Site PS1 — Primary site - SYNTHETIC (5.00.9128.1000)
Is this Configuration Manager site working, and is it safe. Read live from the site itself, plus whatever the hardening collector last brought back from the site server.
Not returned by the site, so the checks over them report as unmeasured: SMS_SCI_Component, SMS_SCI_SiteDefinition, SMS_BootImagePackage, SMS_StatusMessage (history).
Critical
20
Attention
76
OK
151
To verify
85
not gradeable automatically
Checks passing
61%
151 of 247 graded checks pass
Site system role · SMS Distribution Point — DP-LYON.corp.local
Configuration Manager reports SMS Distribution Point on DP-LYON.corp.local at status 2 (0 healthy, 1 warning, 2 critical).
Open Monitoring, then Site Status, for the messages this role has recorded.
Site component · SMS_DISTRIBUTION_MANAGER — CM01
SMS_DISTRIBUTION_MANAGER on CM01 is at status 2, with 37 error(s) and 5 warning(s) over the summary interval.
Open Monitoring, then Component Status, and read this component’s recent messages.
Deployment failure rate · Contoso CAD 2026 → Engineering laptops
39 of 64 targets failed (60.9%). Succeeded 22, in progress 1, no answer 2.
Open this deployment under Monitoring, then Deployments, and work back from the error codes the clients returned.
Failed distribution · PS100001 — DP-LYON.corp.local
Package PS100001 could not be placed on DP-LYON.corp.local and is no longer being retried (state 3).
Redistribute the package to this distribution point, and check the disk space and the content library on it.
Automatic deployment rule failing · Defender definitions
Defender definitions last ran on 2026-09-22 01:00 UTC and ended with error 0x87D01101.
Re-run the rule by hand and read the error it returns; a rule that has failed silently deploys nothing at all.
Task sequence deployed to a built-in collection · Windows 11 24H2 build → All Unknown Computers
The task sequence Windows 11 24H2 build is deployed to All Unknown Computers, which is a built-in collection rather than a chosen population.
Deploy the task sequence to a collection built for it, and make it available rather than required.
Free space on a drive · DP-LYON.corp.local — E:
E: on DP-LYON.corp.local has 2.8% left — 11.0 GB of 400 GB.
Free space on the content library, or move the library to a larger volume. A distribution point that fills up fails the packages it is asked for without failing itself.
Wide directory group in the local administrators · RPT01 — CORP\Domain Admins
CORP\Domain Admins is a directory group with a very wide membership, and it is a local administrator of the site server.
Remove the group and use one dedicated to administering this server.
Wide directory group in the local administrators · DP-NANTES — CORP\Domain Admins
CORP\Domain Admins is a directory group with a very wide membership, and it is a local administrator of the site server.
Remove the group and use one dedicated to administering this server.
Wide directory group in the local administrators · DP-LYON — CORP\Domain Admins
CORP\Domain Admins is a directory group with a very wide membership, and it is a local administrator of the site server.
Remove the group and use one dedicated to administering this server.
Guest account · DP-LYON — Guest
The guest account Guest is enabled.
Disable the guest account.
SMBv1 protocol · DP-LYON
SMBv1 is enabled on this server.
Remove SMBv1: the protocol is obsolete and unauthenticated attacks against it are public.
Windows Firewall profile · DP-LYON — Domain
The Domain profile is disabled.
Turn the firewall back on for this profile.
Windows Firewall profile · DP-LYON — Private
The Private profile is disabled.
Turn the firewall back on for this profile.
WDigest credential caching · DP-LYON
WDigest is enabled, so plain-text passwords can sit in memory.
Set UseLogonCredential to 0 so credentials stop being cached in clear text.
Automatic logon · DP-LYON
Automatic logon is configured and its password sits in the registry in clear text.
Turn off automatic logon on a production server, and change the password immediately if one is stored.
Network Level Authentication · DP-LYON
Network Level Authentication is not required, so the logon screen is reachable before anyone authenticates.
Require Network Level Authentication, so an unauthenticated caller never reaches the session host.
Wide directory group in the local administrators · SQL01 — CORP\Domain Admins
CORP\Domain Admins is a directory group with a very wide membership, and it is a local administrator of the site server.
Remove the group and use one dedicated to administering this server.
Windows Firewall profile · SQL01 — Domain
The Domain profile is disabled.
Turn the firewall back on for this profile.
Wide directory group in the local administrators · CM01 — CORP\Domain Admins
CORP\Domain Admins is a directory group with a very wide membership, and it is a local administrator of the site server.
Remove the group and use one dedicated to administering this server.
Site system role · SMS Software Update Point — CM01.corp.local
Configuration Manager reports SMS Software Update Point on CM01.corp.local at status 1 (0 healthy, 1 warning, 2 critical).
Open Monitoring, then Site Status, for the messages this role has recorded.
Site system role · Storage Object — SQL01.corp.local
Configuration Manager reports Storage Object on SQL01.corp.local at status 1 (0 healthy, 1 warning, 2 critical).
Open Monitoring, then Site Status, for the messages this role has recorded.
Site component · SMS_WSUS_SYNC_MANAGER — CM01
SMS_WSUS_SYNC_MANAGER on CM01 is at status 1, with 0 error(s) and 3 warning(s) over the summary interval.
Open Monitoring, then Component Status, and read this component’s recent messages.
Site component · SMS_SRS_REPORTING_POINT — RPT01
SMS_SRS_REPORTING_POINT on RPT01 is at status 1, with 0 error(s) and 2 warning(s) over the summary interval.
Open Monitoring, then Component Status, and read this component’s recent messages.
Component stopped while reporting OK · SMS_SITE_BACKUP — CM01
SMS_SITE_BACKUP on CM01 is not running, and therefore reports no recent errors — which is why its status still reads healthy.
Restart the component, or confirm deliberately that the site is meant to run without it.
Targets that never reported · 2026-09 Cumulative Update → All Workstations
288 of 420 targets (68.6%) have never reported on this deployment.
Targets that never answer are usually a client-health problem rather than a deployment one. Check that the collection’s machines still have a working agent.
Distribution being retried · PS100002 — DP-LYON.corp.local
Package PS100002 is still being retried towards DP-LYON.corp.local.
Leave it if the retry is recent; if it has been retrying for days, treat it as a failure.
Age of the last successful synchronisation · CM01.corp.local
Last successful synchronisation 13 day(s) ago, on 2026-09-11 02:04 UTC. Raw state reported: 6702.
A catalogue that stops synchronising stops offering new updates without failing. Restore the schedule.
Errors and warnings over the window
Over the last 72 h the site recorded 5 error(s) and 4 warning(s).
Open Monitoring, then System Status, then Status Message Queries, for the full text of each message.
Component reporting repeatedly · SMS_DISTRIBUTION_MANAGER
SMS_DISTRIBUTION_MANAGER recorded 4 error(s) over the last 72 h.
A component repeating the same error is usually one problem, not many. Start with the oldest occurrence.
Component reporting repeatedly · SMS_WSUS_SYNC_MANAGER
SMS_WSUS_SYNC_MANAGER recorded 1 error(s) over the last 72 h.
A component repeating the same error is usually one problem, not many. Start with the oldest occurrence.
Automatic client push installation
The site installs the client automatically by push.
A documented route to credential relay. Prefer deployment by group policy or by Intune, and disable automatic push.
Distribution point serving over HTTP · DP-LYON.corp.local
DP-LYON.corp.local serves content over plain HTTP.
Move this distribution point to HTTPS, or enable Enhanced HTTP on the site.
PXE open to unknown machines · DP-LYON.corp.local
DP-LYON.corp.local answers PXE for machines the site has never heard of.
Answering unknown machines lets anyone on the segment start an operating system deployment. Turn it off outside of a build window.
Excessively wide boundary · Corporate
Corporate covers 16 777 216 addresses (10.0.0.0/8).
A boundary this wide gives content and site assignment to machines nobody intended. Split it along the network segments it actually covers.
Boundaries in no group
1 of 4 boundaries belong to no boundary group, so they route nothing.
A boundary in no group does nothing. Attach it or remove it, so the boundary list still describes the network.
Free space on a drive · SQL01.corp.local — D:
D: on SQL01.corp.local has 6.2% left — 62.0 GB of 1000 GB.
Free space on the content library, or move the library to a larger volume. A distribution point that fills up fails the packages it is asked for without failing itself.
Site system reporting nothing · DP-NANTES.corp.local
DP-NANTES.corp.local holds DP, Component, Site system and reports no component at all, so the console shows it as healthy on the strength of silence.
Either the machine has stopped talking to the site, or its roles were removed and its record left behind. Both look healthy in the console.
Free space on a drive · DP-NANTES.corp.local — E:
E: on DP-NANTES.corp.local has 8.5% left — 34.0 GB of 400 GB.
Free space on the content library, or move the library to a larger volume. A distribution point that fills up fails the packages it is asked for without failing itself.
Distribution point behind the site build · DP-NANTES.corp.local
DP-NANTES.corp.local is on 5.00.9058.1000 while the site is on 5.00.9128.1000.
Check the distribution point upgrade under Monitoring, then Distribution Point Configuration Status. A distribution point that never takes the upgrade quietly stops supporting new content.
WinRM listeners · DP-NANTES
At least one WinRM listener accepts plain HTTP.
Prefer an HTTPS listener with a valid certificate.
SMB share · DP-LYON — Temp
Temp points at C:\Temp and grants write access far too widely: Everyone (Change) — at share level. NTFS permissions were not read: effective access is the stricter of the two, so check them before concluding.
This share was created by hand: restrict write access to named groups (content administrators) and check the underlying NTFS permissions. For a package source share, the site server computer account needs read access; also secure the channel with SMB signing, as Microsoft recommends.
Built-in administrator account · DP-LYON — Administrator
The built-in account Administrator is enabled.
Disable it in favour of named accounts, or manage its password with LAPS.
Minimum password length · DP-LYON
Local minimum password length is 7 characters.
Raise the minimum to fourteen characters or more.
Password complexity · DP-LYON
Password complexity is not required locally.
Require complexity in the local security policy.
Account lockout threshold · DP-LYON
No account lockout threshold is set locally.
Set a lockout threshold, ten attempts for instance, so a password cannot be guessed at leisure.
WebClient service (WebDAV) · DP-LYON
The WebClient service is running on this server.
WebDAV makes credential coercion easier. Disable the service unless something needs it.
Print Spooler service · DP-LYON
The Print Spooler service is running on this server.
A known vector for privilege escalation and coercion. Disable it unless this server prints.
SMB signing required (server) · DP-LYON
SMB signing is not required for inbound connections.
Require SMB signing so an intercepted session cannot be relayed.
SMB signing required (client) · DP-LYON
SMB signing is not required for outbound connections.
Require SMB signing on outbound connections as well; the server half alone does not stop a relay.
NetBIOS over TCP/IP · DP-LYON
NetBIOS over TCP/IP is enabled or left at its default on: Ethernet0; Ethernet1
Disable NetBIOS over TCP/IP to close name-poisoning attacks such as Responder.
LLMNR · DP-LYON
LLMNR is not explicitly disabled, so the default applies and it answers.
Disable LLMNR by group policy, alongside NetBIOS.
LAN Manager authentication level · DP-LYON
Set to 2, which still accepts authentication weaker than NTLMv2.
Set the LAN Manager authentication level to 5, which sends NTLMv2 only and refuses LM and NTLM.
LSA protection (RunAsPPL) · DP-LYON
The LSA process does not run protected.
Enable LSA protection once third-party drivers and agents have been tested against it.
WinRM listeners · DP-LYON
At least one WinRM listener accepts plain HTTP.
Prefer an HTTPS listener with a valid certificate.
WinRM TrustedHosts · DP-LYON
TrustedHosts is set to the wildcard, so this client will authenticate to any host.
Replace the wildcard with an explicit list of trusted servers.
Microsoft Defender Antivirus · DP-LYON
Real-time protection: true. Antivirus engine: true. Signatures are 14 day(s) old.
Make sure real-time protection is on and the signatures current, or confirm an equivalent third-party agent.
Most recent operating system update · DP-LYON — KB5036893
The most recent update on record is KB5036893, installed on 2026-04-10 00:00 UTC — 165 day(s) ago.
Review the patching process for this server.
Command line in process creation events · DP-LYON
Process creation events do not include the command line.
Include the command line in event 4688; without it, process auditing rarely names what actually ran.
PowerShell script block logging · DP-LYON
Script block logging is not enabled.
Enable PowerShell script block logging: it is the single most useful source for detecting what a script did.
PowerShell v2 engine · DP-LYON
The PowerShell v2 engine is still installed.
