Free Tech Answers

Removing Automatic Configuration Script for Proxy Settings from Local Area Network (LAN) Settings in Windows 10 or Windows 11

noreply@blogger.com (Allen Madding) — Thu, 16 May 2024 19:53:00 +0000

reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v AutoConfigURL /t REG_SZ /d "" /f

reg add "HKLM\SYSTEM\ControlSet001\Services\iphlpsvc\Parameters\ProxyMgr\{883B4436-66F2-4B58-9C91-84E325BE6D13}" /v AutoConfigURL /t REG_SZ /d "" /f

SCCM MECM MCM Configuration Manager Taking a Long Time to Update Collections

noreply@blogger.com (Allen Madding) — Thu, 09 Nov 2023 15:24:00 +0000

When Configuration Manager takes a long time to update device collections, there are several possible causes to evaluate.

First, go to Monitoring - Collection Evaluation Queue and review Full Evaluation Queue and Manual Evaluation Queue

Any evaluation exceeding 2 minutes is suspect. If it is a handful of collections, carefully evaluation the collection selection criteria.

If there a numerous collections exceeding 2 minutes (in our case we found numerous exceeding 20 minutes), evaluation of the SQL database performance tuning is recommended as Configuration Manager may run better when the site database is configured at a different SQL Server CE compatibility level.

Refer to the following Microsoft Article:

https://learn.microsoft.com/en-us/troubleshoot/mem/configmgr/alerts-reports-queries/sql-query-times-out-or-console-slow-performance

Configuration Manager installs utilizing SQL Server 2014, SQL Server 2016, SQL Server 2017, SQL Server 2019, and SQL Server 2022 experiencing slower than normal collection evaluations can be improved when the site database is configured at a SQL Server CE compatibility level of 110.

Compatibility level can be set by running the following SQL Query:

ALTER DATABASE <ConfigurationManager_DataBase Name>

SET COMPATIBILITY_LEVEL = 110;

Uninstall Google Chrome Extensions/Apps From Command Line

noreply@blogger.com (Allen Madding) — Tue, 03 Oct 2023 17:38:00 +0000

Google Sheets

"C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory=Default --uninstall-app-id=fhihpiojkbmbpdjeoajapmgkhlnakfjf

Google Drive

"C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory=Default --uninstall-app-id=aghbiahbpaijignceidepookljebhfak

Google Docs

"C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory=Default --uninstall-app-id=mpnpojknpmmopombnjdcgaaiekajbnjb

Gmail

"C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory=Default --uninstall-app-id=fmgjjmmmlfnkbppncabfkddbjimcfncm

Youtube

"C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory=Default --uninstall-app-id=agimnkijcaahngcdmfeangaknmldooml

Google Slides

"C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory=Default --uninstall-app-id=kefjledonklijopmnomlcbpllchaibag

Silent Uninstall Azure Data Studio

noreply@blogger.com (Allen Madding) — Mon, 05 Jun 2023 13:19:00 +0000

C:\Program Files\Azure Data Studio\unins000.exe /SILENT

Silent Uninstall Attribute Changer

noreply@blogger.com (Allen Madding) — Mon, 05 Jun 2023 13:18:00 +0000

C:\Program Files\Attribute Changer\unins000.exe /SILENT

Windows 11 Machines With MECM / SCCM Client Installed Do Not Have Check for Online for Updates from Microsoft Update Drop down From Windows Update

noreply@blogger.com (Allen Madding) — Wed, 18 Jan 2023 17:55:00 +0000

Windows 11 Machines With MECM / SCCM Client Installed Do Not Have Check for Online for Updates from Microsoft Update Drop down From Windows Update

Two registry keys set by MECM client causes this issue (which does NOT cause this issue with Windows 10). Deleting these two registry values returns this functionality:

reg delete "HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows\WindowsUpdate" /V UpdateServiceUrlAlternate /F

reg delete "HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows\WindowsUpdate" /V DoNotConnectToWindowsUpdateInternetLocations /F

Windows 11: Setting Check for Updates to Check Against Microsoft Online

noreply@blogger.com (Allen Madding) — Fri, 16 Dec 2022 20:32:00 +0000

If you need a computer to check against Microsoft for latest updates and the option is missing in the Settings menu, the following will enable it.

1-Close Settings menu.

2-Open Registry Editor.

3-Navigate to :

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate

4-Modify the value of key from 0 to 1

5-Launch Setting and check the updates menu for drop down options for expected 'link' option

(Restart is not needed)

Error Installing Cisco Anyconnect Secure Mobility Client: Must Be Admin to Install

noreply@blogger.com (Allen Madding) — Thu, 17 Nov 2022 13:25:00 +0000

Click Start and type “regedit” in the box.

A dialogue box will pop up with the following text: Do you want to allow the following program to make changes to this computer?

Click Yes.

Browse to the following location: HKEY_CLASSES_ROOT\Installer\Products\

Within the Products folder, locate and delete the registry key which contains product information for Cisco AnyConnect. (We recommend making a backup of this registry key before deleting it.)

Each registry key within Products is an alphanumeric string. Select the first key and look on the right side for ProductName REG_SZ Cisco Anyconnect Secure Mobility Client. Go through each key in the Products folder until you find the one for Cisco AnyConnect.

For example,

the registry key GUID for Cisco Anyconnect Secure Mobility Client v4.4 is 31D43F43B3678C84490E6DDCF38F2486

the registry key GUID for Cisco Anyconnect Secure Mobility Client v4.5 is 89A926BE96E58E04ABE93C3998F959D9

the registry key GUID for Cisco Anyconnect Secure Mobility Client v4.10.05111 is A5EF3288780FD794198D259C9799A4B0

Each version of Cisco Anyconnect Secure Mobility Client will have a different GUID for this registry key.

