Hi folks, Jagat Singh Kathiar here from the Configuration Manager team with another support tip for you. Implementation of a Microsoft PKI with Configuration Manager has been very popular so I thought it would be worth sharing an issue I came across a few weeks back where System Center 2012 Configuration Manager (ConfigMgr 2012) clients were not getting registered when the Site Server was configured for SSL (HTTPS only mode).

In my scenario the ConfigMgr site was configured for “HTTPS only” mode with what appeared to be the appropriate certificates in the personal computer store of the Site Server and the clients. However, the clients were not getting registered and were seeing 80092004 and 0x87d00215 errors in ClientIdMangerStartup.log:

We also found 80092004 and 0x87d00231 errors in CCMmessaging.log:

These errors generally mean that some object cannot be found and it was clear in this case that we were unable to find a proper certificate.

We knew at this point that it was certificate related, and after doing a little more investigating we found that there were two Enterprise Certificate Authorities (CAs) in the environment. We checked the certificates again and discovered that our problem was due to the fact that the client had a certificate issued by one of the CAs and the Site Server was configured to use a certificate from the other.

When you configure ConfigMgr 2012 for SSL/HTTPS, it is recommended that you either use the same CA for the server and clients,  or if that’s not possible, that you add both/all CA certificates to the Trusted Root Certificate Authorities option on the Client Computer Communication tab on the Configuration Manager server.

To check the Root CA used in Configuration Manager, connect to the Configuration Manager console and open the Properties for the site in question.

From there go to the Client Computer Communication tab. When you configure a site for HTTPS only mode you will see “Root CA specified” under Trusted Root Certification Authorities. By default this option doesn’t contain any issuer certificate but as soon as the site is configured for HTTPS only mode it loads the Certificate Authority certificate which was used to issue certificates to the Site Server.

Just for reference, below is what that same tab looks like when the site is not configured for SSL (this is the default setting).

Summary

Keeping all of this in mind, here are a few ways you can ensure that this issue doesn’t occur in your environment:

1. Issue certificates to the site server and the clients using the same Certificate Authority (Recommended).

2. Alternatively, you could keep both (or multiple) Root CA certificates in the “Trusted Root Certificate Authority” setting on the Site’s Properties –> Client Computer Communication tab. Note that in this case, since the CA for the client certificate is different, you must export the Root CA certificate from the alternate CA that the client is using in .cer format and then import it via the same Trusted Root Certificate Authorities option on the Client Computer Communication tab on the ConfigMgr server.

3. Although not recommended, you could also keep no Trusted Root CAs in the Trusted Root Certificate Authority setting on the Client Computer Communication tab. This will skip the ConfigMgr trusted check but assumes that Trusted Root certificates are otherwise properly implemented on clients and servers in the environment.

For more information on configuring certificates in System Center 2012 Configuration Manager (and R2), please see the following:

PKI Certificate Requirements for Configuration Manager: http://technet.microsoft.com/en-us/library/gg699362.aspx

 Jagat Singh Kathiar | Sr. Technical Lead | Microsoft

Get the latest System Center news onFacebookandTwitter:

System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm

Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/

The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/

Hello Everyone, Prabhat Joshi here with another System Center 2012 Configuration Manager support tip for you, this time for reporting services.

At times we have seen issues wherein after installing a ConfigMgr 2012 Reporting Services Point we don't see reports either in the console or under the report manager URL. It’s also possible that you will see some reports but others are missing.

If you check srsrp.log you’ll see entries similar to the ones below.

System.Web.Services.Protocols.SoapException: The path of the item 'Site - General' is not valid. The full path must be less than 260 characters long; other restrictions apply. If the report server is in native mode, the path must start with slash. ---> Microsoft.ReportingServices.Diagnostics.Utilities.InvalidItemPathException: The path of the item 'Site - General' is not valid. The full path must be less than 260 characters long; other restrictions apply. If the report server is in native mode, the path must start with slash.~ at Microsoft.ReportingServices.Library.ReportingService2005Impl.GetPolicies(String Item, Policy[]& Policies, Boolean& InheritParent)~ at Microsoft.ReportingServices.WebServer.ReportingService2005.GetPolicies(String Item, Policy[]& Policies, Boolean& InheritParent)

Failed to retrieve existing folder security for folder [Site - General].

System.Web.Services.Protocols.SoapException: The path of the item 'Site - Server Information' is not valid. The full path must be less than 260 characters long; other restrictions apply. If the report server is in native mode, the path must start with slash. ---> Microsoft.ReportingServices.Diagnostics.Utilities.InvalidItemPathException: The path of the item 'Site - Server Information' is not valid. The full path must be less than 260 characters long; other restrictions apply. If the report server is in native mode, the path must start with slash.~ at Microsoft.ReportingServices.Library.ReportingService2005Impl.GetPolicies(String Item, Policy[]& Policies, Boolean& InheritParent)~ at Microsoft.ReportingServices.WebServer.ReportingService2005.GetPolicies(String Item, Policy[]& Policies, Boolean& InheritParent)

Failed to retrieve existing folder security for folder [Site - Server Information].

If you find yourself in this situation then here are a couple of steps to fix it:

- Start by compiling sqlmgmproviderxpsp2up.mof by running the command below:

mofcomp.exe C:\Program Files (x86)\Microsoft SQL Server\100\Shared\sqlmgmproviderxpsp2up.mof

This should help when you cannot see the reports in the console or reports are not getting copied over.

- If you have some reports that are missing and you also see intermittent health check failures in srsrp.log, check the reporting services log under <drive>:/Program Files/Microsoft SQL Server/<Instance ID>/Reporting Services/LogFiles. A good log to check is ReportServerService_<timestamp>.log as it logs all errors and will provide a complete call stack that should explain why we got an error message.