Remove PowerShell v2: it supports neither AMSI nor script block logging, and it can be requested deliberately to escape both.
Anonymous enumeration of SAM accounts · DP-LYON
Anonymous enumeration of SAM accounts is not explicitly refused.
Refuse anonymous enumeration of SAM accounts and shares.
Legacy TLS/SSL protocol · DP-LYON — SSL 3.0
SSL 3.0 is active server-side.
Disable this protocol: it is obsolete.
Legacy TLS/SSL protocol · DP-LYON — TLS 1.0
TLS 1.0 is active server-side.
Disable this protocol: it is obsolete.
Legacy TLS/SSL protocol · DP-LYON — TLS 1.1
TLS 1.1 is active server-side.
Disable this protocol: it is obsolete.
Cipher suites · DP-LYON
1 weak cipher suite(s) remain enabled: TLS_RSA_WITH_3DES_EDE_CBC_SHA
Remove the obsolete suites from the cipher order.
Built-in administrator account · SQL01 — Administrator
The built-in account Administrator is enabled.
Disable it in favour of named accounts, or manage its password with LAPS.
Minimum password length · SQL01
Local minimum password length is 8 characters.
Raise the minimum to fourteen characters or more.
Account lockout threshold · SQL01
No account lockout threshold is set locally.
Set a lockout threshold, ten attempts for instance, so a password cannot be guessed at leisure.
Print Spooler service · SQL01
The Print Spooler service is running on this server.
A known vector for privilege escalation and coercion. Disable it unless this server prints.
Unquoted service paths · SQL01
1 service(s) have an executable path that contains a space and is not quoted: SqlMonitor : C:\Program Files\Contoso Tools\sqlmon.exe -service
Quote each executable path so a file dropped earlier in it cannot be started instead.
SMB signing required (server) · SQL01
SMB signing is not required for inbound connections.
Require SMB signing so an intercepted session cannot be relayed.
SMB signing required (client) · SQL01
SMB signing is not required for outbound connections.
Require SMB signing on outbound connections as well; the server half alone does not stop a relay.
NetBIOS over TCP/IP · SQL01
NetBIOS over TCP/IP is enabled or left at its default on: Ethernet0
Disable NetBIOS over TCP/IP to close name-poisoning attacks such as Responder.
LLMNR · SQL01
LLMNR is not explicitly disabled, so the default applies and it answers.
Disable LLMNR by group policy, alongside NetBIOS.
LAN Manager authentication level · SQL01
Set to 3, which still accepts authentication weaker than NTLMv2.
Set the LAN Manager authentication level to 5, which sends NTLMv2 only and refuses LM and NTLM.
LSA protection (RunAsPPL) · SQL01
The LSA process does not run protected.
Enable LSA protection once third-party drivers and agents have been tested against it.
WinRM listeners · SQL01
At least one WinRM listener accepts plain HTTP.
Prefer an HTTPS listener with a valid certificate.
Most recent operating system update · SQL01 — KB5040437
The most recent update on record is KB5040437, installed on 2026-06-12 00:00 UTC — 102 day(s) ago.
Review the patching process for this server.
Command line in process creation events · SQL01
Process creation events do not include the command line.
Include the command line in event 4688; without it, process auditing rarely names what actually ran.
PowerShell script block logging · SQL01
Script block logging is not enabled.
Enable PowerShell script block logging: it is the single most useful source for detecting what a script did.
PowerShell v2 engine · SQL01
The PowerShell v2 engine is still installed.
Remove PowerShell v2: it supports neither AMSI nor script block logging, and it can be requested deliberately to escape both.
Legacy TLS/SSL protocol · SQL01 — TLS 1.0
TLS 1.0 is active server-side.
Disable this protocol: it is obsolete.
Legacy TLS/SSL protocol · SQL01 — TLS 1.1
TLS 1.1 is active server-side.
Disable this protocol: it is obsolete.
Cipher suites · SQL01
2 weak cipher suite(s) remain enabled: TLS_RSA_WITH_3DES_EDE_CBC_SHA, TLS_RSA_WITH_RC4_128_SHA
Remove the obsolete suites from the cipher order.
SMB share · CM01 — Sources
Sources points at E:\Sources and grants write access far too widely: Everyone (Full) — at share level. NTFS permissions were not read: effective access is the stricter of the two, so check them before concluding.
This share was created by hand: restrict write access to named groups (content administrators) and check the underlying NTFS permissions. For a package source share, the site server computer account needs read access; also secure the channel with SMB signing, as Microsoft recommends.
Built-in administrator account · CM01 — Administrator
The built-in account Administrator is enabled.
Disable it in favour of named accounts, or manage its password with LAPS.
Minimum password length · CM01
Local minimum password length is 12 characters.
Raise the minimum to fourteen characters or more.
Print Spooler service · CM01
The Print Spooler service is running on this server.
A known vector for privilege escalation and coercion. Disable it unless this server prints.
SMB signing required (client) · CM01
SMB signing is not required for outbound connections.
Require SMB signing on outbound connections as well; the server half alone does not stop a relay.
NetBIOS over TCP/IP · CM01
NetBIOS over TCP/IP is enabled or left at its default on: Ethernet0
Disable NetBIOS over TCP/IP to close name-poisoning attacks such as Responder.
LLMNR · CM01
LLMNR is not explicitly disabled, so the default applies and it answers.
Disable LLMNR by group policy, alongside NetBIOS.
LAN Manager authentication level · CM01
Set to 3, which still accepts authentication weaker than NTLMv2.
Set the LAN Manager authentication level to 5, which sends NTLMv2 only and refuses LM and NTLM.
LSA protection (RunAsPPL) · CM01
The LSA process does not run protected.
Enable LSA protection once third-party drivers and agents have been tested against it.
WinRM listeners · CM01
At least one WinRM listener accepts plain HTTP.
Prefer an HTTPS listener with a valid certificate.
Command line in process creation events · CM01
Process creation events do not include the command line.
Include the command line in event 4688; without it, process auditing rarely names what actually ran.
Every machine this site runs on, gathered into one card each: the roles it holds, what its components are saying, how much room is left on its drives and whether the hardening collector has been near it. Errors are dated from the status messages: a component quiet for 30 days no longer counts as a finding.
Site systems
6
site PS1
Machines in trouble
5
Distribution points
3
Distinct roles
9
Free space
625 GB
of 2.9 TB across every drive read
Hardening collected
5 / 6
Collected on 5 of 6 machines.
MP02.corp.local — Connecting to remote server MP02.corp.local failed with the following error message : WinRM cannot complete the operation. Verify that the specified computer name is valid, that the computer is accessible over the network, and that a firewall exception for the WinRM service is enabled and allows access from this computer.
Components to look at
| Component | Status | Site counters | Last contact |
|---|---|---|---|
| SMS_DISTRIBUTION_MANAGER | Critical | 37 err. / 5 warn. | — |
| SMS_WSUS_SYNC_MANAGER | Attention | 0 err. / 3 warn. | — |
1 stopped
Drives
| Drive | Free space | Size | |
|---|---|---|---|
| E: | 210 GB | 500 GB | 58% used |
| C: | 88.0 GB | 200 GB | 56% used |
Roles
Components to look at
This machine reports no component at all.
Drives
| Drive | Free space | Size | |
|---|---|---|---|
| D: | 62.0 GB | 1000 GB | 93.8% used |
Roles
Components to look at
No component in trouble.
Drives
| Drive | Free space | Size | |
|---|---|---|---|
| E: | 11.0 GB | 400 GB | 97.2% used |
| F: | 150 GB | 400 GB | 62.5% used |
Roles
Components to look at
This machine reports no component at all.
Drives
| Drive | Free space | Size | |
|---|---|---|---|
| E: | 34.0 GB | 400 GB | 91.5% used |
Roles
Components to look at
No component in trouble.
Drives
no drive reported
Roles
Components to look at
| Component | Status | Site counters | Last contact |
|---|---|---|---|
| SMS_SRS_REPORTING_POINT | Attention | 0 err. / 2 warn. | — |
Drives
| Drive | Free space | Size | |
|---|---|---|---|
| C: | 70.0 GB | 120 GB | 41.7% used |
Roles
| Check | Status | Detail | Recommendation | Doc. |
|---|---|---|---|---|
| Infrastructure of this site | To verify | 6 machine(s) carry this site, holding 9 distinct role(s), 3 of them distribution points. | — | — |
| Free space on a driveSQL01.corp.local — D: | Attention | D: on SQL01.corp.local has 6.2% left — 62.0 GB of 1000 GB. | Free space on the content library, or move the library to a larger volume. A distribution point that fills up fails the packages it is asked for without failing itself. | — |
| Free space on a driveDP-LYON.corp.local — E: | Critical | E: on DP-LYON.corp.local has 2.8% left — 11.0 GB of 400 GB. | Free space on the content library, or move the library to a larger volume. A distribution point that fills up fails the packages it is asked for without failing itself. | — |
| Site system reporting nothingDP-NANTES.corp.local | Attention | DP-NANTES.corp.local holds DP, Component, Site system and reports no component at all, so the console shows it as healthy on the strength of silence. | Either the machine has stopped talking to the site, or its roles were removed and its record left behind. Both look healthy in the console. | ↗ |
| Free space on a driveDP-NANTES.corp.local — E: | Attention | E: on DP-NANTES.corp.local has 8.5% left — 34.0 GB of 400 GB. | Free space on the content library, or move the library to a larger volume. A distribution point that fills up fails the packages it is asked for without failing itself. | — |
| Distribution point behind the site buildDP-NANTES.corp.local | Attention | DP-NANTES.corp.local is on 5.00.9058.1000 while the site is on 5.00.9128.1000. | Check the distribution point upgrade under Monitoring, then Distribution Point Configuration Status. A distribution point that never takes the upgrade quietly stops supporting new content. | — |
| Site database serverSQL01.corp.local | To verify | The site database is on SQL01.corp.local. | Confirm this server is sized, backed up and patched as a site component rather than as an ordinary database host. | — |
| Hardening coverage | To verify | The hardening collector has been run on 5 of 6 machines. Nothing is known about the operating system of the others: MP02.corp.local | Run the collector on the remaining machines: a distribution point in a branch office has its own local administrators and its own firewall. | — |
| Site systems, in summary | To verify | 6 machine(s), 5 of them with something to look at: CM01.corp.local, SQL01.corp.local, DP-LYON.corp.local, DP-NANTES.corp.local, RPT01.corp.local | — | — |
No check matches this filter.
The machines the site manages, read as a population: is the client there, is it talking to the infrastructure, is it reporting back, is it healthy, and how much of it has moved to Intune.
Machines known
36
2 superseded
Healthy clients
20
66.7% of clients · active, health OK, policy < 7 d, inventory < 14 d
No client
4
of those discovered
Quiet for a week
4
13.3% · 2 over a month
Client health failing
2
3 never evaluated
Inventory stale
4
13.3%
Co-managed
22
73.3%
site build 5.00.9128.1000
out of 30 managed machines
| Check | Status | Detail | Recommendation | Doc. |
|---|---|---|---|---|
| Clients, in summary | To verify | 36 machines known to the site, 32 carrying a client, 2 superseded. | — | — |
| Machines with no client | Attention | 4 of 34 discovered machines have no client (11.8%). 32 are installed. | A discovered machine with no client is one the site cannot manage or report on. Check client push, the boundary groups that machine falls in, and whether it is still alive at all. | ↗ |
| Superseded records | OK | 2 of 36 records are superseded (5.6%). | — | — |
| Clients the site calls inactive | Attention | The site calls 3 of 30 managed clients inactive (10%). | Inactive is the site’s own verdict, based on heartbeat and policy. Start with the ones that are also quiet. | — |
| Clients that have stopped asking for policy | Attention | 4 of 30 clients (13.3%) have not asked for their policy in over 7 days, 2 of them in over 30. | A client that stops asking for policy stops receiving deployments without failing any of them. This is the most reliable sign of a client that is present and dead. | — |
| Clients that never asked for policy | Attention | 1 of 30 clients have never asked for a policy at all. | A client that has never asked for policy was installed but never registered. Check its certificate, its management point and the boundary group it falls in. | — |
| Clients no longer reporting inventory | Attention | 4 of 30 clients (13.3%) have not reported hardware inventory in over 14 days, and 2 never have. | A client that asks for policy but reports no inventory skews every report you run without ever failing. Check the WMI repository and the inventory cycle on these machines. | ↗ |
| Client health evaluation | Attention | 2 of 27 evaluated clients failed their health check (7.4%). 3 were never evaluated. | Open Monitoring, then Client Status, for the individual checks. Failures here are usually the WMI repository, the client certificate or the agent service. | ↗ |
| Clients behind the site build | Attention | 4 of 30 clients (13.3%) are on a build other than the site’s 5.00.9128. | A client behind the site build fails deployments for reasons that never appear in the deployment. Promote the client upgrade. | ↗ |
| Co-management | To verify | 22 of 30 managed clients are co-managed (73.3%), and 22 are enrolled in Intune. | Co-management is the path off this site. Every machine not co-managed is one the migration has not started on. | ↗ |
| Workloads moved to Intune | To verify | 2 workload(s) have moved to Intune: compliance, deviceConfiguration. Raw bitmask on a sample device: 11. | Each workload switched to Intune is one this site no longer has to carry. The raw bitmask is printed so the reading can be confirmed against the console. | ↗ |
| MDM enrolment failures | Critical | 3 of 30 clients (10%) failed to enrol in Intune. Commonest statuses: 0x8018000a (2), 0x80180014 (1) | These machines are co-management candidates that cannot enrol, so the migration stops at them. The status code is the fix: look it up before touching the device. | ↗ |
No check matches this filter.