Close the registry editor.

Install the latest version Cisco Anyconnect Secure Mobility Client.

MP Control Manager Detected User Service is not Responding to HTTP Requests. The HTTP status code and text is 12175, . Message ID: 5490 Source: SMS Server Component: SMS_MP_Control_Manager

noreply@blogger.com (Allen Madding) — Fri, 28 Oct 2022 14:56:00 +0000

This error was encountered on a MECM Management Point using PKI certificates for IBCM. The cause of the error was discovered to be an expired certificate.

Open CERTLM (Certificates - Local Computer\Personal\Certificates) and review expiration date for all listed certificates. Reissue any expired certificates and import.

Uninstall Windows Built-in Apps With Powershell

noreply@blogger.com (Allen Madding) — Thu, 05 May 2022 11:22:00 +0000

The following Powershell script uninstalls Windows built-in apps for all users on a machine with specific exceptions:

$GoodPackages = 'Camera',

'Calculator',

'Microsoft.WindowsCalculator',

'Microsoft.WindowsCamera',

'Microsoft.SecHelathUI',

'Microsoft.VP9VideoExtension',

'Microsoft.WebMediaExtensions',

'Microsoft.WindowsTerminal',

'Microsoft.Paint',

'Microsoft.MSPaint',

'Microsoft.MicrosoftEdge*',

'Microsoft.Net*',

'Microsoft.WindowsNotepad',

'MicrosoftTeams',

'Microsoft.MicrosoftStickyNotes',

'Microsoft.ScreenSketch',

'Office',

'OneNote for Windows 10',

'Notepad',

'snip & sketch',

'Voice Recorder'

$packages = Get-AppxPackage -allusers | Where-Object {$_.Name -notin $GoodPackages}

foreach ($package in $packages) {

Remove-AppxPackage -allusers $package.PackageFullName

}

$provisionedPackages = Get-AppxProvisionedPackage -online | Where-Object {$_.displayName -notin $GoodPackages}

foreach ($provisionedPackage in $provisionedPackages) {

Remove-AppxProvisionedPackage -online -packageName $provisionedPackage.PackageName

}

RSAT Fails to Install on Windows 11 Installer Encountered an Error: 0x8024001d

noreply@blogger.com (Allen Madding) — Tue, 03 May 2022 19:12:00 +0000

When attempting to install RSAT tools on Windows 11, an error is encountered

This error is a result of the installer being unable to access online content from Windows Update.

To quickly resolve this issue, make a temporary change to the registry settings on the machine.

Start

Run

Regedit

Navigate to:
Computer\HKEY_Local_Machine\Software\Policies\Microsoft\Windows\WindowsUpdate\AU

change the value for UseWuServer from 1 to 0

Start or Restart the WindowsUpdate Service from Services.msc

Reattempt to install RSAT

once RSAT tools are installed, reset the registry key to 1

Restart WindowsUpdate

MECM SCCM: Site Component Manager Failed to Install Component, Because Microsoft Installer File for This Component (bgbisapi.msi) Could Not Install

noreply@blogger.com (Allen Madding) — Thu, 03 Mar 2022 15:31:00 +0000

Issue

After installing a MECM hotfix update, the following error began showing in Component Status for SMS_NOTIFICATION_SERVER:

Site Component Manager Failed to Install Component, Because Microsoft Installer File for This Component (bgbisapi.msi) Could Not Install

Source: SMS Server

Component: SMS_NOTIFICATION_SERVER

Severity: ERROR

Message ID: 4951

Resolution

Restore Performance Counter Registry Settings

On the Site Server, open a command prompt with administrator privileges
run the following command:
LODCTR /R

If the command fails with error code 2, run the command again:
LODCTR /R
Restart the Site Server

Microsoft Endpoint Configuration Manager - MECM - SCCM Error: Distribution Manager Failed to Find or Create the Define Share or Folder on Distribution Point

noreply@blogger.com (Allen Madding) — Wed, 02 Feb 2022 13:37:00 +0000

Configuration Manager Error

While reviewing:

Monitoring - Overview - Distribution Status - Distribution Point Group Status - All Distribution Points

Noted error distributing content:
Distribution Manager Failed to Find or Create the Define Share or Folder () on Distribution Point

=================================================

Summary

The Distribution Manager failed to find or create the defined share or volume on the distribution point for distributing the package.

Causes

This condition could occur because Windows NT distribution points might not have at least one available NTFS drive.

Resolutions

Verify that there is at least one NTFS drive with enough free disk space to store the package. Then, verify that the distribution point directory exists, has the proper permissions, and is accessible.

=====================================================================

Upon reviewing distmgr.log on site server, noted the following error:

Failed to find a drive with 83,958,980 KBytes of free disk space SMS_DISTRIBUTION_MANAGER

Resolution:

Increased drive capacity on distribution server

Microsoft Endpoint Configuration Manager MECM SCCM Failed to Decode Message Hook Authenticate Error 0x87d00309 InvokeDecodingHooks failed 0x87d00309 HandleRemoteSyncSend Failed Cforwarder_Sync:Send failed

noreply@blogger.com (Allen Madding) — Thu, 27 Jan 2022 14:35:00 +0000

After upgrading to MECM current version 2111, deployments were not progressing, imaging was failing, devices all showing offline in Assets and Compliance - Devices.

Upon reviewing CcmMessaging.log (C:\Windows\CCM\logs) on a client machine, the following error messages were noted:

Failed to decode message.

Hook authenticate. Error 0x87d00309

InvokeDecodingHooks failed (0x87d00309).

HandleRemoteSyncSend failed (0x87d00309).

CForwarder_Sync::Send failed (0x87d00309).

CForwarder_Base::Send failed (0x87d00309).

