Search the Community

Team, In a recent Security Audit at my workplace , it was found that SSLv3 was enabled on IBCM server. We need to disable SSLv3 , TLSv1 & enable TLSv1.2 . Did anybody done this… Kindly share your Observations.. Also, Any Support article, guide will be of great help. I have done the changes as per reading on Internet under... HKey_Local_MachineSystemCurrentControlSetControlSecurityProviders SCHANNELProtocols Now, my Internet Based clients are not communicating to IBCM server at all. No Policy since the changes made.. Kindly suggest..

I have a strange one here, Ive created a new SCCM deployment exclusively for IBCM clients. The clients are installing and reporting back hardware/software inventory but nothing related to Remote Tools will apply to any client. The policy setup is very simple just the ICBM clients policy (Deployed to all systems) and the default one. Most settings are getting applied like those for the software center but nothing related to remote tools will apply and the feature is listed as installed but not enabled. Yet in the same policy Remote Control is enabled for local administrators. Even editing the default policy to enable remote tools didn't solve the issue. The clients are 7-10 and server 2008R2-2016 Ive tried running a machine policy eval cycle but this is a site wide issue. Can anyone suggest where to start with this ?

Hello, I am looking for some design recommendations for my test environment that I would like to apply to one production environment. I am working with 2 domains (2 forests) with no trust relationships. Domain A : internal Domain B : DMZ From a firewall point of view, only the ports from the internal to the DMZ will be opened. From the internet to the DMZ, only HTTPS will be opened. Currently, I only manage the clients connected to the internal domain. I would like to deploy a new management point in DMZ that will allow me to manage my DMZ clients and my Internet clients. Should I use 2 management points : - one for the DMZ clients - one dedicated to my internet clients If I use only one MP, should I allow Intranet and Internet clients ? The only documents I can find on Technet require too many ports to be opened in the firewall (From DMZ to Internal) and can't be applied to my environment. Thanks.

Hello! I've got a strange issue with Internet Based Client Management where clients are not communicating when outside of the network. Some interesting things I've found in client side logs: LocationServices.log: 1 internet MP errors in the last 10 minutes, threshold is 5. In CCMMessaging.log, I'm seeing a few of these: Post to https://----sccm-01.-------------.org/ccm_system/request failed with 0x87d00231. Interesting Server Side Logs: ClientAuth.log: Error verifying message from client 'GUID:736B0572-FF7D-45BD-84D2-5E5C6C6F6EC8' (0x80090006). Message from GUID:abb9de52-52f6-42fa-8901-9e65513e5faf client failed signature validation Skipping raising MPEvent_ClientAuth_SignatureFailure event because 4 such events were already raised in the past 60 minutes Could not verify message signature for client 'GUID:abb9de52-52f6-42fa-8901-9e65513e5faf'. ClientLocation.log Raising pending event: instance of CCM_LocationServices_LocationBaseChange { ClientID = "GUID:abb9de52-52f6-42fa-8901-9e65513e5faf"; DateTime = "20160610201145.755000+000"; NewLocation = "Internet"; OldLocation = "Intranet"; ProcessID = 3264; ThreadID = 1464; }; Unable to retrieve AD forest + domain membership. Error 0x8007054b Some background on the environment: Single server with all roles and SQL (~6,000 clients), 32 GB ram, 24 cores. All clients are well connected - no slow links.Upgraded existing server from SCCM 2012 R2 CU5 to SCCM 1511, then to 1602, then did a backup/restore onto new hardware to get the server from 2008 R2 to 2012 R2 Two domains, both have Discovery Methods set up in SCCM, and clients are working internally Newly configured three-tier CA: Offline root Standalone CA, one subordinate issuing Enterprise CACRL and AIA is published over HTTP. Both CRL and AIA are internet accessible. Group Policy for Trusted Root certificate, and client auto enrollment are both configured. All clients in both domains have the Offline Root Cert in the Computer Accounts Trusted Root store. All clients in both domains are being issued SCCM Client authentication Certs from the CA SCCM Server's DP cert is installed, SCCM DNS is published internally and externally with the same name. NATs and ACLs are working on the firewall, and the mplist test methods do return valid XML internally and externally Where else should I look to troubleshoot / diagnose? It almost seems like something with the CA / certs installed, but I *think* they're correct... Has anyone else had similar issues with IBCM, and how did you fix it? Any help / guidance would be appreciated! Thanks!