| Server | Operating system | Client | Policy | Inventory | What is wrong |
|---|---|---|---|---|---|
| PC-0202 | Microsoft Windows NT Workstation 10.0 | 5.00.9058.1000 | 119 d | 129 d | silent for a monthinactiveinventory stale |
| PC-0201 | Microsoft Windows NT Workstation 10.0 | 5.00.9058.1000 | 63 d | 69 d | silent for a monthinactiveinventory stale |
| PC-0301 | Microsoft Windows NT Workstation 10.0 | 5.00.9128.1025 | never | never | never asked for policyinactivenever inventoried |
| PC-0102 | Microsoft Windows NT Workstation 10.0 | 5.00.9128.1025 | 11 d | 19 d | quietinventory stale |
| PC-0401 | Microsoft Windows NT Workstation 10.0 | 5.00.9128.1025 | -1 d | 44 d | health check failedinventory stale |
| PC-0402 | Microsoft Windows NT Workstation 10.0 | 5.00.9128.1025 | -1 d | never | health check failednever inventoried |
| PC-0101 | Microsoft Windows NT Workstation 10.0 | 5.00.9128.1025 | 8 d | 8 d | quiet |
| PC-0502 | Microsoft Windows NT Workstation 10.0 | 5.00.9128.1025 | 0 d | 1 d | enrolment failed |
| PC-0501 | Microsoft Windows NT Workstation 10.0 | 5.00.9128.1025 | -1 d | 0 d | enrolment failed |
| PC-0503 | Microsoft Windows NT Workstation 10.0 | 5.00.9128.1025 | -1 d | 0 d | enrolment failed |
Site
PS1
5.00.9128.1000
Site system roles
11
Components
11
Deployments
5
Distribution points
3
Collections
3
Status messages
9
last 72 h
| Check | Status | Detail | Recommendation | Doc. |
|---|---|---|---|---|
| Site identity and versionPS1 | To verify | Site PS1 (Primary site - SYNTHETIC) on CM01.corp.local, version 5.00.9128.1000, build 9128. | — | — |
| Check | Status | Detail | Recommendation | Doc. |
|---|---|---|---|---|
| Site system roleSMS Distribution Point — DP-LYON.corp.local | Critical | Configuration Manager reports SMS Distribution Point on DP-LYON.corp.local at status 2 (0 healthy, 1 warning, 2 critical). | Open Monitoring, then Site Status, for the messages this role has recorded. | ↗ |
| Site system roleSMS Software Update Point — CM01.corp.local | Attention | Configuration Manager reports SMS Software Update Point on CM01.corp.local at status 1 (0 healthy, 1 warning, 2 critical). | Open Monitoring, then Site Status, for the messages this role has recorded. | ↗ |
| Site system roleStorage Object — SQL01.corp.local | Attention | Configuration Manager reports Storage Object on SQL01.corp.local at status 1 (0 healthy, 1 warning, 2 critical). | Open Monitoring, then Site Status, for the messages this role has recorded. | ↗ |
| Site system roles, in summary | To verify | 8 of 11 site system roles are healthy. | — | — |
| Site componentSMS_DISTRIBUTION_MANAGER — CM01 | Critical | SMS_DISTRIBUTION_MANAGER on CM01 is at status 2, with 37 error(s) and 5 warning(s) over the summary interval. | Open Monitoring, then Component Status, and read this component’s recent messages. | ↗ |
| Site componentSMS_WSUS_SYNC_MANAGER — CM01 | Attention | SMS_WSUS_SYNC_MANAGER on CM01 is at status 1, with 0 error(s) and 3 warning(s) over the summary interval. | Open Monitoring, then Component Status, and read this component’s recent messages. | ↗ |
| Site componentSMS_SRS_REPORTING_POINT — RPT01 | Attention | SMS_SRS_REPORTING_POINT on RPT01 is at status 1, with 0 error(s) and 2 warning(s) over the summary interval. | Open Monitoring, then Component Status, and read this component’s recent messages. | ↗ |
| Component stopped while reporting OKSMS_SITE_BACKUP — CM01 | Attention | SMS_SITE_BACKUP on CM01 is not running, and therefore reports no recent errors — which is why its status still reads healthy. | Restart the component, or confirm deliberately that the site is meant to run without it. | — |
| Site components, in summary | To verify | 11 components monitored, 3 of them not healthy. | — | — |
| Check | Status | Detail | Recommendation | Doc. |
|---|---|---|---|---|
| Deployment failure rateContoso CAD 2026 → Engineering laptops | Critical | 39 of 64 targets failed (60.9%). Succeeded 22, in progress 1, no answer 2. | Open this deployment under Monitoring, then Deployments, and work back from the error codes the clients returned. | ↗ |
| Targets that never reported2026-09 Cumulative Update → All Workstations | Attention | 288 of 420 targets (68.6%) have never reported on this deployment. | Targets that never answer are usually a client-health problem rather than a deployment one. Check that the collection’s machines still have a working agent. | — |
| Deployments, in summary | To verify | 5 active deployments, 1 of them failing on more than a tenth of their targets. | — | — |
| Check | Status | Detail | Recommendation | Doc. |
|---|---|---|---|---|
| Failed distributionPS100001 — DP-LYON.corp.local | Critical | Package PS100001 could not be placed on DP-LYON.corp.local and is no longer being retried (state 3). | Redistribute the package to this distribution point, and check the disk space and the content library on it. | ↗ |
| Distribution being retriedPS100002 — DP-LYON.corp.local | Attention | Package PS100002 is still being retried towards DP-LYON.corp.local. | Leave it if the retry is recent; if it has been retrying for days, treat it as a failure. | — |
| Content distribution, in summary | To verify | 5 package-to-distribution-point states: 1 failed, 1 retrying, 1 in progress. | — | — |
| Check | Status | Detail | Recommendation | Doc. |
|---|---|---|---|---|
| Age of the last successful synchronisationCM01.corp.local | Attention | Last successful synchronisation 13 day(s) ago, on 2026-09-11 02:04 UTC. Raw state reported: 6702. | A catalogue that stops synchronising stops offering new updates without failing. Restore the schedule. | — |
| Automatic deployment rule failingDefender definitions | Critical | Defender definitions last ran on 2026-09-22 01:00 UTC and ended with error 0x87D01101. | Re-run the rule by hand and read the error it returns; a rule that has failed silently deploys nothing at all. | ↗ |
| Automatic deployment rules, in summary | To verify | 2 automatic deployment rules, 1 of them ending in error. | — | — |
| Check | Status | Detail | Recommendation | Doc. |
|---|---|---|---|---|
| Collections evaluated incrementally | OK | 3 of 3 collections are evaluated incrementally (guidance caps this around 200). | — | — |
| Empty collections | OK | 0 of 3 collections have no member. | — | — |
| Collections never re-evaluated | To verify | 0 of 3 collections have no evaluation schedule and only change when someone updates them by hand. | — | — |
| Check | Status | Detail | Recommendation | Doc. |
|---|---|---|---|---|
| Errors and warnings over the window | Attention | Over the last 72 h the site recorded 5 error(s) and 4 warning(s). | Open Monitoring, then System Status, then Status Message Queries, for the full text of each message. | — |
| Component reporting repeatedlySMS_DISTRIBUTION_MANAGER | Attention | SMS_DISTRIBUTION_MANAGER recorded 4 error(s) over the last 72 h. | A component repeating the same error is usually one problem, not many. Start with the oldest occurrence. | — |
| Component reporting repeatedlySMS_WSUS_SYNC_MANAGER | Attention | SMS_WSUS_SYNC_MANAGER recorded 1 error(s) over the last 72 h. | A component repeating the same error is usually one problem, not many. Start with the oldest occurrence. | — |
No check matches this filter.
What the site itself exposes: who administers it, how clients reach it, how it installs them, and what an unknown machine can ask it for. Hardening of the server it runs on is the next tab, and it cannot be read from here.
Critical
1
Attention
5
OK
2
To verify
7
The 23 preventive measures of Misconfiguration Manager (SpecterOps), and what this report measures of them. The status is the worst of the checks involved, across all machines.
| ID | Measure | Status | Checked by |
|---|---|---|---|
| PREVENT-1 | Patch site server with KB15599094 | OK | 1 check(s): Client push NTLM update (KB15599094) |
| PREVENT-2 | Disable fallback to NTLM | — | Not collected: the matching read did not run or returned nothing. |
| PREVENT-3 | Harden or disable network access accounts | To verify | 1 check(s): Network Access Account |
| PREVENT-4 | Configure Enhanced HTTP | To verify | 1 check(s): Client communication mode |
| PREVENT-5 | Disable automatic site-wide client push installation | Attention | 1 check(s): Automatic client push installation |
| PREVENT-6 | Configure a strong PXE boot password | — | Cannot be measured read-only from the site: check by hand. |
| PREVENT-7 | Disable command support in PXE boot configuration | — | Not collected: the matching read did not run or returned nothing. |
| PREVENT-8 | Require PKI certificates for client authentication | To verify | 1 check(s): Client communication mode |
| PREVENT-9 | Enforce MFA for SMS Provider calls | — | Cannot be measured read-only from the site: check by hand. |
| PREVENT-10 | Enforce the principle of least privilege for accounts | Critical | 11 check(s): Holders of the Full Administrator role, Local Administrators group, Wide directory group in the local administrators |
| PREVENT-11 | Disable and uninstall WebClient on site servers | Attention | 5 check(s): WebClient service (WebDAV) |
| PREVENT-12 | Require SMB signing on site systems | Attention | 10 check(s): SMB signing required (server), SMB signing required (client) |
| PREVENT-13 | Require LDAP channel binding and signing | — | Out of scope: a setting of the domain controllers or the directory, not of the site systems. |
| PREVENT-14 | Require EPA on AD CS and site databases | — | Not collected: the matching read did not run or returned nothing. |
| PREVENT-15 | Disable and change passwords of legacy NAAs and collection variables | To verify | 1 check(s): Network Access Account |
| PREVENT-16 | Remove SeMachineAccountPrivilege and set MachineAccountQuota to 0 | — | Not collected: the matching read did not run or returned nothing. |
| PREVENT-17 | Remove Extended Rights assignment from accounts that do not require it | — | Out of scope: a setting of the domain controllers or the directory, not of the site systems. |
| PREVENT-18 | Use strong passwords for DBA accounts | — | Cannot be measured read-only from the site: check by hand. |
| PREVENT-19 | Remove unnecessary links to site databases | — | Cannot be measured read-only from the site: check by hand. |
| PREVENT-20 | Block unnecessary connections to site systems | Critical | 17 check(s): Windows Firewall profile, SMB share |
| PREVENT-21 | Restrict PXE boot to authorized VLANs | — | Cannot be measured read-only from the site: check by hand. |
| PREVENT-22 | Do not manage assets in two or more segmented forests, domains, networks | — | Out of scope: a setting of the domain controllers or the directory, not of the site systems. |
| PREVENT-23 | Ensure the client cache directory (ccmcache) is not writable by non-administrative users | — | Not collected: the matching read did not run or returned nothing. |
| Check | Status | Detail | Recommendation | Doc. |
|---|---|---|---|---|
| Holders of the Full Administrator role | To verify | 1 account(s) or group(s) hold Full Administrator: CORP\g-sccm-fulladmins | Keep Full Administrator to the few who genuinely need it, and use narrower roles for everyday work. | ↗ |
| Check | Status | Detail | Recommendation | Doc. |
|---|---|---|---|---|
| Automatic client push installation | Attention | The site installs the client automatically by push. | A documented route to credential relay. Prefer deployment by group policy or by Intune, and disable automatic push. | ↗ |
| Client push to domain controllers | OK | Domain controllers are excluded from automatic client push. | — | — |
| Client push NTLM update (KB15599094) | OK | Build 9128: later than 2207, which includes update KB15599094. | — | — |
| Check | Status | Detail | Recommendation | Doc. |
|---|---|---|---|---|
| Network Access Account | To verify | The Network Access Account setting could not be read (Software Distribution component of the site control file). | If one is configured, its credentials can be read back from any client by a local administrator. Restrict it to read-only rights, or retire it in favour of Enhanced HTTP or HTTPS. | ↗ |
| Check | Status | Detail | Recommendation | Doc. |
|---|---|---|---|---|
| Client communication mode | To verify | The provider did not return a client communication mode for this site. | Confirm the site is on HTTPS or on Enhanced HTTP, and not on plain HTTP. | ↗ |
| Distribution point serving over HTTPDP-LYON.corp.local | Attention | DP-LYON.corp.local serves content over plain HTTP. | Move this distribution point to HTTPS, or enable Enhanced HTTP on the site. | ↗ |
| Distribution point transport, in summary | To verify | 2 of 3 distribution points serve over HTTPS. | — | — |
| Check | Status | Detail | Recommendation | Doc. |
|---|---|---|---|---|
| PXE-enabled distribution points | To verify | 1 distribution point(s) answer PXE: DP-LYON.corp.local | Require a boot password and restrict which network segments can reach the PXE responder. | ↗ |
| PXE open to unknown machinesDP-LYON.corp.local | Attention | DP-LYON.corp.local answers PXE for machines the site has never heard of. | Answering unknown machines lets anyone on the segment start an operating system deployment. Turn it off outside of a build window. | ↗ |
| Task sequence deployed to a built-in collectionWindows 11 24H2 build → All Unknown Computers | Critical | The task sequence Windows 11 24H2 build is deployed to All Unknown Computers, which is a built-in collection rather than a chosen population. | Deploy the task sequence to a collection built for it, and make it available rather than required. | ↗ |
| Task sequences | To verify | 2 task sequence(s) on this site. Their steps and variables were not opened by this check. | Check that no task sequence stores a password in a variable that is not masked. | — |
| Check | Status | Detail | Recommendation | Doc. |
|---|---|---|---|---|
| Boundary groups | To verify | 3 boundary group(s): Lyon, Nantes, Default-Site-Boundary-Group<PS1> | Confirm that no boundary group grants content access far beyond the site it is meant to serve. | ↗ |
| Excessively wide boundaryCorporate | Attention | Corporate covers 16 777 216 addresses (10.0.0.0/8). | A boundary this wide gives content and site assignment to machines nobody intended. Split it along the network segments it actually covers. | — |
| Boundaries in no group | Attention | 1 of 4 boundaries belong to no boundary group, so they route nothing. | A boundary in no group does nothing. Attach it or remove it, so the boundary list still describes the network. | — |
No check matches this filter.