After coming through server logs, discovered an issue with Active Directory Publishing

In Endpoint Configuration Manager console: Administration - Hierarchy Configuration - Active Directory Forests

Publishing Status was blank Right Clicked domain for domain properties

When domain properties displayed, clicked Publishing tab Site was not checked under "Select the site that will be published"

checked the checkbox by the sitename

clicked OK

Publishing status updated to display "Insufficient Access Rights"

MECM AD Forest publishing requires that the Management Points computer accounts have full access to the System Management OU in AD

Launched Active Directory User and Computers

Clicked View and select Advanced

expanded domain expanded System

right clicked System Management

clicked properties

clicked Security tab

Noted only one MP listed with full access, but permissions were "This Object Only"

Changed permissions to "This object and all descendant objects" (as per https://docs.microsoft.com/en-us/mem/configmgr/core/servers/deploy/configure/publish-site-data)

Added computer account for second MP, granted full access and set permissions to "This object and all descendant objects"

Clicked OK

Closed AD Users and Computers

Refreshed screen in MECM console for Administration - Overview - Hierarchy Configuration - Active Directory Forests

After a few minutes, publishing displayed "Succeeded"

After 30 minutes, devices began to show online in Assets and Compliance - Devices

After an hour, deployments began to show progress.

Tested imaging a workstation and it completed successfully.

LanSweeper Scanner Stuck IP Scanning

noreply@blogger.com (Allen Madding) — Wed, 12 Jan 2022 14:25:00 +0000

LanSweeper Scanner does not complete scanning devices in IP Scanning queue - IP addresses shown as processing not completing.

Exclude Problematic IP or Device

Try to determine the device with the IP address where the scanner is getting stuck. If unneeded, try excluding the device type or the specific IP address:

From the Scanning Tab, select Scanning Targets, then click Add Exclusion

LanSweeper provides 4 Exclusion Types:

Asset Type, IP Address or Range, Windows Computer, and Workgroup of Domain.

Disable Unneeded Scanning Services

Configuration Tab

Click Server Options

Lower Log Data Retention

On the same page, lower the retention of any or all logs - especially Eventlog Entries

Perform LanSweeper Database Maintenance

On the LanSweeper Scanning Server

Launch Windows Services

Stop the LanSweeper Server Service

Stop IIS Service

Run the LanSweeper Database Maintenance Tool

C:\Program Files (x86)\Lansweeper\Tools\DatabaseMaintenance.exe

Click Truncate Logs

Status will show "In Progress". Status will show "Healthy" when completed.

Click Shrink

Status will show "In Progress". Status will show "Healthy" when completed.

Click Rebuild Index

Status will show "In Progress". Status will show "Healthy" when completed.

Close the LanSweeper Database Maintenance Tool

Restart IIS Express Service

Restart LanSweeper Server Service

Deploying Windows Metro Apps With Microsoft Endpoint Configuration Manager (MECM) Without the Microsoft Store Installed

noreply@blogger.com (Allen Madding) — Wed, 01 Dec 2021 20:22:00 +0000

To Deploy Windows Metro Apps in Config Manager, first download the desired app

Open a browser and navigate to the Microsoft Store: https://www.microsoft.com/en-us/store/apps/windows

search and locate the desired app

copy the URL from the address bar without the #activetab=pivot:overviewtab

ex: https://www.microsoft.com/en-us/p/windows-camera/9wzdncrfjbbg

convert the link to the actual Microsoft Store item using the website https://store.rg-adguard.net.

change the option RP to Retail then click the check mark

From the results, locate the latest version with the extension appxbundle

to download the app package, copy and paste the link and open it in a new browser tab (clicking for some reason usually doesn't work)

Create a package in MECM console and distribute it with the app

copy the application to a network share

Overview - Software Library - Applications - Packages

Click the Create Package icon

provide the package a name

check the box "This package contains source files" and browse to the network share where the app was saved

click the radio button Do Not Create a Program

Right Click the newly created package

Click Distribute Content

proceed to deploy to all distribution servers

Create a Task Sequence to Install the App

Overview - Software Library - Operating Systems

Expand Task Sequences

Click Apps

Click the Create Task Sequence icon

Name the task sequence

add Run Command Line

name: enable Client License Service
Command Line: cmd /c sc config ClipSVC start = auto

on the options tab check "continue on error"

add Run Command Line

name: Start Client License Service
Command Line: net start ClipSVC

on the options tab check "continue on error"

add Run Command Line

name: Enable Appx Deployment Service
Command Line: ncmd /c sc config AppxSVC start=auto

on the options tab check "continue on error"

add Run Command Line

name: Start Appx Deployment Service
Command Line: net start AppxSVC

on the options tab check "continue on error"

add Run Command Line

Command Line: Xcopy ".\" "C:\Temp" /D /E /C /R /H /I /K /Y /Q

check the Package box

browse to the package created in the previous step

add Run Command Line

Command Line: cmd /c DISM.exe /Online /Add-ProvisionedAppxPackage /PackagePath:C:\Temp\package name downloaded in step one /SkipLicense

add Run Command Line

Command Line: cmd /c del /q c:\temp\package name downloaded in step one

Click OK

Deploy the Task Sequence

Right click the newly created task sequence and deploy it to the appropriate device collection

Change the Internet FQDN for a Configuration Manager (SCCM) (MECM) Distribution Point/Management Point Internet-Based Client Management (IBCM)

noreply@blogger.com (Allen Madding) — Wed, 27 Oct 2021 15:08:00 +0000

To Change the Internet FQDN for a Configuration Manager (SCCM) (MECM) Distribution Point/Management Point Internet-Based Client Management (IBCM)

Open Configuration Manager Console
Navigate to Administration
Site Configuration
Servers and Site System Roles
Click the name of the site system to update
in the lower pane, right click Site System
click Properties
On the General tab, modify the entry "Internet FQDN"
Click OK

Using REG QUERY to Find Uninstallers on Remote Machines

noreply@blogger.com (Allen Madding) — Fri, 24 Sep 2021 11:34:00 +0000

One of the most tedious tasks a System Administrator or Information Security Analyst faces is locating the proper uninstaller to remove unauthorized or vulnerable application software package from a remote client machine.

