Hi everyone, Tyler Franke here once again with another troubleshooting tip for you.  Consider the following scenario:

In an otherwise healthy and functional site you find one or more of the following.

1) SMS Site Control Manager Site status message:

SMS Site Control Manager
Message ID: 2816
Message: The actual site control file %1 does not exist.
Solution: The SMS server components cannot function without this file. SMS Site Control Manager will shut down SMS Executive immediately. Contact Microsoft for help in restoring the actual site control file.

2) The following error in the sitectrl.log:

The delta site control file "D:\Program Files\Microsoft Configuration Manager\inboxes\sitectrl.box\incoming\.<site> via the SMS SDK on Mon Feb 27 17:32:41 GMT. The record was assigned the serial number 788 at site <site>. SMS_SITE_CONTROL_MANAGER 2/27/2012 11:33:06 AM 16676 (0x4124)
STATMSG: ID=2807 SEV=I LEV=M SOURCE="SMS Server" COMP="SMS_SITE_CONTROL_MANAGER" SYS= SITE= PID=34520 TID=16676 GMTDATE=Mon Feb 27 17:33:06.925 2012 ISTR0="D:\Program Files\Microsoft Configuration Manager\inboxes\sitectrl.box\incoming\" ISTR1="Microsoft.ConfigurationManagement.dll" ISTR2="AD\E143665" ISTR3="%computername%" ISTR4="" ISTR5="2012 02 1 27 17 32 41 000" ISTR6="788" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=0 SMS_SITE_CONTROL_MANAGER 2/27/2012 11:33:06 AM 16676 (0x4124)
Wrote temporary file "D:\Program Files\Microsoft Configuration Manager\inboxes\sitectrl.box\temp\000003D2.ct0". SMS_SITE_CONTROL_MANAGER 2/27/2012 11:33:06 AM 16676 (0x4124)
Copied file "D:\Program Files\Microsoft Configuration Manager\inboxes\sitectrl.box\sitectrl.ct0" to "D:\Program Files\Microsoft Configuration Manager\inboxes\sitectrl.box\history\000003D1.ct0". SMS_SITE_CONTROL_MANAGER 2/27/2012 11:33:06 AM 16676 (0x4124)
WARNING: Could not move file "D:\Program Files\Microsoft Configuration Manager\inboxes\sitectrl.box\temp\000003D2.ct0" to "D:\Program Files\Microsoft Configuration Manager\inboxes\sitectrl.box\sitectrl.ct0". The operating system reported error 32: The process cannot access the file because it is being used by another process. SMS_SITE_CONTROL_MANAGER 2/27/2012 11:33:06 AM 16676 (0x4124)
Sleeping for five seconds... SMS_SITE_CONTROL_MANAGER 2/27/2012 11:33:06 AM 16676 (0x4124)

WARNING: Failed to complete processing of delta site control file "D:\Program Files\Microsoft Configuration Manager\inboxes\sitectrl.box\incoming\g0hrz08y.CT1". SMS_SITE_CONTROL_MANAGER will try to process the file again later. SMS_SITE_CONTROL_MANAGER 2/27/2012 11:34:07 AM 16676 (0x4124)
ERROR: The master site control file "D:\Program Files\Microsoft Configuration Manager\inboxes\sitectrl.box\sitectrl.ct0" does not exist. SMS_SITE_CONTROL_MANAGER will shut down SMS_EXECUTIVE immediately. SMS_SITE_CONTROL_MANAGER 2/27/2012 11:34:07 AM 16676 (0x4124)
STATMSG: ID=2816 SEV=E LEV=M SOURCE="SMS Server" COMP="SMS_SITE_CONTROL_MANAGER" SYS= SITE= PID=34520 TID=16676 GMTDATE=Mon Feb 27 17:34:07.132 2012 ISTR0="D:\Program Files\Microsoft Configuration Manager\inboxes\sitectrl.box\sitectrl.ct0" ISTR1="D:\Program Files\Microsoft Configuration Manager\inboxes\sitectrl.box" ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=0 SMS_SITE_CONTROL_MANAGER 2/27/2012 11:34:07 AM 16676 (0x4124)
SMS_EXECUTIVE is stopping... SMS_SITE_CONTROL_MANAGER 2/27/2012 11:34:07 AM 16676 (0x4124)

3) The following error in the MPControl.log:

SMS_MP_CONTROL_MANAGER 2/27/2012 12:05:33 PM 36352 (0x8E00)
SMS_MP_CONTROL_MANAGER received START notification. SMS_MP_CONTROL_MANAGER 2/27/2012 12:05:33 PM 36352 (0x8E00)
MPStart(): RegOpenKeyEx(MPNotify) returned 2. SMS_MP_CONTROL_MANAGER 2/27/2012 12:05:33 PM 36352 (0x8E00)
SMS_MP_CONTROL_MANAGER failed to start with 0x80070002 SMS_MP_CONTROL_MANAGER 2/27/2012 12:05:33 PM 36352 (0x8E00)
SMS_EXECUTIVE started SMS_MP_CONTROL_MANAGER as thread ID 37408 (0x9220). SMS_MP_CONTROL_MANAGER 2/27/2012 1:05:52 PM 39744 (0x9B40)

4) Service control manager events reporting that SMS_EXECUTIVE is terminating unexpectedly:

Log Name: System
Source: Service Control Manager
Date: 2/27/2012 10:12:55 PM
Event ID: 7034
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: %computername%
Description: The SMS_EXECUTIVE service terminated unexpectedly. It has done this 3 time(s).

Cause

This can potentially be caused by one of more of the following:

1) File system corruption.
2) No Anti-virus scanning exclusion for %programfiles%\Microsoft Configuration Manager\Inboxes.
3) Someone manually or improperly editing the sitectrl.ct0 file on the site.

Resolution

To resolve this issue, execute and complete a site reset on the affected site server to create a new sitectrl.ct0 file.

