Remote Control

[bbedo]

I've got a weird issue that I hope you guys can help me with.

 

I inherited a SCCM 2012 R2 environment that has been running quite well. As part of our SCCM client policy, Remote Tools has been enabled. In addition, our default GPO assigned to client computers has the cmrcservice set to automatic. Everything has been running great for months.

 

Starting Monday, newly loaded client computers (two so far) would show the cmrcservice as Disabled. I've checked the few things I know to check, I would love any insight anyone could give me:

1. GPO: I've RSOP'd both computers and have verified that the Configuration Manager Remote Control service is set to Automatic.
2. SCCM Client Settings. In the Remote Tools section of the Client Properties, I've verified that Remote Control is enabled on the clients and that there are users configured for this etc. Everything appears to be as it should be.
3. The cmrcservice.log file contains only this series of these lines (the same lines for each time the service has been started manually):

   ====== Starting service CmRcService ====== CmRcService 1/28/20158:19:20 AM 5128 (0x1408)
   The ConfigMgr administrator has disabled the Remote Control feature for this machine, Remote Control Service will be disabled now. CmRcService 1/28/2015 8:19:25 AM 5012 (0x1394)
   The service has stopped. CmRcService 1/28/2015 8:19:25 AM 5012 (0x1394)

4. Uninstalled/reinstalled the SCCM client manually. I did see this in the ccmsetup.log:

MSI: Action 8:02:11: SccmRemoteControl_FullDisabled.98C5B086_7EB0_422A_B0A8_674010F525CD

Any ideas?

[checksergio]

https://social.technet.microsoft.com/Forums/systemcenter/en-US/edcbdc02-7dc5-4651-a499-6c0fb3fc0685/remote-control-disabled?forum=configmgrgeneral

 

Are you having the same issue described above?

[bbedo]

Hi checksergio, thanks for the quick reply.

 

I did see that post during my Google-fu before posting. I scanned through it, but ultimately decided to skip it as:

 

• that post described SCCM 2007/WinXP and my issue is with SCCM2012R2/Win7
• consistency with new installs (I've verified three more machines this morning since my initial post). I'm leaning towards something server-side because of this (please correct me if I'm off here)
• these computers are currently in production so I won't have immediate access to them to check some GUI-related settings.

 

That said, if those items don't preclude me, I'll be happy to try them. Let me know what you think, and if I need to, I'll make arrangements to get access to one of the machines.

[bbedo]

For whatever it's worth, I modified the patch file included on https://social.technet.microsoft.com/Forums/systemcenter/en-US/edcbdc02-7dc5-4651-a499-6c0fb3fc0685/remote-control-disabled?forum=configmgrgeneral and ran it against one of the affected computers. Afterwards, I ran gpupdate /force and then tried to enable/start the cmrcservice. It did the same thing as before: immediately disabling, stopping, and writing the "administrator has disabled" message in the cmrcservice.log file.

[bbedo]

Ok, it seems I've found the issue and rectified it -- I'm standing by with cautious optimism. Here's what fixed it:

 

Our internal root CA certificate was set to expire at the end of this year. We've already issued a new RootCA certificate and all new machines are pulling client certificates signed off of the new root CA certificate.

 

The SCCM server had a new certificate based on the new root CA as well one based on the old root CA.certificate. Once I removed the old certificate, the service began working properly.