The Command line command REG QUERY is your friend.

Open a command prompt with administrator level access and enter the following command:

REG QUERY \\RemoteMachineName\HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall /s

This command returns all uninstaller information listed

REG QUERY \\RemoteMachineName\HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall /s

This command returns all uninstaller information listed under the WOW6432Node section

Review the information from these two commands, and locate the uninstaller required.

SCCM MECM Configuration Manager Client not downloading content from distribution point Error: CTM encountered error processing reply from DTS. Code 0x80096004

noreply@blogger.com (Allen Madding) — Mon, 12 Jul 2021 12:43:00 +0000

Configuration Manager Client not downloading content from distribution point. Verified a distribution point was properly assigned to the applicable boundary group and that the distribution point had the content in question.

Reviewing the CCMCACHE folder on the client machines, found folders created for the content in question but no actual content. Began reviewing log files in C:\Windows\CCM\Logs

In CAS.LOG: Error CTM encountered error processing reply from DTS. Code 0x80096004

Error Code: 0x80096004 (2148098052)

Error Name: TRUST_E_CERT_SIGNATURE

Error Source: Windows

Error Message: The signature of the certificate cannot be verified.

The client was registered using the self-signed certificate issued to 'SMS' Client is configured to use HTTPS when available

In the CAS.log

both http and https locations are being returned for content locations

When the issue occurs, the following events occur leading to the 0x80096004 error:

CTM job {A18CC6C5-2A7B-4D84-B4C2-3EB1EC1F22EF} switched to location 'xxx/SMS_DP_SMSPKG$/ACC00A5E'

CTM job {B64D5D76-3846-4415-84F4-503722AF09C8} switched to location 'http://xxx/SMS_DP_SMSPKG$/ACC00A70'

CTM job {A0E7A3F6-76C6-449A-BB13-2C5D5439FE03} switched to location 'http://xxx/SMS_DP_SMSPKG$/Content_81f1d394-c68c-4d8e-8fdd-33756a934992.1'

CTM encountered error processing reply from DTS. Code 0x80096004

CTM job {620B0A00-D1D8-4115-A7D1-962E268AFCCF} entered phase CCM_DOWNLOADSTATUS_PREPARING_DOWNLOAD

CTM encountered error processing reply from DTS. Code 0x80096004

CTM job {A0E7A3F6-76C6-449A-BB13-2C5D5439FE03} entered phase CCM_DOWNLOADSTATUS_PREPARING_DOWNLOAD

CTM job {A18CC6C5-2A7B-4D84-B4C2-3EB1EC1F22EF} entered phase CCM_DOWNLOADSTATUS_PREPARING_DOWNLOAD

CTM encountered error processing reply from DTS. Code 0x80096004

CTM job {B64D5D76-3846-4415-84F4-503722AF09C8} entered phase CCM_DOWNLOADSTATUS_PREPARING_DOWNLOAD

CTM encountered error processing reply from DTS. Code 0x80096004

In the DataTransferService.log:

Completed validation of Certificate [Thumbprint F49997EE2BB8A7ABC5A7B9FE929B08B969DD7981] issued to 'xxx'

Failed to verify if the cert is sccm issued. Error 0x80096004

Completed validation of Certificate [Thumbprint F49997EE2BB8A7ABC5A7B9FE929B08B969DD7981] issued to 'xxx'

Begin validation of Certificate [Thumbprint F49997EE2BB8A7ABC5A7B9FE929B08B969DD7981] issued to 'xxx'

DTS job: '{F3496177-0337-4DDA-9672-473BEFB7BEFD}' AddTransportSecurityOptionsToBITSJob failed: (0x80096004)

Completed validation of Certificate [Thumbprint F49997EE2BB8A7ABC5A7B9FE929B08B969DD7981] issued to 'xxx'

Failed to verify if the cert is sccm issued. Error 0x80096004

DTS job: '{FCAA0817-C92F-46E4-AD39-C1E23B25BCAA}' AddTransportSecurityOptionsToBITSJob failed: (0x80096004)

Resolution:

Connect to the Primary Site Server's Configuration Manager Admin Console and reviewed the properties for the applicable Distribution Point.

On the Communications Tab, found the self-signed certificate's expiration date had passed.

Updated the self-signed certificate's expiration date.
On the distribution server, opened CertLM.MSC from and administrator command prompt and reviewed.

Found SMS Issuing certificate was not in the Personal Store nor the Trusted Root. Exported SMS Issuing Certificate from the site server and imported into Personal Store and the Trusted Root on the problematic Distribution Server.
Reviewed IIS Manager on the Distribution Server:
Default Website
SMS_DP_PKG$
Authentication

Found Windows Authentication missing

Opened Server Manager
In Server Manager, click the Manage menu, and then click Add Roles and Features.
In the Add Roles and Features wizard, click Next. Select the installation type and click Next. Select the destination server and click Next.
On the Server Roles page, expand Web Server (IIS), expand Web Server, expand Security, and then select Windows Authentication. Click Next.
On the Select features page, click Next.
On the Confirm installation selections page, click Install.
On the Results page, click Close.