If you see an entry that mentions something like "Only one usage of each socket address (protocol/network address/port) is normally permitted ::1:80" in the above mentioned log, run the command netstat –ano and check the number of open ports (i.e. connections). If you see a relatively small number of connections (e.g. 240) then run the command netsh int ipv4 show dynamicport tcp. Here’s an example of the output we got on an affected machine:

Protocol tcp Dynamic Port Range
---------------------------------
Start Port : 20000
Number of Ports : 240

This tells us that we may not have access to the ports we need. Try changing the amount of ports by running the command netsh int ipv4 set dynamicportrange protocol=tcp start 40000 numberofports=20000.

NOTE This opened 20000 ports after tcp port 40000 so that the Reporting Services Point can more easily find an open port.

Once the command above is run, restart reporting services. If this was your issue, reports should now start showing up and fix your intermittent health check failures as well.

Prabhat Joshi| Technical Lead | Microsoft

Get the latest System Center news on Facebook and Twitter:

System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm

Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/

App-V Team blog: http://blogs.technet.com/appv/
MED-V Team blog: http://blogs.technet.com/medv/
Server App-V Team blog: http://blogs.technet.com/b/serverappv

The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/

~ Roberto Rodriguez

Hi everyone Roberto Rodriguez here with a Configuration Manager support tip for you. If you find that your System Center Configuration Manager 2007 (ConfigMgr 2007) or System Center 2012 Configuration Manager (ConfigMgr 2012) collections are updating slowly or  maybe even not updating at all, take a look at your colleval.log file. You may find that there are many entries such as ‘Collection MSO00088 cannot be found’ prompting ‘Failed to manage all files in inbox’ alerts. Here’s an example from a case I recently saw:

One possible cause for this is if the collection referenced was deleted shortly after being created or updated, but SMS SQL Monitor and SMS Collection Evaluator processed the create or update file out of sequence. This might happen if when the collection was deleted there was a backlog on the collection evaluator or it was stopped and thus not able to process the file at that time.

To fix this, check and see if the .udc file mentioned is in the  colleval.box like it is in the screen shot below.

If this file exists and you no longer need this update, simply move the file to a temp location and delete it.  The alert should be resolved after completion of the next scheduled processing cycle once this is done.

Roberto Rodriguez | Premier Field Engineer | Microsoft

Get the latest System Center news onFacebookandTwitter:

System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm

Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/

The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/

~ Karen Sullivan

This article explains the steps to create a collection of users using a query, how to copy and modify a role, how to assign it to a collection, and then finally the steps to create a scope and assign it to the collection.

Security in System Center 2012 Configuration Manager (ConfigMgr 2012) was changed to allow more granular control of users and devices. The following steps will create a user collection based on a "Marketing Admins" group in Active Directory, and then once that’s done we'll create and modify both roles and scope to limit access.

Creating the collection

1. In the ConfigMgr admin console, go to Assets and Compliance –> Device collections, then click on "Create user collection" in the ribbon.
2. Enter a name for the collection. In our example the name will be Marketing Admins.
3. Click on Browse, then All Users and User Groups. Click Next.
4. Click on Add Rule, then Query Rule. Give the query a name.
5. Choose User resource and then Edit Query Statement.
6. Click on the Criteria tab and then on the asterisk.
7. Click the top Select button and choose User Resource. For Attribute, choose User Group Name, and click OK.
8. Choose "is equal to" for Operator.
9. Put the name of the group or whatever criteria you are using. In this case we’ll use Marketing Admins since that’s the name of the group we want to use in AD.

Now we have a Marketing Admins collection. Next, we'll copy the role we are using and modify it as needed.

Copying and editing the role

1. In the ConfigMgr admin console, go to Administration –> Security –> Security Roles. Choose one of the 16 roles, right-click on it and choose copy.
2. Give the new role a name.
3. In the bottom half of the screen, change the permissions if needed.
4. Click OK.

Next we will create the scope. The scope is used to limit access to things like distribution points and packages.

Creating the scope

1. In the ConfigMgr admin console, go to Administration –> Security –> Security Scopes and click on "Create Security Scope" in the ribbon.
2. Give the scope a name. For now, just choose the default account name.

Bringing it all together

1. In the ConfigMgr admin console, go to Administration –> Security –> Administrative Users.
2. Choose Add User or Group from the ribbon.
3. Click the Browse button and add the user or group you need from Active Directory. In our example we’ll use Marketing Admins. If you haven't created an AD group for this department, you'll need to do it now, or assign the scope and role to each individual user.
4. Click the Add button and choose the role created in the steps above.
5. Choose "Only the Instances of objects that are assigned to the specified security scopes or collections”.
6. Highlight All Systems in the bottom half of the screen and click Remove. Do the same with All Users and Groups as well as Default.
7. Click Add –> Collection, then User Collection in the drop-down.
8. Click Add –> Collection and then Security Scope. Choose the scope created in the steps above. Click OK and then OK again.

You now have a group of users with permissions defined in a role and limited by the scope. You can also use this process to add more granular objects with a scope such as Distribution Points, packages, and task sequences.

Karen Sullivan | Senior Support Engineer | Microsoft GBS Management and Security Division

Get the latest System Center news onFacebookandTwitter:

System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm

Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/

The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/

After you install the Cumulative Updates for Microsoft System Center 2012 R2 Configuration Manager, you can't successfully install the client update to the Windows XP or Windows Server 2003 client computers. When this problem occurs, the following event is recorded in the Windows installer log:

Action start 15:34:27: CcmCheckFreeDiskSpace.MSI (s) (B8:A8) [15:34:27:809]: Product: Configuration Manager Client -- There is not enough available disk space on  to complete this operation. Installation requires at least 90MB free disk space.

Note This specific problem occurs only when the Configuration Manager client is installed on a nonsystem partition. For example, the Windows system is installed on partition C and you install the ConfigurationManager client onpartition D. This issue occurs even if sufficient free disk space exists on the partition in which the Configuration Manager client is installed.