Hello All, I am wondering if anybody has a step-by-step for implementing the IBCM for CM? I've read a lot of different articles, but none of them seemed to have all the pieces? Basic idea is to obtain the ability to manage portable devices (laptops) while those devices are off of the domain. EX. teacher laptops that need to be managed via CM while on summer break. There is NO AD in the DMZ. I can open needed ports on the firewall for communication between Primary site server/MP and MP in DMZ. We've got CM1511 fully functional within the domain. Client checks, dns, OSD, WSUS, etc all work great while on the domain. I am looking to put a MP in the DMZ to manage these portable devices, but I am lacking the knowledge to fully implement this solution. Any pointers to a complete guide would be VERY much appreciated.

We currently setup Internet Based Management on our SCCM environment over Native mode. This was initially working for the first 2 years and it was handed over to us, but it has suddenly stopped working, and we suspect an expired certificate somewhere that might be causing the issue. However we have gone through and updated the Certificates on the FQDN of our Internet facing site and also on the SUP (port 8531) as well. However, when I try to hit our internet facing site through https://FQDN/ccn_system/request I get a webpage cannot be displayed error on this. If I attempt to hit the same site through the SUP port https://FQDN:8531 I get the certificate to install and then I can get through the IIS and get a you are not authorized to view this page. So it seems that I can get through on the SUP ports, but not through the HTTPS 443 port. When I check the internet base point whilst on the internal network I get the IIS 7 homepage, and suspect that I should see something similar whilst on an external internal source. I checking through my client logs, and get the following: CCMMessaging: Post to https://FQDN/ccm_system/request failed with 0x87d00231. CcmMessaging Failed in WinHttpReceiveResponse API, ErrorCode = 0x2f78 CcmMessaging Client Location: Current Internet Management Point is FQDN with Version 0 and Capabilities: <Capabilities SchemaVersion ="1.0"><Property Name="SSL" Version="1" /></Capabilities> ClientLocation Location Services: Executing Task LSSiteRoleCycleTask LocationServices 1 internet MP errors in the last 10 minutes, threshold is 5. LocationServices) Executing Task LSSiteRoleCycleTask LocationServices) 2 internet MP errors in the last 10 minutes, threshold is 5. LocationServices Executing Task LSSiteRoleCycleTask LocationServices 3 internet MP errors in the last 10 minutes, threshold is 5. LocationServices Executing Task LSSiteRoleCycleTask LocationServices 4 internet MP errors in the last 10 minutes, threshold is 5. LocationServices Current AD site of machine is AHL LocationServices Executing Task LSSiteRoleCycleTask LocationServices Internet MP error threshold reached, moving to next MP. LocationServices Failed to execute LSExecuteTask LocationServices So I can see that it recognises that it has to be on the Internet Based Management Point, and I can see it verifying it has a valid certificate from the Client logs, would the issue be something on our IIS? Thanks, Stephen

Experts, Wanted to know if this was possible - We are considering SCCM 2012 R2 for a customer, but they have a unique environment where the majority of their workstations are workgroup based computers out there in the wild with no network connections back to homebase. What we're looking to achieve is to stand up a single SCCM 2012 R2 Primary site and configure it for IBCM, then publish a CA web enrollment site out on the internet to register certficates for workgroup workstations. The agents will then be installed manually from an FTP site w/ the switches in place to point back to the Primary Site. I understand the "manual" nature of this, but they're willing to put in the work - I've been trying to get the time to lab this setup out, but figured I'd reach out to this community to see whether anyone has experience with this, or knows whether or not it is even possible? Let me know your thoughts, Thanks in advance!

Hi guys, I'm running through different topics and technet document in order to properly make my SCCM 2012 R2 infrastructure available to internet based clients. Here the background of the beast: Single Site Setup (All roles on the same machine and additional DP's on the intranet side) PKI Certificates implementation is complete and all server roles have been moved to HTTP communication Now comes the question of the Internet availability and it gets tricky. I currently have a TMG 2010 reverse proxy with a single NIC in a DMZ and not joined to AD. According to Microsoft’s documentation, TMG/ISA servers can do SSL Bridging (which needs to access to AD and specific certificates installed) or SSL Tunneling (this one doesn't work with TMG and is simply forwarding requests to the destination host. It can be done by my firewall but it's also the least secure way of working). I also have seen that installing a dedicated MP/DP in the DMZ is a solution but I’m wondering what the best solution is. In my case, I’d rather avoid messing up with TMG and make ADLDS available in the DMZ while setting up a dedicated MP/DP in the same network. Can some of you let me know what their experience is with IBCM implementation, the solution chosen, etc? Thanks for sharing, Fed