Configuration Manager Internet Clients and Native Mode Forum

native mode sccm client appears not to be using right certificate.

Thu, 19 Nov 2009 21:06:33 Z

I presently have a few computers that have multiple certs in the personal store. But i also have a cert that coresponds to the sccm but it seems that my client is using a different cert that has been expired but for other reasons(being and edge exchange 2007 server)it can not be moved or deleted. any help would be greatly appreciated.

![LOG[Certificate issued to 'EDGE103' has expired.]LOG]!><time="15:47:32.379+300" date="11-19-2009" component="ClientIDManagerStartup" context="" type="3" thread="3832" file="ccmcert.cpp:962">
<![LOG[Certificate issued to 'EDGE103' has expired.]LOG]!><time="15:47:32.379+300" date="11-19-2009" component="ClientIDManagerStartup" context="" type="3" thread="3832" file="ccmcert.cpp:962">
<![LOG[Raising event:

instance of CCM_ServiceHost_CertRetrieval_Status
{
    DateTime = "20091119204732.379000+000";
    HRESULT = "0x80040282";
    ProcessID = 1904;
    ThreadID = 3832;
};
]LOG]!><time="15:47:32.379+300" date="11-19-2009"

Machines downloading policy but not returning hardware/software reports

Mon, 14 Sep 2009 20:28:14 Z

I have a strange issue occurring in my system right now where machines are downloading and receiving policy, but aren't returning hardware and software reports. About half of my machines are returning hardware and software reports. The machines are all imaged the same way, so I don't understand whats going on. At first, I thought these machines weren't downloading policy, but just for testing purposes, I created an advertisement for one that wasn't reporting sw/hw and within minutes it "Accepted" the mandatory advertisement. This tells me its receiving policy - please correct me if I'm wrong.

What could cause this? Some of the machines not reporting have been in the field well over a month and have had plenty of time to upload the reports.

Internet only based workgroup clients won't install and Site Server signing certificate has the wrong OID value...

Fri, 20 Nov 2009 01:58:21 Z

I've come in to help out with a SCCM 2007 site where there were a few problems left after the installation was completed. Primarily I was called in to get Internet only workgroup systems installed as SCCM 2007 clients. The site is already in native mode and there is a subordinate CA and an Internet MP residing in the DMZ.

Let's put the internet clients aside for a minute...

In trying to research why the internet clients won't install I found that the OID value entered into the CA template for the Site Server signing certificate is wrong, in fact I can't find the number anywhere on the internet.

I've followed this article to ensure that the other certificates are correct and that the Site Server signing certificate is wrong: http://technet.microsoft.com/en-us/library/bb680733.aspx

I've also found this problem, and while the solution sounds workable I am not sure as I've never had to replace a signing certificate. http://social.technet.microsoft.com/Forums/en-US/configmgribcm/thread/74abda47-33a0-4e0c-9516-eed2dc301ba5

So what will I run into when I replace the signing certificate with one that has the correct OID information in it? Is it likely that this problem also is part of why I cannot get my internet based clients up and running?

Now back to the internet based clients...

I have the Site Server signing certificate exported so that I can include it with the client install for the internet clients. Also, currently there are no clients installed and running as internet only.

Good news first. We built a machine on the intranet and made it a part of AD, confirmed that the SCCM client was functional then moved the machine to the internet. Once it was on the internet we initiated a HINV and verify that the inventory came back to the SCCM dB before we moved the system back to the intranet. So we know that the MP is working, well at least to me that means the MP is working.

For the internet clients, we are manually requesting a Client Authentication certificate from the subordinate CA in the DMZ (via the /certsrv website), approving the certificate, then retrieving it from the website.

After the certificate is received we install the SCCM client using the following command via a batch file.

ccmsetup.exe /source:C:\mylocalfolder /native:CRL CCMHOSTNAME=INETMPFQDN.domain.com SMSSIGNCERT=C:\mylocalfolder\SiteSignCert.cer SMSSITECODE=XYZ FSP=INETMPFQDN.domain.com CCMALWAYSINF=1

Here are a few things that I've already found and corrected:

The Subordinate CA did not have an internet accessible CRL or AIA, this was corrected and verified with Certutil - URL.
The OID originally used for the internet client certificates was wrong, actually it was the same OID used for the Site signing certificates.

And here is what I have in log files...

IIS W3SVC1 log from the internet MP (i've only included the relevant entries for my test system):

2009-11-19 19:02:00 W3SVC1 10.100.1.21 GET /sms_mp/.sms_aut mplist 443 - 71.71.194.84 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1) 403 7 64
2009-11-19 19:13:43 W3SVC1 10.100.1.21 POST /SMS_FSP/.sms_fsp - 80 - 71.71.194.84 SMS+FSP 200 0 0
2009-11-19 19:13:59 W3SVC1 10.100.1.21 POST /SMS_FSP/.sms_fsp - 80 - 71.71.194.84 ccmhttp 200 0 0

ClientLocation.log

Client assigned to site 'XYZ' ClientLocation 11/19/2009 2:13:46 PM 316 (0x013C)

GetCurrentManagementPointEx ClientLocation 11/19/2009 2:14:02 PM 4008 (0x0FA8)

Current Management Point is INETMPFQDN.domain.com with version 0 and capabilities: . ClientLocation 11/19/2009 2:14:02 PM 4008 (0x0FA8)

ClientIDManagerStartup.log

RegTask: Client is not registered. Sending registration request... ClientIDManagerStartup 11/19/2009 2:24:03 PM 2168 (0x0878)

RegTask: Failed to send registration request message. Error: 0x80040231 ClientIDManagerStartup 11/19/2009 2:24:03 PM 2168 (0x0878)

RegTask: Failed to send registration request. Error: 0x80040231 ClientIDManagerStartup 11/19/2009 2:24:03 PM 2168 (0x0878)

LocationServices.log

Sending Fallback Status Point message, STATEID='500'. LocationServices 11/19/2009 2:13:41 PM 316 (0x013C)

Processing pending site assignment. LocationServices 11/19/2009 2:13:46 PM 316 (0x013C)

Assigning to site 'XYZ' LocationServices 11/19/2009 2:13:46 PM 316 (0x013C)

LSVerifySiteVersion : Verifying Site Version for <XYZ> LocationServices 11/19/2009 2:13:46 PM 316 (0x013C)

LSVerifySiteVersion: Client is on Internet Enabled - skipping version verification. LocationServices 11/19/2009 2:13:46 PM 316 (0x013C)

Sending Fallback Status Point message, STATEID='700'. LocationServices 11/19/2009 2:13:46 PM 316 (0x013C)

Unknown task LSProxyMPModificationTask in non-quarantine - ignoring. LocationServices 11/19/2009 2:13:46 PM 1124 (0x0464)

Successfully processed pending site assignment. LocationServices 11/19/2009 2:13:46 PM 316 (0x013C)

Security settings update detected, restarting CcmExec. LocationServices 11/19/2009 2:13:46 PM 3764 (0x0EB4)

Successfully stored new site signing certificate... LocationServices 11/19/2009 2:13:46 PM 316 (0x013C)

Name : The site code of this site server is XYZ LocationServices 11/19/2009 2:13:46 PM 316 (0x013C)

Sha1 Hash : xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx LocationServices 11/19/2009 2:13:46 PM 316 (0x013C)

Valid From: 2009-11-09, 21:27 LocationServices 11/19/2009 2:13:46 PM 316 (0x013C)

Valid To : 2010-11-09, 21:27 LocationServices 11/19/2009 2:13:46 PM 316 (0x013C)

LSGetManagementPointForSite: Client is always on Internet - skipping AD look up. LocationServices 11/19/2009 2:13:46 PM 316 (0x013C)

Failed to retrieve AMP for site code 'XYZ' with error (0x80004005). Nulling existing entry in WMI LocationServices 11/19/2009 2:13:46 PM 316 (0x013C)

Persisted Default Management Point Location locally LocationServices 11/19/2009 2:13:46 PM 316 (0x013C)

Failed to reset certificate request times. (0x80041002) LocationServices 11/19/2009 2:13:46 PM 316 (0x013C)

Security settings update detected, restarting CcmExec. LocationServices 11/19/2009 2:13:46 PM 3764 (0x0EB4)

Security settings update detected, restarting CcmExec. LocationServices 11/19/2009 2:13:46 PM 1712 (0x06B0)

No security settings update detected. LocationServices 11/19/2009 2:13:46 PM 316 (0x013C)

LSGetManagementPointForSite: Client is always on Internet - skipping AD look up. LocationServices 11/19/2009 2:13:57 PM 2168 (0x0878)

Failed to retrieve AMP for site code 'XYZ' with error (0x80004005). Nulling existing entry in WMI LocationServices 11/19/2009 2:13:57 PM 2168 (0x0878)

Persisted Default Management Point Location locally LocationServices 11/19/2009 2:13:57 PM 2168 (0x0878)

CCMExec.log

The 'Certificate Store' is empty in the registry, using default store name 'MY'. CCMEXEC 11/19/2009 2:13:57 PM 2168 (0x0878)

Raising event:

instance of CCM_ServiceHost_CertRetrieval_Status

{

DateTime = "20091119191357.477000+000";

HRESULT = "0x00000000";

ProcessID = 2064;

ThreadID = 2168;

};

CCMEXEC 11/19/2009 2:13:57 PM 2168 (0x0878)

[CCMHTTP] AsyncCallback(): ----------------------------------------------------------------- CCMEXEC 11/19/2009 2:14:02 PM 2168 (0x0878)

[CCMHTTP] AsyncCallback(): WINHTTP_CALLBACK_STATUS_SECURE_FAILURE Encountered CCMEXEC 11/19/2009 2:14:02 PM 2168 (0x0878)

[CCMHTTP] : dwStatusInformationLength is 4

CCMEXEC 11/19/2009 2:14:02 PM 2168 (0x0878)