For all the details and a work around, please see the following:

KB2923401 - Configuration Manager client update does not install successfully on Windows XP or Windows Server 2003 clients (http://support.microsoft.com/kb/2923401)

J.C. Hornbeck| Solution Asset PM | Microsoft GBS Management and Security Division

Get the latest System Center news onFacebookandTwitter:

System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm

Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/

The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/

~ Muhammad Adil

Hi Folks, hope you doing well! Sometime back I had the opportunity to give a presentation on Wake on LAN (WOL) to our ConfigMgr PRO team so I thought I would share this information here in an effort to help you configure and troubleshoot Wake on LAN as well. This article consists of almost all of information you should need regarding planning, configuring and troubleshooting Wake on LAN (WOL) in both System Center Configuration Manager 2007 (ConfigMgr 2007) as well as System Center 2012 Configuration Manager (ConfigMgr 2012). My intention is to provide a single document that covers each and every point regarding

Wake on LAN and so that there isn’t a need a rely on multiple resources when trying to implement this in your environment.

What’s covered

1. What Wake on LAN is and how it works

2. The requirements for Wake on LAN

3. Wake On LAN in a multiple site hierarchy

4. General configuration

5. Activating Wake on LAN

6. Monitoring

7. Troubleshooting

8. Limitations

What Wake on LAN is and how it works

So what is Wake on LAN? Wake on LAN is essentially a network request or a network message to turn on a computer when it is in hibernate, sleep mode or turned off.

ConfigMgr supports the sleep states documented in the TechNet article here:

Sleep States for Wake On LAN (http://technet.microsoft.com/en-us/library/bb693821.aspx)

However, it also depends upon the architecture of the computer. It is a technology developed by Intel and IBM and is integrated into Microsoft Configuration Manager.

Wake on LAN is implemented in an environment using a special data packet known as Magic Packet. A Magic Packet consists of 6 bytes of all 255 (FF FF FF FF FF FF), followed by sixteen repetitions of the target computer's MAC address. Below is an example of how a magic packet frame looks like captured using a third party network sniffer tool:

For a machine to wake up, it can be in a shutdown, sleep or any other supported state, but it must also be connected to power source. The Magic packet is sent to the computer where the network card then signals the motherboard and the power supply to turn on the machine, similar to turning it on using a power button.

The requirements for Wake on LAN

The requirements can be divided into four categories and we’ll discuss each of them in brief:

1. Requirements for the ConfigMgr server

2. Requirements for the network

3. Requirements for the client

4. Hardware Inventory

The requirements for the ConfigMgr server are that the server must be up and running, the Management Point needs to be working properly, Wake on LAN must be enabled and the port being used must not be blocked on the firewall.

The requirements for the network are that switches and routers must be configured to allow the broadcast network packets if the chosen method is a subnet directed broadcast, and they should be allowed to forward the UDP packets if the chosen method is Unicast. Apart from that, the port being used must be opened on the router and the switch.

The requirements for the client are that the communication between the client and the management point should be healthy (e.g. the client should be able to download the policy from the Management point, etc.), Wake on LAN must be enabled in the BIOS and the network card must support Wake on LAN and have the feature enabled.

Apart these three requirements there is another very important dependency and that is Hardware Inventory. The Hardware Inventory information sent by the client includes the IP address, MAC address and subnet address. The Hardware Inventory information sent by the client (consisting of the MAC address and the subnet address in case of subnet directed broadcast, and the IP address and MAC address in the case of unicast) must be the actual MAC address and IP or subnet address on the client.

Wake On LAN in a multiple site hierarchy

If you wish to implement Wake On LAN in a multiple site hierarchy then you must be aware of following three considerations:

1. Wake-up packet transmissions are sent only from primary site servers. You cannot configure secondary site servers or other computers acting as proxies to send wake-up packets.

2. If you are enabling Wake On LAN on a child site, deployments and advertisements that are inherited from a parent site will include the Enable Wake On LAN configuration.

3. If the child site is not enabled for Wake On LAN, client computers in that site will not be sent wake-up packets.

General Configuration

Server configuration

Now that we’ve covered some of the basics, let’s go through a simple step-by-step configuration of Wake on LAN.

To enable Wake on LAN in ConfigMgr 2007 or ConfigMgr 2012, go to the site properties –> Wake On LAN and put a check mark next to “Enable Wake on LAN for this site” as shown in the screenshot below.

Choose the first or second option if you want to wake machines using AMT. Choose the first or the third option if you want to wake up the machine using Wake on LAN.

There are two transmission methods for WOL magic packets:

Subnet Directed Broadcast: In this method of transmission, the subnet address and the MAC address is retrieved from Hardware Inventory and wake-up packets are targeted to the subnet where they are broadcast to all the machines within that subnet. This method will fail if the machine changed its subnet and the ConfigMgr server has not yet received the updated Hardware Inventory with the information of its latest subnet. However, it should not fail if the machine has changed its IP address because the wake-up packets hit the subnet address rather than the IP address and should still reach the client. By default, subnet broadcasting is disabled on routers and switches, therefore it is important to ensure that is enabled if this is the method you choose. Also keep in mind that subnet-directed broadcasts are not supported with IPv6 addresses. For security reasons and to prevent smurf attacks, Microsoft highly recommends that you use a non-default port with this method of transmission.

Unicast: With this method of transmission, the IP address and the MAC address is retrieved from Hardware Inventory and wake-up packets are targeted directly to the IP address on the subnet. If the target machine has changed its IP address and Hardware Inventory has yet to update, the wake-up packet will reach the destination IP but will fail because the MAC address is different. Be sure to configure switches to forward UDP packets, and verify with your hardware vendor that older network cards support this method of transmission. In order for this method to be successful, entries for the client machines should be in the ARP cache of the router or the site server. More details on this are mentioned in the last section covering troubleshooting.

Which method should I use?

Both transmission methods have their pros and cons and it depends on your environment as to which method you should opt to use.