More Information

About Performing a Site Reset: http://technet.microsoft.com/en-us/library/bb633159.aspx

How to Perform a Site Reset: http://technet.microsoft.com/en-us/library/bb694286.aspx

Tyler Franke | Senior Support Escalation Engineer

Get the latest System Center news onFacebookandTwitter:

App-V Team blog: http://blogs.technet.com/appv/
ConfigMgr Support Team blog: http://blogs.technet.com/configurationmgr/
DPM Team blog: http://blogs.technet.com/dpm/
MED-V Team blog: http://blogs.technet.com/medv/
Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
Operations Manager Team blog: http://blogs.technet.com/momteam/
SCVMM Team blog: http://blogs.technet.com/scvmm
Server App-V Team blog: http://blogs.technet.com/b/serverappv
Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center Essentials Team blog: http://blogs.technet.com/b/systemcenteressentials
WSUS Support Team blog: http://blogs.technet.com/sus/

The Forefront Server Protection blog: http://blogs.technet.com/b/fss/
The Forefront Endpoint Security blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/

Hi everyone, Tyler Franke here again with one more issue I ran into recently.  Consider a scenario where you have your System Center Configuration Manager 2007 (ConfigMgr) site database on a remote/dedicated SQL Server wherein a drive fails or has to be replaced.  Afterward, the 'Backup ConfigMgr Site Server' site maintenance task fails to run and the following site status error messages are found under SMS Component manager thread:

SMS Site Component Manager could not create the SMS server components' installation directory "I:\SMS_site_server_name" on site system "\\My_SQL_Server" or set the correct permissions on the directory. The operating system reported error 53: The network path was not found.

Possible cause: The destination drive is full.
Solution: Make more space available on that drive.

Possible cause: The site system is not exporting the default drive letter shares, such as "\\My_SQL_Server\C$", "\\My_SQL_Server\D$", and so on.
Solution: You might have disabled the default drive letter shares for security purposes. SMS requires these shares. Please re-enable these shares using the Windows NT Disk Administrator.

Possible cause: The site system is turned off, not connected to the network, or not functioning properly.
Solution: Verify that the site system is turned on, connected to the network, and functioning properly.

This occurs as a result of the ConfigMgr site server not being able to access the folders and files on the SQL server site system.

<drive-letter>:\SMS_site_server_name\bin\<architecture>\smssqlbkup.exe
<drive-letter>:\SMS_site_server_name\logs\SmsSqlBkup.log
<drive-letter>:\SMS_site_server_name\srvacct\srvacct.<site_code> (e.g. srvacct.PR1)

NOTE The last folder shown above (i.e. srvacct) is a hidden folder

Please take the following steps to resolve:

1. On the site server, click on the start menu and navigate to Microsoft System Center-> Configuration Manager 2007, then click on “ConfigMgr Setup”.
2. Once the setup wizard appears on the screen click next on the Welcome page.
3. On the available setup options page, select “Perform site maintenance or reset this Site” and click Next.
4. On the site maintenance page, select only the “Modify SQL Server Configuration” option and then click Next.
5. On the SQL Server Configuration page, verify the existing information is correct for the SQL Server instance and site database names, then click Next and wait for the process to complete.

More Information

In a situation where the drive has not failed and/or changed and only the drive-letter was changed you can most likely resolve this by simply going into the registry of the SQL Server under HKLM\System\CurrentControlSet\services\SMS_SITE_SQL_BACKUP and changing the value of the "ImagePath" string value to reflect the new and correct drive-letter.

Tyler Franke | Senior Support Escalation Engineer

Get the latest System Center news onFacebookandTwitter:

App-V Team blog: http://blogs.technet.com/appv/
ConfigMgr Support Team blog: http://blogs.technet.com/configurationmgr/
DPM Team blog: http://blogs.technet.com/dpm/
MED-V Team blog: http://blogs.technet.com/medv/
Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
Operations Manager Team blog: http://blogs.technet.com/momteam/
SCVMM Team blog: http://blogs.technet.com/scvmm
Server App-V Team blog: http://blogs.technet.com/b/serverappv
Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center Essentials Team blog: http://blogs.technet.com/b/systemcenteressentials
WSUS Support Team blog: http://blogs.technet.com/sus/

The Forefront Server Protection blog: http://blogs.technet.com/b/fss/
The Forefront Endpoint Security blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/

Hi everyone, Tyler Franke here again with another troubleshooting tip for you. When you’re in the System Center Configuration Manager 2007 administrative console and trying to download software updates to an update list, it may fail with an error stating the following:

The requested header could not be found

Furthermore, if you leverage the PatchDownloader.log you will find an entry similar to the following:

Downloading content for ContentID = 27377, FileName = windowsserver2003.windowsxp-kb2621440-x64-enu.exe. Software Updates Patch Downloader 3/22/2012 3:34:37 PM 1337928 (0x146A48)
HttpQueryInfo HTTP_QUERY_CONTENT_LENGTH failed 12150 Software Updates Patch Downloader 3/22/2012 3:34:37 PM 1335744 (0x1461C0)
Download http://download.windowsupdate.com/msdownload/update/software/secu/2012/02/windowsserver2003.windowsxp-kb2621440-x64-enu_337d75494557b29c69230ca182054ad65489847b.exe to C:\Users\SJSIMM~1\AppData\Local\Temp\2\CAB161.tmp returns 12150 Software Updates Patch Downloader 3/22/2012 3:34:37 PM 1335744 (0x1461C0)
ERROR: DownloadContentFiles() failed with hr=0x80072f76 Software Updates Patch Downloader 3/22/2012 3:34:37 PM 1337928 (0x146A48)

Cause

A content filtering device was closing the session. Notice in the Netmon frames below that the connection is initiated by the site server with IPv4 address 192.168.1.100, however the device with IPv4 address 192.168.1.200 is where the traffic is being sent first to try to actually go out and initiate the download. You’ll notice that as part of the HTTP connection initiated by the site server we have to keep the session alive (i.e. ProxyConnection: Keep-Alive) however the device with IPv4 address 192.168.1.200 essentially deconstructs the packet and then closes the connection (i.e. ProxyConnection: close) therefore ending any chances the site server had of downloading the software updates.

The items/lines that I've bolded in the Netmon frames below are the most noteworthy and demonstrate the content filtering device closing the connection.

