MP Rejecting Policy Request from Client - Marked as Blocked

[jka816]

I'm having the following warning popup over and over in the SMS_MP_CONTROL_MANAGER component:

MP has rejected policy request from Client(SMSID = GUID:B1C18985-608A-4CD6-B25F-2D7ADADFD444) because this SMSID is marked as blocked.

The issue is I cannot find a client with that GUID and I'm not blocking any clients within SCCM.

I did a Powershell query for that SMSID as well as blocked devices.

Get-CMDevice | Where-Object { $_.IsBlocked -eq $true}
Get-CMDevice | Where-Object { $_.SMSID -eq 'GUID:E35DAB82-1F79-4850-8383-7A8D7C43E929'}

Both returned no results.

Anyone have any ideas?

[jka816]

I also just checked my MP_RegistrationManager.log file and found the following:

 

Processing Registration request from Client 'GUID:B1C18985-608A-4CD6-B25F-2D7ADADFD444' MP_RegistrationManager 10/21/2016 10:14:54 AM 10920 (0x2AA8)

Begin validation of Certificate [Thumbprint 21C5FF81EE60B855E7FC8F767DA86BAC58DAA51A] issued to 'SMS' MP_RegistrationManager 10/21/2016 10:14:54 AM 10920 (0x2AA8)

Completed validation of Certificate [Thumbprint 21C5FF81EE60B855E7FC8F767DA86BAC58DAA51A] issued to 'SMS' MP_RegistrationManager 10/21/2016 10:14:54 AM 10920 (0x2AA8)

Raising event:

[sMS_CodePage(437), SMS_LocaleID(1033)]

instance of MpEvent_CertRevoked

{

ClientID = "GUID:E19C9C5C-5D8C-408D-A4BB-B7BD4A1441A4";

DateTime = "20161021151454.606000+000";

MachineName = "xxx-sccm1.xxxxxxxxxx.org";

ProcessID = 2948;

Sender = "Client(SMSID = GUID:B1C18985-608A-4CD6-B25F-2D7ADADFD444)";

SiteCode = "XXX";

ThreadID = 10920;

};

MP_RegistrationManager 10/21/2016 10:14:54 AM 10920 (0x2AA8)

Client 'GUID:B1C18985-608A-4CD6-B25F-2D7ADADFD444' is unknown or has an invalid key registered in the database. MP_RegistrationManager 10/21/2016 10:14:54 AM 10920 (0x2AA8)

CCMValidateAuthHeaders failed (0x87d0025e) to validate headers for client 'GUID:B1C18985-608A-4CD6-B25F-2D7ADADFD444'. MP_RegistrationManager 10/21/2016 10:14:54 AM 10920 (0x2AA8)

MP Reg: Failed to verify RegistrationHint, 0x87d0025e. MP_RegistrationManager 10/21/2016 10:14:54 AM 10920 (0x2AA8)

MP Reg: Processing completed. Completion state = 0 MP_RegistrationManager 10/21/2016 10:14:54 AM 10920 (0x2AA8)

This makes me thing there is an issue in the DB but I don't know SQL well enough to fix it.

[GarthMJ]

Why do you think that there is an issue with SQL?

[jka816]

Why do you think that there is an issue with SQL?

I don't think it's an issue with SQL but the database itself, I just don't know SQL well enough to determine if that's true.

 

The warning says "Client 'GUID:B1C18985-608A-4CD6-B25F-2D7ADADFD444' is unknown or has an invalid key registered in the database." This leads me to believe the GUID is somehow associated incorrectly in the DB.

[GarthMJ]

I would think it was more a duplicate certificate than an issue with the db. Did you look for client with the id of E19C9C5C-5D8C-408D-A4BB-B7BD4A1441A4 ?

[jka816]

I would think it was more a duplicate certificate than an issue with the db. Did you look for client with the id of E19C9C5C-5D8C-408D-A4BB-B7BD4A1441A4 ?

Thats te ID of the site server

[jka816]

Nearly two years later I finally fixed the issue so I figured I'd come back and update the thread.

Using:

Get-CMDevice | Where-Object { $_.SMSID -eq 'GUID:B1C18985-608A-4CD6-B25F-2D7ADADFD444'}

I discovered that GUID belonged to the Site Server as I stated above and it showed the client as NOT blocked.

However when running the following SQL Query:

Select * from ClientKeyData where IsRevoked=1

I discovered the client was marked as revoked for some reason. I ran the following to fix it:

Update ClientKeyData set IsRevoked=0 where RecordID=<RECORDID>

You'd need to replace RECORDID with the corresponding record returned in the first query.