The advantage of subnet broadcasting is that the success rate is very high if the target machines frequently change their IP addresses. For this reason it is preferred. This is the original method of sending wake-up packets so it works with almost all sleep states. The disadvantage is that it is less secure, it consumes more network bandwidth, it requires reconfiguration of routers and it does not supports IPv6 addresses.

The advantage of unicast is that it’s more secure, it consumes less bandwidth, it supports both IPv4 and IPv6 addresses and requires no reconfiguration on the routers. The disadvantages of unicast are that it can be less successful, switches must be configured to forward UDP packets, and it may not wake-up machines from all sleep states.

After reading the advantages and disadvantages, if you have decided to use the Unicast method but the clients in your environment frequently change their IP addresses, it is recommended that you increase the DHCP lease time and shorten the Hardware Inventory schedule, however doing so can impact traffic on your network.

After enabling WOL and choosing the transmission method, Please choose the port number as shown in the screen shot below. By default, ConfigMgr uses UDP port 9, however you can use a custom UDP port of your choice. Whichever port you choose, please ensure that it’s not blocked on any firewall or intervening routers.

Client Configuration

After enabling and configuring Wake on LAN on server side, let’s proceed with configuring it on the client side.

On the ConfigMgr clients, ensure that Wake on LAN is enabled in the system BIOS. You may see different terminologies for WOL depending on the manufacturer (e.g. Remote Wake-up, Wake on LAN, Wake on PCI card etc.).

In addition to the BIOS, the network card must be configured to support Magic or wake-up packets. To do this, go to Start –> Run –> devmgmt.msc –> Device Manager –> Network Adapters, then right-click the network card and go to Properties. If your card has an advanced tab, ensure that WOL is enabled as per the screenshot below.

On the Power Management tab of the Network Card, please ensure that all three options shown below are checked to allow the NIC to wake the machine.

I can’t really tell you if there is a way in which you can enable Wake on LAN in the BIOS on multiple machines in your environment, however you can use Fix it tool 55017 from http://support.microsoft.com/kb/2740020 to enable power management on all of the machines in your environment. This Fix it tool can be deployed using a Group Policy, ConfigMgr, etc.

Network Configuration

As mentioned earlier, routers and switches must allow the port configured for Wake on LAN. In addition, intervening routers must allow the broadcast of wake-up packets if the chosen transmission method is subnet directed broadcast. Switches must be configured to forward UDP packets if the chosen transmission method is Unicast.

Hardware Inventory

After configuring the above settings, verify that the machine being tested has successfully reported its inventory. You can do this by right-clicking the machine in the console –> Start –> Resource Explorer –> Hardware –> Network Adapter configuration. In the screenshot below you can see that the client is sending its IP address, subnet address and MAC address. The Hardware Inventory information sent by the client consists of the MAC address and the subnet address in the case of subnet directed broadcast, and the IP address and MAC address in the case of unicast. These must be the same as the actual MAC address and IP or subnet address of the client. If there is mismatch between the inventory information and the details on the client, Wake on LAN will fail because the Magic Packet will fail to locate the machine. In such a case you may have to initiate the hardware inventory cycle on the client so that it sends fresh inventory information.

Activating Wake on LAN

After meeting the above requirements, your client should probably be capable of using WOL, however you must still activate Wake on LAN so your clients can turn on when they receive a Software Update, Package or Task Sequence.

Please note that in ConfigMgr 2007, Advertisements/Deployments should be configured as Mandatory and in ConfigMgr 2012, Deployments must be configured as “Required” for Wake on LAN to work.

Configuring Wake on LAN in ConfigMgr 2007

To configure a Software Update for Wake on LAN:

1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Updates / Deployments.

2. Right-click the deployment you want to configure for Wake on LAN and then click Properties.

3. On the Schedule tab, select the option Enable Wake on LAN.

4. Click OK.

To configure a Software Distribution mandatory advertisement for Wake on LAN:

1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Advertisements.

2. Right-click the advertisement that supports the Software Distribution you want to enable for Wake on LAN and then click Properties.

3. On the Schedule tab, select the option Enable Wake on LAN.

To configure a Task Sequence mandatory advertisement for Wake on LAN:

1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Distribution / Advertisements.

2. Right-click the advertisement that supports the operating system deployment that you want to enable for Wake on LAN and then click Properties.

3. On the Schedule tab, select the option Enable Wake on LAN.

Configuring Wake on LAN in ConfigMgr 2012

To configure a software update for Wake on LAN:

1. In the Configuration Manager console, navigate to Software Library/ Software Updates/ Software Update Groups

2. Right-click on the Software Update Group and click on deploy

3. On the Deployment Settings- Type of Deployment Settings must be configured to “Required” and “Use Wake on-LAN to wake up clients for required deployments” should be checked.

Configuring an Application or a Package for Wake on LAN:

1. In the Configuration Manager console, navigate to Software Library/ Application Management/ Applications or Packages

2. Right-click on the Application or the Package and click on deploy

3. On the Deployment Settings- Purpose must be configured to “Required” and “Send Wake-up Packets” should be checked.

Configuring a Task Sequence for Wake on LAN:

1. In the Configuration Manager console, navigate to Software Library/ Operating Systems/ Task Sequences

2. Right-click on the Task Sequence and click on deploy

3. On the Deployment Settings- Purpose must be configured to “Required” and “Send Wake-up Packets” should be checked.

Monitoring

In ConfigMgr we have two logs on the site server to monitor Wake on LAN activity: Wolmgr.log and Wolcmgr.log. Wolmgr.log basically shows us the status of the Wake on LAN manager component but it’s the Wolcmgr.log which shows us the status of the Wake on LAN packets.

If the wake-up packets are being sent out, we get STATMSG=6504 in wolcmgr.log as per the screenshot below.

Once the sending of the packets is completed we receive STATMSG=6505 in wolcmgr.log.