[CCMHTTP] : *lpvStatusInformation is 0x1

CCMEXEC 11/19/2009 2:14:02 PM 2168 (0x0878)

[CCMHTTP] : WINHTTP_CALLBACK_STATUS_FLAG_CERT_REV_FAILED is set

CCMEXEC 11/19/2009 2:14:02 PM 2168 (0x0878)

[CCMHTTP] AsyncCallback(): ----------------------------------------------------------------- CCMEXEC 11/19/2009 2:14:02 PM 2168 (0x0878)

Raising event:

instance of CCM_CcmHttp_Status

{

DateTime = "20091119191402.547000+000";

HostName = "INETFQDN.domain.com";

HRESULT = "0x80072f8f";

ProcessID = 2064;

StatusCode = 1;

ThreadID = 2168;

};

CCMEXEC 11/19/2009 2:14:02 PM 2168 (0x0878)

Failed in WinHttpSendRequest API, ErrorCode = 0x2f8f CCMEXEC 11/19/2009 2:14:02 PM 2168 (0x0878)

[CCMHTTP] HTTP ERROR: URL=http://INETMPFQDN.domain.com/ccm_system/request, Port=443, Protocol=https, SSLOptions=63, Code=12175, Text=ERROR_WINHTTP_SECURE_FAILURE CCMEXEC 11/19/2009 2:14:02 PM 2168 (0x0878)

HandleRemoteSyncSend failed (0x80040231). CCMEXEC 11/19/2009 2:14:02 PM 2168 (0x0878)

CForwarder_Sync::Send failed (0x80040231). CCMEXEC 11/19/2009 2:14:02 PM 2168 (0x0878)

CForwarder_Base::Send failed (0x80040231). CCMEXEC 11/19/2009 2:14:02 PM 2168 (0x0878)

One last thing, there is no MP_RegistrationManager.log on the internet MP yet...

Well I believe that is about it any help would be greatly appreciated!

-Jake Cohen

Problem with machines moving into and out of the domain

Tue, 24 Nov 2009 20:47:49 Z

I'm having a problem with some laptops that were recently imaged onto the domain (with certs, client configured for LAN, etc.) for a two-day training class and then re-imaged with our external, non-domain image (with certs, client configured for IBCM, etc.). It seems that when they're imaged to the domain, they register with the SCCM server with no problems, send in hardware scans, etc., but then when they're re-imaged again with an external image, they don't seem to overwrite the "domain version". So, I end up with either the old "domain version" of the machine in the SCCM database or two machines with the same system name but one on the domain and the other in a workgroup. The computer account will not be removed automatically until it hasn't contacted the domain in 90 days. Is SCCM supposed to be able to manage machines that are moved to and from the domain or should I have deleted the computer account in both AD and SCCM before re-imaging them to be used on a workgroup via IBCM?

Thanks

Possible incorrectly named certificate on the Internet facing site system

Wed, 04 Nov 2009 11:46:43 Z

This is an extension to the question I asked earlier. I think the problem I have is related to certificates as I am now getting some other errors.

In the mpcontrol log, I have an error about certificates not being in the MY store. Resolved that, but now I get these:

The 'Certificate Selection Criteria' was not specified, counting number of certificates present in 'MY' of 'Local Computer' store.    SMS_MP_CONTROL_MANAGER    04/11/2009 11:01:18    4012 (0x0FAC)

The 'MY' of 'Local Computer' store has 2 certificate(s).~Using custom selection criteria based on the machine name.    SMS_MP_CONTROL_MANAGER    04/11/2009 11:01:18    4012 (0x0FAC)

Machine name is '2k3internet'.    SMS_MP_CONTROL_MANAGER    04/11/2009 11:01:18    4012 (0x0FAC)

There are no certificate(s) that meet the criteria.    SMS_MP_CONTROL_MANAGER    04/11/2009 11:01:18    4012 (0x0FAC)

Performing machine FQDN to SAN2 search.    SMS_MP_CONTROL_MANAGER    04/11/2009 11:01:18    4012 (0x0FAC)

Certificate doesn't have SAN2 extension.    SMS_MP_CONTROL_MANAGER    04/11/2009 11:01:18    4012 (0x0FAC)

Found a certificate with subject name as ‘sccm-ent.SCCM_ENT.local’, but will continue to look for the certificate with subject name as ‘2k3internet’.    SMS_MP_CONTROL_MANAGER    04/11/2009 11:01:18    4012 (0x0FAC)

Using custom selection criteria based on the machine NetBIOS name.    SMS_MP_CONTROL_MANAGER    04/11/2009 11:01:18    4012 (0x0FAC)

Machine name is '2K3INTERNET'.    SMS_MP_CONTROL_MANAGER    04/11/2009 11:01:18    4012 (0x0FAC)

There are no certificate(s) that meet the criteria.    SMS_MP_CONTROL_MANAGER    04/11/2009 11:01:18    4012 (0x0FAC)

Call to HttpSendRequestSync failed for port 443 with an error code.    SMS_MP_CONTROL_MANAGER    04/11/2009 11:01:18    4012 (0x0FAC)

Successfully performed Management Point availability check against local computer.    SMS_MP_CONTROL_MANAGER    04/11/2009 11:01:18    4012 (0x0FAC)

Initialization still in progress.    SMS_MP_CONTROL_MANAGER    04/11/2009 11:01:18    4012 (0x0FAC)

The plot thickens. In the mpretry log, I've gone from this:

Hinv Retry: ******************* Start of Task *********************    RetryManager    04/11/2009 11:07:28    2788 (0x0AE4)
CMPDBConnection::Init(): IDBInitialize::Initialize() failed with 0x80004005    RetryManager    04/11/2009 11:08:31    2788 (0x0AE4)
=======================================    RetryManager    04/11/2009 11:08:31    2788 (0x0AE4)

MPDB ERROR - CONNECTION PARAMETERS
SQL Server Name     : SCCM-ENT
SQL Database Name   : SMS_SC0
Integrated Auth     : True

MPDB ERROR - EXTENDED INFORMATION
MPDB Method         : Init()
MPDB Method HRESULT : 0x80004005
Error Description   : [DBNETLIB][ConnectionOpen (Connect()).]SQL Server does not exist or access denied.
OLEDB IID           : {0C733A8B-2A1C-11CE-ADE5-00AA0044773D}
ProgID              : Microsoft OLE DB Provider for SQL Server

MPDB ERROR - INFORMATION FROM DRIVER
Native Error no. : 17
Error State       : 1
Class (Severity) : 16
    RetryManager    04/11/2009 11:08:31    2788 (0x0AE4)
=======================================
    RetryManager    04/11/2009 11:08:31    2788 (0x0AE4)
Hinv Retry: IMPDBConnection::Init() for class failed.    RetryManager    04/11/2009 11:08:31    2788 (0x0AE4)

To this:

Hinv Retry: ******************* Start of Task *********************    RetryManager    04/11/2009 11:18:31    2176 (0x0880)
Hinv Retry: Loaded class definition map; DB policy timestamp: 2009-05-27 21:56:17.597    RetryManager    04/11/2009 11:18:36    2176 (0x0880)
Hinv Retry: Normalized DB policy timestamp: 20090527215617.000000+000.    RetryManager    04/11/2009 11:18:36    2176 (0x0880)
Hinv Retry: Looking for retry files in C:\SMS\mp\outboxes\hinv.box\retry\*.hml    RetryManager    04/11/2009 11:18:36    2176 (0x0880)
Hinv Retry: no files found in the HINV retry directory    RetryManager    04/11/2009 11:18:36    2176 (0x0880)
Hinv Retry: ******************* End of Task *********************    RetryManager    04/11/2009 11:18:36    2176 (0x0880)

Not sure how, but I'm happy so far.

The error in the MPControl log is as at the beginning which suggests that the certificate is wrong.

However, the Internet facing machine isn't in the same domain so the certificate that I brought over (the Web and Client) originates from the domain/machine as the Primary server. As a result, the name is incorrect, which I assume is why I get this:

Found a certificate with subject name as ‘sccm-ent.SCCM_ENT.local’, but will continue to look for the certificate with subject name as ‘2k3internet’. SMS_MP_CONTROL_MANAGER 04/11/2009 11:01:18 4012 (0x0FAC)

What do I need to check or do as I can't find anything anywhere to help...

Internet based site server connection problem

Wed, 04 Nov 2009 09:44:11 Z

I hope this is a simple one (!).....

I'm doing internet based management which, I'm sure has been done by someone here nicely.

However, in my test environment, my MP, DP and SUP site server isn't working properly. The Primary server is in Domain "A" and the site system is, currently, in a workgroup - in my live environment, like my test environment, there will be no trust between the two as the internet facing component is in a DMZ and the firewall will allow the relevant traffic. The Site is also in Native mode and the certificates are, I believe, set up properly and placed on both the Primary and the site server (the site server has the certificates in the relevant stores for IIS and for the MP)

My site server is showing these errors in the MP_Retry log file:

MPDB ERROR - CONNECTION PARAMETERS
SQL Server Name     : SCCM-ENT
SQL Database Name   : SMS_SC0
Integrated Auth     : True

MPDB ERROR - EXTENDED INFORMATION
MPDB Method         : Init()
MPDB Method HRESULT : 0x80004005
Error Description   : [DBNETLIB][ConnectionOpen (Connect()).]SQL Server does not exist or access denied.
OLEDB IID           : {0C733A8B-2A1C-11CE-ADE5-00AA0044773D}
ProgID              : Microsoft OLE DB Provider for SQL Server

MPDB ERROR - INFORMATION FROM DRIVER
Native Error no. : 17
Error State       : 1
Class (Severity) : 16

Which I would expect as the site server does not, as yet, have rights back to the Primary server.

To complicate things, the Primary server (due to limited resources) is also a DC but I don't think that's the cause of the problem.

My question really is - How do I allow the Site system to talk back to the Primary?

