Configuration Manager | Compliance state unknown

Boopathi S 3,821 Reputation points
2025-07-17T07:35:14.44+00:00

Hello Team,

there are devices under compliance state unknown for specific collection and for a software update deployment.

Checked that there are no scan errors in the scan report.

I read https://learn.microsoft.com/en-us/troubleshoot/mem/configmgr/update-management/troubleshoot-software-update-scan-failures#compliance-results-unknown

User's image

Please let me know is there any report or query available based on the specific software update group and collection to check the status message in database.

Need to know whether devices return below state message or not.

User's image

Alos guide me how to troubleshoot from SCCM infrastructure end to check the issue.

Microsoft Security | Intune | Configuration Manager | Updates
0 comments No comments
{count} votes

2 answers

Sort by: Most helpful
  1. Rahul Jindal 11,076 Reputation points
    2025-07-17T21:59:53.7666667+00:00

    Unknown compliance generally ties to scan agent status. Are the devices in question receiving the update deployment assignments and installing updates or is that not working either?

    0 comments No comments

  2. Kalyan Sundar 571 Reputation points
    2025-08-08T19:39:11.41+00:00

    Please verify the scan status of Scan 3 - Last Scan Status by Collection under Scan Deport, and determine whether all unknown devices have completed their scan and are reported as "Scan Completed"

    1. Scan Status Verification:
      • Review the status of Scan 3 - Last Scan Status by Collection in the console.
      • Check if all devices categorized as "Unknown" have transitioned to a completed scan state.
    2. Log Validation on Sample Clients:
      • Select a few client devices from the affected group.
      • Review the following logs for errors or scan-related issues:
        • ScanAgent.log
        • WUAHandler.log
      • Confirm whether the scan has been successfully completed or if any errors persist.
    3. Force Update Compliance State (if scan is complete):
      • If the scan has been completed without errors, execute the following PowerShell commands on the client to manually trigger a compliance state update to the database:
      powershell Get-WmiObject -Namespace "root\CCM\StateMsg" -Query "select * from CCM_StateMsg where (TopicType = 300 or TopicType = 301) and TopicID =''" | Set-WmiInstance -Arguments @{MessageSent = $true} $UpdatesStore = New-Object -ComObject Microsoft.CCM.UpdatesStore $UpdatesStore.RefreshServerComplianceState()
    0 comments No comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.