Always check your Bios Settings

The following errors were found in our TS logfile of a brand new out of the box machine.

In SSL, but with no client cert

unknown host (gethostbyname failed)

sending with winhttp failed; 80072ee7

Failed to get client identity (80004005)

As standard practice we boot the machine, modify the time, WOL settings and power settings of the laptop and get to imaging.

For this particular problem it wasn't the network drivers that needed to be updated in WinPE or anything with the network. The tech kept looking at the client and the image. The twin that came with the machine imaged at the same time with not problems and we have imaged this laptop model several times before. The orginal error was the a Policy couldn't be found for the Task Sequence. I checked the machine and asked the standard questions. Well I could jump to a command prompt and see the ip address and ping back and forth from the server. Hmmm what could be the issue. Well I was scrolling throught the log above and couldn't make out the problems. Upon checking the ipconfig /all data I saw that the lease expires on Dec 26, 2009.

Well that struck me as odd!!! Looked at the log...wrong date there. It just happened that the OSD Certificate (Native mode) was create on Dec 1, 2010. So since the date was before this certificate existed it couldn't be found. Rebooted, changed the date in the bios and we imaged the machine. The Tech's response, "That is why you're the MVP." Not I just looked at the one thing you assume is always correct.

Inventory Certificates

Ok here is the link to the code to inventory certificates.

http://www.sccm-tools.com/tools/vbscript/vbscript-certificates.html

Inventory Certificates

Recently we found some Native Mode computers that had expired computer certificates. When this happens the client becomes unhealth and thus stops responding. Until the cert is renewed it will just sit in a dead state. Well instead of working "reactively" I want to be "proactive." Now I have found several differnet reasons for certificate renewal errors which I have document one or more here in my blog. With my latest work with Sherry Kissinger, another MVP in the ConfigMgr area we were able to create a VBscript that would pull the cert data and inject into WMI so it can be pulled at inventory time. Since the expiration date (and count down in days) is pulled a report can be run that will tell you if a computer is getting ready to expire or has already occured.

The only difficult issue is that it relies on Capicom, which some admins don't use. It will attempt to register the dlls so it can inventory. I haven't found a better way to do this. .NET offers some but again you are dependent on an installtion of .NET and some other assemblies. Well hopefully I can have some others confirm this works correctly in their test enviroments. I will then post the code here, link from the original post in the Technet Forums and move it into production.

Native machine will not pull down computer certificate

Did you ever have a machine that just won't pull down the Computer certificate? You do everything you can think of and it just doesn't work. When you do a run>MMC.exe and add Certificates to the console then you can right click on personal certificates and request a cert. You might see this error

The certificate request failed because of one of the following conditions:-The request required an exchange certificate from a Certification Authority (CA) that is not started.-You do not have the permissions to request certificates from the available CAs.

if so then you might need to add the EnableDCOM entry to the machine with a value of Y

The EnableDCOM registry entry is located in the following registry subkey:
HKEY_LOCAL_MACHINE\Software\Microsoft\Ole

then restart the machine and wait for GPO to pull down the cert. The client should now be happy again.

http://support.microsoft.com/kb/929494

See this other post on Certificate errors
http://sms-hints-tricks.blogspot.com/2008/02/sccm-client-certificate-problems.html

The ConfigMgr Advanced Client encountered a certificate .... that could not be verified

Have you seen this error message after modifying the Site Certficates on your SCCM 2007 site?


Advanced Client encountered a certificate for Management Point XXX that could not be verified. Message ID 10822

Well if you have the certificates fix then the client will work correctly by sending data and receiving advertisments. The problem is that the cached certs need to be refreshed so the old info is removed.

To do this you need to repair the client. If you change the push setting to include the following command RESETKEYINFORMATION=TRUE or login script "CCMSetup.exe RESETKEYINFORMATION=TRUE " etc

Now you simply need to right click on the client and select Repair and you should see "The SMS Advanced client was repaired. The current version is 4.00.6221.1000" or something similar.

About Configuration Manager Client Installation Properties

SCCM Client Certificate Problems

Do you have a client that refuses to finish the install of the SCCM client because the certificate doesn't have a private key?

There are 2 different solutions. The easiest is to check the cert store under personnal and see if there are any invalid certs. Delete and restart. The other is a more dangerous solution but will correct the problem

I only recommend this solution if you see all the of the following problems:
CCM Setup Log:
Client sucessfully installed
Applicationn Event Log:

Automatic certificate enrollment for local system failed to enroll for one Computer
certificate (0x80090016). Keyset does not exist

ClientIDManagerStartup:
Certificate issued to 'computer.domain.com' doesn't have private key.
RegTask: Failed to get certificate. Error: 0x80040280
RegTask: Failed to get certificate. Error: 0x80040281
Error initializing client registration (0x80040222).


Solution:
Stop the Crypto Service
Rename the folders under the Crypto Folder
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto

Restart the machine and watch the ClientIDManagerStartup log

See this other post on Certification issues
http://sms-hints-tricks.blogspot.com/2009/03/native-machine-will-not-pull-down.html