Certificate Problem with USMT 3?

[thadkew]

So here's my situation:

I have SCCM server running mixed mode.

Our network environment does not have any certificates at all.

I set up an SMP on one of the DPs, created the folder and gave Everyone full rights.

Created a task sequence to collect data.

SMTS log shows this:

Failed to verify certificate signature for '<MyServer>' (0X80090006)

ClientKeyRequestToSMP failed (0X80090006)

ClientRequestToSMP::DoRequest failed. error=(0X80090006)

 

I have reinstalled the client on the target machine, but it seems to make no difference.

 

Question: Do i need to create some kind of certificate on my server? I mean, there is no chance of getting any certificates created from the DC in our environment.

 

I have checked the certificate store on both the SCCM server and the DP. I've found certs in the SMS folder, and copied them to the Trusted folder. No luck.

 

Please help!

[Eswar Koneti]

Check the Locationservices.log to see if the client is able to communicate with MP or not.

 

Have you checked on any other client PC's if they are able communicate with MP ?

 

 

 

[thadkew]

Check the Locationservices.log to see if the client is able to communicate with MP or not.

 

Have you checked on any other client PC's if they are able communicate with MP ?

 

From the Locationservices.log:

 

"Failed to refresh trusted key information while refreshing mp list."

[Eswar Koneti]

From the Locationservices.log:

 

"Failed to refresh trusted key information while refreshing mp list."

 

Okay,this seems to be Management Point is corrupted.

 

To resolve this problem, you must delete the management point certificate by using the CCMDelCert.exe utility. To do this, follow these steps.

 

Note The CCMDelCert.exe utility is part of Systems Management Server 2003 Toolkit 2. To obtain this toolkit, visit the following Microsoft Web site: http://technet.micro...s/bb676787.aspx

1. Log on to the SMS management point computer by using an account that has administrative permissions.
2. Click Start, click Run, type services.msc in the Open box, and then click OK.
3. In the Services MMC snap-in, right-click SMS_EXECUTIVE, and then click Stop.
4. In the Services MMC snap-in, right-click SMS_SITE_COMPONENT_MANAGER, and then click Stop.
5. Click Start, click Run, type ccmdelcert in the Open box, and then click OK.
    
   You receive the following message: Successfully deleted cert.
6. In the Services MMC snap-in, right-click SMS_EXECUTIVE, and then click Start.
7. In the Services MMC snap-in, right-click SMS_SITE_COMPONENT_MANAGER, and then click Start.

[thadkew]

Answer:

Write a script to delete the Trusted Root Key on the clients. Deploy via SCCM

Then the key will be replaced later on next heartbeat

 

Simple. Brilliant.