Scenario 3 with SQL Server Replica - setup guide or how to

Mon, 09 Nov 2009 17:37:40 Z

I'm in the process of implementing Scenario 3 with SQL Server Replica in the DMZ server interent clients and am getting stuck implementing. http://technet.microsoft.com/en-us/library/bb694250.aspx

Architecture

central site with secondary’s and a primary child with secondaries. Central site and child primary both have clients reporting directly to them, I would like to setup the DMZ server to serve all internet clients, but I can have another DMZ server for the other sites internet clients.

PKI is inplace internally and passes native mode test.

The DMZ is off the central site in a firewalled segment DMZ and I have AD, SQL and prerequisites installed.

Next steps:

1. create a SQL replica from the central site to the DMZ server in SQL ?? then??
2. ?
3. ?

Thanks for any help

SCCM (configmgr) 2007 Native Mode Client Install Fails on SCVMM and Hyper-V Hosts due to Certificate Error

Thu, 05 Nov 2009 20:53:18 Z

Hello.
I'm running configmgr 2007 with SP2 RTM and the R2 components. Using native mode and the software update point as the client install mehod fails on my VMM 08 R2 server. It also fails on all of my Server 2008 R2 hyper-v hosts. The cause of the failure is that when the client installer looks for the client certificates it uses the first one that matches, as configured under site properties. The problem there is that the first cert to match is the self-signed certificate from VMM, named SCVMM_CERTIFICATE_KEY_CONTAINER<fqdn of hyper-v host>.

Is this a known issue?

Are there any known workarounds?

So far the answer has been to uninstall the VMM certificate from the store. I haven't seen any adverse affects from this yet, but I assume the VMM server/client install puts it there for a reason.

SCCM Client Installation (installed but now showing up)

Fri, 01 Aug 2008 12:48:32 Z

Hey everyone,

Thanks in advance for taking the time and reading about my situation.

I had previously set up SCCM back when it first came out, but due to so many problems i first had and the lack of time i decided to uninstall. I was previously in mixed mode and clients were installed and setup properly.

I was able to push software packages and so on.

Recently i decided to go back into sccm, so i set myself up in native mode this time on a sql cluster

So here is the deal, i tried doing a push installation to my systems with the ccmhttpsstate=1 parameter i think it was

ccmsetup.log doesnt show any problems, says needs a reboot so i rebooted my systems.

but they dont show up as "Client = yes" in my collections, it still assigned but with no client

when i look on a system in control panel for the config manager settings, i see that it is installed (possibly from previous sccm installation back in the day) but it is properly configured as well, i see the correct site code, i re-do a manually discovery for the site code and it says im already assigned to it.

So why does it not show up as installed in my collection?

Remote Tools Available Outside of Local Network

Thu, 05 Nov 2009 21:12:09 Z

Is it possible to install the SCCM Client on, say a laptop that is used outside of our network and be able to use Remote Tools to assist them? We have multiple users that go to conferences and travel in general, is it possible to use Remote Tools with them. These users can have VPN access giving them an IP on the same subnet as the SCCM server. These laptops are not on our domain, just their local workgroup.

I have installed the client using “CCMSetup.exe /native CCMALWAYSINF=1 CCMHOSTNAME=SERVER.CONTOSO.COM SMSSITECODE=ABC”, while being connected to our VPN and not. The client computer says it was successful in installing, I just do not see the client in any collection.

New client installs no longer communicating with MP and not pulling policy

Tue, 27 Oct 2009 14:11:48 Z

Good morning,

All of a sudden when new clients are being installed, they are not communicating with the MP or SLP properly (I can't really tell which). For example I am using a GPO startup script to install the SCCM client with the appropriate parameters. The client is installed fine but it does not look like any of the parameters took. In the general tab it shows "unknown" for ConfigMgr Connection Type and Site Mode. The site code does not appear in the "Advanced" tab and the actions tab only shows "Machine Policy Retrieval & Evaluation Cycle" and "User Policy Retrieval & Evaluation Cycle". The "Components" tab shows all installed, but none show enabled for the various components. When I initiate a user and machine policy cycle, nothing happens.

Nothing has changed from my end as far as I know. The group policy is still the same and as far as I know nothing has changed with the domain. I can't see any obvious errors in the logs on the SCCM server. Does anyone know what I can check to try and see why this stopped working? It seems that any new clients aren't working properly. Thanks.

IBCM Problems...

Tue, 11 Aug 2009 12:20:12 Z

I had an issue where I needed to work on my certificate server a few days ago and after ironing out all the issues, I re-deployed certificates to most machines. One that I forgot to re-deploy until yesterday was the Site Server Signing Cert to the Central Site Server. Several machines had been imaged, talked to the MP at least long enough to download the Signing Cert and then sent to the field. I wasn't getting reports from any of the machines. I re-deployed a new signing cert to the Central Site server, but it seems to be causing problems with machines in the field downloaded the updated cert.

I have just deployed a handful of laptops with an IBCM-only configuration to the field and I'm only hearing back from a handful of them. These machines have a proxy configured in IE for internet browsing, but I wouldn't think that would affect the agent. On some machines I'm getting full reports, on others, I'm only getting software inventories and on others I'm getting them to show up in the collection, but when I go into resource explorer, I have no data. On my DMZ-based MP, for one of the machines that I'm getting a software inventory but no hardware inventory, under the MP_Status.log, I got one "SMS_ServiceHost_CertificateOperationsFailure" for it, a "DPBITSConfigDeleted", a couple "SMS_PolicyAgent_PolicyMismatch" events, then a bunch of "SMS_PolicyAgent_BitsPolicyDownloadFailed", and lastly another "SMS_PolicyAgent_PolicyMismatch" event.

For one of the machines that I've gotten nothing from, at first I had a bunch of alternating "SMS_RemoteClient_SiteSigning_AuthFailure_Trust" and "SMS_PolicyAgent_PolicyAuthorizationFailure" events, but now I'm just getting a bunch of "SMS_PolicyAgent_BitsPolicyDownloadFailed" events and one "SMS_PolicyAgent_PolicyMismatch" event.

All of the machines I'm having problems with are showing up in the MP_Status.log on the DMZ MP with either the "SMS_PolicyAgent_BitsPolicyDownloadFailed" and/or "SMS_PolicyAgent_PolicyAuthorizationFailure".

Thanks in advance.

Computer name and cert validity question

Tue, 03 Nov 2009 17:12:06 Z

If I image a machine that uses a script using certreq.exe and certutil.exe to automatically request and install its client and trusted root certs, and later on the computer name changes, will that computer lose the ability to download policy since the hostname no longer matches the subject name on the client certificate?

I would think it would, but I have a client that seems to be downloading policy anyway... any ideas?

IBCM Fall-Back Status Point work for Intranet too?

Tue, 20 Oct 2009 13:37:33 Z

I was curious, if I setup a fallback status point on my IBCM server can my intranet clients also use the same server or should I have a fallback status point in both my intranet and perimiter network?

native install client being used for updates

Thu, 15 Oct 2009 21:25:17 Z

hi everyone,

we have installed the sccm sp2 in native mode all the computers have been reconized by sccm and have been put into the right site.
I have recently been asked to use SCCM to update our computers from our original wsus sp2. I have went in and created the management point and update point and have no erros. I have also went in and installed the wsup for some other catalogue files we need. The problem comes from when i go in and modify the clients to point to the SCCM server for updates in the registry and if there is anythng else i need to look for.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\windows\WindowsUpdate]
"WUServer"="https://SCCM101.happy.NET:443"
"WUStatusServer"="https://SCCM101.happy.NET:443"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\windows\WindowsUpdate\AU]
"UseWUServer"=dword:00000001

make additonal server exchange to master mail server ?

Tue, 27 Oct 2009 21:34:58 Z

I need to convert the additional exchange 2003 to master ?

Native mode clients downloading via BITS is it always encrypted traffic

Wed, 21 Oct 2009 19:01:05 Z

Customer has SCCM 2007 SP1 in native mode deployed. They have Cisco WAAS devices in some remote locations(not WoWaas). It is their understanding that the WAAS devices are not caching the SCCM download packages because the data is encrypted. They want to use the WAAS devices(no peer DP's, etc). If we created protected DPs without web certs .... would the client download via BITS in an unecrypted manor? Or can you change the IIS config on the site servers DP web shares?
Thanks
Tim

Some Clients Not Accepting PKI Certificate for Native Mde

Sat, 26 Sep 2009 12:01:09 Z

I realize that the PKI implentation is outside the scope of this formum, but thought I would post this in hopes that someoine else might have had this problem and provide some guidance on a resolution.
I am in the process of readying my SCCM environment for switching to native mode from mixed mode. I have used the "Step-By-Step Example Deployment of the PKI Certificates Required for Configuration Manager Native Mode Windows Server 2008 Certification Authority" to setup my environment for issuing PKI certificates as part of the preparation to making the switch to native mode. When I run the report "Summary information of clients capable of native mode communication" I have four laptops that fall into the classification of "Native Mode Incapable Clients" and show an error code of -2147220864 , which I believe translates to "A valid certificate was not found in the certificate store".
When I use the "Certificates" MMC snap-in to check the certificate store, there are not any certificates listed under "personal/certificates" as there is for all of the other PC's in my environment.
The commonality amongst these four laptpos are that they are all new Lenovo T500 laptops. They are in the same orgainzational unit as other PC's that do auto accept the PKI certificates. The event logs on the PC's do not show any errors.
Thanks in advance for anyone that might make a suggestion on how to further troubleshoot this problem and/or provide a work-around on getting the needed certificate installed.

Can my clients renwew or extend their certificates?

Fri, 02 Oct 2009 13:06:12 Z

Greetings,

I should have made my certificate validity longer than the default. I have plenty of time until my client's certificates expire. However, can I extend the exisiting certificate in any way? Can I renew it right now instead of waiting until February? or do I have to create a new certificate for my clients and the two can co-exisit on a machine? Thanks for the help.

