports Remediation
Software – Illegal Software Installed	Detects whether any software specified in a named list of either software titles or software GUIDs is installed.	No
Software – Internet Explorer Home Page	Checks and Remediates: Whether the Internet Explorer home page is set correctly, and if not sets it.	Yes

System Performance Health Checks

Health Check	Description	Supports Remediation
System – Defrag Drive	Runs the disk defragmentation tool to reorganize and optimize the disk.	No
System - Disk Cleanup	Verifies whether the device is under a specified percentage of free disk space. Schedules the Disk Cleanup Manager utility with the specified cleanup options to safely reclaim space.	Yes
System – Free Disk Space	Verifies: The % free space on disk drives.	No
System - Reboot Required	Verifies whether a reboot is required for up to four primary reboot reasons (Windows Update Installation, Windows Component Installation, File Rename Operations, SCCM Reboot Pending).	No
System - Run Check Disk	Schedules a ChkDsk to run on the next reboot.	No
System – Trigger System Restore	Triggers a System Restore task so systems can be restored to a specific point in time.	No
System – Uptime	Verifies whether a system has been online longer than the specified number of days.	No

System Settings Checks

Health Check	Description	Supports Remediation
System – Registry Setting must Exist	Verifies that a specific registry setting exists or is set to a specific value.	Yes
Unquoted Service Binary Path	Scans for services that have spaces in their binary path, but which are not surrounded by double quotes. Remediates any that are found.	Yes

Tanium Health Checks

Health Check	Description	Supports Remediation
Tanium – Verify Client Settings	Verifies that Tanium Client settings are set to a desired state.	Yes

Windows 10 Health Checks

Health Check	Description	Supports Remediation
Windows 10 - Credential Guard Active	Verifies that Credential Guard is enabled and active on the machine. If Credential Guard is not enabled, remediation will enable it.	Yes
Windows 10 - Device Guard & Credential Guard Active	Verifies that both Device Guard and Credential Guard are enabled and active on the machine. If Device Guard and Credential Guard are not enabled, remediation will enable them.	Yes
Windows 10 - Device Guard & Credential Guard Capable	Verifies that the device has all prerequisites and is capable of supporting both Device Guard and Credential Guard.	No
Windows 10 - Device Guard HVCI Active	Verifies that Device Guard HVCI is enabled and active on the machine. If Device Guard is not enabled remediation will enable it.	Yes
Windows 10 - DG-CG - DMA Protection	Verifies that Direct Memory Access Protection is available. This advanced security feature is desirable for Device Guard/Credential Guard security.	No
Windows 10 - DG-CG - NX Protection	Verifies that No-Execute (NX) Protection is available. This advanced security feature is desirable for Device Guard/Credential Guard security.	No
Windows 10 - DG-CG - OS Architecture	Verifies that the Operating System is 64-bit. 64-bit virtualization is required for Device Guard/Credential Guard.	No
Windows 10 - DG-CG - OS SKU	Verifies that the Operating System is a valid SKU. Supported SKUs for Device Guard/Credential Guard include Enterprise, Server, Education and IoT.	No
Windows 10 - DG-CG - Secure Boot State	Verifies that Secure Boot is enabled on the device. Secure Boot is a requirement for Device Guard/Credential Guard.	No
Windows 10 - DG-CG - Secure MOR	Verifies that Secure Memory Overwrite Request (MOR) Protection is available. This advanced security feature is desirable for Device Guard/Credential Guard security.	No
Windows 10 - DG-CG - SLAT Supported CPU	Verifies that the installed CPU supports the Second-level address translation feature desirable for Device Guard/Credential Guard.	No
Windows 10 - DG-CG - SMM Protection	Verifies that System Management Mode (SMM) Protection is available. This advanced security feature is desirable for Device Guard/Credential Guard security.	No
Windows 10 - DG-CG - TPM Version	Verifies that the system has a valid TPM and that it is at least version 2.0. Version 2.0 of the TPM is desirable for Device Guard/Credential Guard.	No
Windows 10 - DG-CG - Virtualization Firmware	Verifies that virtualization firmware is present and available. This includes Intel Virtualization Technology, Intel VT-x, AMD-V, Virtualization Extensions or similar. Virtualization firmware is a requirement for Device Guard/Credential Guard.	No
Windows 10 - DG-CG - Win10 Build Version	Verifies that the version of Windows 10 running is Redstone X or higher. Additional security options were made available after build 10586 (release 1511) that are desirable for Device Guard/Credential Guard.	No
Windows 10 - Last OS Install Date-Time	Verifies that the last time the device had an OS install/reinstall was more than X days ago. This can ensure that end-users that have just been disrupted for an install are prioritized last for another install.	No
Windows 10 - Microsoft Edge Version	Verifies that the installed version of Microsoft Edge meets requirements.	No
Windows 10 - Minimum Hardware Requirements	Verifies that the device has the minimum required hardware specification for supporting Windows 10. Defaults are set to Microsoft hardware recommendations but can be adjusted at design time or runtime to reflect specific business requirements for Windows 10.	No
Windows 10 - Unified Extensible Firmware Interface (UEFI)	Verifies that the device is running the Unified Extensible Firmware Interface (UEFI) required for Secure Boot and Device Guard/Credential Guard. These security features are not supported on legacy BIOS.	No

Windows Update Agent Health Checks

Health Check	Description	Supports Remediation
Windows Update - Auto Update GPO	Verifies whether the group policy settings for Windows Update configuration are set correctly.	No
Windows Update - Last Scan Cycle	Verifies whether the machine last ran the software update scan cycle within the specified number of days.	Yes
Windows Update - Metadata Version	Verifies whether the software update metadata version on the client matches the current metadata version on the server.	Yes
Windows Update - Non-Compliant Assignments	Verifies whether there are any ConfigMgr software update deployments that contain updates in a non-compliant state.	No
Windows Update - Software Update Scan Errors	Verifies whether any errors have been reported by the Software update scan agent and reports back up to the last 10 errors.	No
WUA – Service Missing	Checks and Remediates: Whether WSUS service is present on the machine or not.	Yes
WUA – Service Running	Checks and Remediates: The wuauserv service is running, and its start mode is set to desired type.	Yes
WUA - Version	Checks and Remediates: The WSUS client version is current.	Yes

WMI Health Checks

Health Check	Description	Supports Remediation
WMI – ConfigMgr Client Namespaces	Checks and Remediates: Connectivity to WMI namespaces used by the SCCM client.	Yes
WMI – ExecMgr Connection Error	Checks and Remediates: Detects whether the SCCM client's execmgr log contains WMI connection errors.	Yes
WMI – In Path	Checks and Remediates: The system32\wbem folder is included in the path variable in the environment.	Yes
WMI – Repository Integrity	Checks and Remediates: The integrity of the WMI repository.	Yes
WMI – Service Running	Checks and Remediates: The WinMgmt service is running, and its start mode is set to desired type.	Yes