Below is a table of Message ID’s with the description you will find in Wolcmgr.log. These ID’s will assist you in understanding the status of wake-up packets in the event of a success or a failure.

In addition to the above logs, you can also use a Network Monitor trace or any third party WOL sniffer tool (e.g. http://profshutdown.com/download.aspx) to verify if packets are being sent out.

Troubleshooting

Below are some tips for you that I have learned from my experience with WOL. However, before we begin to troubleshoot Wake on LAN issues, we should always narrow down where exactly the problem is. We need to determine if the problem is at the ConfigMgr server, on the Network or at the client end.

First of all, be sure that you read through each section above to make sure you have the basics covered. And when testing, always have at least two or more machines to test with instead of just one.

For specific troubleshooting I’ll take a shortcut here to save some time.

- If you are unable to wake a machine using ConfigMgr WOL, however your are able to wake it using a 3^rd party Wake On LAN utility, most likely the machine is capable of WOL and the issue lies either in the Hardware Inventory, on the server side or in the network.

- If you are able to wake a machine on the same subnet as the Site server, however it’s not waking on a different subnet then most likely the issue is with the switch or the router.

- Verify that problematic machines are communicating with the Management point and are able to download policies. (e.g. check Ccmexec.log, ClientIDManagerstartup.log, PolicyAgent.log etc.).

- Ensure that the port you specified for Wake on LAN is not blocked at the firewall or on any intervening device on the network. You might also try an alternate port for testing purposes.

- Check the binding order of the network cards if there are more than one on the ConfigMgr server or client. Also ensure that all network cards (or at least the one in use) are configured to forward and receive Wake-up Packets.

- If you are using the subnet directed broadcast transmission method, ensure that Broadcast is enabled on intervening routers and switches.

- If you are using Unicast, ensure that switches and routers are configured to forward UDP packets.

- I have come across a specific scenario several times where machines do not wake-up when using Unicast because routers are unable to resolve the IP address to MAC address since the entry of the machine does not exist in the ARP Table on the router. ARP is a mapping of MAC and IP addresses, and by running the command Arp –a on the Router/Site server we can verify if the entry of the machine exists in the ARP cache of the Router/Site Server. To verify is the issue is with ARP cache you can manually add the entry of a machine to the ARP cache of the ConfigMgr site server by running the command arp –s <ip_address> <mac_address> (e.g. arp -s 192.168.x.xxx 00-2x-5x-C1-xx-xx) on the ConfigMgr site server. This will override the ARP cache of the router. To fix this issue for several machines you might have to increase the ARP Cache Stale Timeout period and ARP Cache Update Timeout period. The default time out period for most Routers and Switches is 240 seconds.

- If you have enabled the Time Zone Hardware Inventory class you may come across an issue where a machine wakes-up in a different time zone. In such a case please ensure that the time zone in the Hardware Inventory and the actual time zone of the machine is the same.

Limitations

- Using ConfigMgr Wake On LAN, you will not be able to wake-up machines which are on the Internet.

- You will not be able to wake-up Bare Metal machines.

- Wake On LAN transmissions are always sent at the scheduled time, ignoring any maintenance windows that might be in effect on a client computer.

That’s it for Wake on LAN. Thanks for going through this article and kindly drop me a comment if I forgot to add something.

Muhammad Adil | Senior Consult-Escalation Engineer | PRO Support Middle East & India

Get the latest System Center news onFacebookandTwitter:

System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm

Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/

The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/

Cumulative Update 4 for System Center 2012 Configuration Manager SP1 is now available. This update includes the following:

Software distribution

- Packages are listed as Unknown in the Content Status node of the Administrator Console. This occurs after a Configuration Manager 2007 distribution point is upgraded and assigned to a Configuration Manager 2012 secondary site.

- Internet-based clients cannot download content from an Internet-facing distribution point after first they first encounter a failure to reach Windows Update. The DataTransferService.log file on the client will record errors that resemble the following:

Failed to set proxy to bits job for url 'https:// site.configmgr.com:443/SMS_DP_SMSPKG$/{pkg_id}'. Error 0x87d00215
All proxy types and no proxy have been tried for times but failed.

- 2913703 (http://support.microsoft.com/kb/2913703/) Applications that use dynamic variable lists are not installed in System Center 2012 Configuration Manager

- Adding or deleting a deployment to a software update group results in policy evaluation for all deployments within the group instead of the deployment that changed.

Operating system deployment

- The wrong software update for an operating system image may be selected the list of items that are returned in the Schedule Updates Wizard is sorted.

- 2894539 (http://support.microsoft.com/kb/2894539/) A post-CU3 update is available for System Center 2012 Configuration Manager SP1.
Task sequences that contain Windows 8.1 as a condition on the Options tab generate an exception when they are changed or accessed. Details of the exception are displayed in text that resembles the following:

System.Reflection.TargetInvocationException
Exception has been thrown by the target of an invocation.

- Child sites will not process the content for a task sequence that was changed after migration from another site. The Distmgr.log file on the child site will contain entries that resemble the following, and the package state will not change:

Package {Package_ID} is in Pending state and will not be processed...

Note This fix applies only to task sequences that are not yet migrated. Task sequences that were migrated before you applied CU4 should be deleted and then migrated again.

- After the update is installed on site servers, any operating system boot images should be updated. To update boot images after the hotfix is applied, follow these steps:

1. In the Configuration Manager console, click Software Library.
2. In the Software Library workspace, expand Operating Systems, and then click Boot Images.
3. Select the boot image that you want to update.
4. Right-click and then select the Update Distribution Points action.
   Note This action updates all distribution points and may have an adverse effect on an environment that contains many distribution points.
5. Repeat steps 3 and 4 for all boot images that were previously distributed.

For more information about how to update boot images, see the "How to Manage Boot Images in Configuration Manager” topic on the Microsoft TechNet website.

