Topic last updated—August 2007

This section provides troubleshooting information to help you resolve unexpected compliance results when using Configuration Manager 2007 desired configuration management.

Compliance Evaluation Results of Some Known Error Conditions

The following tables display the compliance evaluation results of some known error conditions in Configuration Manager 2007, some of which return a discovery error that is displayed in the desired configuration management reports with the category of Compliance Evaluation Errors.

For more information about these reports, see About Reports for Desired Configuration Management.

When a configuration item is evaluated and returns a discovery error, evaluation stops and other instances, objects, and settings within the same configuration item are not evaluated for compliance. However, the instance count (the Report a non-compliance event when this instance count fails option) for the setting is still evaluated.


√ = Discovery error

Ø = No discovery error (returns non-compliant if the following option is enabled: Report a non-compliance event when this instance count fails).

SQL Query Setting Discovery Error

Instance of SQL not found—If Use default instance or Instance name is configured

Instance of SQL not found—If All instances is configured


No SQL Server installed

Invalid SQL query

SQL Server installed but disabled

SQL query returned no value


SQL database not found

Access Denied on SQL Server Instance


Access Denied on SQL database


A non-read query (UPDATE, DELETE, DROP, CREATE)

SQL Server Access Denied


File or Folder Setting Discovery Error

Invalid file path

Driver for file does not exist

File Access Denied (System)


Access Denied on one or more files or folders in a wildcard setting


File does not exist


Script Setting Discovery Error

Script errors (divide zero)

√ (but does not apply to JScript)

No software installed or version not matched

Invalid script syntax

√ (although dependent on script host)

PowerShell Access Denied


Script contains UI that blocks execution

√ (after 6-hour time-out period expires)

Script hit infinite loop

√ (after 6-hour time-out period expires)

IIS Metabase Setting Discovery Error

Query with invalid path

IIS not installed

Query with non-existent intermediate path


IIS installed but disabled

IIS service will be started

IIS installed but metabase is not installed


Metabase Access Denied


XML Query Setting Discovery Error

File not found


File doesn’t contain XML data

File is in use

File returned Access Denied


File is encrypted


Registry Setting Discovery Error

Non existing registry hive

Invalid registry path


Registry setting that returns no value


WMI Setting Discovery Error

WQL query on nonexisting class

WQL query with invalid namespace

WQL query with invalid syntax (class or filter)

Designated value does not exist in the specified class


Value is an object rather than a standard data type


Value is a reference


WMI is disabled

Succeed (service is restarted)

Active Directory Domain Services Setting Discovery Error

Specified path and the first level of subfolders or Specified path and all subfolders

Invalid distinguished name (DN)

Active Directory is not present (nonexisting server)

Access Denied


Invalid Active Directory LDAP attribute


Evaluation Failure for User Account Not Found

A configuration item that evaluates the compliance of Windows security permissions on registry key objects, and on file or folder objects, results in an evaluation failure (discovery error) rather than non-compliance if the specified user account does not exist.


Specify only valid user accounts for Windows security permissions.

Evaluation Failure for File or Folder Object That Validates SHA1-Hash When File Is Open

A configuration item that evaluates the compliance of a file or folder object by using SHA1-Hash validation results in an evaluation failure (discovery error) when the file is open for write access by another application.



Inconsistent Compliance Results for Same Configuration Item

When you import configuration items into Configuration Manager 2007, multiple content versions can be stored and evaluated by clients. However, desired configuration management reports can display compliance with a single version only. When there is a difference in compliance results on the same client between one content version and another, this can lead to inconsistent compliance results in the reports, which will display the results from the last evaluated content version.

For more information about content versions, see About Content Versions in Desired Configuration Management.


This is a known limitation. Use the client report to determine the content version used in the compliance evaluation of a configuration item. As a best practice, avoid this situation by ensuring that the content version on externally authored configuration items is always incremented whenever the configuration item is modified.

File or Folder Object Discovery Returns Multiple Copies of the Same File on Computers Running Windows Vista

On computers running Windows Vista, file or folder object discovery might return multiple copies of the same file when Name pattern search depth is set to Specified path and all subfolders on the General tab of the New File or Folder Properties dialog box.

Computers running Windows Vista utilize User Account Control (UAC) to ask users for permission before performing actions that change system settings such as registry values or system files. If a program is installed that is not UAC-compliant and therefore cannot write to the computer's file system, Windows Vista creates a virtualized copy of the file that is changed within the user's profile. This means that multiple, virtualized copies of files might exist on a computer running Windows Vista that are then discovered by desired configuration management compliance evaluations.


Consider specifying a different value for Name pattern search depth to more closely specify the location of the file to evaluate for compliance.

Multiple, Identical Permissions on a File, Might Result in Non-Compliance When Exclusive File Permissions Are Used

When exclusive file permissions are used in a configuration item object, desired configuration management checks that one set of the specified permissions are applied to the file. However, it is possible that the file inherits a second set of permissions that might be identical to the specified permissions. In this scenario, desired configuration management reports a non-compliant state for the configuration item.


If the file inherits a second set of identical permissions, delete the instance permissions on the file so that only the inherited permissions remain.

A Configuration Item with an IIS Setting Returns an Error on Windows 2008 Server Computers

When a configuration item with an Internet Information Services (IIS) setting is evaluated on a computer running Windows Server 2008, a discovery error might be generated in the log file Discovery.log and evaluation might fail.


To evaluate configuration items with IIS settings on computers running Windows Server 2008, you must install IIS 6.0 Management Compatibility for Internet Information Services 7.0 on the computer running Windows Server 2008.

Configuration Item Settings and Objects That Use the Version Data Type Always Report Compliance

When configuration item settings and objects use the Version data type, they might always evaluate as compliant, despite the version value returned from the client computer being non-compliant. This happens when the value returned from the client computer is a single-digit version number. Desired configuration management expects the version value returned from client computers to be in the format of major version.minor version—for example, 1.2.


There is currently no solution or workaround for this issue.

Modified Configuration Baselines Continue to Display Compliance Results Prior to Modification in the Report “Compliance details for a configuration baseline”

When a configuration item is modified that is being referenced by a configuration baseline assigned to clients, the Actual Compliance value displayed in the report for those configuration baselines will continue to display the results from when the configuration baseline was last evaluated.

In this scenario, the report "Compliance details for a configuration baseline" might display the modified version of the configuration baseline, even though it has not yet been evaluated for compliance. The report will correctly display the configuration items that were used for the last evaluation (prior to modification).


Wait for the configuration baseline to be re-evaluated to display compliance results for the modified configuration items.

See Also