Restarted Distribution Server
Reviewed DataTransferService.log and found successfully completed downloads

SCCM MECM Configuration Manager: Troubleshooting Windows Update Deployments (WSUS) - Clients Not Showing Progress and Clients With Unknown Status

noreply@blogger.com (Allen Madding) — Thu, 24 Jun 2021 18:19:00 +0000

When reviewing Windows Update Deployments in Configuration Manager Monitoring - Deployments, administrator discovers numerous clients showing unknown status and complaint status is not incrementing.

Troubleshooting

Start by utilizing the built in tools in the Configuration Manager Reporting:

Navigate to Monitoring - Reporting - Reports
Expand "Software Updates - E Troubleshooting"
run the report "Troubleshooting 1 - Scan Errors"
run the report "Troubleshooting 2 - Deployment Errors"
run the report "Troubleshooting 3 - Computers Failing With Specific Scan Error"
run the report "Troubleshooting 3 - Computers Failing With Specific Deployment Error"
Review the reports

Possible Errors Found:

Error Code -2145107934 Hex Error Code 80244022 "Same as HTTP Status 503 - the service is temporarily overloaded"

and

Error Code -2145107940 Hex Error Code 8024401C "Same as HTTP status 408 - the server timed out waiting for the request"

these errors indicate a possible issue with the WSUS IIS Application Pool.

Resolution:

Review the WSUS IIS Application Pool in II Manager

If it is stopped, this may indicate the service is crashing due to lack of adequate resources and may need to be optimized.

Restart the WSUSPOOL in IIS Manager
Optimize the Service:
IIS Manager > Application Pools > WsusPool > Advanced Settings
make the following changes to the settings for the WSUSPool:

Queue Length: 2000 (default 1000)
Idle Time-out (minutes): 0 ( default 20)
Ping Enabled: False (default True)
Private Memory Limit (KB): 0 (unlimited) (default 1,843,200 KB)
Regular Time Interval (minutes): 0 (to prevent a recycle) (default 1740)

image source: https://docs.microsoft.com/en-us/troubleshoot/mem/configmgr/windows-server-update-services-best-practices#disable-recycling-and-configure-memory-limits

helpful articles:
https://patchmypc.com/troubleshooting-sccm-clients-with-unknown-update-state

https://docs.microsoft.com/en-us/troubleshoot/mem/configmgr/windows-server-update-services-best-practices#disable-recycling-and-configure-memory-limits

SCCM MECM Configuration Manager Clients Not Checking in With Management Point, Server Certificate Retrieved in TLS is Not an Exact Match of the Current MP Encryption Certificate 0x80004005

noreply@blogger.com (Allen Madding) — Tue, 22 Jun 2021 21:56:00 +0000

Issue:

After migrating to a new management point, many clients were not checking into the management point. When reviewing the Devices under Assets and Compliance, many clients were showing offline even though the were actually online and responded to ping from the server.

Reviewing the logs on the client machines, the CCM Notification log CCMNotificationAgent.log showed:

Server Certificate Retrieved in TLS is Not an Exact Match of the Current MP Encryption Certificate 0x80004005

Reviewing logs on the management point server, the BGB Server Log bgbserver.log showed:

Expecting More Data From Client

and

Can't Finish Connecting With Client, Which Might Have Already Disconnect System.IO.IOException: Authentication Failed Because the Remote Party Has Closed the Transport System

Reviewing the Configuration Manager Console

Administration - Hierarchy Configuration - Active Directory Forests

Publishing Status showed Authentication Failure

Reviewed properties of Domain Forest and Use Computer Account of Site Server was checked

Resolution:

In Active Directory Users and Computers Click View and check Advanced

Expand System OU

Grant the Site Server's Computer Account Full Permissions on the System Management container

This article was helpful in resolving the issue: http://eskonr.com/2019/12/client-assignment-failed-from-http-to-https-with-error-code-failed-to-verify-message-could-not-retrieve-certificate-from-mpcert/

Moving Microsoft Endpoint Configuration Manager (MECM) (formerly SCCM) to the Cloud

noreply@blogger.com (Allen Madding) — Fri, 11 Jun 2021 13:18:00 +0000

While there are a couple different methods to move a Configuration Manager Site Server to the cloud, we recommend utilizing the Site Server High Availability approach. This allows the administrator to build a new site server in Passive mode in the cloud (in addition to your existing site server that is in active mode) and then promote it to active to test connectivity. If all connectivity is not functional, the administrator can promote the original site server to active. This approach provides a safe method of continual testing until all connectivity has been validated.

Microsoft provides the following article configuring the Configuration Manager Site Server High Availability : https://docs.microsoft.com/en-us/mem/configmgr/core/servers/deploy/configure/site-server-high-availability

Our experience found a few items missing in the Microsoft article which we will cover in this post.

Prerequisites for Installing a Passive Primary Site Server

.NET Framework installed
Remote Differential Compression installed
Windows ADK installed
SQL Server Native Client installed.
Must have its computer account in the local Administrators group on the site server in active mode.
Must have its computer account in the local Administrators group on each distribution point.
Must install using source files that match the version of the site server in active mode.
Can't have a site system role from any site installed on it before you install the site server in passive mode role.
The site content library must be on a remote network share. Both site servers need Full Control permissions to the share and its contents. (If the site content library resides on the existing site server, it will have to be moved)

Moving the Site Content Library to a Remote Network Share

Microsoft provides the following article on moving the site content library: https://docs.microsoft.com/en-us/mem/configmgr/core/plan-design/hierarchy/the-content-library#bkmk_remote

Create a folder in a network share as the target for the content library. For example, \\server\share\folder. (Don't reuse an existing folder with content. For example, don't use the same folder as your package sources. Because, before copying the content library, Configuration Manager removes any existing content from the location you specify.)

