SCEP unable to reinstall if removed

[zick]

Got a strange issue.

SCCM 1606

SCEP is setup and has been working for a while.

If we image a PC (Windows 10 1803), SCCM automatically deploys the SCEP policy and is successfully managed by SCCM.

However, in some case we need to changed the policy to a standalone as the PC will not be able to communicate w/ the server. It's basically the same policy except it doesn't include our WSUS for definition updates and only go out to the internet.

If we uninstall SCEP from Programs and Features and then run SCEPInstall.exe /policy <path>\StandAlonePolicy.xml right after imaging, it works fine.

But if we wait too long and the SCEP client gets updated to a newer version, trying the same thing again fails w/ 0x80070002 "The system cannot find the file specified". I have tried just the SCEPInstall.exe w/out the policy and get the same error. At this point, I have not be able to get the PC to have a working SCEP client no matter what I do (aside from reimaging). Even SCCM is unable to reapply the default SCEP policy as the EndpointProtectionAgent.log shows the same error;

 

Create Process Command line: "C:\WINDOWS\ccmsetup\SCEPInstall.exe" /s /q /policy "C:\WINDOWS\CCM\EPAMPolicy.xml".

Detail error message is : [EppSetupResult]
HRESULT=0x80070002
Description=Cannot complete the System Center Endpoint Protection installation. An error has prevented the System Center Endpoint Protection setup wizard from completing successfully. Please restart your computer and try again. Error code:0x80070002. The system cannot find the file specified.

 

Maybe our process of changing the policy is incorrect so feel free to correct us.

Thanks