hollisorama

I rebooted both the site server and db server multiple times while troubleshooting. This has been happening since December. The event viewer has no error messages. Site components are good except for from inventory dataloader size and delta issues that I'm trying to clean up.

My site backup task is running. The logs show both the Site components and SQL DB backups completing successfully. It seems like the notification messages never get back to the site server. Site Server smsbkup.log LogEvent(): Successfully logged Event to NT Event Log. (4 - 48 - 1,073,746,880) SMS_SITE_BACKUP 1/17/2015 7:51:46 PM 5200 (0x1450) FinalSnapshotPath = \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\PROGRAM FILES\MICROSOFT CONFIGURATION MANAGER\INBOXES\. SMS_SITE_BACKUP 1/17/2015 7:51:46 PM 5200 (0x1450) Backup Succeeded for Component - SI4Backup\SiteServer\SMSServer\inboxes. SMS_SITE_BACKUP 1/17/2015 7:53:40 PM 5200 (0x1450) FinalSnapshotPath = \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\PROGRAM FILES\MICROSOFT CONFIGURATION MANAGER\LOGS\. SMS_SITE_BACKUP 1/17/2015 7:53:40 PM 5200 (0x1450) Backup Succeeded for Component - SI4Backup\SiteServer\SMSServer\Logs. SMS_SITE_BACKUP 1/17/2015 7:53:48 PM 5200 (0x1450) FinalSnapshotPath = \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\PROGRAM FILES\MICROSOFT CONFIGURATION MANAGER\DATA\. SMS_SITE_BACKUP 1/17/2015 7:53:48 PM 5200 (0x1450) Backup Succeeded for Component - SI4Backup\SiteServer\SMSServer\data. SMS_SITE_BACKUP 1/17/2015 7:53:48 PM 5200 (0x1450) FinalSnapshotPath = \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\PROGRAM FILES\MICROSOFT CONFIGURATION MANAGER\SRVACCT\. SMS_SITE_BACKUP 1/17/2015 7:53:48 PM 5200 (0x1450) Backup Succeeded for Component - SI4Backup\SiteServer\SMSServer\srvacct. SMS_SITE_BACKUP 1/17/2015 7:53:48 PM 5200 (0x1450) FinalSnapshotPath = \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Program Files\Microsoft Configuration Manager\install.map. SMS_SITE_BACKUP 1/17/2015 7:53:48 PM 5200 (0x1450) Backup Succeeded for Component - SI4Backup\SiteServer\SMSServer. SMS_SITE_BACKUP 1/17/2015 7:53:48 PM 5200 (0x1450) FinalSnapshotPath = \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Program Files\Microsoft Configuration Manager\BackupTemp\SMSbkSiteRegSMS.dat. SMS_SITE_BACKUP 1/17/2015 7:53:48 PM 5200 (0x1450) Backup Succeeded for Component - SI4Backup\SiteServer\SMSbkSiteRegSMS.dat. SMS_SITE_BACKUP 1/17/2015 7:53:48 PM 5200 (0x1450) Waiting On SQL Backup for component sccmsi4 to complete... SMS_SITE_BACKUP 1/17/2015 7:53:48 PM 5200 (0x1450) Sleeping for 30 seconds... SMS_SITE_BACKUP 1/17/2015 7:53:49 PM 5200 (0x1450) Sleeping for 30 seconds... SMS_SITE_BACKUP 1/17/2015 7:54:19 PM 5200 (0x1450) Database Server smsbkup.log Updating the status to [snapshot done]. SMS_SITE_SQL_BACKUP_P-SC-SCM04.DOMAIN.NET 1/17/2015 7:50:50 PM 2420 (0x0974) Starting the backup complete phase. SMS_SITE_SQL_BACKUP_P-SC-SCM04.DOMAIN.NET 1/17/2015 7:50:50 PM 2420 (0x0974) Backup Succeeded for Component - SCCMSI4. SMS_SITE_SQL_BACKUP_P-SC-SCM04.DOMAIN.NET 1/17/2015 7:52:42 PM 2420 (0x0974) Updating the database status to [sCCMSI4:Succeeded;]. SMS_SITE_SQL_BACKUP_P-SC-SCM04.DOMAIN.NET 1/17/2015 7:52:42 PM 2420 (0x0974) Successfully created the backup metadata file - E:\Site_Backup\SI4Backup\SiteDBServer\\SQLBackupDocument.xml SMS_SITE_SQL_BACKUP_P-SC-SCM04.DOMAIN.NET 1/17/2015 7:52:42 PM 2420 (0x0974) Info: Starting asynchronous BackupComplete... SMS_SITE_SQL_BACKUP_P-SC-SCM04.DOMAIN.NET 1/17/2015 7:52:42 PM 2420 (0x0974) Info: Asynchronous BackupComplete finished. SMS_SITE_SQL_BACKUP_P-SC-SCM04.DOMAIN.NET 1/17/2015 7:52:43 PM 2420 (0x0974) After BackupComplete SQL Writer status = STABLE. SMS_SITE_SQL_BACKUP_P-SC-SCM04.DOMAIN.NET 1/17/2015 7:52:43 PM 2420 (0x0974) Updating the status to [backup completed]. SMS_SITE_SQL_BACKUP_P-SC-SCM04.SDOMAINNET 1/17/2015 7:52:43 PM 2420 (0x0974) SQL backup completed - Sat Jan 17 19:52:43 2015 SMS_SITE_SQL_BACKUP_P-SC-SCM04.DOMAIN.NET 1/17/2015 7:52:43 PM 2420 (0x0974) Waiting for the Event Notification... SMS_SITE_SQL_BACKUP_P-SC-SCM04.DOMAIN.NET 1/17/2015 7:52:43 PM 2420 (0x0974) I'm not sure where to go on this. I've tried a bunch of things like permissions, local vs., remote backup target.