In the Configuration Manager console, navigate to the Administration workspace. Expand Site Configuration, select the Sites node, and select the site. On the Summary tab at the bottom of the details pane, notice a new column for the Content Library.
Select Manage Content Library on the ribbon.
In the Manage Content Library window, the Current Location field shows the local drive and path. Enter a valid network path for the New Location. This path is the location to which the site moves the content library. It must include a folder name that already exists on the share (for example: \\server\share\folder.)
Select OK.
Monitor the Status value in the Content Library column on the Summary tab of the details pane. It updates to show the site's progress in moving the content library. While In progress, the Move Progress (%) value displays the percentage complete. (Make a cup of coffee! If you have a large content library, you may see 0% progress in the console for a while - a VERY LONG WHILE. For example, with a 1 TB library, it has to copy 10 GB before it shows 1%. Review distmgr.log, which shows the number of files and bytes copied. Starting in version 1810, the log file also shows an estimated time remaining.) If there's an error state, the status displays the error. Common errors include access denied or disk full.
When complete it displays Complete.

NOTE: We recommend enabling 8DOT3NAMES on the server volume where the Site Content Library will reside as some file names combined with fully qualified server name and temporary directory names may exceed the 255 character limit. For more information, see this article: https://knowledge.kofax.com/Capture/Kofax_Capture/Scan/Enable_8dot3_File_Name_Creation

Preparing the Site Database

Both site servers must use the same site database. The database can be remote from each site server or reside on the original site server.

Both site servers need the sysadmin security role on the instance of SQL Server that hosts the site database. The original site server already has these roles.

Add them for the new site server.

Microsoft kindly provides the following SQL script adds these roles for the new site server VM2 in the Contoso domain:

SQL

USE [master]

CREATE LOGIN [contoso\vm2$] FROM WINDOWS WITH DEFAULT_DATABASE=[master], DEFAULT_LANGUAGE=[us_english]

ALTER SERVER ROLE [sysadmin] ADD MEMBER [contoso\vm2$]

Both site servers need access to the site database on the instance of SQL Server. The original site server should already have this access, so add it for the new site server. For example, the following SQL script adds a login to the CM_ABC database for the new site server VM2 in the Contoso domain:

SQL

USE [CM_ABC]

CREATE USER [contoso\vm2$] FOR LOGIN [contoso\vm2$] WITH DEFAULT_SCHEMA=[dbo]

The site server in passive mode is configured to use the same site database as the site server in active mode. The site server in passive mode only reads from the database. It doesn't write to the database until after it's promoted to active mode.

Adding a Site Server in Passive Mode

In the Configuration Manager console, navigate to the Administration workspace, expand Site Configuration, select the Sites node, and select Create Site System Server in the ribbon.
On the General page of the Create Site System Server Wizard, specify the server to host the site server in passive mode. (Note: The server you specify can't host any site system roles before installing a site server in passive mode.)

The wizard performs the following initial prerequisite checks:
The selected server isn't a secondary site server
The selected server isn't already a site server in passive mode
The site's content library is in a remote location
On the Site Server In Passive Mode page, choose the following option:

Use the source files at the following network location: Specify the path directly to the contents of the CD.Latest folder from the site server in active mode.
( \\Server\SMS_ABC\CD.Latest where "Server" is the name of the site server in active mode, and "ABC" is the site code.)
Complete the wizard. Configuration Manager then installs the site server in passive mode on the specified server.
Both site servers will be displayed on the Nodes tab in the Sites node of the console. All Configuration Manager site server components are in standby on the site server in passive mode. The Windows services are still running.

Configure Windows Firewall on the new Site Server in Passive Mode

Windows Firewall will need to be configured to accommodate traffic to the existing site server and to the distribution points

Recommendation: Export the windows firewall configuration from the existing site server and importing windows firewall configuration into the new passive primary server

Promote the Site Server in Passive Mode to Active Mode

In the Configuration Manager console, navigate to the Administration workspace, expand Site Configuration, and select the Sites node.
Select the site, and then switch to the Nodes tab. Select the site server in passive mode, and then select Promote to active in the ribbon. Select Yes to confirm and continue.
Refresh the console node. The Status column for the server you're promoting displays in the Nodes tab as Promoting.
Make a cup of coffee this may take up to an hour or more
After the promotion is complete, the Status column shows OK for both the new site server in active mode, and for the new site server in passive mode.
In the Configuration Manager console, navigate to the Monitoring workspace, select Distribution Point Configuration Status.

Monitor each distribution point by clicking the details tab for each.

After promoting the new Site Server, each will eventually display:
"IIS was successfully configured on the distribution point"
and eventually
"Distribution Point installation/upgrade successfully completed"

If errors are displayed for failure to communicate with the distribution point, review Windows Firewall settings on the newly created site server and verify the newly created site server's computer account is in the local Administrators group on each distribution point.

Moving the Site Database

After monitoring all services and remediating any issues raised by promoting the new site server, prepare to move the site database from the old site server to the new site server.

The following article outlines this process well: https://www.deploymentresearch.com/moving-the-configmgr-current-branch-database-to-another-server-as-in-back-to-the-primary-site-server/

Stop ConfigMgr Services on the New Site Server

Locate preinst.exe in one of the subdirectories under the ConfigMgr installation directory .(for instance: E:\Program Files\Microsoft Configuration Manager\bin\X64\00000409)
From an administrator command prompt: preinst.exe /stopsite
Grab a cup of coffee as this process took approximately one hour to complete.
When Preinst.exe has completed, verify the following services have been stopped:
AI_UPDATE_SERVICE_POINT
CONFIGURATION_MANAGER_UPDATE
SMS_NOTIFICATION_SERVER

by executing the following PowerShell commands:
Get-Service -Name AI_UPDATE_SERVICE_POINT
Get-Service -Name CONFIGURATION_MANAGER_UPDATE
Get-Service -Name SMS_NOTIFICATION_SERVER