SCCM Native Mode broken after CA migration from 2003 >> 2008

Mon, 12 Oct 2009 18:05:47 Z

Last week, our CA was migrated from 2003 to 2008 server. Now, SCCM isn't working properly. Specifically, getting the following errors in mpcontrol.log

CryptVerifyCertificateSignatureEx returned error 0x80090006.    SMS_MP_CONTROL_MANAGER    10/12/2009 11:02:03 AM    5664 (0x1620)
Certificate doesn't have "SSL Client Authentication" capabilities.    SMS_MP_CONTROL_MANAGER    10/12/2009 11:02:03 AM    5664 (0x1620)
Skipping certificate that is not valid for ConfigMgr usage.    SMS_MP_CONTROL_MANAGER    10/12/2009 11:02:03 AM    5664 (0x1620)
CryptVerifyCertificateSignatureEx returned error 0x80090006.    SMS_MP_CONTROL_MANAGER    10/12/2009 11:02:03 AM    5664 (0x1620)
Certificate has "SSL Client Authentication" capability.    SMS_MP_CONTROL_MANAGER    10/12/2009 11:02:03 AM    5664 (0x1620)
Call to HttpSendRequestSync failed for port 443 with status code 403, text: Forbidden    SMS_MP_CONTROL_MANAGER    10/12/2009 11:02:03 AM    5664 (0x1620)
Successfully performed Management Point availability check against local computer.    SMS_MP_CONTROL_MANAGER    10/12/2009 11:02:03 AM    5664 (0x1620)
Machine name is 'sccmserver.domain.com'.    SMS_MP_CONTROL_MANAGER    10/12/2009 11:02:03 AM    5664 (0x1620)
CryptVerifyCertificateSignatureEx returned error 0x80090006.    SMS_MP_CONTROL_MANAGER    10/12/2009 11:02:03 AM    5664 (0x1620)
Certificate doesn't have "SSL Client Authentication" capabilities.    SMS_MP_CONTROL_MANAGER    10/12/2009 11:02:03 AM    5664 (0x1620)
Skipping certificate that is not valid for ConfigMgr usage.    SMS_MP_CONTROL_MANAGER    10/12/2009 11:02:03 AM    5664 (0x1620)
CryptVerifyCertificateSignatureEx returned error 0x80090006.    SMS_MP_CONTROL_MANAGER    10/12/2009 11:02:03 AM    5664 (0x1620)
Certificate has "SSL Client Authentication" capability.    SMS_MP_CONTROL_MANAGER    10/12/2009 11:02:03 AM    5664 (0x1620)
Call to HttpSendRequestSync succeeded for port 443 with status code 200, text: OK    SMS_MP_CONTROL_MANAGER    10/12/2009 11:02:03 AM    5664 (0x1620)
Http test request succeeded.    SMS_MP_CONTROL_MANAGER    10/12/2009 11:02:03 AM    5664 (0x1620)
Successfully performed Device Management Point availability check against local computer.    SMS_MP_CONTROL_MANAGER    10/12/2009 11:02:03 AM    5664 (0x1620)
Initialization still in progress.    SMS_MP_CONTROL_MANAGER    10/12/2009 11:02:03 AM    5664 (0x1620)
Machine name is 'sccmserver.domain.com'.    SMS_MP_CONTROL_MANAGER    10/12/2009 11:02:33 AM    5664 (0x1620)
CryptVerifyCertificateSignatureEx returned error 0x80090006.    SMS_MP_CONTROL_MANAGER    10/12/2009 11:02:33 AM    5664 (0x1620)
Certificate doesn't have "SSL Client Authentication" capabilities.    SMS_MP_CONTROL_MANAGER    10/12/2009 11:02:33 AM    5664 (0x1620)
Skipping certificate that is not valid for ConfigMgr usage.    SMS_MP_CONTROL_MANAGER    10/12/2009 11:02:33 AM    5664 (0x1620)
CryptVerifyCertificateSignatureEx returned error 0x80090006.    SMS_MP_CONTROL_MANAGER    10/12/2009 11:02:33 AM    5664 (0x1620)
Certificate has "SSL Client Authentication" capability.    SMS_MP_CONTROL_MANAGER    10/12/2009 11:02:33 AM    5664 (0x1620)
Call to HttpSendRequestSync failed for port 443 with status code 403, text: Forbidden    SMS_MP_CONTROL_MANAGER    10/12/2009 11:02:33 AM    5664 (0x1620)
Successfully performed Management Point availability check against local computer.    SMS_MP_CONTROL_MANAGER    10/12/2009 11:02:33 AM    5664 (0x1620)
Machine name is 'sccmserver.domain.com'.    SMS_MP_CONTROL_MANAGER    10/12/2009 11:02:33 AM    5664 (0x1620)
CryptVerifyCertificateSignatureEx returned error 0x80090006.    SMS_MP_CONTROL_MANAGER    10/12/2009 11:02:33 AM    5664 (0x1620)
Certificate doesn't have "SSL Client Authentication" capabilities.    SMS_MP_CONTROL_MANAGER    10/12/2009 11:02:33 AM    5664 (0x1620)
Skipping certificate that is not valid for ConfigMgr usage.    SMS_MP_CONTROL_MANAGER    10/12/2009 11:02:33 AM    5664 (0x1620)
CryptVerifyCertificateSignatureEx returned error 0x80090006.    SMS_MP_CONTROL_MANAGER    10/12/2009 11:02:33 AM    5664 (0x1620)
Certificate has "SSL Client Authentication" capability.    SMS_MP_CONTROL_MANAGER    10/12/2009 11:02:33 AM    5664 (0x1620)
Call to HttpSendRequestSync succeeded for port 443 with status code 200, text: OK    SMS_MP_CONTROL_MANAGER    10/12/2009 11:02:33 AM    5664 (0x1620)
Http test request succeeded.    SMS_MP_CONTROL_MANAGER    10/12/2009 11:02:33 AM    5664 (0x1620)
Successfully performed Device Management Point availability check against local computer.    SMS_MP_CONTROL_MANAGER    10/12/2009 11:02:33 AM    5664 (0x1620)
Initialization still in progress.    SMS_MP_CONTROL_MANAGER    10/12/2009 11:02:33 AM    5664 (0x1620)

Thoughts? I made sure the new CA was extended to support SAN2 attributes.

client installation in 2000 server

Tue, 13 Oct 2009 05:42:47 Z

Hi

we are facing issue in installing sccm Client in 2000 server with SP 4. we are getting the following error.

and this servers are in child domain

error msg :
native security mode is invalid on windows 2000

already refered the following link but did not helped me
http://social.technet.microsoft.com/Forums/en-US/configmgribcm/thread/002af352-cd44-4947-8933-7279af32b3d6

Please do the needful

AIA access for internet-based clients in native mode

Mon, 05 Oct 2009 19:51:21 Z

I have an environment where some clients will be primarily internet-based but the issuing CA will be in on the intranet. When clients connect from the Internet and they are configured for CRL checking, they will not be able to access the CRL from the CA. They will also not be able to access the AIA for certificate chaining. I read this article describing how to publish the CRL on a separate web server outside of the forest:

http://blogs.technet.com/configmgrteam/archive/2009/05/01/how-to-publish-the-crl-on-a-separate-web-server.aspx

My question is, what about the AIA? Does it need to be available to these internet-based systems as well? Or will the CRL suffice?

Thanks!

Windows 2003 Std Server and PKI

Tue, 06 May 2008 13:57:46 Z

Hi Everyone,

i have a problem with a customer who also wants to upgrade to native mode. Not yet but in the future. The customer has only a Win 2003 Std Server and a PKI on it.

So thats my problem. I need WIn2003 Enp to create the certificates for native mode.

So my question is, is there a workaround to do this on a WIN2003 Std ?

Must the RootCA be a domain controller ? or can i do this also on a member server in a domain ?

thanks a lot

report: all clients connecting through internet?

Mon, 28 Sep 2009 09:53:34 Z

Is it possible to query which clients currently connect through an internet management point, perhaps via a report or through a collection?

A query for the client property:ConfigMgr Connection Status of "Currently Internet" would be great. Is this possible?

IBCM only works for one day at a time, then has to be put back on the internal network

Tue, 04 Aug 2009 17:06:46 Z

Yesterday I thought I made a breakthrough. I successfully got a laptop to download advertised software via the internet. I then pulled out half of the ram and a bit after the computer came back up ran a report to check on the installed ram amount. It changed! Then I installed some Windows Updates from a deployment that was advertised to the collection. Also good! Then today happened.

I configured an update deployment to hit the laptop late in the night and left the laptop up and running. I checked in the morning and it never ran. I tested a software deployment. The laptop was able to see the list of software advertised to it, but it would fail to download when I told it to install any piece of software. After a reboot the computer came back up with the same problem. The ram test now failed.

I pulled the laptop from the collection for the update deployment and reconnected it to our internal network and rebooted. Now it can download advertised software. I took it off of the network again and rebooted once more. It is still able to download software. I have now added the laptop back in to the collection for the update deployment (while the laptop is fully off of the internal network), and it worked. So this seems to be nailed down to some kind of time based problem, as multiple reboots off network don't cause a failure.

My setup: A single SCCM server for a site in native mode which is working fine with all computers on the intranet. We also have a primary child site in mixed mode for a separate forest, but I don't see any relevance for this problem. My guess is that this is in some way a cert issue. To that end, the internal and external server name(fqdn) is exactly the same, and I checked and was told I didn't need a SAN specified.
Laptop setup: Dell Latitude D520 running a Verizon wireless card with all other networking disabled. (nic not plugged in)

There are errors in many of the client logs, but I'm not sure which would be relevant for the problem, as many of these errors actually show up on intranet computers as well. I'll post any logs asked of me.

