Enhanced Audit Status Message Queries

First published on TECHNET on Mar 18, 2019

Authored by Brandon McMillan

Hello everyone!  My name is Brandon McMillan and I am a Microsoft Endpoint Configuration Manager (ConfigMgr) CE.  I have found that Status Message Queries can be one of the more underappreciated features of ConfigMgr.  The information you can gather in a quick and easy query can be very powerful in helping you determine the root cause analysis of an issue.  I hope this blog will provide you with additional Status Message Queries and how you can quickly export/import some examples into your environment.

If you would like to go direct to the GitHub resource to import custom status messages queries, please go here: GitHub - EnhancedAuditStatusMsgQueries.  For more information on status messages and how it can help you with discovering activities in your environment, please continue below.

Last Updated: April 14th, 2021 - A fellow CE, Daniel Lovely provided feedback that the EnumerateStatusMessages link from TechNet Gallery is no longer active since TechNet Gallery has been retired.  I uploaded a copy of the original script to extract status messages from SaudM should you be interested in using it.

First let’s break down the different Status Message Types:

 

Reference: SMS_StatusMessage WMI Class

Here is a quick overview of Status Message Queries:

 

Reference: Use Alerts and the Status System

 

Enumerating Status Message Strings

How can we obtain a full listing of Status Message ID’s?  If you are unsure what Status Message ID’s to use to create a specific Status Message Query, you can export all the Status Messages ConfigMgr provides by using a PowerShell script from an article by SaudM.  The script originally was hosted on TechNet Gallery and currently I'm unsure if/where it may had been migrated to, if at all.  I have a previous copy of the script which can be found here: EnumerateStatusMessages | GitHub.

Here’s an example of how you can leverage the script and export the Status Messages based on type: Client, Provider, or Server Messages.

 

Client Messages

 

.\Export-StatusMessages.ps1 -stringPathToDLL "<InstallDrive>:\Program Files\Microsoft Configuration Manager\bin\X64\system32\smsmsgs\climsgs.dll" -stringOutputCSV ExportClientMsgs.csv

 

Provider Messages

 

.\Export-StatusMessages.ps1 -stringPathToDLL "<InstallDrive>:\Program Files\Microsoft Configuration Manager\bin\X64\system32\smsmsgs\provmsgs.dll" -stringOutputCSV ExportProviderMsgs.csv

 

Server Messages

 

.\Export-StatusMessages.ps1 -stringPathToDLL "<InstallDrive>:\Program Files\Microsoft Configuration Manager\bin\X64\system32\smsmsgs\srvmsgs.dll" -stringOutputCSV ExportServerMsgs.csv

 

 

Default Status Message Queries

We provide many out of box queries that are delivered with the product; however, there are many Message ID’s that you can leverage which could help you build your own specific queries for your environment. Some of the default Status Message Queries you may already be familiar with are below:

 

 

Enhanced Audit Status Message Queries

Now what if you need something more specific?  The following list may help you quickly determine what specific activities are occurring within your environment.  You can download the XML file and script resources here on GitHub: Enhanced Audit Status Message Queries.

 

 

Script to Import Enhanced Status Message Queries

Here is an example of executing the script to import the status message queries.

 

Import-CMStatusMessageQueries.ps1 -XMLPath C:\Queries\Enhanced_StatMsgQueries.xml

 

 

Script Details

 

param(
    [Parameter(Mandatory=$True)]
    [string]$XMLPath
)

# Imports ConfigMgr Module
Import-Module "$env:SMS_ADMIN_UI_PATH\..\ConfigurationManager.psd1"

# Get SiteCode
$SiteCode = Get-PSDrive -PSProvider CMSITE
Set-location $SiteCode":"

# Imports XML
try
{
    $CMStatusMsgs = Import-Clixml $XMLPath
}
catch
{
    Write-Host -ForegroundColor Red "Invalid file path or file type.  Please try again."
    Exit
}

foreach ($Query in $CMStatusMsgs)
{
    try
    {
        $StatusQuery = @{
            Name = $Query.Name
            Expression = $Query.Expression
            Comments = $Query.Comments
        }
        New-CMStatusMessageQuery @StatusQuery | Out-Null
        Write-Host -ForegroundColor Green $Query.Name "was created successfully."
    }
    catch
    {
        Write-Host -ForegroundColor Red $Query.Name "already exists."
    }
}

 

 

 

Export Status Message Queries to XML

What if you wish to export your own Status Message Queries to another environment?  You can leverage the ConfigMgr PowerShell cmdlets: Get-CMStatusMessageQuery and Export-Clixml.

 

NOTE: Requires the ConfigMgr PowerShell Module

 

Export all Queries

 

Get-CMStatusMessageQuery | Export-Clixml <path>\StatusMsgQueries.xml

 

 

Export only Queries beginning with the name “Audit”

 

Get-CMStatusMessageQuery -Name Audit* | Export-Clixml <path>\Audit_StatusMsgQueries.xml

 

 

References: Get-CMStatusMessageQuery, Export-Clixml

I hope this information will help you in becoming a true detective within your environment.  Very special thanks for SaudM on the “Enumerating Status Message Strings” script along with Kevin Kasalonis and Daniel Lovely on their feedback with the content of this blog.

Thank you again for reading!

Brandon McMillan, Customer Engineer 

Disclaimer: The information on this site is provided “AS IS” with no warranties, confers no rights, and is not supported by the authors or Microsoft Corporation. Use of any included script samples are subject to the terms specified in the Terms of Use.