Registry keys, local groups, services and protocols on the site server. No REST interface exposes any of this, so it is collected by a read-only script run on that server, and the result is graded here.
Collected on 5 of 6 machines.
MP02.corp.local — Connecting to remote server MP02.corp.local failed with the following error message : WinRM cannot complete the operation. Verify that the specified computer name is valid, that the computer is accessible over the network, and that a firewall exception for the WinRM service is enabled and allows access from this computer.
Server read
5
machines collected
Collected
22/09/2026
the most recent of them
Critical
13
Attention
56
| Check | Status | Detail | Recommendation | Doc. |
|---|---|---|---|---|
| Non-administrative SMB sharesRPT01 | OK | This server publishes no share beyond the administrative ones. | — | — |
| File names suggesting secretsRPT01 | To verify | The share content scan was not requested, so no file name was examined. | Run the collector with the share scan enabled if you want file names examined. It reads names only, never contents. | — |
| Shares created by Configuration Manager, WSUS or WindowsDP-NANTES | OK | 1 product share(s), checked at both the share and the NTFS level: no broad group can write to them. SCCMContentLib$ (ConfigMgr content) | — | — |
| Content published by the distribution pointDP-NANTES | To verify | This server publishes the content library (SCCMContentLib$). By design, distribution point content is readable by every domain user, over SMB as over HTTP: any script, configuration file or package holding a password is exposed there. | The fix is not in the share ACLs but in what gets published: no credentials in package, application or task sequence sources (use masked collection variables or a vault, and hunt existing secrets with -ScanShares). To restrict a sensitive package, use package access accounts (HTTP distribution point), the path Microsoft documents. Remove the distribution point role from the site server, keep anonymous access off on DPs, and filter traffic to the DPs (Misconfiguration Manager CRED-6, PREVENT-10 and PREVENT-20). | ↗ |
| Non-administrative SMB sharesDP-NANTES | OK | No hand-made share: this server only publishes administrative shares or shares created by a product. | — | — |
| File names suggesting secretsDP-NANTES | To verify | The share content scan was not requested, so no file name was examined. | Run the collector with the share scan enabled if you want file names examined. It reads names only, never contents. | — |
| Shares created by Configuration Manager, WSUS or WindowsDP-LYON | OK | 2 product share(s), checked at both the share and the NTFS level: no broad group can write to them. REMINST (WDS / PXE), SCCMContentLib$ (ConfigMgr content) | — | — |
| Content published by the distribution pointDP-LYON | To verify | This server publishes the content library (SCCMContentLib$). By design, distribution point content is readable by every domain user, over SMB as over HTTP: any script, configuration file or package holding a password is exposed there. | The fix is not in the share ACLs but in what gets published: no credentials in package, application or task sequence sources (use masked collection variables or a vault, and hunt existing secrets with -ScanShares). To restrict a sensitive package, use package access accounts (HTTP distribution point), the path Microsoft documents. Remove the distribution point role from the site server, keep anonymous access off on DPs, and filter traffic to the DPs (Misconfiguration Manager CRED-6, PREVENT-10 and PREVENT-20). | ↗ |
| SMB shareDP-LYON — Temp | Attention | Temp points at C:\Temp and grants write access far too widely: Everyone (Change) — at share level. NTFS permissions were not read: effective access is the stricter of the two, so check them before concluding. | This share was created by hand: restrict write access to named groups (content administrators) and check the underlying NTFS permissions. For a package source share, the site server computer account needs read access; also secure the channel with SMB signing, as Microsoft recommends. | — |
| File names suggesting secretsDP-LYON | To verify | The share content scan was not requested, so no file name was examined. | Run the collector with the share scan enabled if you want file names examined. It reads names only, never contents. | — |
| Non-administrative SMB sharesSQL01 | OK | This server publishes no share beyond the administrative ones. | — | — |
| File names suggesting secretsSQL01 | To verify | The share content scan was not requested, so no file name was examined. | Run the collector with the share scan enabled if you want file names examined. It reads names only, never contents. | — |
| Shares created by Configuration Manager, WSUS or WindowsCM01 | OK | 2 product share(s), checked at both the share and the NTFS level: no broad group can write to them. SCCMContentLib$ (ConfigMgr content), SMS_PS1 (ConfigMgr site) | — | — |
| Content published by the distribution pointCM01 | To verify | This server publishes the content library (SCCMContentLib$). By design, distribution point content is readable by every domain user, over SMB as over HTTP: any script, configuration file or package holding a password is exposed there. | The fix is not in the share ACLs but in what gets published: no credentials in package, application or task sequence sources (use masked collection variables or a vault, and hunt existing secrets with -ScanShares). To restrict a sensitive package, use package access accounts (HTTP distribution point), the path Microsoft documents. Remove the distribution point role from the site server, keep anonymous access off on DPs, and filter traffic to the DPs (Misconfiguration Manager CRED-6, PREVENT-10 and PREVENT-20). | ↗ |
| SMB shareCM01 — Sources | Attention | Sources points at E:\Sources and grants write access far too widely: Everyone (Full) — at share level. NTFS permissions were not read: effective access is the stricter of the two, so check them before concluding. | This share was created by hand: restrict write access to named groups (content administrators) and check the underlying NTFS permissions. For a package source share, the site server computer account needs read access; also secure the channel with SMB signing, as Microsoft recommends. | — |
| File names suggesting secretsCM01 | To verify | The share content scan was not requested, so no file name was examined. | Run the collector with the share scan enabled if you want file names examined. It reads names only, never contents. | — |
| Check | Status | Detail | Recommendation | Doc. |
|---|---|---|---|---|
| Local Administrators groupRPT01 | To verify | 2 member(s): RPT01\Administrator, CORP\Domain Admins | Keep only what is needed: the Configuration Manager service accounts and the named administrators. | — |
| Wide directory group in the local administratorsRPT01 — CORP\Domain Admins | Critical | CORP\Domain Admins is a directory group with a very wide membership, and it is a local administrator of the site server. | Remove the group and use one dedicated to administering this server. | — |
| Built-in administrator accountRPT01 — Administrator | OK | The built-in account Administrator is disabled. | — | — |
| Guest accountRPT01 — Guest | OK | The guest account Guest is disabled. | — | — |
| LAPSRPT01 | OK | A LAPS configuration is present on this server (windows). | — | — |
| Local Administrators groupDP-NANTES | To verify | 3 member(s): DP-NANTES\Administrator, CORP\Domain Admins, CORP\CM01$ | Keep only what is needed: the Configuration Manager service accounts and the named administrators. | — |
| Wide directory group in the local administratorsDP-NANTES — CORP\Domain Admins | Critical | CORP\Domain Admins is a directory group with a very wide membership, and it is a local administrator of the site server. | Remove the group and use one dedicated to administering this server. | — |
| Built-in administrator accountDP-NANTES — Administrator | OK | The built-in account Administrator is disabled. | — | — |
| Guest accountDP-NANTES — Guest | OK | The guest account Guest is disabled. | — | — |
| LAPSDP-NANTES | OK | A LAPS configuration is present on this server (windows). | — | — |
| Local Administrators groupDP-LYON | To verify | 4 member(s): DP-LYON\Administrator, DP-LYON\support, CORP\Domain Admins, CORP\CM01$ | Keep only what is needed: the Configuration Manager service accounts and the named administrators. | — |
| Wide directory group in the local administratorsDP-LYON — CORP\Domain Admins | Critical | CORP\Domain Admins is a directory group with a very wide membership, and it is a local administrator of the site server. | Remove the group and use one dedicated to administering this server. | — |
| Built-in administrator accountDP-LYON — Administrator | Attention | The built-in account Administrator is enabled. | Disable it in favour of named accounts, or manage its password with LAPS. | ↗ |
| Guest accountDP-LYON — Guest | Critical | The guest account Guest is enabled. | Disable the guest account. | — |
| LAPSDP-LYON | To verify | This reading could not be taken on the server, so it is reported as unmeasured rather than counted as a pass. | Re-run the collector with local administrator rights on the site server, or check this setting by hand. | — |
| Local Administrators groupSQL01 | To verify | 4 member(s): SQL01\Administrator, CORP\Domain Admins, CORP\GG-SCCM-Admins, CORP\Domain Users | Keep only what is needed: the Configuration Manager service accounts and the named administrators. | — |
| Wide directory group in the local administratorsSQL01 — CORP\Domain Admins | Critical | CORP\Domain Admins is a directory group with a very wide membership, and it is a local administrator of the site server. | Remove the group and use one dedicated to administering this server. | — |
| Built-in administrator accountSQL01 — Administrator | Attention | The built-in account Administrator is enabled. | Disable it in favour of named accounts, or manage its password with LAPS. | ↗ |
| Guest accountSQL01 — Guest | OK | The guest account Guest is disabled. | — | — |
| LAPSSQL01 | To verify | This reading could not be taken on the server, so it is reported as unmeasured rather than counted as a pass. | Re-run the collector with local administrator rights on the site server, or check this setting by hand. | — |
| Local Administrators groupCM01 | To verify | 4 member(s): CM01\Administrator, CORP\Domain Admins, CORP\GG-SCCM-Admins, CORP\svc-cm-push | Keep only what is needed: the Configuration Manager service accounts and the named administrators. | — |
| Wide directory group in the local administratorsCM01 — CORP\Domain Admins | Critical | CORP\Domain Admins is a directory group with a very wide membership, and it is a local administrator of the site server. | Remove the group and use one dedicated to administering this server. | — |
| Built-in administrator accountCM01 — Administrator | Attention | The built-in account Administrator is enabled. | Disable it in favour of named accounts, or manage its password with LAPS. | ↗ |
| Guest accountCM01 — Guest | OK | The guest account Guest is disabled. | — | — |
| LAPSCM01 | OK | A LAPS configuration is present on this server (windows). | — | — |
| Check | Status | Detail | Recommendation | Doc. |
|---|---|---|---|---|
| Minimum password lengthRPT01 | OK | Local minimum password length is 14 characters. | — | — |
| Password complexityRPT01 | OK | Password complexity is required locally. | — | — |
| Account lockout thresholdRPT01 | OK | Accounts lock after 10 failed attempt(s). | — | — |
| Minimum password lengthDP-NANTES | OK | Local minimum password length is 14 characters. | — | — |
| Password complexityDP-NANTES | OK | Password complexity is required locally. | — | — |
| Account lockout thresholdDP-NANTES | OK | Accounts lock after 10 failed attempt(s). | — | — |
