Peter van der Woude

Not really sure how your clients where getting that content (probably straight from the internet). I would just make sure that .NET 3.5 is installed on all your machines, either via the standard deployment, or by deploying an application that will install it.

You can't stop the machine during the installation of updates. Either let the machine install their updates as scheduled, or just temporarily target a different maintenance window to them.

How are you applying the driver to the machine? Also, are you sure it's the correct driver?

See your post on Technet: http://social.technet.microsoft.com/Forums/en-US/ef546cc1-27b8-4ac4-b827-beb2767d4c02/discovery-and-permissions-single-forest-multiple-domains-in-sccm-2012-r2?forum=configmanagerdeployment

Haven't really payed attention to the "remote" wording, but AFAIK that log file always mentions it like that. Even for local configurations. So it looks like something already goes wrong there. What does your CAS config looks like (number of server, different roles per server)?

Not really, but a machine will always first boot into WinPE. In your case that can simply be your custom WinPE (unless it's really big).

I would definitly remove the roles first, as most of them are "integrated" with IIS.

You're getting all errors like this Failed to sync update 3331cb93-46b3-438c-a5f5-6eda6c76c50a. Error: The Microsoft Software License Terms have not been completely downloaded and~~cannot be accepted. in you wsyncmgr.log. I've seen cases were this was related to not storing the files of WSUS locally (which can be configured during the install of WSUS).

What is that "recovery environment" that you're talking about? Is it just a stripped windows, or winpe version?

What version of WSUS are you running?

Can't you just use the buildin report of Compliance 1 - Overall compliance. With that report you can see the overall compliance of a software update group to a collection.

If so, did you also add the package to the DP?

The provided log files don't show any information about the issue. Please look at the PkgXferMgr.log file and share it.

Did you check the log files for more detailed information?

It indeed would need at least local admin rights to the server.

You could also remove the whole containernodeID part, if it's only bothering. The only reason I putted it in there is to make the search area a bit smaller, but I can imagine that it's not always helpfull.

You can also use an account for installing the site system roles.

I did it only once (well, including my lab, twice) and I can't recall it being really difficult... The main thing was installing the policy module (step 3) In case you keep on getting the 403 error, please check the iis log for more details.

Different locations, domains and trusts, are not really reasons to install a specific site server/system. Numbers are more important, numbers like network connections and the number of clients.

I think you can look at log files like CCMSDKProvider.log and SCClient_<device>@<user>

Do exactly as mentioned by Torsten, it's your best shot. Create a custom security role and scope it to the specific DP.

You could do something like this: http://www.petervanderwoude.nl/post/install-computer-targeted-application-during-os-deployment-via-powershell-and-configmgr-2012/

This is the best I can find: http://blogs.technet.com/b/configurationmgr/archive/2014/01/28/a-complete-guide-to-wake-on-lan-for-configmgr-2007-and-configmgr-2012.aspx

You are aware of the fact to manually create boot images for Windows 8(.1) deployment via ConfigMgr 2012 SP1 (see: http://blogs.technet.com/b/server-cloud/archive/2013/01/28/deploying-windows-8-with-system-center-2012-configuration-manager-service-pack-1.aspx)?

Look at a problematic client in the Windows\CCM\Log directory in the log files that start with Update*. Those log files should give some indication if the client is still able to communicate with ConfigMgr for updates..