The root is staying the same. Thanks for you response.

Thanks Ath3na. I had seen that site too. It seemed straight forward. I just wondered if anyone had done it before and if everything went smooth or if there were any catches. I was concerned that if the certificates got messed up that my clients would not download policy anymore.

From what you describe, I'm having the same issue in my lab environment. My production environment is fine. I thought about building a fresh 2012 R2 lab environment and migrating all my systems to it. Has anyone resolved this?

I have a site with 2 management points running ConfigMgr 2012 SP1 CU3. One of the management points is also the Site Server. The certificates for both of these servers will expire in April so I have a bit of time to figure this out. What is the proper procedure for updating the certificates that are about to expire? Is the only place I need to be concerned about updating IIS? Should I reissue the cert with the same key or different key or should I issue a new certificate with the same key or different key? Your experience is appreciated.

I recently noticed a similar thing. Sometimes Microsoft re-releases an update under the same KB. You may have downloaded the original version but in order for the update to deploy, you have to download the new version.

I tried this method of install and it still fails. Anyone else have any suggestions?? Michael

My SQL server is running 2012 SP1. I just installed CU8 and now I have the same problem. I was going to start by looking here (http://blogs.technet.com/b/configurationmgr/)

The uninstall is specified. So I don't need the old version application source files to be present on the client in order for the new application to call the uninstallation routine? What if it's a script that performs the uninstall?

I'm also hiding the app so it is not displayed in Software Center so users can't accidentally install it before the deadline

I'm also using application supercedence for this deployment. The supercedence rule uninstalls the old version first. I'm my test deployment (from scratch on 3 VMs and 6 computers based on our gold image), I had deployed the old version of the app with ConfigMgr and then deployed the new app with supercedence through ConfigMgr. It all worked flawlessly. In my production deployment, the existing app is already installed on all the computers. Can I just deploy the new version of the app superceding the old or do I need to deploy both the old and the new for the supercedence to work? I wasn't going to deploy the old because the app is part of the gold image already. I hope that makes sense This new deployment will get us off from using the gold image to have the app installed and enable us to use ConfigMgr going forward.

Sweet. Thanks for the confirmation

Hi There. I have a scenario that I want to get some clarification. I think I know how it will work but wonder if I'm understanding it correctly. I have clients across a WAN that I want to deploy an application to but the bandwidth is limited and I can't put local DPs there. I want to prestage the content and then enforce its installation after the server side of the app has been upgraded on Saturday. The collection that the clients are a member has a maintenance window defined daily from 2am to 5am. I was going to deploy the app and make it available for tonight at 8pm thinking that the client would see the deployment and begin to download it. The application deadline is set for 2 days from now on Saturday at 8pm. Am I correct in thinking that the client will install the application tonight at 2am during it's first available maintenance windows?? If so, my plan is to temporarily replace the daily 2am to 5am maintenance window with a maintenance window that starts at the deployment deadline on Saturday at 8pm. It seems to me that then the client would see the application, download it and wait to install until 8pm on Saturday when it would be enforced. I also plan to hide the deployment so that it does not show up in software center. Is my thinking correct?

Could it be something in your detection settings that make it look to the client that it's not installed when it actually is?