Frame: Number = 28900, Captured Frame Length = 361, MediaType = ETHERNET
- Ethernet: Etype = Internet IP (IPv4),DestinationAddress:[06-7A-8B-9C-10-11],SourceAddress:[00-1A-2B-3C-04-05]
- DestinationAddress: BROADCOM CORPORATION BCE088 [06-7A-8B-9C-10-11]
Rsv: (000000..)
UL: (......0.) Universally Administered Address
IG: (.......0) Individual address (unicast)
+ SourceAddress: Hewlett Packard D89A3B [00-1A-2B-3C-04-05]
EthernetType: Internet IP (IPv4), 2048(0x800)
- Ipv4: Src = 192.168.1.100, Dest = 192.168.1.200, Next Protocol = TCP, Packet ID = 17864, Total IP Length = 347
+ Versions: IPv4, Internet Protocol; Header Length = 20
+ DifferentiatedServicesField: DSCP: 0, ECN: 0
TotalLength: 347 (0x15B)
Identification: 17864 (0x45C8)
+ FragmentFlags: 16384 (0x4000)
TimeToLive: 128 (0x80)
NextProtocol: TCP, 6(0x6)
Checksum: 0 (0x0)
SourceAddress: 192.168.1.100
DestinationAddress: 192.168.1.200
- Tcp: Flags=...AP..., SrcPort=50355, DstPort=HTTP Alternate(8080), PayloadLen=307, Seq=1611337238 - 1611337545, Ack=2596688289, Win=16425 (scale factor 0x2) = 65700
SrcPort: 50355
DstPort: HTTP Alternate(8080)
SequenceNumber: 1611337238 (0x600B0E16)
AcknowledgementNumber: 2596688289 (0x9AC651A1)
+ DataOffset: 80 (0x50)
+ Flags: ...AP...
Window: 16425 (scale factor 0x2) = 65700
Checksum: 0x2251, Disregarded
UrgentPointer: 0 (0x0)
TCPPayload: SourcePort = 50355, DestinationPort = 8080
- Http: Request, GET http://download.windowsupdate.com/msdownload/update/software/secu/2012/02/windowsserver2003.windowsx
Command: GET
- URI: http://download.windowsupdate.com/msdownload/update/software/secu/2012/02/windowsserver2003.windowsxp-kb2621440-x64-enu_337d75494557b29c69230ca182054ad65489847b.exe
Location: http://download.windowsupdate.com/msdownload/update/software/secu/2012/02/windowsserver2003.windowsxp-kb2621440-x64-enu_337d75494557b29c69230ca182054ad65489847b.exe
ProtocolVersion: HTTP/1.1
Accept: */*
UserAgent: Download Progress
Host: download.windowsupdate.com
ProxyConnection: Keep-Alive
Pragma: no-cache
HeaderEnd: CRLF

Frame: Number = 28969, Captured Frame Length = 364, MediaType = ETHERNET
- Ethernet: Etype = Internet IP (IPv4),DestinationAddress:[00-1A-2B-3C-04-05],SourceAddress:[06-7A-8B-9C-10-11]
- DestinationAddress: Hewlett Packard D89A3B [00-1A-2B-3C-04-05]
Rsv: (000000..)
UL: (......0.) Universally Administered Address
IG: (.......0) Individual address (unicast)
+ SourceAddress: BROADCOM CORPORATION BCE088 [06-7A-8B-9C-10-11]
EthernetType: Internet IP (IPv4), 2048(0x800)
- Ipv4: Src = 192.168.1.200, Dest = 192.168.1.100, Next Protocol = TCP, Packet ID = 3683, Total IP Length = 350
+ Versions: IPv4, Internet Protocol; Header Length = 20
+ DifferentiatedServicesField: DSCP: 0, ECN: 0
TotalLength: 350 (0x15E)
Identification: 3683 (0xE63)
+ FragmentFlags: 16384 (0x4000)
TimeToLive: 64 (0x40)
NextProtocol: TCP, 6(0x6)
Checksum: 2612 (0xA34)
SourceAddress: 192.168.1.200
DestinationAddress: 192.168.1.100
- Tcp: Flags=...AP..., SrcPort=HTTP Alternate(8080), DstPort=50355, PayloadLen=310, Seq=2596688289 - 2596688599, Ack=1611337545, Win=54 (scale factor 0x7) = 6912
SrcPort: HTTP Alternate(8080)
DstPort: 50355
SequenceNumber: 2596688289 (0x9AC651A1)
AcknowledgementNumber: 1611337545 (0x600B0F49)
+ DataOffset: 80 (0x50)
+ Flags: ...AP...
Window: 54 (scale factor 0x7) = 6912
Checksum: 0xB4CF, Good
UrgentPointer: 0 (0x0)
TCPPayload: SourcePort = 8080, DestinationPort = 50355
- Http: Response, HTTP/1.1, Status: Ok, URL: http://download.windowsupdate.com/msdownload/update/software/secu/2012/02/windowsserver2003.windowsx
ProtocolVersion: HTTP/1.1
StatusCode: 200, Ok
Reason: OK
Date: Fri, 06 Apr 2012 18:56:46 GMT
Last-Modified: Wed, 22 Feb 2012 21:36:04 GMT
+ ContentType: application/octet-stream
ETag: "03a6bfaa9f1cc1:0"
Accept-Ranges: bytes
Server: Microsoft-IIS/7.5
XPoweredBy: ASP.NET
Age: 261162
ProxyConnection: close
Via: 1.1 localhost.localdomain
HeaderEnd: CRLF

NOTE In this particular case the device was a Websense content filtering device but any device that performs similar functions can cause the same issue.

Resolution

To fix this, you’ll need to configure the content filtering device to allow their Configuration Manager site server access to at least the following list of websites as taken from KB885819.

Quite commonly the cache of the web filtering device will also have to be cleared or purged after making the necessary changes to allow the site server access to the required web addresses. Failure to do so can leave the cache intact and not allow for a successful connection.

Websites to allow:

http://download.windowsupdate.com
http://*.download.windowsupdate.com
http://download.microsoft.com
https://*.update.microsoft.com
http://*.update.microsoft.com
https://update.microsoft.com
http://update.microsoft.com
http://*.windowsupdate.com
http://*.windowsupdate.microsoft.com
http://windowsupdate.microsoft.com
https://*.windowsupdate.microsoft.com
http://ntservicepack.microsoft.com
http://wustat.windows.com

More Information

885819 - You experience problems when you access the Windows Update Version 6 Web site through a server that is running ISA Server
(http://support.microsoft.com/default.aspx?scid=kb;EN-US;885819)

Tyler Franke| Senior Support Escalation Engineer

Get the latest System Center news onFacebookandTwitter:

App-V Team blog: http://blogs.technet.com/appv/
ConfigMgr Support Team blog: http://blogs.technet.com/configurationmgr/
DPM Team blog: http://blogs.technet.com/dpm/
MED-V Team blog: http://blogs.technet.com/medv/
Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
Operations Manager Team blog: http://blogs.technet.com/momteam/
SCVMM Team blog: http://blogs.technet.com/scvmm
Server App-V Team blog: http://blogs.technet.com/b/serverappv
Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center Essentials Team blog: http://blogs.technet.com/b/systemcenteressentials
WSUS Support Team blog: http://blogs.technet.com/sus/

The Forefront Server Protection blog: http://blogs.technet.com/b/fss/
The Forefront Endpoint Security blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/

Consider a scenario where you have encountered issues with the installation of KB2720211 (An update for Windows Server Update Services 3.0 Service Pack 2 is available) which forced you to remove and reinstall WSUS. Afterward, when reinstalling 2720211 it fails to install and in the MWusSetup.txt file you find the following:

2012-07-01 15:45:58 Success CustomActions.Dll Successfully set propery of WSUS admin groups' full names
2012-07-01 15:46:14 Error CustomActions.Dll CSqlConnection::Open: Failed to open SQL connection to instance SERVERNAME\MICROSOFT##SSEE (Error 0x80004005: Unspecified error)
2012-07-01 15:46:14 Error CustomActions.Dll GetDatabaseLocation: Failed to open connection to SQL instance %computername%\MICROSOFT##SSEE (Error 0x80004005: Unspecified error)
2012-07-01 15:46:14 Error CustomActions.Dll SetWyukonInstallDirProperty: Failed to get installed location of SUSDB in WYukon (Error 0x80004005: Unspecified error)
2012-07-01 15:46:14 Error CustomActions.Dll SetUnInstallProperties: Failed to set WYUKON install directory (Error 0x80004005: Unspecified error)

Following this, let’s say you decide to change the value of 'wYukonInstalled' to 0 in the registry under 'HKLM\Software\Microsoft\Update Services\Server\Setup' and after doing so KB2720211 installs successfully. However, a short time later the "Update Services' service fails and will not start and you begin seeing events logged like the one below.

To resolve this, on the server use the SQL Server Configuration Manager tool to check the network configuration of the ‘MICROSOFT##SSEE’ Windows internal database. You need to identify specifically which (if any) protocols are enabled.

1. Open the Sql Server Configuration Manager (Start > Programs > Microsoft SQL Server 2008 R2 > Configuration Tools)
2. SQL Server Network Configuration > Protocols for MICROSOFT##SSEE

If you find that the ‘TCP/IP’ protocol and/or the ‘Named Pipes’ protocols are enabled, then next launch the SQL Client Configuration Utility (Cliconfg.exe) on the server and enable the appropriate protocols to match, then apply the changes.

Following this, next use the services MMC (services.msc) to stop ‘Update Services’, restart the ‘Windows Internal Database’ Service and then start ‘Update Services’ once again. Once this is done, attempt to install the KB2720211 update again on the server.

NOTE The steps above are also applicable if the SUSDB is running in a full version of SQL Server as well.

Tyler Franke| Senior Support Escalation Engineer

Get the latest System Center news onFacebookandTwitter:

App-V Team blog: http://blogs.technet.com/appv/
ConfigMgr Support Team blog: http://blogs.technet.com/configurationmgr/
DPM Team blog: http://blogs.technet.com/dpm/
MED-V Team blog: http://blogs.technet.com/medv/
Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
Operations Manager Team blog: http://blogs.technet.com/momteam/
SCVMM Team blog: http://blogs.technet.com/scvmm
Server App-V Team blog: http://blogs.technet.com/b/serverappv
Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center Essentials Team blog: http://blogs.technet.com/b/systemcenteressentials
WSUS Support Team blog: http://blogs.technet.com/sus/

The Forefront Server Protection blog: http://blogs.technet.com/b/fss/
The Forefront Endpoint Security blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/

Consider the following scenario: When running setup for System Center 2012 Configuration Manager (ConfigMgr 2012), in the Setup window you receive the following warnings:

<A communication error has been detected between the specified site system and the site database computer. This error can occur when the site database server is offline or if a valid SPN has not been registered in Active Directory Domain Services for the SQL Server instance hosting the site database. Setup cannot continue.>

You will also see the following error messages in ConfigMgrPrereq.log:

INFO: Computer Account is <DOMAIN\SiteServerCOMPUTERNAME$>

ERROR: Connected to SQL Server but failed to execute query IF NOT EXISTS (select * from master.sys.server_principals where name=' DOMAIN\SiteServerCOMPUTERNAME$') BEGIN CREATE LOGIN [DOMAIN\SiteServerCOMPUTERNAME$] FROM WINDOWS; SELECT 1; END ELSE SELECT 0
save to ini file SQLCONNECT:SQLFQDN\INSTANCE.
ERROR: Failed to connect to SQL Server Site Server FQDN.
SiteServer FQDN; Site System to SQL Server Communication; Warning; A communication error has been detected between the specified site system and the site database computer. This error can occur when the site database server is offline or if a valid SPN has not been registered in Active Directory Domain Services for the SQL Server instance hosting the site database. Setup cannot continue.

In the ConfigMgrSetup.log you will get these error messages:

CWmiRegistry::GetValues: Failed to connect to registry on machine SQL FQDN. Error code: 2   
INFO: File \\SiteServerFQDN\admin$\sms_get_ADPERMS_svc.exe does not exist. No zapping needed.   
CSql Error: Cannot find type data, cannot get a connection.
INFO: File C:\Windows\sms_account_test_svc.exe does not exist. No zapping needed.
INFO: Connected to ROOT\CIMV2 WMI namespace on SQL Server
INFO: SQL Server version detected is 10.50, 10.50.2811.0.   
INFO: File \\SiteServerFQDN\admin$\sccm_sysroletosql_connect_test.exe does not exist. No zapping needed.   
CSql Error: Cannot find type data, cannot get a connection.
*** IF NOT EXISTS (select * from master.sys.server_principals where name= ‘DOMAIN\SiteServerCOMPUTERNAME$') BEGIN CREATE LOGIN [DOMAIN\SiteServerCOMPUTERNAME$] FROM WINDOWS; SELECT 1; END ELSE SELECT 0   
*** [42000][15401][Microsoft][ODBC SQL Server Driver][SQL Server]Windows NT user or group ‘DOMAIN\SiteServerCOMPUTERNAME$'  not found. Check the name again.   

In this case, although you may have created a domain group where you have added the Site Server System Account and gave this group sysadmin rights on the SQL instance dedicated for ConfigMgr 2012, you might still receive these error messages.

In this case, you will most probably have to add the Site System account (computer name) with admin rights in SQL:

If you try to add the computer name you will see that with advanced search you are not able to select Computers (only users or groups):

To add a computer as an admin in SQL, you will have to type in the Login Name: DOMAIN\COMPUTERNAME$ and press OK. If the computer name is not found in AD you will receive an error similar to the one below:

With a remote SQL server, you will need to make sure that the site system account has admin rights for the SQL instance, dedicated for ConfMgr.

Adding computers to SQL Logins individually can be done using the syntax DOMAIN\COMPUTERNAME$, or by using groups.

Other means of troubleshooting:

1. Check if 1433 port is configured for TCP Port for every IP section (including IP All) and TCP Dynamic Ports fields are empty as bellow:

1433 is the default port that is used and should not be changed to another or a dynamic port.