Administrator console

- 2894539 (http://support.microsoft.com/kb/2894539/) A post-CU3 update is available for System Center 2012 Configuration Manager SP1

The "All Windows RT" and "All Windows RT 8.1 Preview" entries should not appear in the supported platform list for new configuration items.

Application Virtualization

This cumulative update adds support for Microsoft Application Virtualization (App-V) 5.0 Service Pack 2 (SP2). The following issues are seen only in App-V 5.0 SP2 environments earlier than CU4.

- With App-V 5.0 SP2, when a new version of an App-V package supersedes an earlier version, and that earlier version is being used, the package will be listed as not published. Errors that resemble the following are seen in the AppEnforce.log and AppDiscovery.log files

AppEnforce.log:

Publish-AppvClientPackage : A publish operation has been scheduled, pending
the shutdown of all applications in the package or the connection group.
…
Publishing Package is successful but one one of the Virtual Package is currently in use. Close this Virtual Package to get the changes into effect
Performing detection of app deployment type TestApp - Microsoft Application Virtualization 5(ScopeId_0C7279F0-1490-4A0E-A7A3-32A000CEF76D/DeploymentType_d1adf427-ac14-4ee1-9e51-415af7675383, revision 2) for system.

AppDiscovery.log:

Required component [{AppVPackageRoot}]\TestApp.exe is not published

- With App-V 5.0 SP2, App-V packages that are being used cannot be uninstalled. Errors that resemble to the following will appear in the AppEnforce.log file:

CVEWorker::UninstallConnectionGroup() failed

Endpoint Protection

- 2907566 (http://support.microsoft.com/kb/2907556/) November 2013 anti-malware platform update for Endpoint Protection clients

Site Server

- Adding or removing a deployment from a Software Update group results in increased load on the Object Replication Manager component of the SMS Executive service. This can lead to delays in distributing software updates in a hierarchy.

=====

For all the details and download instructions, please see the following:

KB2922875 - Description of Cumulative Update 4 for System Center 2012 Configuration Manager Service Pack 1 (http://support.microsoft.com/kb/2922875)

J.C. Hornbeck| Solution Asset PM | Microsoft GBS Management and Security Division

Get the latest System Center news onFacebookandTwitter:

System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm

Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/

The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/

Consider the following scenario:

You upgrade a Microsoft System Center Configuration Manager site server from System Center 2012 Configuration Manager Service Pack 1 (ConfigMgr 2012 SP1) to System Center 2012 R2 Configuration Manager (ConfigMgr 2012 R2). When you try to deploy Windows 8.1 to a Windows XP-based computer in an update scenario, the deployment fails and you notice that the following error message is logged in the SMSTS.LOG file:

Installing boot image to hard drive TSManager datetime 3048 (0x0BE8)
Backing up existing boot system before trying to set up new boot system TSManager datetime 3048 (0x0BE8)
BootLoader::backup: C:\, C:\_SMSTaskSequence\backup TSManager datetime 3048 (0x0BE8)
BootLoader::restore: C:\_SMSTaskSequence\WinPE, C:\ TSManager datetime 3048 (0x0BE8)
Saving bcd store to C:\_SMSTaskSequence\WinPE\boot\BCD TSManager datetime 3048 (0x0BE8)
Executing command line: "C:\_SMSTaskSequence\WinPE\SMS\bin\i386\bootsect.exe" /NT60 SYS /MBR TSManager datetime 3048 (0x0BE8)
CreateProcess failed. Code(0x800700C1) TSManager datetime 3048 (0x0BE8)
Command line execution failed (800700C1) TSManager datetime 3048 (0x0BE8)
Failed to install boot image.
is not a valid Win32 application. (Error: 800700C1; Source: Windows) TSManager datetime 3048 (0x0BE8)
Failed to install boot image CCR00004.
is not a valid Win32 application. (Error: 800700C1; Source: Windows) TSManager datetime 3048 (0x0BE8)
Failed to reboot the system. Error 0x(800700c1) TSManager datetime 3048 (0x0BE8)
Failed to initialize a system reboot.
is not a valid Win32 application. (Error: 800700C1; Source: Windows) TSManager datetime 3048 (0x0BE8)
Fatal error is returned in check for reboot request of the action (Restart in Windows PE).
is not a valid Win32 application. (Error: 800700C1; Source: Windows) TSManager datetime 3048 (0x0BE8)

For all the details and a link to a hotfix that resolves this issue please see the following:

KB2910552 - You cannot deploy Windows 8.1 to a Windows XP-based computer after you upgrade to System Center 2012 R2 Configuration Manager (http://support.microsoft.com/kb/2910552)

J.C. Hornbeck| Solution Asset PM | Microsoft GBS Management and Security Division

Get the latest System Center news onFacebookandTwitter:

System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm

Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/

The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/

We just released a new ConfigMgr 2007 hotfix addressing the following issue:

The Asset Intelligence synchronization point re-enrolls with the System Center Online service in Microsoft System Center Configuration Manager 2007 every synchronization cycle. This behavior occurs even though the Asset Intelligence synchronization point was previously enrolled successfully. The System Center Online service cannot find the machine-specific certificate for Asset Intelligence in the ALM store even when an apparently valid machine certificate is present. Therefore, an accumulation of machine certificates that are saved in the machine certificate store occurs in the ALM folder.

Additionally, error messages that resemble the following appear in the AIUpdateSvc.log file:

Note These are partial log entries. Other lines that are unrelated to this issue may appear in production log files.