If any of these services shows running, stop them by executing the following PowerShell commands:
Stop-Service -Name AI_UPDATE_SERVICE_POINT
Stop-Service -Name CONFIGURATION_MANAGER_UPDATE
Stop-Service -Name SMS_NOTIFICATION_SERVER

Backup the Site Server Database on the Old Site Server

On the old site server, open using SQL Server Management Studio, and locate the site server database. (typical naming convention: CM_sitecode) Your mileage may vary.
Make a full backup of the ConfigMgr database:
Backup type: FULL
Destination: DISK (provide a name and provide a file location that can be accessed from both the old and new server)
Once the backup is completed, make note of the database settings by running the following SQL query:
select name, collation_name, user_access_desc, is_read_only, state_desc, is_trustworthy_on, is_broker_enabled,is_honor_broker_priority_on from sys.databases
Install SQL Server on the New Site Server (it can be the same or newer version as on the old site server)
Run the following query in SQL Server Management Studio to enable CLR Integration:
sp_configure 'clr enabled', 1
Reconfigure

Restore the Database Backup on the New Site Server

Copy the SQL backup from old site server to a local drive on the new site server
Restore the backup using SQL Server Management Studio.
Once the backup is restored, review the database configuration by running the following query in SQL Server Management Studio:
select name, collation_name, user_access_desc, is_read_only, state_desc, is_trustworthy_on, is_broker_enabled,is_honor_broker_priority_on from sys.databases
Several database settings are not restored and the database may not be Online. To resolve this, run the following query in SQL Server Management Studio:
USE master
ALTER DATABASE (CM_sitecode) ONLINE
ALTER DATABASE (CM_sitecode) SET ENABLE_BROKER
ALTER DATABASE (CM_sitecode) SET TRUSTWORTHY ON
ALTER DATABASE (CM_sitecode) SET HONOR_BROKER_PRIORITY ON

Setup ConfigMgr to use the Database on the New Site Server

Verify .Net Framework 3.5 SP1 is installed on your server. (ConfigMgr setup requires .NET Framework!)
Note the SQL Server Logon account on the old site server and set the new site server SQL database login account identically. (NOTE: This process will fail if you leave the logon account set as NTSERVICE\MSSQLSERVER.)
Locate Setup.exe in the cd.latest folder under the ConfigMgr Install Directory (example: E:\Program Files\Microsoft Configuration Manager\cd.latest\smssetup\bin\x64)
Run Setup.exe
On the Available Setup Option page, select the Perform site maintenance or reset this site option, and click Next.
On the Site Maintenance page, select the Modify SQL Server configuration option, and click Next.
On the Database Information page, type in the NEW Site Server fully qualified name, and click Next.
If the setup fails, review the log (see the convenient button) and review.
Once setup has completed successfully, reboot both site servers
Once both servers are back online, Monitor Configuration Manager Console to confirm that ConfigMgr has removed the site database role from old site server and the new site server shows the site database role.

Transfer Additional Roles to the New Site Server

Move Reporting Services Role

install and configure reporting service in SQL on new server
remove reporting services role on old server
add reporting services role on new server

Move Asset Intelligence Role

remove role on old server
add role on new server

Move Endpoint Protection Role

remove role on old server
add role on new server

Move Service Connection Point Role

remove role on old server
add role on new server

Move Software Update Point Role

configure WSUS on new server
remove role on old server
add role on new server

Update Preferred Management Point in Boundary Groups if Used

Launch Console
Navigate to the Administration – Site Configuration – Sites node
select Hierarchy Settings from the site server
Verify that "Clients prefer to use management points specified in boundary groups option" is enabled from the General tab.

If "Clients prefer to use management points specified in boundary groups option" is enabled, update the management point specified in each boundary group:

Navigate to the Administration –Boundary groups
Right click a Boundary group
Click Properties
Click the References Tab
Replace any existing Management Point server name with the name of the new site server
Repeat for each boundary group

Note: This change will take up to 24 hours to update the client machines.

source: https://www.anoopcnair.com/sccm-preferred-management-points-selection/

Move Source Files for Applications, Packages Drivers, Etc

Copy Source_File Share From Old Server to New Server
Update the content source locations for Applications, Packages, Drivers, Etc

Recommendation: Utilize the ConfigMgr Content Update Source Tool From MSEndpointMgr.com:
https://msendpointmgr.com/2017/02/23/configmgr-content-source-update-tool-version-1-0-2-released/
This tool can copy the files and update the content source locations inside of Config Manager

Perform SCCM Configuration Manager Site Reset

Run Configuration Manager Setup from <SCCM site installation folder>\BIN\X64\setup.exe.
Select Perform Site Maintenance or Reset the Site
Click Next
Select Reset the Site With No Configuration Changes
When prompted "Your Site will be reset with default file and registry permissions. Are you sure? Click YES
Make a cup of coffee as this will take 10-15 minutes while the wizard will perform the following steps:
Stopping Configuration Manager services.
Setting up server accounts.
Updating directory permissions.
Upgrading site control information.
Updating registry.
Installing site component manager.
Verifying directory permissions.
Once it displays Core Setup Has Completed, you can review the log file by click View Log or simply click Close

Monitor Content Distribution Until Completion

After changing the source file location for all content, Config Manager will redistribute all content. Depending on the size of the site content, this may take several days. Monitor the content distribution until completed before proceeding to decommission the original site server.

In the Configuration Manager console, navigate to the Monitoring workspace, expand Distribution Status, and select Content Status.