| Minimum password lengthDP-LYON | Attention | Local minimum password length is 7 characters. | Raise the minimum to fourteen characters or more. | — |
| Password complexityDP-LYON | Attention | Password complexity is not required locally. | Require complexity in the local security policy. | — |
| Account lockout thresholdDP-LYON | Attention | No account lockout threshold is set locally. | Set a lockout threshold, ten attempts for instance, so a password cannot be guessed at leisure. | — |
| Minimum password lengthSQL01 | Attention | Local minimum password length is 8 characters. | Raise the minimum to fourteen characters or more. | — |
| Password complexitySQL01 | OK | Password complexity is required locally. | — | — |
| Account lockout thresholdSQL01 | Attention | No account lockout threshold is set locally. | Set a lockout threshold, ten attempts for instance, so a password cannot be guessed at leisure. | — |
| Minimum password lengthCM01 | Attention | Local minimum password length is 12 characters. | Raise the minimum to fourteen characters or more. | — |
| Password complexityCM01 | OK | Password complexity is required locally. | — | — |
| Account lockout thresholdCM01 | OK | Accounts lock after 10 failed attempt(s). | — | — |
| Check | Status | Detail | Recommendation | Doc. |
|---|---|---|---|---|
| Service under a named accountRPT01 — SQLServerReportingServices | To verify | SQL Server Reporting Services runs as NT SERVICE\SQLServerReportingServices and is currently Running. | Confirm this account holds only the rights the service needs. | — |
| WebClient service (WebDAV)RPT01 | OK | The WebClient service is absent, disabled or stopped. | — | — |
| Print Spooler serviceRPT01 | OK | The Print Spooler service is absent, disabled or stopped. | — | — |
| Unquoted service pathsRPT01 | OK | No service has an unquoted executable path outside the Windows directory. | — | — |
| Services running under a named accountDP-NANTES | OK | No third-party service runs under a named account. | — | — |
| WebClient service (WebDAV)DP-NANTES | OK | The WebClient service is absent, disabled or stopped. | — | — |
| Print Spooler serviceDP-NANTES | OK | The Print Spooler service is absent, disabled or stopped. | — | — |
| Unquoted service pathsDP-NANTES | OK | No service has an unquoted executable path outside the Windows directory. | — | — |
| Services running under a named accountDP-LYON | OK | No third-party service runs under a named account. | — | — |
| WebClient service (WebDAV)DP-LYON | Attention | The WebClient service is running on this server. | WebDAV makes credential coercion easier. Disable the service unless something needs it. | — |
| Print Spooler serviceDP-LYON | Attention | The Print Spooler service is running on this server. | A known vector for privilege escalation and coercion. Disable it unless this server prints. | — |
| Unquoted service pathsDP-LYON | OK | No service has an unquoted executable path outside the Windows directory. | — | — |
| Service under a named accountSQL01 — MSSQLSERVER | To verify | SQL Server (MSSQLSERVER) runs as CORP\svc-sql and is currently Running. | Confirm this account holds only the rights the service needs. | — |
| Service under a named accountSQL01 — SQLSERVERAGENT | To verify | SQL Server Agent (MSSQLSERVER) runs as CORP\svc-sql and is currently Running. | Confirm this account holds only the rights the service needs. | — |
| WebClient service (WebDAV)SQL01 | OK | The WebClient service is absent, disabled or stopped. | — | — |
| Print Spooler serviceSQL01 | Attention | The Print Spooler service is running on this server. | A known vector for privilege escalation and coercion. Disable it unless this server prints. | — |
| Unquoted service pathsSQL01 | Attention | 1 service(s) have an executable path that contains a space and is not quoted: SqlMonitor : C:\Program Files\Contoso Tools\sqlmon.exe -service | Quote each executable path so a file dropped earlier in it cannot be started instead. | — |
| Service under a named accountCM01 — SMS_EXECUTIVE | To verify | SMS_EXECUTIVE runs as LocalSystem and is currently Running. | Confirm this account holds only the rights the service needs. | — |
| Service under a named accountCM01 — CcmExec | To verify | SMS Agent Host runs as LocalSystem and is currently Running. | Confirm this account holds only the rights the service needs. | — |
| Service under a named accountCM01 — BackupAgent | To verify | Contoso Backup Agent runs as CORP\svc-backup and is currently Running. | Confirm this account holds only the rights the service needs. | — |
| WebClient service (WebDAV)CM01 | OK | The WebClient service is absent, disabled or stopped. | — | — |
| Print Spooler serviceCM01 | Attention | The Print Spooler service is running on this server. | A known vector for privilege escalation and coercion. Disable it unless this server prints. | — |
| Unquoted service pathsCM01 | OK | No service has an unquoted executable path outside the Windows directory. | — | — |
| Check | Status | Detail | Recommendation | Doc. |
|---|---|---|---|---|
| SMBv1 protocolRPT01 | OK | SMBv1 is disabled. | — | — |
| SMB signing required (server)RPT01 | OK | SMB signing is required for inbound connections. | — | — |
| SMB signing required (client)RPT01 | OK | SMB signing is required for outbound connections. | — | — |
| NetBIOS over TCP/IPRPT01 | OK | NetBIOS over TCP/IP is disabled on every active IP interface. | — | — |
| LLMNRRPT01 | OK | LLMNR is disabled by policy. | — | — |
| mDNSRPT01 | OK | mDNS is disabled. | — | — |
| SMBv1 protocolDP-NANTES | OK | SMBv1 is disabled. | — | — |
| SMB signing required (server)DP-NANTES | OK | SMB signing is required for inbound connections. | — | — |
| SMB signing required (client)DP-NANTES | OK | SMB signing is required for outbound connections. | — | — |
| NetBIOS over TCP/IPDP-NANTES | OK | NetBIOS over TCP/IP is disabled on every active IP interface. | — | — |
| LLMNRDP-NANTES | OK | LLMNR is disabled by policy. | — | — |
| mDNSDP-NANTES | To verify | mDNS is not explicitly disabled. | On versions that support it, consider disabling mDNS too. | — |
| SMBv1 protocolDP-LYON | Critical | SMBv1 is enabled on this server. | Remove SMBv1: the protocol is obsolete and unauthenticated attacks against it are public. | — |
| SMB signing required (server)DP-LYON | Attention | SMB signing is not required for inbound connections. | Require SMB signing so an intercepted session cannot be relayed. | — |
| SMB signing required (client)DP-LYON | Attention | SMB signing is not required for outbound connections. | Require SMB signing on outbound connections as well; the server half alone does not stop a relay. | — |
| NetBIOS over TCP/IPDP-LYON | Attention | NetBIOS over TCP/IP is enabled or left at its default on: Ethernet0; Ethernet1 | Disable NetBIOS over TCP/IP to close name-poisoning attacks such as Responder. | — |
| LLMNRDP-LYON | Attention | LLMNR is not explicitly disabled, so the default applies and it answers. | Disable LLMNR by group policy, alongside NetBIOS. | — |
| mDNSDP-LYON | To verify | mDNS is not explicitly disabled. | On versions that support it, consider disabling mDNS too. | — |
| SMBv1 protocolSQL01 | OK | SMBv1 is disabled. | — | — |
| SMB signing required (server)SQL01 | Attention | SMB signing is not required for inbound connections. | Require SMB signing so an intercepted session cannot be relayed. | — |
| SMB signing required (client)SQL01 | Attention | SMB signing is not required for outbound connections. | Require SMB signing on outbound connections as well; the server half alone does not stop a relay. | — |
| NetBIOS over TCP/IPSQL01 | Attention | NetBIOS over TCP/IP is enabled or left at its default on: Ethernet0 | Disable NetBIOS over TCP/IP to close name-poisoning attacks such as Responder. | — |
| LLMNRSQL01 | Attention | LLMNR is not explicitly disabled, so the default applies and it answers. | Disable LLMNR by group policy, alongside NetBIOS. | — |
| mDNSSQL01 | To verify | mDNS is not explicitly disabled. | On versions that support it, consider disabling mDNS too. | — |
| SMBv1 protocolCM01 | OK | SMBv1 is disabled. | — | — |
| SMB signing required (server)CM01 | OK | SMB signing is required for inbound connections. | — | — |
| SMB signing required (client)CM01 | Attention | SMB signing is not required for outbound connections. | Require SMB signing on outbound connections as well; the server half alone does not stop a relay. | — |
| NetBIOS over TCP/IPCM01 | Attention | NetBIOS over TCP/IP is enabled or left at its default on: Ethernet0 | Disable NetBIOS over TCP/IP to close name-poisoning attacks such as Responder. | — |
| LLMNRCM01 | Attention | LLMNR is not explicitly disabled, so the default applies and it answers. | Disable LLMNR by group policy, alongside NetBIOS. | — |
| mDNSCM01 | To verify | mDNS is not explicitly disabled. | On versions that support it, consider disabling mDNS too. | — |
| Check | Status | Detail | Recommendation | Doc. |
|---|---|---|---|---|
| Windows Firewall profileRPT01 — Domain | OK | The Domain profile is enabled. | — | — |
| Windows Firewall profileRPT01 — Private | OK | The Private profile is enabled. | — | — |
| Windows Firewall profileRPT01 — Public | OK | The Public profile is enabled. | — | — |
| Windows Firewall profileDP-NANTES — Domain | OK | The Domain profile is enabled. | — | — |
| Windows Firewall profileDP-NANTES — Private | OK | The Private profile is enabled. | — | — |
| Windows Firewall profileDP-NANTES — Public | OK | The Public profile is enabled. | — | — |
| Windows Firewall profileDP-LYON — Domain | Critical | The Domain profile is disabled. | Turn the firewall back on for this profile. | — |
| Windows Firewall profileDP-LYON — Private | Critical | The Private profile is disabled. | Turn the firewall back on for this profile. | — |
| Windows Firewall profileDP-LYON — Public | OK | The Public profile is enabled. | — | — |
| Windows Firewall profileSQL01 — Domain | Critical | The Domain profile is disabled. | Turn the firewall back on for this profile. | — |
| Windows Firewall profileSQL01 — Private | OK | The Private profile is enabled. | — | — |
| Windows Firewall profileSQL01 — Public | OK | The Public profile is enabled. | — | — |
| Windows Firewall profileCM01 — Domain | OK | The Domain profile is enabled. | — | — |
| Windows Firewall profileCM01 — Private | OK | The Private profile is enabled. | — | — |
| Windows Firewall profileCM01 — Public | OK | The Public profile is enabled. | — | — |
| Check | Status | Detail | Recommendation | Doc. |
|---|---|---|---|---|
| LAN Manager authentication levelRPT01 | OK | Set to 5, which sends NTLMv2 only and refuses LM and NTLM. | — | — |
| Outgoing NTLM trafficRPT01 | OK | Outgoing NTLM traffic is restricted (value 2). | — | — |
| Incoming NTLM trafficRPT01 | OK | Incoming NTLM traffic is restricted (value 2). | — | — |
| LAN Manager authentication levelDP-NANTES | OK | Set to 5, which sends NTLMv2 only and refuses LM and NTLM. | — | — |
| Outgoing NTLM trafficDP-NANTES | OK | Outgoing NTLM traffic is restricted (value 1). | — | — |
| Incoming NTLM trafficDP-NANTES | To verify | Incoming NTLM traffic is not restricted (value 0). | On a server as sensitive as a site server, evaluate this restriction in audit mode. | — |
| LAN Manager authentication levelDP-LYON | Attention | Set to 2, which still accepts authentication weaker than NTLMv2. | Set the LAN Manager authentication level to 5, which sends NTLMv2 only and refuses LM and NTLM. | ↗ |
| Outgoing NTLM trafficDP-LYON | To verify | Outgoing NTLM traffic is not restricted (value 0). | Consider restricting it, in audit mode first, as part of moving away from NTLM towards Kerberos. | — |
| Incoming NTLM trafficDP-LYON | To verify | Incoming NTLM traffic is not restricted (value 0). | On a server as sensitive as a site server, evaluate this restriction in audit mode. | — |
| LAN Manager authentication levelSQL01 | Attention | Set to 3, which still accepts authentication weaker than NTLMv2. | Set the LAN Manager authentication level to 5, which sends NTLMv2 only and refuses LM and NTLM. | ↗ |