Asset Intelligence Catalog Sync Service Information: 0 : datetime GMT:Sync Now detected
Asset Intelligence Catalog Sync Service Verbose: 0 : datetime GMT:Writing to registry: lastPoll time
Asset Intelligence Catalog Sync Service Information: 0 : datetime GMT:Next scheduled sync time: 02/02/2014 00:00:00
Asset Intelligence Catalog Sync Service Verbose: 0 : datetime GMT:Next scheduled sync is at least another poll interval away.
Asset Intelligence Catalog Sync Service Verbose: 0 : datetime GMT:No retry key found
Asset Intelligence Catalog Sync Service Verbose: 0 : datetime GMT:Reading persisted settings from site server
Asset Intelligence Catalog Sync Service Verbose: 0 : datetime GMT:Reading network settings from registry
Asset Intelligence Catalog Sync Service Verbose: 0 : datetime GMT:Reading proxy server info
Asset Intelligence Catalog Sync Service Information: 0 : datetime GMT:Using proxy: Server=<Your Proxy Server>, Credentials=<Your Credential for Proxy>
Asset Intelligence Catalog Sync Service Information: 0 : datetime GMT:Authentication: Did not find machine certificate in ALM store
Asset Intelligence Catalog Sync Service Information: 0 : datetime GMT:Enrollment Certicate Path is 
Asset Intelligence Catalog Sync Service Verbose: 0 : datetime GMT:Created bootstrap cert from byte array
Asset Intelligence Catalog Sync Service Verbose: 0 : datetime GMT:Key container already exist. CryptAcquireContextW(CRYPT_MACHINE_KEYSET|CRYPT_NEWKEYSET) returns -2146893809
Asset Intelligence Catalog Sync Service Verbose: 0 : datetime GMT:Enrollment string: <Enrollment AccountID="e72756d8-8fe6-4bdd-90cb-31470ef06e18"><HardwareID>VjQtRU5VLVNQMi1TQTUAAAAAAAA=</HardwareID><PublicKey>MIGfMA0QAB</PublicKey></Enrollment>
Asset Intelligence Catalog Sync Service Information: 0 : datetime GMT:Redirected to URL https://sc.microsoft.com/CatalogService/service.svc
Asset Intelligence Catalog Sync Service Verbose: 0 : datetime GMT:
…
Asset Intelligence Catalog Sync Service Verbose: 0 : datetime GMT:Writing to registry FileSeqNo 3
Asset Intelligence Catalog Sync Service Information: 0 : datetime GMT:
=====================Data/Status copied to outbox=====================
Asset Intelligence Catalog Sync Service Verbose: 0 : datetime GMT:Machine Cert updated in ALM store

For additional details and a link to a ConfigMgr 2007 hotfix that resolves this issue please see the following:

KB2911369 - The System Center Online service cannot find the machine-specific certificate for Asset Intelligence in the ALM store in Configuration Manager 2007 (http://support.microsoft.com/kb/2911369)

J.C. Hornbeck| Solution Asset PM | Microsoft GBS Management and Security Division

Get the latest System Center news onFacebookandTwitter:

System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm

Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/

The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/

~ Bryan Xiao

When deploying an operating system to clients using an OS image with either System Center Configuration Manager 2007 (ConfigMgr 2007) or System Center 2012 Configuration Manager (ConfigMgr 2012), even if there's an "Install Software Update" step in the Task Sequence, computers will try to connect to Windows Update to download some updates before initiating the "Install Software Update" step. This is a normal behavior and we can monitor this via Windowsupdate.log by looking for the following entries:

1004 7bc Agent ** START ** Agent: Finding updates [CallerId = AutomaticUpdates]
1004 7bc Agent *********
1004 7bc Agent   * Online = Yes; Ignore download priority = No
1004 7bc Agent * Criteria = "IsInstalled=0 and DeploymentAction='Installation' or IsPresent=1 and DeploymentAction='Uninstallation' or IsInstalled=1 and DeploymentAction='Installation' and RebootRequired=1 or IsInstalled=0 and DeploymentAction='Uninstallation' and RebootRequired=1"
1004 7bc Agent   * ServiceID = {9482F4B4-E343-43B6-B170-9A65BC822C77} Windows Update
1004 7bc Agent   * Search Scope = {Machine}
1004 7bc Setup Checking for agent SelfUpdate

While this behavior is normal, it can potentially introduce a couple of issues:

- If the computers do not have Internet access they will retry the connection several times before proceeding with next action, thus prolonging the overall execution time of the Task Sequence.

- If the computers do have Internet access, this may cause high utilization of the Internet connection if many computers are running the Task Sequence.

Fortunately for us there is a way we can modify this behavior. To suppress the Windows Update Agent until the "Install Software Update" step runs in the Task Sequence, you can use an unattend.xml file to set the "ProtectYourPC" property to "3" in OOBE and add it in the Task Sequence.

Microsoft recommends using Windows System Image Manager (Windows SIM) when creating your unattend.xml file. The Windows System Image Manager technical reference can be found here: http://technet.microsoft.com/en-us/library/cc722301(v=ws.10).aspx

For reference, here is an example of how one such file might look for Windows 7 x86:

<?xml version="1.0" encoding="utf-8"?>
<unattend xmlns="urn:schemas-microsoft-com:unattend">
    <settings pass="oobeSystem">
        <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="x86" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
            <OOBE>
                <ProtectYourPC>3</ProtectYourPC>
            </OOBE>
        </component>
    </settings>
    <cpi:offlineImage cpi:source="catalog://cm12std-sp1/dsources/install_windows 7 enterprise.clg" xmlns:cpi="urn:schemas-microsoft-com:cpi" />
</unattend>

Hope this helps!

Bryan Xiao | Support Engineer | Microsoft

Get the latest System Center news onFacebookandTwitter:

System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm

Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/

The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/

We recently announced a new eBook titled Microsoft System Center: Troubleshooting Configuration Managerthat is free to download. This eBook will provide you with insights and tips on troubleshooting System Center 2012 Configuration Manager drawn from the authors insider knowledge and real-world field experiences. While most of you who are Configuration Manager administrators are fairly comfortable with the product and can perform common management tasks, many of you still have pain points when it comes to certain aspects of how the product works. Based on observations and interactions with customers, the biggest knowledge gaps tend to be in the following areas:

• Troubleshooting common Configuration Manager tasks such as software distribution, software updates, and deployment.
• Understanding how the various components of Configuration Manager on both the server and client side work together when such tasks are performed.
• Dealing with the enormous number of log files that are generated on both the server and client side of Configuration Manager.