2. Create a UDL file to test connectivity between machines (See http://msdn.microsoft.com/en-us/library/e38h511e(v=VS.71).aspx for more information):

Radu Tomoiaga

Get the latest System Center news onFacebookandTwitter:

App-V Team blog: http://blogs.technet.com/appv/
ConfigMgr Support Team blog: http://blogs.technet.com/configurationmgr/
DPM Team blog: http://blogs.technet.com/dpm/
MED-V Team blog: http://blogs.technet.com/medv/
Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
Operations Manager Team blog: http://blogs.technet.com/momteam/
SCVMM Team blog: http://blogs.technet.com/scvmm
Server App-V Team blog: http://blogs.technet.com/b/serverappv
Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center Essentials Team blog: http://blogs.technet.com/b/systemcenteressentials
WSUS Support Team blog: http://blogs.technet.com/sus/

The Forefront Server Protection blog: http://blogs.technet.com/b/fss/
The Forefront Endpoint Security blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/

In System Center 2012 Configuration Manager, the ‘Backup Site Server’ maintenance task may fail if the Backup Destination is set to a network share. An example is below:

When this happens, the following errors are logged:

SMSSQLBKUP.LOG

Error: Backup folder \\MachineName\1234 does not exist or backup service does not have permission to access the folder.

Or

SMSBKUP.LOG

Error: Backup folder \\MachineName\1234 does not exist or backup service does not have permission to access the folder.

If you look at the network share you see that the folder does exists and permissions are correct. So why does it fail? To know more, please download Procmon tool from here and capture a trace on both SQL and ConfigMgr site server with following filters while running the backup:

Process Name is ‘SMSSQLBkup.exe’
Process Name is ‘SMSBkup.exe’
Result is ‘BAD NETWORK NAME’

Screenshot:

Once you see the error(s) mentioned at the start of this post, please stop the trace and look at the result.

If you look closely enough at Path column the backup task triggers a CreateFile operation on \\MachineName\123 which doesn’t exist. The correct path is \\MachineName\1234 . It drops the last character ‘4’ and as a result the backup task fails to complete successfully.

At the moment you can choose to use any of the following three workarounds to get the backup task to work.

1. Create a sub-folder under existing folder and configure the backup task accordingly. For example:

\\MachineName\1234\456

2. Save the files on local drive.

3. Create and use a network share on SQL Server instead.

NOTE This issue is schedule to be addressed in Service Pack 1

Additional information on Backup Site Server task can be found here.

Other links of interest:

The System Center 2012 Configuration Manager Survival Guide (en-US): http://social.technet.microsoft.com/wiki/contents/articles/7075.system-center-2012-configuration-manager-survival-guide-en-us.aspx

System Center 2012 Configuration Manager SDK: http://msdn.microsoft.com/library/hh948960.aspx

Karan Rustagi

Get the latest System Center news onFacebookandTwitter:

App-V Team blog: http://blogs.technet.com/appv/
ConfigMgr Support Team blog: http://blogs.technet.com/configurationmgr/
DPM Team blog: http://blogs.technet.com/dpm/
MED-V Team blog: http://blogs.technet.com/medv/
Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
Operations Manager Team blog: http://blogs.technet.com/momteam/
SCVMM Team blog: http://blogs.technet.com/scvmm
Server App-V Team blog: http://blogs.technet.com/b/serverappv
Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center Essentials Team blog: http://blogs.technet.com/b/systemcenteressentials
WSUS Support Team blog: http://blogs.technet.com/sus/

The Forefront Server Protection blog: http://blogs.technet.com/b/fss/
The Forefront Endpoint Security blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/

~ Ibrahim Aladwan

Hello everyone, my name is Ibrahim Aladwan and I’m a support engineer on the Configuration Manager team. Today I’d like to take a minute and go through the update process in System Center Configuration Manager current branch (ConfigMgr 1511, ConfigMgr 1602, etc.) and demonstrate how things work from the client side of things.

Overview

When a client computer in the target collection for a deployment receives machine policy, the Software Update Client Agent starts an evaluation scan. The client agent downloads the content for any required software updates from a distribution point to the local client cache soon after it receives the deployment, but waits until after the software available time setting for the deployment before the software updates are available for installation. This differs for software updates in optional deployments (deployments that do not have an installation deadline), as they are not downloaded until a user manually starts the installation. When the configured deadline passes, the Software Updates client agent performs a scan to verify that the software updates are still required, and assuming they are, it then checks the local cache on the client computer to verify that the software update source files are still available and installs the updates. If the content was deleted from the client cache to make room for another deployment, the client re-downloads the software updates from the distribution point to the client cache. Software updates are always downloaded to the client cache regardless of the configured maximum client cache size. When the installation is complete, the client agent verifies that the software updates are no longer required, then sends a state message to the management point to indicate that the software updates are now installed on the client.

Taking a Closer Look

To get a better understanding of this, let’s take a look at the client log files and track the progress as we deploy KB 3176493. The client and site server components record process information in individual log files, and by default, client and server component logging is enabled in Configuration Manager. You can use the information in these log files to help you troubleshoot issues that might occur in your Configuration Manager environment. For additional information on these log files please refer to the following:

Technical Reference for Log Files in Configuration Manager

So here’s what KB 3176493 looks like when we start:

Software Update Scanning and Evaluation

When the Evaluation cycle is requested (manual or on schedule), entries similar to the following will appear in ScanAgent.log:

Message received: ‘<?xml version=’1.0′ ?>              <UpdateSourceMessage MessageType=’ScanByUpdateSource’>
<ForceScan>TRUE</ForceScan>
<UpdateSourceIDs>
<ID>{39B24983-D827-4C7C-8782-029410E9C146}</ID>
</UpdateSourceIDs>
</UpdateSourceMessage>’
ScanAgent

On the SQL Server, SQL profiler will show that Configuration Manager is executing the stored procedure MP_GetWSUSServerLocations:

RPC:Completed        exec MP_GetWSUSServerLocations N'{39B24983-D827-4C7C-8782-029410E9C146}’,N’167′,N’FCH’,N’FCH’,N’0′,N’server.contoso.local’         System Center 2012 Configuration Manager            SYSTEM    NT AUTHORITY\SYSTEM          16              131           0                  38              1816         72              8/10/2016 1:24:05 AM
0X000000000700000032004D0050005F0047006500740057005300550053005300650072007600650072004C006F0063006100740069006F006E007300720000

This value is then returned to LocationService.log:

Calling back with the following WSUS locations        LocationServices
8/10/2016 1:24:05 AM        7956 (0x1F14) WSUS Path=’http://server.contoso.local:8530′, Server=’server.contoso.local’, Version=’167′        LocationServices

ScanAgent.log also shows the following:

*****Policy Change notification received for ToolUniqueID={39B24983-D827-4C7C-8782-029410E9C146}        ScanAgent        8/10/2016 1:24:01 AM
*****ScanByUpdates request received with ForceReScan=0, ScanOptions=0x00000008,  WSUSLocationTimeout = 604800        ScanAgent

