Peter van der Woude

Could it be that the old WDS is still responding?

If you're not using ConfigMgr for the OS deployment, then yes the solution is in tuning the combination of the Heartbeat Discovery and the Clear Install Flag. As long as the console still shows client YES, then the automatic client push will not be performed.

How are you deploying per user to a devices collection? Are you using programs set to Only when a user is logged on? In that case the changes are that it's sitting and waiting for a user to logon. A deployment straight to a device doesn't have to wait on anything, besides the deadline.

Yes, you could still use old-school packages like you did before. Personally I would look into the application model to also take advantage of things like supersedence.

It can't resolve the name of the site system. Make sure the client can resolve the site system via something like DNS.

If you are using ConfigMgr to manage to devices than you will get the information after enabling the Endpoint Protection in the client settings. It doesn't matter how and when the Endpoint Protection was installed.

You can use the site backup to perform a restore on the new server.

Don't know the exact report, but you should be able to get that information from the reports in the Hardware category.

Correct you can use the collection to scope the endpoint protection administrators.

There is not much ConfigMgr can do for you when it comes to applying specific licenses to specific users. The only thing you can do is deploy the software with a specifc license and target it to a specific collection. That would be a hell of a job if you have a different license per user/ device and that would be a standard method when you've got one license for all users/ devices.

The only other thing I can imagine is that you configured Update distribution points on a schedule on those packages.

You can find the problem in your CcmMessaging.log file. It shows the following error ERROR_WINHTTP_NAME_NOT_RESOLVED which explains itself.

I'm seeing errors like this [We do not find an available volume to store the local data path]. Usually it's an indication that it's trying to use the attached media as a location to put the image.

You don't have the tab in the properties of the DP, but that doesn't mean you can't control it. When the DP is installed on the secondary site server you can manage the throttling settings via the File Replication node in the console, as I mentioned before.

I've created an PDF that contains the content of the series I did about integrating Microsoft Intune and System Center 2012 R2 Configuration Manager with Single Sign-On. All the following parts are covered in the PDF: How to integrate Microsoft Intune and System Center 2012 R2 Configuration Manager with Single Sign-On – Part 1: Introduction and prerequisites; How to integrate Microsoft Intune and System Center 2012 R2 Configuration Manager with Single Sign-On – Part 2: Install and configure Active Directory Federation Service; How to integrate Microsoft Intune and System Center 2012 R2 Configuration Manager with Single Sign-On – Part 3: Configure directory synchronization; How to integrate Microsoft Intune and System Center 2012 R2 Configuration Manager with Single Sign-On – Part 4: Integrate ConfigMgr and Microsoft Intune. Before this link was only available via my own blog, but it's now also available for a wider audience here at windows-noob. The guide can be downloaded here:https://gallery.technet.microsoft.com/How-to-integrate-Intune-cb04f7a5

It should available via Hierarchy Configuration > File replication.

To prevent jumping back-and-forth between threads, see the reply's here: https://social.technet.microsoft.com/Forums/en-US/7f087548-c4ff-42b5-a6ac-18e2cde123ba/internet-mp-not-allowing-clients-to-connect?forum=configmanagerdeployment

That indeed sounds plausible .

Yes, PowerShell would be the way. Three things you need to do and they are relatively easy to find online, read the CSV, loop through the users, add the user to a collection via Add-CMUserCollectionDirectMembershipRule.

You shouldn't be wanting that... first of all it's totally unsupported to alter the database for something like that and second why?

It indeed shouldn't be to difficult anymore. As long as you're not changing anything at the root certificate level, it should be simply adjusting the certificates in IIS.

Check if the request arrives and what the message is displayed. When it's a 403 message, look at the number behind that as it will provide more details about the exact error.

I would look at the certificates. Check the IIS log files for more detailed information.

Correct, to be able to manage the Endpoint Protection agent you need ConfigMgr.

Can the client resolve the Internet FQDN of the MP on the Internet?