This book addresses some of these gaps and pain points. Chapter 1 provides insights into the Configuration Manager architecture and deployment principles. Chapter 2 familiarizes you with some of the key components of Configuration Manager and how they interact with each other when performing common tasks by using verbose logging for tracing the actions of various components. Chapter 3 examines how to troubleshoot various Configuration Manager functionality including software and application deployment, site-to-site replication, software update and patching, operating system deployment, and Mac client issues.

To download Microsoft System Center: Troubleshooting Configuration Manager as well as many other free eBooks on System Center 2012 and other Microsoft technologies, visit http://www.microsoftvirtualacademy.com/ebooks#?fbid=ydq1Md_7vrB.

J.C. Hornbeck| Solution Asset PM | Microsoft GBS Management and Security Division

Get the latest System Center news onFacebookandTwitter:

System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm

Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/

The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/

We recently announced a new eBook titled Microsoft System Center: Configuration Manager Field Experience that is free to download. The purpose of this book is to provide System Center 2012 Configuration Manager administrators with helpful and tested real-world guidance from consultants and product experts at Microsoft. We want you to get the most out of using Configuration Manager in your environment regardless of whether the task at hand is querying the Configuration Manager database for system information, creating and customizing reports or deploying operating system images to client machines. The book is divided into the following three parts:

Part 1: WMI for System Center Configuration Manager 2012 administrators is designed to familiarize you with basic WMI concepts and tools, show you how to use WMI classes to create Configuration Manager queries, and help you understand the underlying database design of Configuration Manager so you can create custom reports for querying the information you need.

Part 2: System Center 2012 Configuration Manager Reporting is designed to familiarize you with SSRS and show you how to integrate SSRS with Configuration Manager 2012 and to customize and create new reports using SSRS.

Part 3: Configuration Manager Deployment Tips provides tips that cover a wide variety of different scenarios to help you ensure the success of your deployments.

To download Microsoft System Center: Configuration Manager Field Experience as well as many other free eBooks on System Center 2012 and other Microsoft technologies, visit http://www.microsoftvirtualacademy.com/ebooks#?fbid=ydq1Md_7vrB.

J.C. Hornbeck| Solution Asset PM | Microsoft GBS Management and Security Division

Get the latest System Center news onFacebookandTwitter:

System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm

Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/

The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/

~ Clint Koenig

Hi everyone, Clint Koenig here with a quick support tip for you. We’ve seen this issue a few times now and it can be easy to hit so if any of you happen to run across it then this will hopefully show you how to get things working again.

PROBLEM:

SMSExec crashes and prevents deployments from successfully being sent out. If you look in crash.log you’ll see entries similar to the following:

EXCEPTION INFORMATION
Time =
Service name = SMS_EXECUTIVE
Thread name = SMS_DISTRIBUTION_MANAGER
Executable = C:\Program Files\Microsoft Configuration Manager\bin\x64\smsexec.exe
Process ID = 2636 (0xa4c)
Thread ID = 5052 (0x13bc)
Instruction address = 00007FFA2157AB78
Exception = eeeeffff (EXCEPTION_SMS_FATAL_ERROR)
Description = "Invalid params exception was raised. Expression is: []. function [], File [] Line [0]."
Raised inside CService mutex = No

Typically, you’ll see some failure in the distmgr.log, indicating why a package may be in a retry condition:

Distmgr thread 5052
Attempting to add or update a package on a distribution point.
STATMSG: ID=2342 SEV=I LEV=M SOURCE="SMS Server" COMP="SMS_DISTRIBUTION_MANAGER" SYS=<SiteServerName> SITE=<Sitecode> PID=2636 TID=5052 GMTDATE=<Date/Time> ISTR0="<Description>" ISTR1="["Display=\\<DPServerName>\"]MSWNET:["SMS_SITE=<Sitecode>"]\\<DPServerName>\" ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=2 AID0=400 AVAL0="<PackageID>" AID1=404 AVAL1="["Display=\\<DPServerName>\"]MSWNET:["SMS_SITE=<Sitecode>"]\\<DPServerName>\"
The current user context will be used for connecting to ["Display=\\<DPServerName>\"]MSWNET:["SMS_SITE=<Sitecode>"]\\<DPServerName>\.~
Failed to make a network connection to \\<DPServerName>\ADMIN$ (0x35).~
~Cannot establish connection to ["Display=\\<DPServerName>\"]MSWNET:["SMS_SITE=<Sitecode>"]\\<DPServerName>\. Error = 53

CAUSE:

This is a known issue that can occur if a sites Maximum Number of Retries (under Administration -> Site Configuration -> Sites -> Right Click Site -> Configure Site Components -> Software Distribution -> Maximum Number of Retries) setting is modified to a value lower than the current retry count for a failing package.

NOTEThe default value is 100

When this happens, SMS Executive may crash in the Distribution Manager thread. The crash occurs because ConfigMgr doesn’t correctly handle the case where the current package retry count is more than the max retry count and a package distribution error is encountered.

The current retry count for an individual package is stored in the Number of Retries value in the following Registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SMS\Components\SMS_DISTRIBUTION_MANAGER\Retry History\<PackageID>

For example:

Forced Disconnect =
Last Retry = 1391793343
Number of Retries = 45
Package Priority = 2

RESOLUTION:

This is a known issue in System Center 2012 R2 Configuration Manager and an update is being investigated. More information will be posted as it becomes available.

As a workaround, return the Maximum Number of Retries value to the previous setting (100 by default). To ensure that you do not encounter this issue, if the Maximum Number of Retries value must be lowered then make sure that there are no packages in a retry condition before doing so.

Clint Koenig| Senior Support Escalation Engineer | Microsoft GBS Management and Security Division

Get the latest System Center news onFacebookandTwitter:

System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm

Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/

The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/