Thanks,

Aaron Barlow

Troubleshooting BITS in Native mode with BITSADMIN

Mon, 21 Sep 2009 17:04:03 Z

We are having some wierd network issue's SW downloads (via BITS) on specific subnets and I'm trying to troubleshoot. We are using SCCM 2007 sp1 in Native mode and I can't get BITSADMIN.EXE to access the NOCERT or regular SMSPKGx$ web links. I've tried to supply credentials via /setCredentials but its not working. I also used Aaron C.'s CMD file but still the same issue. (http://blogs.technet.com/aaronczechowski/archive/2008/03/08/bitsadmin-script.aspx). It's probably something simple but has anyone tried to do this?

TM

Windows Server 2008 R2 gives error after installation: The ConfigMgr Advanced Client received policy that could not be verified.

Wed, 23 Sep 2009 13:18:44 Z

I installed 2 2008 R2 servers and did an install of the sccm client.

As soon as the client was installed the errors came.

The client has no advertisments assigned
-------------------------------------------------------------------------------------------------------------------------------

The ConfigMgr Advanced Client received policy that could not be verified.

The following errors are seen in de policyagent log

Requesting policy from authority 'SMS:VEL' PolicyAgent_RequestAssignments 23-9-2009 15:11:33 1120 (0x0460)
Raising event:

instance of CCM_PolicyAgent_AssignmentsRequested
{
AuthorityName = "SMS:VEL";
ClientID = "GUID:ED09C70C-80D0-4456-B297-1DA047562E6E";
DateTime = "20090923131133.528000+000";
ProcessID = 736;
ResourceName = "S031-1039";
ResourceType = "Machine";
ThreadID = 1120;
};
PolicyAgent_RequestAssignments 23-9-2009 15:11:33 1120 (0x0460)
Processing Machine assignments from 'SMS:VEL'. The new cookie is '2009-09-23 00:05:48.553'. PolicyAgent_ReplyAssignments 23-9-2009 15:11:33 1280 (0x0500)
Raising event:

instance of CCM_PolicyAgent_AssignmentsReceived
{
AuthorityName = "SMS:VEL";
ClientID = "GUID:ED09C70C-80D0-4456-B297-1DA047562E6E";
DateTime = "20090923131133.665000+000";
ProcessID = 736;
ReplyType = "Full";
ResourceName = "S031-1039";
ResourceType = "Machine";
ThreadID = 1280;
};
PolicyAgent_ReplyAssignments 23-9-2009 15:11:33 1280 (0x0500)
The 'Certificate Store' is empty in the registry, using default store name 'MY'. PolicyAgent_ReplyAssignments 23-9-2009 15:11:33 1280 (0x0500)
Raising event:

instance of CCM_ServiceHost_CertRetrieval_Status
{
ClientID = "GUID:ED09C70C-80D0-4456-B297-1DA047562E6E";
DateTime = "20090923131133.680000+000";
HRESULT = "0x00000000";
ProcessID = 736;
ThreadID = 1280;
};
PolicyAgent_ReplyAssignments 23-9-2009 15:11:33 1280 (0x0500)
Raising event:

instance of CCM_PolicyAgent_PolicyAuthorizationFailure
{
ClientID = "GUID:ED09C70C-80D0-4456-B297-1DA047562E6E";
DateTime = "20090923131133.680000+000";
PolicyNamespace = "\\\\S031-1039\\ROOT\\ccm\\Policy\\Machine\\RequestedConfig";
PolicySource = "SMS:VEL";
ProcessID = 736;
ThreadID = 1280;
};
PolicyAgent_ReplyAssignments 23-9-2009 15:11:33 1280 (0x0500)

How to Decipher Error Codes for Clients Incapable of Native Mode Communication

Fri, 18 Sep 2009 20:40:29 Z

I have been preparing my site for native mode communication. After setting up PKI and running the sccmnativemodereadiness.exe I have several client PC's showing up on the report named "Clients Incapable of Native Mode Communication". The error codes listed are 2147220864 and 2147220862, but I have not been able to find a reference to what those codes mean. They do not appear on the document "Custom Error Codes for Configuration Manager 2007. How can I decipher what these codes mean?

FSP for roaming clients

Mon, 17 Aug 2009 08:52:09 Z

How can I have my roaming clients communicate with multiple FSP?

When the laptops are on the intranet, we want them to communicate with an internal FSP and when they are on the internet, with an FSP on the DMZ.
We have a single (native mode) site.

Does secondary DP have to have the Site Server Signing Certificate

Tue, 15 Sep 2009 12:33:58 Z

Greetings,

I know I had to have my primary site server installed with the SCCM Site Signing Certificate. Do I need to have that same certificate on any additional site systems? I set up a second DP (that's all this new site server will do). Do I have to request the Site Server Signing Certificate or is that only required on my server running the database, acting as site server, etc. I would assume no, but I figured I'd ask.

Site assignment for clients that are Internet and Intranet managed

Tue, 08 Sep 2009 18:31:19 Z

Hi all, I have a planning question I'm hoping someone can help with.

The requirement is to manage a large number of clients on the Internet and Intranet. I'd like the Internet site to be a single site globally (manully assigned of course), but the Intranet site to be automatically assigned based on their location (Asia site, Europe site, US site,etc). Is this possible?

Thx.

Guy

IBCM Configuration

Wed, 09 Sep 2009 14:13:49 Z

I am planning to setup IBCM and wanted to open a thread to see if folks can guide me through the process. I read the possible configuration scenarios for IBCM here: http://technet.microsoft.com/en-us/library/bb693755.aspx. What is the most commonly used configuration? I know the configuration will depend on the requirements and constraints but I would like to get feedback from people who have successfully implemented IBCM in a secure environment.

I am working with following configuration:

Server 2003

Primary site

Child site

Native mode

SP1 R2

Server 1:

PXE service point

Reporting point

Site server

SUP

SQL

Distribution point

Server 2:

Windows 2003

FSP

SLP

Mayur

Multiple Non Trusting Forest with "Internet or intranet management" enabled Client Behavior and Design?

Thu, 03 Sep 2009 03:39:46 Z

I saw a posting similar to this (Multiple forests native mode implementation
http://social.technet.microsoft.com/Forums/en-US/configmgribcm/thread/9302902d-6bf0-4a87-81c7-baba342ecef5 ), but not quite the same.

Here is the scenario.
5 Forest -Non-Trusting, Each SCCM Site has has Key Exchanged and the Sites are communicating fine. Sender using Mirrored Account (Server to Server).
Clients will be "Internet or Intranet"
There is a Central Sitee, it has a Primary Child Site in each Forest, and one in its own forest that serves the Internet Clients. This primary site server is in the Intranet and uses Tunneling (Not bridging) from ISA 2006 (so not really on the Internet side of firewall).
The SAN (Subject Alternate Name) is entered into the PKI Certificates for this Primary Sites Internet Name and handed out to all clients in each forest, and the ISA Box forwards Internet Clients via tunnel to this server.
All Clients everywhere can only connect through this location, even if their assigned site is in another forest.

The SCCM Hierarchy encompasses all Forest, but will the clients honor the packages on the Primary Site that is above their own in the Hierarchy. I made a really nice graphic depiciting this, but I don't see a way to share it. PKI Root is in the Top Most forest, and has issuing into each forest as well.
The question or wonder is how will the clients behave? Will they utilize the same Package ID from the Internet SCCM Site? or will they try to traverse to their own forest and to their Primary Site in that forest?

I would like all Primary Site Child Site Clients to be able to communicate with this Internet servicing site when connecting from the internet.

David Baur

SCCM Client Expiration???

Mon, 24 Aug 2009 20:43:05 Z

We have 1 SCCM Native Mode Site with approx 500 Clients I have been working on weeding out the issues with Client Installations. Early this morning I was showing 14 Computers that said that they did not have a SCCM Client installed. Now I am showing 38. Some of the machines in the list were imaged with SCCM so I know that they have a client. What am I missing? I know that the client will uninstall after 90 days if it has not contacted the site but some of the clients are less than 90 days old. Is there another expiration that I am missing?

Thanks

Walshtech

Scenario for computer not in domain.

Mon, 24 Aug 2009 01:54:07 Z

Hi,

I need to deploy the SCCM infrastructure in a environment which some computers are joined in the domain and some others not. My question is: to manage the computers that are not joined to the domain do I need to use native mode communication or there is a way to do that using Mixed mode communication?

Thanks in advance

New Agent Policy Retrieval

Mon, 17 Aug 2009 15:30:56 Z

I have a SCCM 2007 SP1, single site, native mode install and I have started having problems with new agents. The agent installes locally (control panel applets, etc) via WSUS deployment and the computer shows up in the 'all systems' collection (Client: YES), but the agent does not download policy.

Previously installed agents are still working properly, installing updates and running advertisements.

I've been looking through the logs but I'm not really sure which log I should be focusing on or what I should be lookign for. Any direction would be apreciated.
Joe

DMZ dual-homed

Sun, 16 Aug 2009 19:01:23 Z

Are most machines configured for a DMZ dual-homed?

Native Mode Client to Mixed Mode Site

Wed, 12 Aug 2009 12:44:12 Z

What is the best practice when you need to move/reassign a Native Mode client to a Mixed Mode Site? The client reassignment appears to be working, but HW inventory is not getting processed and put into BADMIF. The error received in dataldr.log is "CMachineSource::InsertMachine - could not validate machine".

Where is SMS client certificate store at client site

Tue, 28 Jul 2009 14:48:37 Z

Hi,
i want to know the exact location where is sms client certificate store after client installtion .

Client Push to Servers

Mon, 13 Jul 2009 09:59:50 Z

Hello,

I am trying to push install SCCM clients on our servers, but all server installations fail with different erros. Windows Vista and XP clients already have successfully installed clients. My SCCM runs in native mode and certificates are working on Vista and XP.