ScanAgent then checks the update source and Time-To-Live (TTL) settings for the last scan results and submits a request for WSUS server location, then LocationService retrieves the WSUS location from the Management Point and returns the URL and the server name, as seen here in ScanAgent.log:

ScanJob({DCB47C9A-3D45-4495-8116-5EE9E0F3B4D2}): – – – – – -Locations requested for ScanJobID={DCB47C9A-3D45-4495-8116-5EE9E0F3B4D2} (LocationRequestID={6CBEFDD4-7390-4A41-AA4D-4D3F8B72111F}), will process the scan request once locations are available.        ScanAgent        8/10/2016 1:24:03 AM

*****WSUSLocationUpdate received for location request guid={6CBEFDD4-7390-4A41-AA4D-4D3F8B72111F}        ScanAgent

Next, the Windows Update scan is initiated and we see the following in ScanAgent.log:

*****ScanByUpdates request received with ForceReScan=0, ScanOptions=0x00000008, WSUSLocationTimeout = 604800        ScanAgent        8/10/2016 1:26:41 AM        5148 (0x141C)
– – -Evaluating Update Status…        ScanAgent        8/10/2016 1:26:41 AM        5148 (0x141C)
Found CategoryID of :0fa1201d-4330-4fa8-8ae9-b877473b6441 for Update:4d52d21e-e4a1-4043-bcda-69a696b2b257        ScanAgent        8/10/2016 1:26:41 AM        5148 (0x141C)
CScanAgent::ScanByUpdates – Found UpdateClassification 0fa1201d-4330-4fa8-8ae9-b877473b6441 for Update:4d52d21e-e4a1-4043-bcda-69a696b2b257        ScanAgent        8/10/2016 1:26:41 AM        5148 (0x141C)
Found CategoryID of :0fa1201d-4330-4fa8-8ae9-b877473b6441 for Update:a12fff7b-aefc-4815-ab2e-0048ada4ea9e        ScanAgent        8/10/2016 1:26:41 AM        5148 (0x141C)
CScanAgent::ScanByUpdates – Found UpdateClassification 0fa1201d-4330-4fa8-8ae9-b877473b6441 for Update:a12fff7b-aefc-4815-ab2e-0048ada4ea9e        ScanAgent        8/10/2016 1:26:41 AM        5148 (0x141C)
Found CategoryID of :0fa1201d-4330-4fa8-8ae9-b877473b6441 for Update:c071152f-3697-44f4-b77c-bf07519dd63e        ScanAgent        8/10/2016 1:26:41 AM        5148 (0x141C)
CScanAgent::ScanByUpdates – Found UpdateClassification 0fa1201d-4330-4fa8-8ae9-b877473b6441 for Update:c071152f-3697-44f4-b77c-bf07519dd63e        ScanAgent        8/10/2016 1:26:41 AM        5148 (0x141C)
Found CategoryID of :0fa1201d-4330-4fa8-8ae9-b877473b6441 for Update:e6561a3e-2ee6-48e4-8770-78068771cfcb        ScanAgent        8/10/2016 1:26:41 AM        5148 (0x141C)
CScanAgent::ScanByUpdates – Found UpdateClassification 0fa1201d-4330-4fa8-8ae9-b877473b6441 for Update:e6561a3e-2ee6-48e4-8770-78068771cfcb        ScanAgent        8/10/2016 1:26:41 AM        5148 (0x141C)

State messages are created for each software update that changed in compliance state, then state messages are sent to the Management Point as seen in StateMessage.log:

Adding message with TopicType 500 and TopicId 4d52d21e-e4a1-4043-bcda-69a696b2b257 to WMI        StateMessage        8/10/2016 1:25:53 AM        5148 (0x141C)
State message(State ID : 2) with TopicType 500 and TopicId 4d52d21e-e4a1-4043-bcda-69a696b2b257 has been recorded for SYSTEM        StateMessage        8/10/2016 1:25:53 AM        5148 (0x141C)
Successfully forwarded State Messages to the MP        StateMessage        5148 (0x141C)

We also see entries similar to the following in WUAHandler.log:

Its a WSUS Update Source type ({39B24983-D827-4C7C-8782-029410E9C146}), adding it.        WUAHandler        8/10/2016 1:24:42 AM        7544 (0x1D78)
Existing WUA Managed server was already set (http://FC-CM01.fourthcoffee.local:8530), skipping Group Policy registration.        WUAHandler        8/10/2016 1:24:42 AM        7544 (0x1D78)
Added Update Source ({39B24983-D827-4C7C-8782-029410E9C146}) of content type: 2        WUAHandler        8/10/2016 1:24:42 AM        7544 (0x1D78)
Scan results will include superseded updates only when they are superseded by service packs and definition updates.        WUAHandler        8/10/2016 1:24:42 AM        7544 (0x1D78)
Search Criteria is (DeploymentAction=* AND Type=’Software’) OR (DeploymentAction=* AND Type=’Driver’)        WUAHandler        8/10/2016 1:24:42 AM        7544 (0x1D78)
Async searching of updates using WUAgent started.        WUAHandler        8/10/2016 1:24:42 AM        7544 (0x1D78)
Async searching completed.        WUAHandler        8/10/2016 1:25:52 AM        1308 (0x051C)
Successfully completed scan.        WUAHandler        8/10/2016 1:25:52 AM        5148 (0x141C)

Installation

When a client computer in the target collection for the deployment receives the machine policy, machine policy including new or changed deployment assignment policy is downloaded. UpdatesDeployment.log receives modification event and triggers evaluation and installation process, as shown here:

Assignment {b8cf0a9f-3b46-4ce7-9712-b281aa88b953} has total CI = 16        UpdatesDeploymentAgent        8/10/2016 1:24:02 AM        7956 (0x1F14)
OnPolicyModify for assignment ({b8cf0a9f-3b46-4ce7-9712-b281aa88b953})…         UpdatesDeploymentAgent        8/10/2016 1:24:02 AM        7956 (0x1F14)
Update (Site_39B24983-D827-4C7C-8782-029410E9C146/SUM_4d52d21e-e4a1-4043-bcda-69a696b2b257) Name (Cumulative Update for Windows 10 Version 1511 (KB3176493)) ArticleID (3176493) added to the targeted list of deployment ({b8cf0a9f-3b46-4ce7-9712-b281aa88b953})        UpdatesDeploymentAgent        8/10/2016 1:26:41 AM        5148 (0x141C)
Raising client SDK event for class CCM_SoftwareUpdate, instance CCM_SoftwareUpdate.UpdateID=”Site_39B24983-D827-4C7C-8782-029410E9C146/SUM_4d52d21e-e4a1-4043-bcda-69a696b2b257″, actionType 11l, value NULL, user NULL, session 4294967295l, level 0l, verbosity 30l        UpdatesDeploymentAgent        8/10/2016 1:26:41 AM        5148 (0x141C)