| Outgoing NTLM trafficSQL01 | To verify | Outgoing NTLM traffic is not restricted (value 0). | Consider restricting it, in audit mode first, as part of moving away from NTLM towards Kerberos. | — |
| Incoming NTLM trafficSQL01 | To verify | Incoming NTLM traffic is not restricted (value 0). | On a server as sensitive as a site server, evaluate this restriction in audit mode. | — |
| LAN Manager authentication levelCM01 | Attention | Set to 3, which still accepts authentication weaker than NTLMv2. | Set the LAN Manager authentication level to 5, which sends NTLMv2 only and refuses LM and NTLM. | ↗ |
| Outgoing NTLM trafficCM01 | To verify | Outgoing NTLM traffic is not restricted (value 0). | Consider restricting it, in audit mode first, as part of moving away from NTLM towards Kerberos. | — |
| Incoming NTLM trafficCM01 | To verify | Incoming NTLM traffic is not restricted (value 0). | On a server as sensitive as a site server, evaluate this restriction in audit mode. | — |
| Check | Status | Detail | Recommendation | Doc. |
|---|---|---|---|---|
| WDigest credential cachingRPT01 | OK | WDigest is disabled or not configured. | — | — |
| LSA protection (RunAsPPL)RPT01 | OK | The LSA process runs protected. | — | — |
| Credential GuardRPT01 | OK | Credential Guard is running. | — | — |
| AlwaysInstallElevatedRPT01 | OK | Not enabled at machine level. | — | — |
| Automatic logonRPT01 | OK | Automatic logon is not configured. | — | — |
| WDigest credential cachingDP-NANTES | OK | WDigest is disabled or not configured. | — | — |
| LSA protection (RunAsPPL)DP-NANTES | OK | The LSA process runs protected. | — | — |
| Credential GuardDP-NANTES | To verify | Credential Guard does not appear to be running. | Evaluate enabling it, bearing in mind the hardware prerequisites and agent compatibility. | — |
| AlwaysInstallElevatedDP-NANTES | OK | Not enabled at machine level. | — | — |
| Automatic logonDP-NANTES | OK | Automatic logon is not configured. | — | — |
| WDigest credential cachingDP-LYON | Critical | WDigest is enabled, so plain-text passwords can sit in memory. | Set UseLogonCredential to 0 so credentials stop being cached in clear text. | — |
| LSA protection (RunAsPPL)DP-LYON | Attention | The LSA process does not run protected. | Enable LSA protection once third-party drivers and agents have been tested against it. | — |
| Credential GuardDP-LYON | To verify | Credential Guard does not appear to be running. | Evaluate enabling it, bearing in mind the hardware prerequisites and agent compatibility. | — |
| AlwaysInstallElevatedDP-LYON | OK | Not enabled at machine level. | — | — |
| Automatic logonDP-LYON | Critical | Automatic logon is configured and its password sits in the registry in clear text. | Turn off automatic logon on a production server, and change the password immediately if one is stored. | — |
| WDigest credential cachingSQL01 | To verify | This reading could not be taken on the server, so it is reported as unmeasured rather than counted as a pass. | Re-run the collector with local administrator rights on the site server, or check this setting by hand. | — |
| LSA protection (RunAsPPL)SQL01 | Attention | The LSA process does not run protected. | Enable LSA protection once third-party drivers and agents have been tested against it. | — |
| Credential GuardSQL01 | To verify | Credential Guard does not appear to be running. | Evaluate enabling it, bearing in mind the hardware prerequisites and agent compatibility. | — |
| AlwaysInstallElevatedSQL01 | OK | Not enabled at machine level. | — | — |
| Automatic logonSQL01 | OK | Automatic logon is not configured. | — | — |
| WDigest credential cachingCM01 | OK | WDigest is disabled or not configured. | — | — |
| LSA protection (RunAsPPL)CM01 | Attention | The LSA process does not run protected. | Enable LSA protection once third-party drivers and agents have been tested against it. | — |
| Credential GuardCM01 | To verify | Credential Guard does not appear to be running. | Evaluate enabling it, bearing in mind the hardware prerequisites and agent compatibility. | — |
| AlwaysInstallElevatedCM01 | OK | Not enabled at machine level. | — | — |
| Automatic logonCM01 | OK | Automatic logon is not configured. | — | — |
| Check | Status | Detail | Recommendation | Doc. |
|---|---|---|---|---|
| Remote DesktopRPT01 | OK | Remote Desktop connections are refused. | — | — |
| Remote DesktopDP-NANTES | To verify | Remote Desktop connections are allowed on this server. | Restrict Remote Desktop as tightly as possible: firewall, a restricted group, and a bastion or privileged workstation. | — |
| Network Level AuthenticationDP-NANTES | OK | Network Level Authentication is required. | — | — |
| Remote DesktopDP-LYON | To verify | Remote Desktop connections are allowed on this server. | Restrict Remote Desktop as tightly as possible: firewall, a restricted group, and a bastion or privileged workstation. | — |
| Network Level AuthenticationDP-LYON | Critical | Network Level Authentication is not required, so the logon screen is reachable before anyone authenticates. | Require Network Level Authentication, so an unauthenticated caller never reaches the session host. | — |
| Remote DesktopSQL01 | To verify | Remote Desktop connections are allowed on this server. | Restrict Remote Desktop as tightly as possible: firewall, a restricted group, and a bastion or privileged workstation. | — |
| Network Level AuthenticationSQL01 | OK | Network Level Authentication is required. | — | — |
| Remote DesktopCM01 | To verify | Remote Desktop connections are allowed on this server. | Restrict Remote Desktop as tightly as possible: firewall, a restricted group, and a bastion or privileged workstation. | — |
| Network Level AuthenticationCM01 | OK | Network Level Authentication is required. | — | — |
| Check | Status | Detail | Recommendation | Doc. |
|---|---|---|---|---|
| WinRM listenersRPT01 | OK | No plain HTTP WinRM listener is configured. | — | — |
| WinRM TrustedHostsRPT01 | OK | TrustedHosts is empty. | — | — |
| WinRM listenersDP-NANTES | Attention | At least one WinRM listener accepts plain HTTP. | Prefer an HTTPS listener with a valid certificate. | — |
| WinRM TrustedHostsDP-NANTES | OK | TrustedHosts is empty. | — | — |
| WinRM listenersDP-LYON | Attention | At least one WinRM listener accepts plain HTTP. | Prefer an HTTPS listener with a valid certificate. | — |
| WinRM TrustedHostsDP-LYON | Attention | TrustedHosts is set to the wildcard, so this client will authenticate to any host. | Replace the wildcard with an explicit list of trusted servers. | — |
| WinRM listenersSQL01 | Attention | At least one WinRM listener accepts plain HTTP. | Prefer an HTTPS listener with a valid certificate. | — |
| WinRM TrustedHostsSQL01 | OK | TrustedHosts is empty. | — | — |
| WinRM listenersCM01 | Attention | At least one WinRM listener accepts plain HTTP. | Prefer an HTTPS listener with a valid certificate. | — |
| WinRM TrustedHostsCM01 | OK | TrustedHosts is empty. | — | — |
| Check | Status | Detail | Recommendation | Doc. |
|---|---|---|---|---|
| Microsoft Defender AntivirusRPT01 | OK | Real-time protection is on and the signatures are 0 day(s) old. | — | — |
| Attack surface reduction rulesRPT01 | OK | 14 attack surface reduction rule(s) configured. | — | — |
| AppLockerRPT01 | OK | 36 effective AppLocker rule(s). | — | — |
| Microsoft Defender AntivirusDP-NANTES | OK | Real-time protection is on and the signatures are 1 day(s) old. | — | — |
| Attack surface reduction rulesDP-NANTES | OK | 6 attack surface reduction rule(s) configured. | — | — |
| AppLockerDP-NANTES | To verify | No effective AppLocker rule was found. | Evaluate application control — AppLocker or WDAC — on a server this sensitive. | — |
| Microsoft Defender AntivirusDP-LYON | Attention | Real-time protection: true. Antivirus engine: true. Signatures are 14 day(s) old. | Make sure real-time protection is on and the signatures current, or confirm an equivalent third-party agent. | — |
| Attack surface reduction rulesDP-LYON | To verify | No attack surface reduction rule is configured. | Enable attack surface reduction rules, starting with the one that blocks credential theft from LSASS. | — |
| AppLockerDP-LYON | To verify | No effective AppLocker rule was found. | Evaluate application control — AppLocker or WDAC — on a server this sensitive. | — |
| Microsoft Defender AntivirusSQL01 | OK | Real-time protection is on and the signatures are 2 day(s) old. | — | — |
| Attack surface reduction rulesSQL01 | To verify | No attack surface reduction rule is configured. | Enable attack surface reduction rules, starting with the one that blocks credential theft from LSASS. | — |
| AppLockerSQL01 | To verify | No effective AppLocker rule was found. | Evaluate application control — AppLocker or WDAC — on a server this sensitive. | — |
| Microsoft Defender AntivirusCM01 | OK | Real-time protection is on and the signatures are 1 day(s) old. | — | — |
| Attack surface reduction rulesCM01 | To verify | No attack surface reduction rule is configured. | Enable attack surface reduction rules, starting with the one that blocks credential theft from LSASS. | — |
| AppLockerCM01 | To verify | No effective AppLocker rule was found. | Evaluate application control — AppLocker or WDAC — on a server this sensitive. | — |
| Check | Status | Detail | Recommendation | Doc. |
|---|---|---|---|---|
| Most recent operating system updateRPT01 — KB5043050 | OK | The most recent update on record is KB5043050, installed on 2026-09-12 00:00 UTC — 10 day(s) ago. | — | — |
| Most recent operating system updateDP-NANTES — KB5043050 | OK | The most recent update on record is KB5043050, installed on 2026-09-12 00:00 UTC — 10 day(s) ago. | — | — |
| Most recent operating system updateDP-LYON — KB5036893 | Attention | The most recent update on record is KB5036893, installed on 2026-04-10 00:00 UTC — 165 day(s) ago. | Review the patching process for this server. | — |
| Most recent operating system updateSQL01 — KB5040437 | Attention | The most recent update on record is KB5040437, installed on 2026-06-12 00:00 UTC — 102 day(s) ago. | Review the patching process for this server. | — |
| Most recent operating system updateCM01 — KB5043050 | OK | The most recent update on record is KB5043050, installed on 2026-09-11 00:00 UTC — 11 day(s) ago. | — | — |
| Check | Status | Detail | Recommendation | Doc. |
|---|---|---|---|---|
| Command line in process creation eventsRPT01 | OK | Process creation events include the command line. | — | — |
| Command line in process creation eventsDP-NANTES | OK | Process creation events include the command line. | — | — |
| Command line in process creation eventsDP-LYON | Attention | Process creation events do not include the command line. | Include the command line in event 4688; without it, process auditing rarely names what actually ran. | — |
| Command line in process creation eventsSQL01 | Attention | Process creation events do not include the command line. | Include the command line in event 4688; without it, process auditing rarely names what actually ran. | — |
| Command line in process creation eventsCM01 | Attention | Process creation events do not include the command line. | Include the command line in event 4688; without it, process auditing rarely names what actually ran. | — |
| Check | Status | Detail | Recommendation | Doc. |
|---|---|---|---|---|
| PowerShell script block loggingRPT01 | OK | Script block logging is enabled. | — | — |
| PowerShell module loggingRPT01 | OK | Module logging is enabled. | — | — |
| PowerShell transcriptionRPT01 | OK | Transcription is enabled. | — | — |
| PowerShell v2 engineRPT01 | OK | The PowerShell v2 engine is removed. | — | — |
| PowerShell script block loggingDP-NANTES | OK | Script block logging is enabled. | — | — |
| PowerShell module loggingDP-NANTES | To verify | Module logging is not enabled. | Consider enabling module logging alongside script block logging. | — |