CCMsetup.log (windows server 2008 64bit; 2 servers: 1st server = DC; 2nd server = SCCM host):

<![LOG[==========[ ccmsetup started in process 3572 ]==========]LOG]!><time="11:14:59.960+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="3804" file="ccmsetup.cpp:8849">
<![LOG[Version: 4.0.6221.1000]LOG]!><time="11:14:59.960+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="3804" file="ccmsetup.cpp:1907">
<![LOG[Command line parameters for ccmsetup have been specified.  No registry lookup for command line parameters is required.]LOG]!><time="11:14:59.960+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="3804" file="ccmsetup.cpp:3932">
<![LOG[Command line: "C:\Windows\ccmsetup\ccmsetup.exe" /runservice /config:MobileClient.tcf]LOG]!><time="11:14:59.960+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="3804" file="ccmsetup.cpp:3941">
<![LOG[CCMHTTPPORT:    80]LOG]!><time="11:14:59.960+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="3804" file="ccmsetup.cpp:7847">
<![LOG[CCMHTTPSPORT:    443]LOG]!><time="11:14:59.960+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="3804" file="ccmsetup.cpp:7862">
<![LOG[CCMHTTPSSTATE:    63]LOG]!><time="11:14:59.960+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="3804" file="ccmsetup.cpp:7880">
<![LOG[CCMHTTPSCERTNAME:    ]LOG]!><time="11:14:59.960+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="3804" file="ccmsetup.cpp:7908">
<![LOG[FSP:    MESSERSCHMITT.LLB.MW.TU-MUENCHEN.DE]LOG]!><time="11:14:59.960+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="3804" file="ccmsetup.cpp:7923">
<![LOG[CCMFIRSTCERT:    0]LOG]!><time="11:14:59.960+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="3804" file="ccmsetup.cpp:7965">
<![LOG[Config file:      C:\Windows\ccmsetup\MobileClient.tcf]LOG]!><time="11:14:59.960+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="3804" file="ccmsetup.cpp:4336">
<![LOG[Retry time:       10 minute(s)]LOG]!><time="11:14:59.960+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="3804" file="ccmsetup.cpp:4337">
<![LOG[MSI log file:     ]LOG]!><time="11:14:59.960+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="3804" file="ccmsetup.cpp:4338">
<![LOG[MSI properties:    INSTALL="ALL" SMSSITECODE="LLB" CCMHTTPPORT="80" CCMHTTPSPORT="443" CCMHTTPSSTATE="63" FSP="MESSERSCHMITT.LLB.MW.TU-MUENCHEN.DE" CCMFIRSTCERT="0"]LOG]!><time="11:14:59.960+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="3804" file="ccmsetup.cpp:4339">
<![LOG[Source List:]LOG]!><time="11:14:59.960+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="3804" file="ccmsetup.cpp:4347">
<![LOG[                  \\messerschmitt.llb.mw.tu-muenchen.de\SMSClient]LOG]!><time="11:14:59.960+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="3804" file="ccmsetup.cpp:4354">
<![LOG[                  \\MESSERSCHMITT\SMSClient]LOG]!><time="11:14:59.960+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="3804" file="ccmsetup.cpp:4363">
<![LOG[MPs:]LOG]!><time="11:14:59.960+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="3804" file="ccmsetup.cpp:4366">
<![LOG[                  messerschmitt.llb.mw.tu-muenchen.de]LOG]!><time="11:14:59.960+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="3804" file="ccmsetup.cpp:4381">
<![LOG[Updated security on object C:\Windows\ccmsetup\.]LOG]!><time="11:14:59.960+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="3804" file="ccmsetup.cpp:8688">
<![LOG[Sending Fallback Status Point message, STATEID='100'.]LOG]!><time="11:14:59.960+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="3804" file="ccmsetup.cpp:9165">
<![LOG[Request failed: 404 Not Found
]LOG]!><time="11:15:00.007+-120" date="07-13-2009" component="FSPStateMessage" context="" type="3" thread="3804" file="fsputillib.cpp:1300">
<![LOG[Running as user "SYSTEM"]LOG]!><time="11:15:00.007+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="3508" file="ccmsetup.cpp:2529">
<![LOG[Detected 116459 MB free disk space on system drive.]LOG]!><time="11:15:00.007+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="3508" file="ccmsetup.cpp:459">
<![LOG[DetectWindowsEmbeddedFBWF() Detecting OS Version]LOG]!><time="11:15:00.007+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="3508" file="ccmsetup.cpp:505">
<![LOG[Client OS is not Windows XP Embedded]LOG]!><time="11:15:00.007+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="3508" file="ccmsetup.cpp:542">
<![LOG[Ccmsetup is being restarted due to an administrative action. Installation files will be reset and downloaded again.]LOG]!><time="11:15:00.007+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="3508" file="ccmsetup.cpp:2613">
<![LOG[BITS version check will not be run on Vista.]LOG]!><time="11:15:00.007+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="3508" file="ccmsetup.cpp:6699">
<![LOG[The 'Certificate Store' is empty in the registry, using default store name 'MY'.]LOG]!><time="11:15:00.023+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="3508" file="ccmcert.cpp:204">
<![LOG[The 'Certificate Selection Criteria' was not specified, counting number of certificates  present in 'MY' store of 'Local Computer'.]LOG]!><time="11:15:00.023+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="3508" file="ccmcert.cpp:3480">
<![LOG[5 certificate(s) found in the 'MY' certificate store.]LOG]!><time="11:15:00.038+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="3508" file="ccmcert.cpp:3509">
<![LOG[The 'MY' of 'Local Computer' store has 5 certificate(s). Using custom selection criteria based on the machine name.]LOG]!><time="11:15:00.038+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="3508" file="ccmcert.cpp:3548">
<![LOG[Machine name is 'Junkers.llb.mw.tu-muenchen.de'.]LOG]!><time="11:15:00.038+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="3508" file="ccmcert.cpp:1919">
<![LOG[SSL Registry key Software\Microsoft\CCM not found, assuming Client SSL is disabled.]LOG]!><time="11:15:00.038+-120" date="07-13-2009" component="ccmsetup" context="" type="2" thread="3508" file="ccmutillib.cpp:134">
<![LOG[The certificate issued to 'Junkers.llb.mw.tu-muenchen.de' has 'Client Authentication' capability.]LOG]!><time="11:15:00.038+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="3508" file="ccmcert.cpp:432">
<![LOG[Using the certificate issued to 'Junkers.llb.mw.tu-muenchen.de'.]LOG]!><time="11:15:00.038+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="3508" file="ccmcert.cpp:3593">
<![LOG[Failed to send HTTP request. (Error at WinHttpSendRequest: 12030)]LOG]!><time="11:15:00.101+-120" date="07-13-2009" component="ccmsetup" context="" type="2" thread="3508" file="ccmsetup.cpp:5740">
<![LOG[DownloadFileByWinHTTP encountered an unrecoverable error.]LOG]!><time="11:15:00.101+-120" date="07-13-2009" component="ccmsetup" context="" type="3" thread="3508" file="ccmsetup.cpp:5787">
<![LOG[Sending Fallback Status Point message, STATEID='308'.]LOG]!><time="11:15:00.101+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="3508" file="ccmsetup.cpp:9165">
<![LOG[Request failed: 404 Not Found]LOG]!><time="11:15:00.117+-120" date="07-13-2009" component="FSPStateMessage" context="" type="3" thread="3508" file="fsputillib.cpp:1300">

CCMsetup.log (windows server 2003 32bit):

<![LOG[==========[ ccmsetup started in process 2256 ]==========]LOG]!><time="10:59:31.343+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="2260" file="ccmsetup.cpp:8849">

<![LOG[Version: 4.0.6221.1000]LOG]!><time="10:59:31.437+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="2260" file="ccmsetup.cpp:1907">

<![LOG[Command line parameters for ccmsetup have been specified.  No registry lookup for command line parameters is required.]LOG]!><time="10:59:31.437+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="2260" file="ccmsetup.cpp:3932">

<![LOG[Command line: "C:\WINDOWS\system32\ccmsetup\ccmsetup.exe" /runservice /config:MobileClient.tcf]LOG]!><time="10:59:31.437+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="2260" file="ccmsetup.cpp:3941">

<![LOG[CCMHTTPPORT:    80]LOG]!><time="10:59:31.531+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="2260" file="ccmsetup.cpp:7847">

<![LOG[CCMHTTPSPORT:    443]LOG]!><time="10:59:31.531+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="2260" file="ccmsetup.cpp:7862">

<![LOG[CCMHTTPSSTATE:    63]LOG]!><time="10:59:31.531+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="2260" file="ccmsetup.cpp:7880">

<![LOG[CCMHTTPSCERTNAME:    ]LOG]!><time="10:59:31.531+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="2260" file="ccmsetup.cpp:7908">

<![LOG[FSP:    MESSERSCHMITT.LLB.MW.TU-MUENCHEN.DE]LOG]!><time="10:59:31.531+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="2260" file="ccmsetup.cpp:7923">

<![LOG[CCMFIRSTCERT:    0]LOG]!><time="10:59:31.531+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="2260" file="ccmsetup.cpp:7965">

<![LOG[Config file:      C:\WINDOWS\system32\ccmsetup\MobileClient.tcf]LOG]!><time="10:59:31.531+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="2260" file="ccmsetup.cpp:4336">

<![LOG[Retry time:       10 minute(s)]LOG]!><time="10:59:31.531+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="2260" file="ccmsetup.cpp:4337">

<![LOG[MSI log file:     ]LOG]!><time="10:59:31.531+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="2260" file="ccmsetup.cpp:4338">

<![LOG[MSI properties:    INSTALL="ALL" SMSSITECODE="LLB" CCMHTTPPORT="80" CCMHTTPSPORT="443" CCMHTTPSSTATE="63" FSP="MESSERSCHMITT.LLB.MW.TU-MUENCHEN.DE" CCMFIRSTCERT="0"]LOG]!><time="10:59:31.531+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="2260" file="ccmsetup.cpp:4339">

