Deploying SCCM 2007 client using SUP?

[GopherRob]

We recently installed a fresh SCCM 2007 site on our existing WSUS 3.0 SP1 server. To get SCCM to properly exist with WSUS, we also did a fresh install of WSUS 3.0 SP1 and cancelled at the config screen as instructed.

 

We don't want to disable the windows firewall or open a broad range of ports to install the new SCCM client, so we are having issues pushing the client. This caused me to look at deploying it through the SUP, but ever since performing the fresh install of WSUS on the SCCM server, client machines (with the old SMS 2003 client) are not commuticating with the WSUS portion of SCCM. On client machines I am seeing the following error messages in the Windowsupdate.log file.

 

2010-03-25 12:08:07:307 1164 780 PT WARNING: Cached cookie has expired or new PID is available

2010-03-25 12:08:07:307 1164 780 PT Initializing simple targeting cookie, clientId = 62cb241f-4ebb-4022-adb4-dae37fe97b7be, target group = , DNS name = testbox.domain.com

2010-03-25 12:08:07:307 1164 780 PT Server URL = http://WsusServerName/SimpleAuthWebService/SimpleAuth.asmx

2010-03-25 12:08:07:323 1164 780 PT WARNING: GetAuthorizationCookie failure, error = 0x80244019, soap client error = 10, soap error code = 0, HTTP status code = 404

2010-03-25 12:08:07:323 1164 780 PT WARNING: Failed to initialize Simple Targeting Cookie: 0x80244019

2010-03-25 12:08:07:323 1164 780 PT WARNING: PopulateAuthCookies failed: 0x80244019

2010-03-25 12:08:07:323 1164 780 PT WARNING: RefreshCookie failed: 0x80244019

2010-03-25 12:08:07:323 1164 780 PT WARNING: RefreshPTState failed: 0x80244019

2010-03-25 12:08:07:323 1164 780 PT WARNING: PTError: 0x80244019

2010-03-25 12:08:07:323 1164 780 Report WARNING: Reporter failed to upload events with hr = 80244019.

 

I have changed our GPO for WSUS from http://WSUSServerName to http://WSUSServerName:8530 since port 8530 is what the SUP is configured to use, where our old WSUS was using 80.

 

Despite forcing a group policy update and running wuauclt.exe /detectnow, this error persists.

 

Any ideas and input would be appreciated, as we need to get the new sccm client out on the domain ASAP.

 

Thanks!

[GopherRob]

So I tried pushing the client manually today and it seems to be working...except it only did half the machines that I sent it to, and now is giving me the following warning for the component SMS_MP_CONTROL_MANAGER:

 

MP has rejected a policy request from GUID:GUIIDofMachineHere because it was not approved. The operating system reported error 2147942405. Access is denied.

 

This is occuring frequently, almost non stop.

[GopherRob]

Any ideas about this? I think I am going to try to move the database to a remote server, as the server is running at 80% memory utilization non stop with the database being on a local SQL 2008 instance. I'm not sure if it will help or not, but I've seen several articles that list resource utilization as a possibility for this error.

 

If anyone else has any input it would be greatly appreciated.

[anyweb]

Microsoft recommends keeping sql on box so i wouldn't move it, you can adjust the amount of RAM sql eats if you want help with that i'll tell you,

 

as regards your other problem, are we talking one boundary here or more than one ? and more than one site ?

[GopherRob]

Microsoft recommends keeping sql on box so i wouldn't move it, you can adjust the amount of RAM sql eats if you want help with that i'll tell you,

 

as regards your other problem, are we talking one boundary here or more than one ? and more than one site ?

One boundary, where the domain is the boundary. We had an SMS 2003 site, but the site name was not the same and it has since been decommissioned and all entries removed from the AD system management container.

 

It appears that the client installed successfully on most machines, but the MP is rejecting them for some reason. IS the problem here with the MP or the clients?

[GopherRob]

Is there something I can run on the client to get it talking right? I guess that doesn't matter until I can get the MP to start accepting policy requests?

[GopherRob]

So after some more digging, the problem seems to be duplicate SMSUIDs from imaged machines.

 

Testing now on deleting the smscfg.ini file from "C:\windows\" and restarting the CCMexec service. I deleted the old entry from the SCCM console for the computer and set AD discovery to run as soon as possible. I'm hoping this does the trick.

[GopherRob]

I'm at a loss. Even after removing and reinstalling the client, the newly generated SMS Unique ID is identical to what it was before. Why on earth is it generating the same UID? I know for a fact these machines were ghostwalked and given new SIDs when deployed, so I can't for the life of me figure out why they are constantly generating duplicate IDs. Any thoughts?

[anyweb]

are they Dell gx260s ?

[GopherRob]

are they Dell gx260s ?

No. It's a mix of GX620, Optiplex 745, 755, and 960 machines.

 

Some are also dual boot iMacs. Quite a mix. Can I use ccmdelcert.exe in combination with tranguid.exe and possibly get them working? In theory, I imagine this process "Should" work.

 

-Delete SMSCFG.INI (located in C:\Windows)

-Run CCMDELCERT.EXE

-Stop the "SMS Agent Host" service (needed to restart the SCCM client to generate a new SMSCFG.INI file)

-Start the "SMS Agent Host" service

-Run TRANGUID.EXE (this is what will regenerate the GUID and force the SCCM client to talk to the server)