| PowerShell transcriptionDP-NANTES | To verify | Transcription is not enabled. | Consider enabling transcription to a protected share. | — |
| PowerShell v2 engineDP-NANTES | OK | The PowerShell v2 engine is removed. | — | — |
| PowerShell script block loggingDP-LYON | Attention | Script block logging is not enabled. | Enable PowerShell script block logging: it is the single most useful source for detecting what a script did. | — |
| PowerShell module loggingDP-LYON | To verify | Module logging is not enabled. | Consider enabling module logging alongside script block logging. | — |
| PowerShell transcriptionDP-LYON | To verify | Transcription is not enabled. | Consider enabling transcription to a protected share. | — |
| PowerShell v2 engineDP-LYON | Attention | The PowerShell v2 engine is still installed. | Remove PowerShell v2: it supports neither AMSI nor script block logging, and it can be requested deliberately to escape both. | — |
| PowerShell script block loggingSQL01 | Attention | Script block logging is not enabled. | Enable PowerShell script block logging: it is the single most useful source for detecting what a script did. | — |
| PowerShell module loggingSQL01 | To verify | Module logging is not enabled. | Consider enabling module logging alongside script block logging. | — |
| PowerShell transcriptionSQL01 | To verify | Transcription is not enabled. | Consider enabling transcription to a protected share. | — |
| PowerShell v2 engineSQL01 | Attention | The PowerShell v2 engine is still installed. | Remove PowerShell v2: it supports neither AMSI nor script block logging, and it can be requested deliberately to escape both. | — |
| PowerShell script block loggingCM01 | OK | Script block logging is enabled. | — | — |
| PowerShell module loggingCM01 | To verify | Module logging is not enabled. | Consider enabling module logging alongside script block logging. | — |
| PowerShell transcriptionCM01 | To verify | Transcription is not enabled. | Consider enabling transcription to a protected share. | — |
| PowerShell v2 engineCM01 | OK | The PowerShell v2 engine is removed. | — | — |
| Check | Status | Detail | Recommendation | Doc. |
|---|---|---|---|---|
| User Account ControlRPT01 | OK | User Account Control is enabled. | — | — |
| Anonymous enumeration of SAM accountsRPT01 | OK | Anonymous enumeration of SAM accounts is refused. | — | — |
| System drive encryptionRPT01 | OK | The system drive is encrypted with BitLocker. | — | — |
| Time synchronisation sourceRPT01 — DC01.corp.local | To verify | Current source: DC01.corp.local | Reliable time is a prerequisite for Kerberos, whose default tolerance is five minutes. | — |
| User Account ControlDP-NANTES | OK | User Account Control is enabled. | — | — |
| Anonymous enumeration of SAM accountsDP-NANTES | OK | Anonymous enumeration of SAM accounts is refused. | — | — |
| System drive encryptionDP-NANTES | OK | The system drive is encrypted with BitLocker. | — | — |
| Time synchronisation sourceDP-NANTES — DC01.corp.local | To verify | Current source: DC01.corp.local | Reliable time is a prerequisite for Kerberos, whose default tolerance is five minutes. | — |
| User Account ControlDP-LYON | OK | User Account Control is enabled. | — | — |
| Anonymous enumeration of SAM accountsDP-LYON | Attention | Anonymous enumeration of SAM accounts is not explicitly refused. | Refuse anonymous enumeration of SAM accounts and shares. | — |
| System drive encryptionDP-LYON | To verify | The system drive is not encrypted with BitLocker. | Worth enabling mainly where the machine could be physically taken. | — |
| Time synchronisation sourceDP-LYON — Local CMOS Clock | To verify | Current source: Local CMOS Clock | Reliable time is a prerequisite for Kerberos, whose default tolerance is five minutes. | — |
| User Account ControlSQL01 | OK | User Account Control is enabled. | — | — |
| Anonymous enumeration of SAM accountsSQL01 | OK | Anonymous enumeration of SAM accounts is refused. | — | — |
| System drive encryptionSQL01 | To verify | The system drive is not encrypted with BitLocker. | Worth enabling mainly where the machine could be physically taken. | — |
| Time synchronisation sourceSQL01 — DC01.corp.local | To verify | Current source: DC01.corp.local | Reliable time is a prerequisite for Kerberos, whose default tolerance is five minutes. | — |
| User Account ControlCM01 | OK | User Account Control is enabled. | — | — |
| Anonymous enumeration of SAM accountsCM01 | OK | Anonymous enumeration of SAM accounts is refused. | — | — |
| System drive encryptionCM01 | To verify | The system drive is not encrypted with BitLocker. | Worth enabling mainly where the machine could be physically taken. | — |
| Time synchronisation sourceCM01 — DC01.corp.local | To verify | Current source: DC01.corp.local | Reliable time is a prerequisite for Kerberos, whose default tolerance is five minutes. | — |
| Check | Status | Detail | Recommendation | Doc. |
|---|---|---|---|---|
| Legacy TLS/SSL protocolRPT01 — SSL 2.0 | OK | SSL 2.0 is explicitly disabled server-side. | — | — |
| Legacy TLS/SSL protocolRPT01 — SSL 3.0 | OK | SSL 3.0 is explicitly disabled server-side. | — | — |
| Legacy TLS/SSL protocolRPT01 — TLS 1.0 | OK | TLS 1.0 is explicitly disabled server-side. | — | — |
| Legacy TLS/SSL protocolRPT01 — TLS 1.1 | OK | TLS 1.1 is explicitly disabled server-side. | — | — |
| TLS 1.2RPT01 — TLS 1.2 | OK | TLS 1.2 is active, or at least not explicitly disabled. | — | — |
| Cipher suitesRPT01 | OK | No obviously weak cipher suite is enabled. | — | — |
| Legacy TLS/SSL protocolDP-NANTES — SSL 2.0 | OK | SSL 2.0 is explicitly disabled server-side. | — | — |
| Legacy TLS/SSL protocolDP-NANTES — SSL 3.0 | OK | SSL 3.0 is explicitly disabled server-side. | — | — |
| Legacy TLS/SSL protocolDP-NANTES — TLS 1.0 | OK | TLS 1.0 is explicitly disabled server-side. | — | — |
| Legacy TLS/SSL protocolDP-NANTES — TLS 1.1 | OK | TLS 1.1 is explicitly disabled server-side. | — | — |
| TLS 1.2DP-NANTES — TLS 1.2 | OK | TLS 1.2 is active, or at least not explicitly disabled. | — | — |
| Cipher suitesDP-NANTES | OK | No obviously weak cipher suite is enabled. | — | — |
| Legacy TLS/SSL protocolDP-LYON — SSL 2.0 | To verify | SSL 2.0 is not configured either way, so the operating system default decides. | Disable this protocol explicitly unless something still needs it. | — |
| Legacy TLS/SSL protocolDP-LYON — SSL 3.0 | Attention | SSL 3.0 is active server-side. | Disable this protocol: it is obsolete. | — |
| Legacy TLS/SSL protocolDP-LYON — TLS 1.0 | Attention | TLS 1.0 is active server-side. | Disable this protocol: it is obsolete. | — |
| Legacy TLS/SSL protocolDP-LYON — TLS 1.1 | Attention | TLS 1.1 is active server-side. | Disable this protocol: it is obsolete. | — |
| TLS 1.2DP-LYON — TLS 1.2 | OK | TLS 1.2 is active, or at least not explicitly disabled. | — | — |
| Cipher suitesDP-LYON | Attention | 1 weak cipher suite(s) remain enabled: TLS_RSA_WITH_3DES_EDE_CBC_SHA | Remove the obsolete suites from the cipher order. | — |
| Legacy TLS/SSL protocolSQL01 — SSL 2.0 | OK | SSL 2.0 is explicitly disabled server-side. | — | — |
| Legacy TLS/SSL protocolSQL01 — SSL 3.0 | OK | SSL 3.0 is explicitly disabled server-side. | — | — |
| Legacy TLS/SSL protocolSQL01 — TLS 1.0 | Attention | TLS 1.0 is active server-side. | Disable this protocol: it is obsolete. | — |
| Legacy TLS/SSL protocolSQL01 — TLS 1.1 | Attention | TLS 1.1 is active server-side. | Disable this protocol: it is obsolete. | — |
| TLS 1.2SQL01 — TLS 1.2 | OK | TLS 1.2 is active, or at least not explicitly disabled. | — | — |
| Cipher suitesSQL01 | Attention | 2 weak cipher suite(s) remain enabled: TLS_RSA_WITH_3DES_EDE_CBC_SHA, TLS_RSA_WITH_RC4_128_SHA | Remove the obsolete suites from the cipher order. | — |
| Legacy TLS/SSL protocolCM01 — SSL 2.0 | OK | SSL 2.0 is explicitly disabled server-side. | — | — |
| Legacy TLS/SSL protocolCM01 — SSL 3.0 | OK | SSL 3.0 is explicitly disabled server-side. | — | — |
| Legacy TLS/SSL protocolCM01 — TLS 1.0 | To verify | TLS 1.0 is not configured either way, so the operating system default decides. | Disable this protocol explicitly unless something still needs it. | — |
| Legacy TLS/SSL protocolCM01 — TLS 1.1 | To verify | TLS 1.1 is not configured either way, so the operating system default decides. | Disable this protocol explicitly unless something still needs it. | — |
| TLS 1.2CM01 — TLS 1.2 | OK | TLS 1.2 is active, or at least not explicitly disabled. | — | — |
| Cipher suitesCM01 | OK | No obviously weak cipher suite is enabled. | — | — |
| Check | Status | Detail | Recommendation | Doc. |
|---|---|---|---|---|
| Unconstrained Kerberos delegationRPT01 — RPT01 | OK | The computer account is not trusted for unconstrained delegation. | — | — |
| Unconstrained Kerberos delegationDP-NANTES — DP-NANTES | OK | The computer account is not trusted for unconstrained delegation. | — | — |
| Unconstrained Kerberos delegationDP-LYON — DP-LYON | OK | The computer account is not trusted for unconstrained delegation. | — | — |
| Unconstrained Kerberos delegationSQL01 — SQL01 | OK | The computer account is not trusted for unconstrained delegation. | — | — |
| Unconstrained Kerberos delegationCM01 — CM01 | OK | The computer account is not trusted for unconstrained delegation. | — | — |
No check matches this filter.
The Configuration Manager logs of every site system, read over the last 7 days, and the status messages of the last 30 days. Four views: an analysis (what the errors probably have in common and what to do), a chronology, every distinct error file by file, and the status messages component by component.
Times shown in the time zone of the machine that produced the report (UTC+02:00). Hover a date for UTC.
Logs read on 6 machine(s) of 6.
Machines read
6 / 6
15 log files
Problems to handle
7
families of errors, section 1
Errors
127
9 distinct messages
Warnings
97
10 distinct messages
Active < 24 h
19
messages seen in the last 24 h
Last error
10-05 16:11
just now
Messages are grouped by probable cause. A family last seen more than 30 days ago is filed as “To verify”, not as an alert. The groupings are leads, not verdicts: read the sample messages.
What to do: A component could not write for lack of space. Check the volume of the inboxes, the content library (SCCMContentLib) and SQL; free or extend it before anything else: a full disk stalls the whole site.
From 2026-09-29 11:40 to 2026-10-05 16:11 · Logs to open (CMTrace): distmgr.logsmsdpprov.log
| Machine | Log | Message (latest occurrence) | Count | Last | |
|---|---|---|---|---|---|
| CM01 | distmgr.log | Failed to copy content PS100001 to \\DP-LYON.corp.local\SMS_DP$\. Error = 0x80070070 There is not enough space on the disk. | 34 | 2026-10-05 16:11just now | |
| DP-LYON | smsdpprov.log | Failed to write file E:\SCCMContentLib\FileLib\4A1F\4A1F7C2E. Error 0x80070070 not enough space on the disk. | 28 | 2026-10-05 16:05just now |
What to do: The component could not reach or query the site database. Check that SQL is running, network connectivity to the instance, the SPNs/Kerberos of the SQL service account, room for the data and log files, and the site server computer account’s rights on the database.
From 2026-09-29 16:40 to 2026-10-05 14:35 · Logs to open (CMTrace): smsdbmon.logsrsrp.log
| Machine | Log | Message (latest occurrence) | Count | Last | |
|---|---|---|---|---|---|
| RPT01 | srsrp.log | Login failed for user 'CORP\svc-cm-reporting'. Reason: The password of the account has expired. SQL Server error 18487. | 13 | 2026-10-05 14:35just now | |
| CM01 | smsdbmon.log | SQL error: [40001][1205][Microsoft][ODBC Driver 17 for SQL Server][SQL Server]Transaction (Process ID 87) was deadlocked on lock resources with another process. | 4 | 2026-10-04 10:35just now |
What to do: Read distmgr.log and PkgXferMgr.log on the site server, then smsdpprov.log on the distribution point. Frequent causes: package source unreachable, room on the DP, computer account rights on the source share, the DP’s IIS/WebDAV.