<![LOG[Source List:]LOG]!><time="10:59:31.531+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="2260" file="ccmsetup.cpp:4347">

<![LOG[                  \\messerschmitt.llb.mw.tu-muenchen.de\SMSClient]LOG]!><time="10:59:31.531+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="2260" file="ccmsetup.cpp:4354">

<![LOG[                  \\MESSERSCHMITT\SMSClient]LOG]!><time="10:59:31.531+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="2260" file="ccmsetup.cpp:4363">

<![LOG[MPs:]LOG]!><time="10:59:31.531+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="2260" file="ccmsetup.cpp:4366">

<![LOG[                  messerschmitt.llb.mw.tu-muenchen.de]LOG]!><time="10:59:31.531+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="2260" file="ccmsetup.cpp:4381">

<![LOG[Updated security on object C:\WINDOWS\system32\ccmsetup\.]LOG]!><time="10:59:31.734+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="2260" file="ccmsetup.cpp:8688">

<![LOG[Sending Fallback Status Point message, STATEID='100'.]LOG]!><time="10:59:31.734+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="2260" file="ccmsetup.cpp:9165">

<![LOG[State message with TopicType 800 and TopicId {EC5364A1-A6D5-4E6D-AD86-D9203B5A5428} has been sent to the FSP]LOG]!><time="10:59:34.437+-120" date="07-13-2009" component="FSPStateMessage" context="" type="1" thread="2260" file="fsputillib.cpp:730">

<![LOG[Running as user "SYSTEM"]LOG]!><time="10:59:34.437+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="2408" file="ccmsetup.cpp:2529">

<![LOG[Detected 29568 MB free disk space on system drive.]LOG]!><time="10:59:34.437+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="2408" file="ccmsetup.cpp:459">

<![LOG[DetectWindowsEmbeddedFBWF() Detecting OS Version]LOG]!><time="10:59:34.437+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="2408" file="ccmsetup.cpp:505">

<![LOG[Client OS is not Windows XP Embedded]LOG]!><time="10:59:34.437+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="2408" file="ccmsetup.cpp:542">

<![LOG[Successfully ran BITS check.]LOG]!><time="10:59:37.015+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="2408" file="ccmsetup.cpp:6944">

<![LOG[Registry entry 'Certificate Store' is either missing or empty.]LOG]!><time="10:59:37.062+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="2408" file="ccmcert.cpp:133">

<![LOG[The 'Certificate Store' is empty in the registry, using default store name 'MY'.]LOG]!><time="10:59:37.062+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="2408" file="ccmcert.cpp:204">

<![LOG[Registry entry 'Certificate Selection Criteria' is either missing or empty.]LOG]!><time="10:59:37.062+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="2408" file="ccmcert.cpp:133">

<![LOG[The 'Certificate Selection Criteria' was not specified, counting number of certificates  present in 'MY' store of 'Local Computer'.]LOG]!><time="10:59:37.062+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="2408" file="ccmcert.cpp:3480">

<![LOG[1 certificate(s) found in the 'MY' certificate store.]LOG]!><time="10:59:37.062+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="2408" file="ccmcert.cpp:3509">

<![LOG[Only one certificate present in the certificate store.]LOG]!><time="10:59:37.062+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="2408" file="ccmcert.cpp:3517">

<![LOG[Client SSL is enabled. The current state is 0x63.]LOG]!><time="10:59:37.062+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="2408" file="ccmutillib.cpp:171">

<![LOG[Sending Fallback Status Point message, STATEID='315'.]LOG]!><time="10:59:37.140+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="2408" file="ccmsetup.cpp:9165">

<![LOG[State message with TopicType 800 and TopicId {178619F1-9CC2-4799-A1AC-82BE576E176D} has been sent to the FSP]LOG]!><time="10:59:37.218+-120" date="07-13-2009" component="FSPStateMessage" context="" type="1" thread="2408" file="fsputillib.cpp:730">

CCMsetup.log (windows server 2003 64bit; server = DC):

<![LOG[==========[ ccmsetup started in process 3768 ]==========]LOG]!><time="10:26:18.246+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="8048" file="ccmsetup.cpp:8849">

<![LOG[Version: 4.0.6221.1000]LOG]!><time="10:26:18.246+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="8048" file="ccmsetup.cpp:1907">

<![LOG[Command line parameters for ccmsetup have been specified.  No registry lookup for command line parameters is required.]LOG]!><time="10:26:18.246+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="8048" file="ccmsetup.cpp:3932">

<![LOG[Command line: "C:\WINDOWS\ccmsetup\ccmsetup.exe" /runservice /config:MobileClient.tcf]LOG]!><time="10:26:18.246+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="8048" file="ccmsetup.cpp:3941">

<![LOG[CCMHTTPPORT:    80]LOG]!><time="10:26:18.246+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="8048" file="ccmsetup.cpp:7847">

<![LOG[CCMHTTPSPORT:    443]LOG]!><time="10:26:18.246+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="8048" file="ccmsetup.cpp:7862">

<![LOG[CCMHTTPSSTATE:    63]LOG]!><time="10:26:18.246+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="8048" file="ccmsetup.cpp:7880">

<![LOG[CCMHTTPSCERTNAME:    ]LOG]!><time="10:26:18.246+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="8048" file="ccmsetup.cpp:7908">

<![LOG[FSP:    MESSERSCHMITT.LLB.MW.TU-MUENCHEN.DE]LOG]!><time="10:26:18.246+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="8048" file="ccmsetup.cpp:7923">

<![LOG[CCMFIRSTCERT:    0]LOG]!><time="10:26:18.246+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="8048" file="ccmsetup.cpp:7965">

<![LOG[Config file:      C:\WINDOWS\ccmsetup\MobileClient.tcf]LOG]!><time="10:26:18.246+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="8048" file="ccmsetup.cpp:4336">

<![LOG[Retry time:       10 minute(s)]LOG]!><time="10:26:18.246+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="8048" file="ccmsetup.cpp:4337">

<![LOG[MSI log file:     ]LOG]!><time="10:26:18.246+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="8048" file="ccmsetup.cpp:4338">

<![LOG[MSI properties:    INSTALL="ALL" SMSSITECODE="LLB" CCMHTTPPORT="80" CCMHTTPSPORT="443" CCMHTTPSSTATE="63" FSP="MESSERSCHMITT.LLB.MW.TU-MUENCHEN.DE" CCMFIRSTCERT="0"]LOG]!><time="10:26:18.246+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="8048" file="ccmsetup.cpp:4339">

<![LOG[Source List:]LOG]!><time="10:26:18.246+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="8048" file="ccmsetup.cpp:4347">

<![LOG[                  \\messerschmitt.llb.mw.tu-muenchen.de\SMSClient]LOG]!><time="10:26:18.246+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="8048" file="ccmsetup.cpp:4354">

<![LOG[                  \\MESSERSCHMITT\SMSClient]LOG]!><time="10:26:18.246+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="8048" file="ccmsetup.cpp:4363">

<![LOG[MPs:]LOG]!><time="10:26:18.246+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="8048" file="ccmsetup.cpp:4366">

<![LOG[                  messerschmitt.llb.mw.tu-muenchen.de]LOG]!><time="10:26:18.246+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="8048" file="ccmsetup.cpp:4381">

<![LOG[Updated security on object C:\WINDOWS\ccmsetup\.]LOG]!><time="10:26:18.246+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="8048" file="ccmsetup.cpp:8688">

<![LOG[Sending Fallback Status Point message, STATEID='100'.]LOG]!><time="10:26:18.246+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="8048" file="ccmsetup.cpp:9165">

<![LOG[State message with TopicType 800 and TopicId {89E19F3C-7420-4E0B-8BEC-E449E3D30A51} has been sent to the FSP]LOG]!><time="10:26:18.449+-120" date="07-13-2009" component="FSPStateMessage" context="" type="1" thread="8048" file="fsputillib.cpp:730">

<![LOG[Running as user "SYSTEM"]LOG]!><time="10:26:18.449+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="2720" file="ccmsetup.cpp:2529">

<![LOG[Detected 88148 MB free disk space on system drive.]LOG]!><time="10:26:18.449+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="2720" file="ccmsetup.cpp:459">

<![LOG[DetectWindowsEmbeddedFBWF() Detecting OS Version]LOG]!><time="10:26:18.449+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="2720" file="ccmsetup.cpp:505">

<![LOG[Client OS is not Windows XP Embedded]LOG]!><time="10:26:18.449+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="2720" file="ccmsetup.cpp:542">

<![LOG[Ccmsetup is being restarted due to an administrative action. Installation files will be reset and downloaded again.]LOG]!><time="10:26:18.449+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="2720" file="ccmsetup.cpp:2613">

<![LOG[The 'Certificate Store' is empty in the registry, using default store name 'MY'.]LOG]!><time="10:26:18.481+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="2720" file="ccmcert.cpp:204">

<![LOG[The 'Certificate Selection Criteria' was not specified, counting number of certificates  present in 'MY' store of 'Local Computer'.]LOG]!><time="10:26:18.481+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="2720" file="ccmcert.cpp:3480">

<![LOG[8 certificate(s) found in the 'MY' certificate store.]LOG]!><time="10:26:18.481+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="2720" file="ccmcert.cpp:3509">

<![LOG[The 'MY' of 'Local Computer' store has 8 certificate(s). Using custom selection criteria based on the machine name.]LOG]!><time="10:26:18.481+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="2720" file="ccmcert.cpp:3548">

<![LOG[Machine name is 'server1.llb.mw.tu-muenchen.de'.]LOG]!><time="10:26:18.481+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="2720" file="ccmcert.cpp:1919">

<![LOG[There are no certificate(s) that meet the criteria.]LOG]!><time="10:26:18.481+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="2720" file="ccmcert.cpp:1748">

<![LOG[Performing search that includes SAN2 extensions...]LOG]!><time="10:26:18.481+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="2720" file="ccmcert.cpp:1955">