Decommission Original Site Server

Verify all site server roles have been added to the new site server that were on the old site server.
One by one, remove the roles on the old site server and monitor Config Manager for proper operation (including imaging workstations). After confidence is gained that all is well, remove the original site server.
In the Configuration Manager console, navigate to the Administration workspace, expand Site Configuration, select the Servers and Site System Roles node
Click on the old site server
Right Click on the Site Server Role
Click Remove Role

Remove SMS Provider Role

On the new site server, navigate to \BIN\X64\setup.exe in the Configuration Manager site installation folder.
run Setup.exe
On the Getting Started page, select Perform site maintenance or reset this site.
On the Site Maintenance page, select Modify SMS provider configuration.
On the Manage SMS providers page, select the option Uninstall the specified SMS provider
Select the name of the computer from which you want to remove the SMS provider.

Remove Component Server Role

Once all site system roles have been removed, the Component server role will automatically be removed after all other site system roles are removed. There will be a delay until a scheduled cleanup task is run.

You can expedite the removal by restarting the Windows service SMS_SITE_COMPONENT_MANAGER on the primary site server.

source: https://rothstein.dev/remove-an-sccm-site-system-server/

Remove Old Site Server

Once the Component Server Role is gone from the old site server's roles, the old site server can be deleted.

Right click the old Site Server
Click Delete

Move Content Library to New Site Server (if desired)

In preparing for this migration, we moved the moved the Content Library to a network share (not on either of the site servers) as was required to create a passive site server. If desired, now move the Content Library to the new site server

Microsoft provides the following article on moving the site content library: https://docs.microsoft.com/en-us/mem/configmgr/core/plan-design/hierarchy/the-content-library#bkmk_remote

In the Configuration Manager console, navigate to the Administration workspace. Expand Site Configuration, select the Sites node, and select the site. On the Summary tab at the bottom of the details pane, notice a new column for the Content Library.
Select Manage Content Library on the ribbon.
In the Manage Content Library window, the Current Location field shows the local drive and path. Enter a valid network path for the New Location. This path is the location to which the site moves the content library. It must include a folder name that already exists on the share (for example: \\server\share\folder.)
Select OK.
Monitor the Status value in the Content Library column on the Summary tab of the details pane. It updates to show the site's progress in moving the content library. While In progress, the Move Progress (%) value displays the percentage complete. (Make a cup of coffee! If you have a large content library, you may see 0% progress in the console for a while - a VERY LONG WHILE. For example, with a 1 TB library, it has to copy 10 GB before it shows 1%. Review distmgr.log, which shows the number of files and bytes copied. Starting in version 1810, the log file also shows an estimated time remaining.) If there's an error state, the status displays the error. Common errors include access denied or disk full.
When complete it displays Complete.

FOLLOW UP NOTES:

If after completing this process, clients are not reporting into the new management point, review Active Directory for old Management Point records:

open Active Directory Users and Computers
click View
select Advanced Features
expand the group SYSTEM
expand the group SYSTEM MANAGEMENT
delete any records for the old management point(s)
Grant the computer account for the new site server Full access to the System Management container

Create a New Root CA Certificate and Import it Into Configuration Manager

Create a New Root CA certificate on the new site server
Export the new Root CA certificate to a drive\folder accessible for browsing
In the Configuration Manager console, navigate to the Administration workspace, expand Site Configuration, and select the Sites node.
Click Properties
Click Communication Security tab
Click the Set button
Click the New Sunburst icon
Browse to the new cert
Click Add
Click OK
Delete any old Certs shown in the pane

For more information, see this article: https://azurecloudai.blog/2020/04/03/migrating-sccm-to-use-a-new-certificate-authority/

Task Sequence Deploy Button is Grayed Out Microsoft System Center Configuration Manager / Microsoft Endpoint Configuration Manager

noreply@blogger.com (Allen Madding) — Mon, 21 Sep 2020 19:59:00 +0000

Issue:

If the deploy button is grayed out for an imaging task sequence, it may be because you have not yet created a valid client package.

Resolution:

Package the current client upgrade:

Navigate to: “Software Library” > “Application Management” > “Packages”

Right click the packages node > select “Create package from definition”

Right Click the “Configuration Manager Client Upgrade” package > Select “Distribute Content”

distribute the content to all distribution servers

Update the Imaging Task Sequence:

Navigate to: “Software Library” > “Operating System Deployment” > Right click the imaging task sequence > Edit

Update the “Setup Windows and Configuration manager” step with the new Client Package created above.

The “Deploy” option should now be available

Windows Deployment Server (WDS) / Microsoft System Center Configuration Manager / Microsoft Endpoint Configuration Manager/ Error 0x102 When PXE Booting

noreply@blogger.com (Allen Madding) — Mon, 21 Sep 2020 19:53:00 +0000

Issue:

When PXE booting after an upgrade to Configuration Manager, PXE timed out with error 0x102.

reviewing the smspxe.log revealed "no advertisements found"

reviewed imaging task sequence and boot.wim boot image

found task sequence had not been associated with new boot image

Resolution:

Open Config Manager Console

Software Library

Operating Systems

Task Sequences

right click the task sequence - properties - advanced tab, ticked "Use a boot image" then browse to the boot image.

redeploy the task sequence to all workstations and unknown computers.

How To Trigger an Update to Microsoft Office O365 From The Command Line

noreply@blogger.com (Allen Madding) — Mon, 31 Aug 2020 20:08:00 +0000

O365 Update:

"C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe" /update user

Silent:

"C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe" /update user displaylevel=false forceappshutdown=true

Update a List of Machines Using PSTOOLS:

psexec @computers.txt -d -n 3 cmd /c “C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe” /update user updatepromptuser=false forceappshutdown=true displaylevel=false

text file named computers.txt contains a list of computer names to update

(with 3 seconds timeout)

Source credits:

https://serverfault.com/questions/979000/update-office-without-opening-an-office-application

TechNet Blog: Office365 and its associated command-line and switches