From 2026-09-29 12:37 to 2026-10-05 15:41 · Logs to open (CMTrace): distmgr.logsmsdpmon.logsmsdpusage.log
| Machine | Log | Message (latest occurrence) | Count | Last | |
|---|---|---|---|---|---|
| CM01 | distmgr.log | DP-LYON.corp.local: failed to create the content library folder for package PS100001, error 112. | 9 | 2026-10-05 15:23just now | |
| CM01 | distmgr.log | Will retry package PS100002 to DP-LYON.corp.local in 60 minutes (retry 4 of 100). | 22 | 2026-10-05 15:41just now | |
| DP-LYON | smsdpusage.log | Warning: content library free space below 5% on drive E:. | 12 | 2026-10-05 15:35just now | |
| DP-LYON | smsdpmon.log | Content validation for package PS100002 timed out after 3600 seconds, will retry. | 6 | 2026-10-05 08:35just now | |
| DP-NANTES | smsdpmon.log | Connection to the management point timed out, retrying in 60 seconds. | 2 | 2026-10-03 14:35just now |
What to do: Read WCM.log (SUP configuration and WSUS subscription) then wsyncmgr.log (synchronisation). Check that the IIS WsusPool is running and not recycling (private memory), that WSUS answers on its port (8530/8531) and that the proxy is right for the upstream sync.
From 2026-09-29 10:04 to 2026-10-05 13:35 · Logs to open (CMTrace): ruleengine.logwcm.logwsyncmgr.log
| Machine | Log | Message (latest occurrence) | Count | Last | |
|---|---|---|---|---|---|
| CM01 | ruleengine.log | Failed to download content for update {3f2a9c1e-8b47-4d2e-9a61-2c5b7e0d4f18}. Error = 0x87D01101 | 11 | 2026-10-04 14:35just now | |
| CM01 | wsyncmgr.log | Sync failed. Will retry in 60 minutes. | 7 | 2026-10-05 13:35just now | |
| CM01 | wcm.log | Timed out waiting for the WSUS server CM01.corp.local to answer on port 8530, retrying. | 5 | 2026-10-05 10:35just now |
What to do: The target did not answer. Test from the server concerned: DNS resolution (Resolve-DnsName), ports (Test-NetConnection -Port 445/135/443/80/1433), firewalls, and the proxy set on the site system when the traffic goes out to the Internet.
From 2026-09-29 15:16 to 2026-10-05 13:35 · Logs to open (CMTrace): wsyncmgr.log
| Machine | Log | Message (latest occurrence) | Count | Last | |
|---|---|---|---|---|---|
| CM01 | wsyncmgr.log | Sync failed: WebException: The remote server returned an error: (407) Proxy Authentication Required. Source: Microsoft.UpdateServices.Administration.AdminProxy.CreateUpdateServer | 7 | 2026-10-05 13:35just now |
What to do: A secure handshake failed. Check certificate validity and chain (expiry, trusted root, reachable revocation list), the machines’ clocks, TLS 1.2 enabled on client and server (.NET SchUseStrongCrypto), and the HTTPS binding in IIS.
From 2026-09-30 22:52 to 2026-10-05 12:35 · Logs to open (CMTrace): MP_Location.log
| Machine | Log | Message (latest occurrence) | Count | Last | |
|---|---|---|---|---|---|
| MP02 | MP_Location.log | MP LM: Failed to get the certificate for the site signing. Error 0x80092013, the revocation function was unable to check revocation. | 15 | 2026-10-05 12:35just now |
What to do: An account lacks the rights it needs. Find which account in the message (site server computer account, network access account, site system installation account) and check its membership of the target’s local Administrators group and its share and folder rights.
From 2026-09-29 11:04 to 2026-10-04 18:35 · Logs to open (CMTrace): smsbkup.log
| Machine | Log | Message (latest occurrence) | Count | Last | |
|---|---|---|---|---|---|
| CM01 | smsbkup.log | Error: Backup destination \\NAS01\CMBackup is not accessible. Access is denied. (0x80070005) | 6 | 2026-10-04 18:35just now |
What to do: Messages with no known signature: read them in their log with CMTrace, starting with the oldest occurrence of a series.
From 2026-09-30 01:39 to 2026-10-05 14:35 · Logs to open (CMTrace): srsrp.log
| Machine | Log | Message (latest occurrence) | Count | Last | |
|---|---|---|---|---|---|
| RPT01 | srsrp.log | Retrying the data source check for report folder ConfigMgr_PS1 in 900 seconds. | 13 | 2026-10-05 14:35just now |
What to do: Read colleval.log: failing or slow evaluations usually come from an invalid WQL query or too many incremental collections. The Collection Evaluation Viewer (site tools) shows the durations.
From 2026-09-29 08:19 to 2026-10-05 14:35 · Logs to open (CMTrace): colleval.log
| Machine | Log | Message (latest occurrence) | Count | Last | |
|---|---|---|---|---|---|
| CM01 | colleval.log | Collection PS100021 took 412 seconds to evaluate, longer than its 300-second warning threshold. | 18 | 2026-10-05 14:35just now |
What to do: Read mpcontrol.log: it says whether the management point answers over HTTP/HTTPS. Check IIS (CCM pools), the ISAPI extension, BITS, and the management point’s access to the site database. A quick test: https://<MP>/sms_mp/.sms_aut?mplist.
From 2026-10-01 05:22 to 2026-10-05 11:35 · Logs to open (CMTrace): ccmisapi.logmpcontrol.log
| Machine | Log | Message (latest occurrence) | Count | Last | |
|---|---|---|---|---|---|
| MP02 | ccmisapi.log | Request timed out after 30 seconds for /ccm_system/request. | 9 | 2026-10-05 11:35just now | |
| CM01 | mpcontrol.log | Http test request failed, status code is 500, 'Internal Server Error'. Retrying in 5 minutes. | 3 | 2026-10-04 00:35just now |
| Machine | Log | Message (latest occurrence) | Count | First | Last | Probable cause | |
|---|---|---|---|---|---|---|---|
| CM01 | distmgr.logDistribution Manager: content to the DPs | Failed to copy content PS100001 to \\DP-LYON.corp.local\SMS_DP$\. Error = 0x80070070 There is not enough space on the disk.SMS_DISTRIBUTION_MANAGER | 34 | 2026-09-29 22:04just now | 2026-10-05 16:11just now | Not enough disk space | |
| DP-LYON | smsdpprov.logDistribution point provider (on the DP) | Failed to write file E:\SCCMContentLib\FileLib\4A1F\4A1F7C2E. Error 0x80070070 not enough space on the disk.SMS_DP_PROVIDER | 28 | 2026-09-29 11:40just now | 2026-10-05 16:05just now | Not enough disk space | |
| CM01 | distmgr.logDistribution Manager: content to the DPs | DP-LYON.corp.local: failed to create the content library folder for package PS100001, error 112.SMS_DISTRIBUTION_MANAGER | 9 | 2026-09-29 19:55just now | 2026-10-05 15:23just now | Content distribution | |
| RPT01 | srsrp.logReporting Services point | Login failed for user 'CORP\svc-cm-reporting'. Reason: The password of the account has expired. SQL Server error 18487.SMS_SRS_REPORTING_POINT | 13 | 2026-09-29 16:40just now | 2026-10-05 14:35just now | Access to the site SQL database | |
| CM01 | wsyncmgr.logSoftware update synchronisation | Sync failed: WebException: The remote server returned an error: (407) Proxy Authentication Required. Source: Microsoft.UpdateServices.Administration.AdminProxy.CreateUpdateServerSMS_WSUS_SYNC_MANAGER | 7 | 2026-09-29 15:16just now | 2026-10-05 13:35just now | Network, name resolution or proxy | |
| MP02 | MP_Location.logManagement point: client request processing | MP LM: Failed to get the certificate for the site signing. Error 0x80092013, the revocation function was unable to check revocation.MP_LocationManager | 15 | 2026-09-30 22:52just now | 2026-10-05 12:35just now | Certificate, TLS or HTTPS | |
| CM01 | smsbkup.logSite backup | Error: Backup destination \\NAS01\CMBackup is not accessible. Access is denied. (0x80070005)SMS_SITE_BACKUP | 6 | 2026-09-29 11:04just now | 2026-10-04 18:35just now | Access denied | |
| CM01 | ruleengine.logAutomatic deployment rules (ADR) | Failed to download content for update {3f2a9c1e-8b47-4d2e-9a61-2c5b7e0d4f18}. Error = 0x87D01101SMS_RULE_ENGINE | 11 | 2026-09-30 10:32just now | 2026-10-04 14:35just now | Software update point and WSUS | |
| CM01 | smsdbmon.logDatabase monitor: SQL triggers to the components | SQL error: [40001][1205][Microsoft][ODBC Driver 17 for SQL Server][SQL Server]Transaction (Process ID 87) was deadlocked on lock resources with another process.SMS_DATABASE_NOTIFICATION_MONITOR | 4 | 2026-10-01 20:50just now | 2026-10-04 10:35just now | Access to the site SQL database | |
| CM01 | distmgr.logDistribution Manager: content to the DPs | Will retry package PS100002 to DP-LYON.corp.local in 60 minutes (retry 4 of 100).SMS_DISTRIBUTION_MANAGER | 22 | 2026-09-29 12:37just now | 2026-10-05 15:41just now | Content distribution | |
| DP-LYON | smsdpusage.log | Warning: content library free space below 5% on drive E:.SMS_DP_USAGE | 12 | 2026-09-29 18:33just now | 2026-10-05 15:35just now | Content distribution | |
| RPT01 | srsrp.logReporting Services point | Retrying the data source check for report folder ConfigMgr_PS1 in 900 seconds.SMS_SRS_REPORTING_POINT | 13 | 2026-09-30 01:39just now | 2026-10-05 14:35just now | Other messages | |
| CM01 | colleval.logCollection evaluation | Collection PS100021 took 412 seconds to evaluate, longer than its 300-second warning threshold.SMS_COLLECTION_EVALUATOR | 18 | 2026-09-29 08:19just now | 2026-10-05 14:35just now | Collection evaluation | |
| CM01 | wsyncmgr.logSoftware update synchronisation | Sync failed. Will retry in 60 minutes.SMS_WSUS_SYNC_MANAGER | 7 | 2026-09-29 10:04just now | 2026-10-05 13:35just now | Software update point and WSUS | |
| MP02 | ccmisapi.logManagement point ISAPI extension | Request timed out after 30 seconds for /ccm_system/request.CcmIsapi | 9 | 2026-10-01 05:22just now | 2026-10-05 11:35just now | Management point | |
| CM01 | wcm.logSUP configuration and WSUS subscription | Timed out waiting for the WSUS server CM01.corp.local to answer on port 8530, retrying.SMS_WSUS_CONFIGURATION_MANAGER | 5 | 2026-10-02 01:50just now | 2026-10-05 10:35just now | Software update point and WSUS | |
| DP-LYON | smsdpmon.logDP content validation | Content validation for package PS100002 timed out after 3600 seconds, will retry.SMS_DP_MONITOR | 6 | 2026-09-30 03:18just now | 2026-10-05 08:35just now | Content distribution | |
| CM01 | mpcontrol.logMP Control Manager: registration and HTTP availability | Http test request failed, status code is 500, 'Internal Server Error'. Retrying in 5 minutes.SMS_MP_CONTROL_MANAGER | 3 | 2026-10-03 17:06just now | 2026-10-04 00:35just now | Management point | |
| DP-NANTES | smsdpmon.logDP content validation | Connection to the management point timed out, retrying in 60 seconds.SMS_DP_MONITOR | 2 | 2026-10-03 06:54just now | 2026-10-03 14:35just now | Content distribution |
| Machine | Files read | Errors | Warnings | Folders |
|---|---|---|---|---|
| CM01.corp.local | 8 | 71 | 55 | E:\Program Files\Microsoft Configuration Manager\Logs C:\Windows\CCM\Logs |
| SQL01.corp.local | 0 | 0 | 0 | |
| DP-LYON.corp.local | 3 | 28 | 18 | E:\SMS_DP$\sms\logs |
| DP-NANTES.corp.local | 1 | 0 | 2 | D:\SMS_DP$\sms\logs |
| MP02.corp.local | 2 | 15 | 9 | C:\Windows\CCM\Logs |
| RPT01.corp.local | 1 | 13 | 13 | E:\Program Files\SMS_SRSRP\Logs |
Read-only: every .log / .lo_ file changed in the window is opened with read/write sharing (never locked) and only its end is read. CMTrace format: the severity is the one the component wrote. SMS format (no severity): a line is classed as error or warning by its keywords (error, failed, 0x8…, warning, retry…), phrases like “Error = 0” being set aside.