<![LOG[Certificate doesn't have SAN2 extension.]LOG]!><time="10:26:18.481+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="2720" file="ccmcert.cpp:1307">

<![LOG[Found a certificate with subject name as ‘server1’, but will continue to look for the certificate with subject name as ‘server1.llb.mw.tu-muenchen.de’.]LOG]!><time="10:26:18.481+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="2720" file="ccmcert.cpp:1284">

<![LOG[Checking if certificate issued to 'server1.llb.mw.tu-muenchen.de' is valid for ConfigMgr usage.]LOG]!><time="10:26:18.481+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="2720" file="ccmcert.cpp:1233">

<![LOG[Client SSL is disabled. Setting state to 0x0.]LOG]!><time="10:26:18.481+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="2720" file="ccmutillib.cpp:184">

<![LOG[The certificate issued to 'server1' doesn't have 'Client Authentication' capability.]LOG]!><time="10:26:18.481+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="2720" file="ccmcert.cpp:449">

<![LOG[The certificate found using 'server1.llb.mw.tu-muenchen.de' as cert name is not valid for ConfigMgr usage.]LOG]!><time="10:26:18.481+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="2720" file="ccmcert.cpp:1275">

<![LOG[Found a certificate with subject name as ‘server1’, but will continue to look for the certificate with subject name as ‘server1.llb.mw.tu-muenchen.de’.]LOG]!><time="10:26:18.481+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="2720" file="ccmcert.cpp:1284">

<![LOG[Checking if certificate issued to 'server1.llb.mw.tu-muenchen.de' is valid for ConfigMgr usage.]LOG]!><time="10:26:18.481+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="2720" file="ccmcert.cpp:1233">

<![LOG[Certificate issued to 'server1' has expired.]LOG]!><time="10:26:18.481+-120" date="07-13-2009" component="ccmsetup" context="" type="3" thread="2720" file="ccmcert.cpp:962">

<![LOG[The certificate found using 'server1.llb.mw.tu-muenchen.de' as cert name is not valid for ConfigMgr usage.]LOG]!><time="10:26:18.481+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="2720" file="ccmcert.cpp:1275">

<![LOG[Found a certificate with subject name as ‘server1’, but will continue to look for the certificate with subject name as ‘server1.llb.mw.tu-muenchen.de’.]LOG]!><time="10:26:18.481+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="2720" file="ccmcert.cpp:1284">

<![LOG[Checking if certificate issued to 'server1.llb.mw.tu-muenchen.de' is valid for ConfigMgr usage.]LOG]!><time="10:26:18.481+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="2720" file="ccmcert.cpp:1233">

<![LOG[The certificate issued to 'server1' doesn't have 'Client Authentication' capability.]LOG]!><time="10:26:18.481+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="2720" file="ccmcert.cpp:449">

<![LOG[The certificate found using 'server1.llb.mw.tu-muenchen.de' as cert name is not valid for ConfigMgr usage.]LOG]!><time="10:26:18.481+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="2720" file="ccmcert.cpp:1275">

<![LOG[Found a certificate with subject name as ‘server1’, but will continue to look for the certificate with subject name as ‘server1.llb.mw.tu-muenchen.de’.]LOG]!><time="10:26:18.481+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="2720" file="ccmcert.cpp:1284">

<![LOG[Checking if certificate issued to 'server1.llb.mw.tu-muenchen.de' is valid for ConfigMgr usage.]LOG]!><time="10:26:18.481+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="2720" file="ccmcert.cpp:1233">

<![LOG[The certificate issued to 'server1' doesn't have 'Client Authentication' capability.]LOG]!><time="10:26:18.481+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="2720" file="ccmcert.cpp:449">

<![LOG[The certificate found using 'server1.llb.mw.tu-muenchen.de' as cert name is not valid for ConfigMgr usage.]LOG]!><time="10:26:18.481+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="2720" file="ccmcert.cpp:1275">

<![LOG[Found a certificate with subject name as ‘server1’, but will continue to look for the certificate with subject name as ‘server1.llb.mw.tu-muenchen.de’.]LOG]!><time="10:26:18.481+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="2720" file="ccmcert.cpp:1284">

<![LOG[Checking if certificate issued to 'server1.llb.mw.tu-muenchen.de' is valid for ConfigMgr usage.]LOG]!><time="10:26:18.481+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="2720" file="ccmcert.cpp:1233">

<![LOG[Certificate issued to 'server1' has expired.]LOG]!><time="10:26:18.481+-120" date="07-13-2009" component="ccmsetup" context="" type="3" thread="2720" file="ccmcert.cpp:962">

<![LOG[The certificate found using 'server1.llb.mw.tu-muenchen.de' as cert name is not valid for ConfigMgr usage.]LOG]!><time="10:26:18.481+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="2720" file="ccmcert.cpp:1275">

<![LOG[Certificate doesn't have SAN2 extension.]LOG]!><time="10:26:18.481+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="2720" file="ccmcert.cpp:1307">

<![LOG[Found a certificate with subject name as ‘server1’, but will continue to look for the certificate with subject name as ‘server1.llb.mw.tu-muenchen.de’.]LOG]!><time="10:26:18.481+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="2720" file="ccmcert.cpp:1284">

<![LOG[Checking if certificate issued to 'server1.llb.mw.tu-muenchen.de' is valid for ConfigMgr usage.]LOG]!><time="10:26:18.481+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="2720" file="ccmcert.cpp:1233">

<![LOG[The certificate issued to 'server1' doesn't have 'Client Authentication' capability.]LOG]!><time="10:26:18.481+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="2720" file="ccmcert.cpp:449">

<![LOG[The certificate found using 'server1.llb.mw.tu-muenchen.de' as cert name is not valid for ConfigMgr usage.]LOG]!><time="10:26:18.481+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="2720" file="ccmcert.cpp:1275">

<![LOG[Using custom selection criteria based on the machine NetBIOS name.]LOG]!><time="10:26:18.481+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="2720" file="ccmcert.cpp:3568">

<![LOG[Machine name is 'SERVER1'.]LOG]!><time="10:26:18.481+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="2720" file="ccmcert.cpp:1919">

<![LOG[The certificate issued to 'server1' doesn't have 'Client Authentication' capability.]LOG]!><time="10:26:18.481+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="2720" file="ccmcert.cpp:449">

<![LOG[Skipping certificate that is not valid for ConfigMgr usage.]LOG]!><time="10:26:18.481+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="2720" file="ccmcert.cpp:1740">

<![LOG[Certificate issued to 'server1' has expired.]LOG]!><time="10:26:18.481+-120" date="07-13-2009" component="ccmsetup" context="" type="3" thread="2720" file="ccmcert.cpp:962">

<![LOG[Skipping certificate that is not valid for ConfigMgr usage.]LOG]!><time="10:26:18.481+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="2720" file="ccmcert.cpp:1740">

<![LOG[The certificate issued to 'server1' doesn't have 'Client Authentication' capability.]LOG]!><time="10:26:18.481+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="2720" file="ccmcert.cpp:449">

<![LOG[Skipping certificate that is not valid for ConfigMgr usage.]LOG]!><time="10:26:18.481+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="2720" file="ccmcert.cpp:1740">

<![LOG[The certificate issued to 'server1' doesn't have 'Client Authentication' capability.]LOG]!><time="10:26:18.496+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="2720" file="ccmcert.cpp:449">

<![LOG[Skipping certificate that is not valid for ConfigMgr usage.]LOG]!><time="10:26:18.496+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="2720" file="ccmcert.cpp:1740">

<![LOG[Certificate issued to 'server1' has expired.]LOG]!><time="10:26:18.496+-120" date="07-13-2009" component="ccmsetup" context="" type="3" thread="2720" file="ccmcert.cpp:962">

<![LOG[Skipping certificate that is not valid for ConfigMgr usage.]LOG]!><time="10:26:18.496+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="2720" file="ccmcert.cpp:1740">

<![LOG[The certificate issued to 'server1' doesn't have 'Client Authentication' capability.]LOG]!><time="10:26:18.496+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="2720" file="ccmcert.cpp:449">

<![LOG[Skipping certificate that is not valid for ConfigMgr usage.]LOG]!><time="10:26:18.496+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="2720" file="ccmcert.cpp:1740">

<![LOG[There are no certificate(s) that meet the criteria.]LOG]!><time="10:26:18.496+-120" date="07-13-2009" component="ccmsetup" context="" type="0" thread="2720" file="ccmcert.cpp:1748">

<![LOG[Sending Fallback Status Point message, STATEID='315'.]LOG]!><time="10:26:18.496+-120" date="07-13-2009" component="ccmsetup" context="" type="1" thread="2720" file="ccmsetup.cpp:9165">

<![LOG[State message with TopicType 800 and TopicId {59BB9AC2-BD7F-474B-9A63-A2B56413DCFF} has been sent to the FSP]LOG]!><time="10:26:18.512+-120" date="07-13-2009" component="FSPStateMessage" context="" type="1" thread="2720" file="fsputillib.cpp:730">

<![LOG[The language specific BITS version wasn't found (Failed to download 'WindowsServer2003.WindowsXP-KB923845-x64-ENU.exe' from 'https://messerschmitt.llb.mw.tu-muenchen.de/CCM_Client/x64/BITS25' with error code 0x80040281).]LOG]!><time="10:26:18.512+-120" date="07-13-2009" component="ccmsetup" context="" type="3" thread="2720" file="ccmsetup.cpp:6906">

Both win 2008 servers have the certificates installed, but cannot connect to the SCCM website.

Both win 2003 servers seem not to get any certificate from the certificate authority (win 2008 DC). If I try to request the certificate manually (as domain admin), I always get the message: "The wizzard cannot be started because of one ore more of the following conditions: - There are no trusted CAs availlable; - you do not have the permission to request certificates from the availlable CAs; - the available CAs issue certificates for which you "do not have permissions"

Has anyone a solution for that.

Thanks and Best Regards

Tom