UpdatesStore will check the status of each update and look for the source, then CIDownloader determines applicability for each update. This is shown in UpdateStore.log:

Queried Update (4d52d21e-e4a1-4043-bcda-69a696b2b257): Status=Missing, Title=Cumulative Update for Windows 10 Version 1511 (KB3176493), BulletinID=MS16-095, QNumbers=3176493, LocaleID=, ProductID=0fa1201d-4330-4fa8-8ae9-b877473b6441, UpdateClassification = 0fa1201d-4330-4fa8-8ae9-b877473b6441, ExcludeForStateReporting=FALSE.        UpdatesStore        8/10/2016 1:25:53 AM        4316 (0x10DC)
Querying update status of 2 updates.        UpdatesStore        8/10/2016 3:10:47 AM        6232 (0x1858)
Queried Update (4d52d21e-e4a1-4043-bcda-69a696b2b257): Status=Missing, Title=Cumulative Update for Windows 10 Version 1511 (KB3176493), BulletinID=MS16-095, QNumbers=3176493, LocaleID=, ProductID=0fa1201d-4330-4fa8-8ae9-b877473b6441, UpdateClassification = 0fa1201d-4330-4fa8-8ae9-b877473b6441, ExcludeForStateReporting=FALSE.        UpdatesStore        8/10/2016 3:26:49 AM        6232 (0x1858)
Queried Update (4d52d21e-e4a1-4043-bcda-69a696b2b257): Status=Installed, Title=Cumulative Update for Windows 10 Version 1511 (KB3176493), BulletinID=MS16-095, QNumbers=3176493, LocaleID=, ProductID=0fa1201d-4330-4fa8-8ae9-b877473b6441, UpdateClassification = 0fa1201d-4330-4fa8-8ae9-b877473b6441, ExcludeForStateReporting=FALSE.        UpdatesStore        8/10/2016 5:08:07 AM        3628 (0x0E2C)

UpdatesHandler then retrieves download settings and software update relationships, then calls to download content.

Entries similar to the following appear in UpdatesHanlder.log:

Bundle update (4d52d21e-e4a1-4043-bcda-69a696b2b257) is requesting download from child updates for action (INSTALL)        UpdatesHandler        8/10/2016 1:26:41 AM        7556 (0x1D84)
StateCore – bundle update (4d52d21e-e4a1-4043-bcda-69a696b2b257) state changed from (WAIT_CONTENTS) to (EXECUTE_READY) as child update state changed        UpdatesHandler        8/10/2016 3:10:43 AM        6548 (0x1994)
Bundle update (4d52d21e-e4a1-4043-bcda-69a696b2b257) is requesting download from child updates for action (INSTALL)        UpdatesHandler        8/10/2016 3:10:48 AM        4432 (0x1150)

Entries similar to the following appear in WUAHandler.log:

Going to search using WSUS update source.        WUAHandler        8/10/2016 3:10:49 AM        3688 (0x0E68)
Synchronous searching of all updates started…        WUAHandler        8/10/2016 3:10:49 AM        3688 (0x0E68)
Successfully completed synchronous searching of updates.        WUAHandler        8/10/2016 3:11:00 AM        3688 (0x0E68)
1. Update: 4d52d21e-e4a1-4043-bcda-69a696b2b257, 205 BundledUpdates: 1        WUAHandler        8/10/2016 3:11:00 AM        3688 (0x0E68)
Update: a12fff7b-aefc-4815-ab2e-0048ada4ea9e, 200 BundledUpdates: 0        WUAHandler        8/10/2016 3:11:00 AM        3688 (0x0E68)
1. Update (Missing): Cumulative Update for Windows 10 Version 1511 (KB3176493) (4d52d21e-e4a1-4043-bcda-69a696b2b257, 205)        WUAHandler        8/10/2016 3:11:00 AM        3688 (0x0E68)
Async installation of updates started.        WUAHandler        8/10/2016 3:12:58 AM        3688 (0x0E68)
Update 1 (4d52d21e-e4a1-4043-bcda-69a696b2b257) finished installing (0x00000000), Reboot Required? Yes        WUAHandler        8/10/2016 3:26:35 AM        4708 (0x1264)
Async install completed.        WUAHandler        8/10/2016 3:26:46 AM        5660 (0x161C)
Installation of updates completed.        WUAHandler        8/10/2016 3:26:46 AM        6232 (0x1858)

Then we get the content location and the following is logged in LocationService.log:

Calling back with the following distribution points        LocationServices        8/10/2016 3:09:02 AM        5648 (0x1610)
Distribution Point=’http://FC-CM01.fourthcoffee.local/SMS_DP_SMSPKG$/a12fff7b-aefc-4815-ab2e-0048ada4ea9e’, Locality=’LOCAL’, DPType=’SERVER’, Version=’8325′, Capabilities='<Capabilities SchemaVersion=”1.0″><Property Name=”SSLState” Value=”0″/></Capabilities>’, Signature=’http://FC-CM01.fourthcoffee.local/SMS_DP_SMSSIG$/a12fff7b-aefc-4815-ab2e-0048ada4ea9e.1.tar’, ForestTrust=’TRUE’,        LocationServices        8/10/2016 3:09:02 AM        5648 (0x1610)
Filtering locations for request {E68DF60D-00D0-4330-9ECE-8742B48CB801}.        LocationServices        8/10/2016 3:09:02 AM        5648 (0x1610)

Then software update content is downloaded to the cache and the following is logged in DataTransferService.log:

UpdateURLWithTransportSettings(): OLD URL – http://FC-CM01.fourthcoffee.local/SMS_DP_SMSPKG$/a12fff7b-aefc-4815-ab2e-0048ada4ea9e        DataTransferService        8/10/2016 3:09:02 AM        5648 (0x1610)
UpdateURLWithTransportSettings(): NEW URL – http://FC-CM01.fourthcoffee.local:80/SMS_DP_SMSPKG$/a12fff7b-aefc-4815-ab2e-0048ada4ea9e        DataTransferService        8/10/2016 3:09:02 AM        5648 (0x1610)
DTSJob {252AF5CA-A261-49FA-82DB-50556214AEAC} created to download from ‘http://FC-CM01.fourthcoffee.local:80/SMS_DP_SMSPKG$/a12fff7b-aefc-4815-ab2e-0048ada4ea9e’ to ‘C:\Windows\ccmcache\1b’.        DataTransferService        8/10/2016 3:09:02 AM        5648 (0x1610)
DTSJob {252AF5CA-A261-49FA-82DB-50556214AEAC} in state ‘DownloadingManifest’.        DataTransferService        8/10/2016 3:09:02 AM        6548 (0x1994)
GET: Host=FC-CM01.fourthcoffee.local, Path=/SMS_DP_SMSPKG$/a12fff7b-aefc-4815-ab2e-0048ada4ea9e, Port=80, Protocol=http, Flags=133, Options=224        DataTransferService        8/10/2016 3:09:02 AM        4320 (0x10E0)

