Check if the failed clients are in Provisioning Mode. For some reason working clients sometimes is set back to provisioning mode the night after they have been deployed (and that may be caused by a scheduled task).
Check the values “ProvisioningMode” and “SystemTaskExcludes” under the registry key [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CCM\CcmExec]
Change the value“ProvisioningMode” to "False" and delete the data in value
“SystemTaskExcludes” so it is blank. Then restart the SMS Client service. Wait a minute and then check in the ConfigMgr control panel if PKI is enabled again and that all Actions are there.
We have seen this problem and we think it is caused by one or several applications in the Task Sequence that is stuck in a installation loop. The MSI product code detection method was not enough so we added other detection methods, eg a registry value or a file existence, fore those applications.
Beware of that a client you fix can be set to Provisioning Mode again the night after you have fixed it.
Regards
M