There are settings in the ADR (any deployment really) that allow you to specify things like going to Microsoft Update or sharing content with clients in the same subnet

I think having lots of ADRs for EP Definition updates is for the most part unnecessary (but depends on your situation). I have three ADRs for deploying EP updates. One for desktops, one for laptops and one for servers. I do this to allow for different download settings for EP updates. For example, I don't want any of our desktops to go to Microsoft Update to download definitions because that would put a heavy load on our WAN links that are already starved for bandwidth (As all internet/datacenter and a lot of the telco traffic goes through the main campus - not the design I would choose). They have to go to a DP. (I also control this through the Antimalware Policy) However, for servers, if they can't get the definition on a DP in the datacenter, I'm OK with them going to the internet because they have a lot more bandwidth available to them because they are all in the datacenter. Likewise, I allow sharing content on the local subnet (BrancheCache) for the desktop ADR because some are in small remote sites without a DP so that should cut down a bit on WAN utilization, but for server I don't need that because they have a local DP. I think it's a really good idea though to have lots of collections (Really as many as you need for granularity) for deploying the Antimalware policies for servers. We have only two policies for desktops and laptops but we have at least 10 policies for different server workloads. I basically set up a collection for each of the in box antimalware policies for each Microsoft workload we have in the environment. We have those policies ordered in such a way that precedence applies the settings in the way we desire. We have a one-to-one correlation between an Antimalware Policy and a collection targeting that type of workload. Then we use global security groups (Of which computer objects are members) to define rules for the collections for the various workloads (SQL, Web, TMG, Exchange, etc) Because we have servers that run multiple workloads (Say SQL & Web) a computer object is in both the SQL and Web groups, and they will find their way into both those EP collections (Web & SQL 2008) and receive the cumulative effect of the antimalware policies created for those different workloads. The main policy differences are in what gets excluded from scanning.

I found some helpful suggestions here http://social.technet.microsoft.com/Forums/en-US/9c34add1-5261-4dcf-b3f6-7c26ef4fcd28/sccm-2012-sp1-offline-servicing-failed-to-install-update?forum=configmanagerosd and here http://blogs.technet.com/b/systemcenterpfe/archive/2013/01/11/updated-system-center-2012-configuration-manager-antivirus-exclusions-with-more-details.aspx

Have you followed the full guide? It shows how to deploy EndPoint to all your systems. At a high level, You need to specify client settings and target those EndPoint Protection client settings at a collectio nthat contains the devices you want to manage. Then, you need to think about Anti-Malware Policies and definition update mechanisms.

Have you created a subscription under the Alerts node on the Monitoring work area?

I'd like to help you offline as there is potentially a lot wrapped up in your request and it would be difficult to write a post that addresses it in enough detail to be helpful One quick thing. Workgroup computer installations need to be done manually. You could write a script to make it less painful.

Alright. Problem solved. The message "HTTP is selected for Client. The current state is 0" is because we have clients that are on ConfigMgr 2007 and the site is in mixed mode. All clients have the registry key HKLM\SOFTWARE\Microsoft\CCM\Httpsstate set to 0. Clients need to have this value set to 63 for a ConfigMgr 2012 site set only for PKI to be able to install the client via a SUP. This does not affect Client Push installation methods. It is an aparent bug that has been reported to Microsoft. See the thread http://social.technet.microsoft.com/Forums/en-US/67d85763-f787-4a8f-99c4-0ffa1a392829/client-install-via-wsus-fails?prof=required and look for the post near the bottom that says "Issues with GPO/WSUS SCCM 2012 (CM12) (HTTPS/PKI/Native) Client Installation/Upgrade from SCCM 2007 (CM07) (HTTP Mixed Mode) Client" The fix is to use group policy preference (Computer Configuration) to set the key to 63 and scope it to clients that you are migrating to ConfigMgr 2012. I made this setting part of my GPO I'm using for SUP client deployment.

Didn't know there was a CU2 yet. I'll look into that option

I have a similar issue with EndPoint Protection definition updates that run every 8 hours via an ADR tied to my Software Update Point sync schedule which is set for 8 hours. I look at the distmgr.log and the package is successfully processed, but about 50% of clients show "Calling back with empty distribution points list" when they are looking for the package. If I perform and "Update Content" for the EndPoint Protection package, they all pick up the location and install the updates within the hour. Not sure what this is all about. It doesn't even happen all the time. Usually my morning Definition Update causes the most problems and runs at 5:30am.

I changed my SU Point to sync every 8 hours. My ADRs are set to run after every SUS sync. Now my EndPoint protection Software Update Group only shows the most recent definition update so I don't have this issue any more. I am having an issue where my content package isn't always distributed properly so 50% of clients can't find the content until I perform an update of the distribution point for the definition package but that's probably a separate issue.