The recent Wave-D release of the Windows Intune service and the release of System Center 2012 Configuration Manager SP1 enables enterprise management of the Windows RT devices for customers using the Intune standalone management service or System Center Configuration Manager who have obtained a Windows Intune subscription for the management of mobile devices. Management capabilities specifically for Windows RT devices include features such as enrollment, registration, hardware inventory collection, compliance settings and software distribution.
This post contains the steps which you, as an IT administrator, can perform to troubleshoot and investigate software distribution (download and install) issues on the Windows RT client.
Assumptions
The user is able to enroll the Windows RT device to be managed by the Windows Intune Service on behalf of a Windows Intune Standalone or (Configuration Manager) SP1 account using the Company Apps control panel applet and by using their user credentials.
The user has installed the Company Apps Windows 8 style application from the Windows Store and is able to sign in into the application using their valid credentials which they used to enroll.
The enrolled user is able to view applications made available and published to them by their enterprise administrator (Windows Intune or System Center Configuration Manager administrator) and is able to view the details of these apps and request these apps from within the Company Apps Windows 8 style app installed from the Windows Store.
Investigating Issues
For each application requested by the user, there is an application job which is created in the local registry hive of the device under (HKCUSoftwareMicrosoftWindowsCurrentVersionMDMJobDB ). Each application job will have a corresponding Job ID associated with it which will be present in this registry key.
The screenshot below displays the job status for an app which was successfully downloaded and installed by the client:
In the screenshot above notice that the reg key entry for the application job ID has a number of settings associated with it. Some of the important one’s are:
1) BITSId : The MDM Agent client exe on the Windows RT client leverages the BITS service running on the Windows RT device to download content from the content location and subsequently installs the content on the device. The BITS ID denotes the unique ID of the download job which the BITS service uses to track the download. Once BITS completes downloading the content it calls back to the MDMAgent exe on the device indicating that content download succeeded or failed.
2) DeployRetryCount : The number of times the content download was tried by BITS before succeeding or classifying the job as download failure.
3) CurrentDPUrl: The location from which content was last tried to be downloaded from.
4) LastError : The error code HRESULT indicating the error encountered while downloading / installing the application.
5) Status : Indicates the status of the application job. The following mapping defines what each of the possible status codes indicates:
Initialized /Created = 10
Download In Progress = 20
Download Failed = 30
Download Complete = 40
Install In Progress = 50
Install Failed = 60
Install Complete = 70
Troubleshooting Steps for Issues/Symptoms some common issues
-
Symptom
: The user browses through the available apps in the Company Apps Windows 8 Style application downloaded and installed from the Windows Store and requests the app of their choice. The app does not get installed and in the Job DB in the registry the status of the application is 10.
Probable Cause : Most likely sideloading is not enabled on the device. The MDM Agent exe will not process any download / install jobs created until it detects that sideloading is enabled on the device.
Mitigation: To ensure that sideloading is enabled on the Windows RT device.
- In the registry on the device check that the DWord value AllowTrustedApps is set as 1 for the registry key HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindowsAppx
If this value is set to 0 that indicates sideloading isn’t enabled. Contact your enterprise admin and confirm that a valid sideloading key has been targeted by them to your Windows RT device.
-
Symptom
: The user requests the app of their choice. The app does not get installed and in the Job DB in the registry the status of the application is 60.
Probable Cause : Job status 60 indicates that installation of the application failed after download.
Likely causes for this may be any from the list below.
The code signing certificate with which app was signed is not present on the device.
A framework dependency on which the application depends upon is not found installed on the device.
Mitigation:
Copy the package locally
Use the Add-AppxPackage powershell commandlet to attempt install of the application ( http://technet.microsoft.com/en-us/library/hh856048 )
The error message which you get after executing the above PowerShell cmdlet will most likely indicate issues related to code signing or framework dependencies or package corruption.
- Ensure that the code signing certificate with which your application was signed is present on the device and confirm with the enterprise admin that such a certificate was targeted for all enterprise enrolled Windows RT devices.
- In case the installation failure is due to framework dependency missing, the enterprise admin will have to re-publish the application again packaging the framework along with the application package.
- The application package downloaded isn’t a valid package, may have been corrupted, or may not be compatible with the OS version on the device.
-
Symptom
: The user requests the app of their choice. The application does not get installed and in the Job DB in the registry the status of the application is 30.
Probable Cause : Job status 30 indicates that the download of the application failed.
Likely causes for this may be:
- The device lost Internet connectivity while the download was in progress.
- The distribution point where content was hosted was down or unavailable for some time.
- The certificate issued to the device at the time of enrollment may have expired.
Mitigation:
- By launching the Company Apps applet from control panel on the device confirm that the device certificate hasn’t expired, if it has then you will need to re-enroll the device.
- Confirm that the device is connected to the Internet and try to request the application again through the Company Apps Windows 8 Style.
-
Symptom
: The user browses through the available apps in the Company Apps Windows 8 Style application on the device and requests the app of their choice. No Job entry is created in the Registry corresponding to the application requested.
Probable Cause :
- The device may have lost Internet connectivity, at the time when user requests the app from the company app portal, Windows Notification Services in the cloud tries to contact the MDM Agent task running on the device. If there is no connectivity to the Internet then notification services will not be able to contact the device and as a result the device would not be able to talk to the management server endpoint to receive and process application policies.
- The Channel URI associated with the WNS notification channel associated with the device is not been created. You can confirm this by looking at the
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionMDM key in the registry, the WNSChannelURi value in this case would be empty.
Mitigation:
- Confirm that the device is connected to the Internet and request the application again through the Company Apps Windows 8 Style Application downloaded and installed from the Windows store.
This posting is provided "AS IS" with no warranties and confers no rights.