Installing Configuration Manager 2012 clients on all my servers was fairly easy and straight forward. With one exception – My TMG2010 server running Server 2008R2.
For some reason, the client would install, but would never assign itself to my site, or download policies. The firewall rules allowed it to talk to the ConfigMgr server, and monitoring the traffic showed nothing was being blocked at all.
Much digging in TechNet etc and I found various mentions relating to certificates. This put me on the right track and got me 80% of the way there, but not quite.
There was not a lot of indication of what was going wrong. Most of the logs just weren’t reporting anything, let alone an error. The one log that was showing something is the “ClientIDManagerStartuplog” with repeating entries of
Various articles say to delete all the files in the MachineKeys certificates folder. That is VERY BAD, DO NOT DO THAT!
While they are misguided, they do point to the correct resolution. Some suggest deleting one specific file which is the SMS certificate. At first, permissions blocked me doing this, but even after deleting it, the problem would repeat.
On a working machine, this is what you see:
But on the machine that doesn’t work, it looks like this:
For some reason, the Network Service is being given permissions. The SMS Agent service runs using the Local System account, so that explains why it works on the Good machine. Perhaps this is due due to some “hardening” permissions that TMG has applied to the certificates folder.
For some reason, the client would install, but would never assign itself to my site, or download policies. The firewall rules allowed it to talk to the ConfigMgr server, and monitoring the traffic showed nothing was being blocked at all.
Much digging in TechNet etc and I found various mentions relating to certificates. This put me on the right track and got me 80% of the way there, but not quite.
There was not a lot of indication of what was going wrong. Most of the logs just weren’t reporting anything, let alone an error. The one log that was showing something is the “ClientIDManagerStartuplog” with repeating entries of
RegTask: Failed to get certificate. Error: 0x80004005This was the only place I could find an indication of what was wrong.
Various articles say to delete all the files in the MachineKeys certificates folder. That is VERY BAD, DO NOT DO THAT!
While they are misguided, they do point to the correct resolution. Some suggest deleting one specific file which is the SMS certificate. At first, permissions blocked me doing this, but even after deleting it, the problem would repeat.
SOLUTION
It turns out that for some reason the permissions being applied to the certificate are wrong. Deleting and recreating just put the wrong permissions on again.On a working machine, this is what you see:
For some reason, the Network Service is being given permissions. The SMS Agent service runs using the Local System account, so that explains why it works on the Good machine. Perhaps this is due due to some “hardening” permissions that TMG has applied to the certificates folder.
- Browse to the directory with the certificate files – C:\Users\All Users\Microsoft\Crypto\RSA\MachineKeys
- Right click the file name starting with “19c5cf9c7b5dc9….” and open properties
- Click the Security Tab
- Click Edit
- Click “Locations” and change to the local computer
- Add – SYSTEM – Full Control
- Add – Administrators – Leave the default “Read” permissions
- Click OK, and OK again to close the file properties
- Open Services and restart the “SMS Agent” Service
- Watch the C:\Windows\CCM\Logs\ClientIDManagerStartup.log” file
- You should also see the client assignment working in the “ClientLocation.log” file
Give it a few minutes, and it should all appear in the ConfigMgr console.
No comments:
Post a Comment