UpdatesDeploymentAgent then raises a state message (download complete) and calls WUAHandler to handle the software update installation via WUA. You can see this via the following entries in UpdatesDeployment.log:

ApplyCIs – JobId = {301925A8-283F-42AE-95F0-272A10359929}        UpdatesDeploymentAgent        8/10/2016 3:10:47 AM        4432 (0x1150)
……
Update (Site_39B24983-D827-4C7C-8782-029410E9C146/SUM_4d52d21e-e4a1-4043-bcda-69a696b2b257) Progress: Status = ciStateInstalling, PercentComplete = 10, DownloadSize = 0, Result = 0x0        UpdatesDeploymentAgent        8/10/2016 3:19:31 AM        4432 (0x1150)
Update (Site_39B24983-D827-4C7C-8782-029410E9C146/SUM_4d52d21e-e4a1-4043-bcda-69a696b2b257) Progress: Status = ciStateInstalling, PercentComplete = 100, DownloadSize = 0, Result = 0x0        UpdatesDeploymentAgent        8/10/2016 3:24:54 AM        3688 (0x0E68)

CUpdatesJob({301925A8-283F-42AE-95F0-272A10359929}): Job completion received.        UpdatesDeploymentAgent        8/10/2016 3:26:50 AM        4320 (0x10E0)
CUpdatesJob({301925A8-283F-42AE-95F0-272A10359929}): Delete job from WMI        UpdatesDeploymentAgent        8/10/2016 3:26:50 AM        4320 (0x10E0)

WUA then installs the updates and we see the following in CBS.log:

2016-08-10 03:13:02, Info CBS Opened cabinet package, package directory: \\?\C:\WINDOWS\SoftwareDistribution\Download\b0e4281cd82e8b66165a25b8a4ae6648\, sandbox location: \\?\C:\WINDOWS\SoftwareDistribution\Download\b0e4281cd82e8b66165a25b8a4ae6648\inst\, cabinet location: \\?\C:\WINDOWS\SoftwareDistribution\Download\b0e4281cd82e8b66165a25b8a4ae6648\Windows10.0-KB3176493-x86.cab, manifest location: \\?\C:\WINDOWS\SoftwareDistribution\Download\b0e4281cd82e8b66165a25b8a4ae6648\inst\update.mum

2016-08-10 03:14:36, Info CBS Extracting all files from cabinet \\?\C:\WINDOWS\SoftwareDistribution\Download\b0e4281cd82e8b66165a25b8a4ae6648\inst\Cab_1_for_KB3176493.cab

Next, state messages are created for each software update that changed in compliance state, and these state messages are sent to the management point as seen in StateMessage.log:

State message(State ID : 3) with TopicType 500 and TopicId 4d52d21e-e4a1-4043-bcda-69a696b2b257 has been recorded for SYSTEM        StateMessage        8/10/2016 5:08:07 AM        3784 (0x0EC8)

At this point the updates are installed and the hierarchy is updated.

More Information

For more information about state message and ID, please see the table below.

Ref: State Messages in Configuration Manager 2007

For more information on Software Updates, see Introduction to Software Updates in Configuration Manager

Ibrahim Aladwan, Support Engineer
Microsoft System Center Configuration Manager

Release version 1606 of System Center Configuration Manager Current Branch contains many changes intended to both prevent issues and improve features. For the list of issues that are fixed, please see the Knowledge Base article below.

3184080 – Summary of changes in System Center Configuration Manager current branch, version 1606 (https://support.microsoft.com/en-us/kb/3184080)

Note that this list is not inclusive of all changes, but instead captures the work that our product development team believes is most relevant to our broad customer base. Many of these changes are the result of direct customer feedback on product issues, and ideas for product improvement. Version 1606 is available as an in-console update to be installed at the top-most site in a hierarchy. For more information, see the Checklist for installing update 1606 for System Center Configuration Manager.

J.C. Hornbeck, Solution Asset PM
Microsoft Enterprise Cloud Group

Update Rollup 1 for System Center Configuration Manager current branch, version 1606, is now available. This update is available for installation in the Updates and Servicing node of the Configuration Manager console. Please note that if the Service Connection Point is in offline mode, you have to re-import the update so that it is listed in the Configuration Manager console. Refer to Install Updates for System Center Configuration Manager for details.

For complete details regarding UR1 for ConfigMgr 1606, including the list of issues that are fixed, please see the following:

3186654 – Description of Update Rollup 1 for System Center Configuration Manager current branch, version 1606 (https://support.microsoft.com/en-us/kb/3186654)

J.C. Hornbeck, Solution Asset PM
Microsoft Enterprise Cloud Group

A new update has been released that adds the following platforms to the supported platforms list for Microsoft System Center Configuration Manager current branch, version 1606:

• All iOS 10 iPhone or iPod Touch devices
• All iOS 10 iPad devices

These iOS 10 devices may be targeted as client platforms for features such as Application Deployment, Compliance Settings, and Company Resource Access. After you install this update, the Supported Platforms tab of policy settings has an All iOS 10 iPhone or iPod Touch devices option in the iPhone category and an All iOS 10 iPad devices option in the iPad category.

Note that policies that previously had the root category selected (iPhone or iPad) now have iOS 10 automatically selected together with all earlier iOS versions. Previously, when individual iOS versions such as All iOS 7 IPad devices were selected, but the corresponding top level category was not selected, the policies did not automatically have iOS 10 selected.

For complete details on this update as well as installation instructions, please see the following:

3192616 – Update to add Apple iOS 10 to the Supported Platforms list for System Center Configuration Manager, version 1606 (https://support.microsoft.com/en-us/kb/3192616)

J.C. Hornbeck, Solution Asset PM
Microsoft Enterprise Cloud Group

ConfigMgr 1606

Hi everyone, today I wanted to post a quick reminder regarding support for the non-Service Pack 2 versions of Microsoft System Center 2012 Configuration Manager (ConfigMgr 2012) and non-Service Pack 1 versions of Microsoft System Center 2012 R2 Configuration Manager (ConfigMgr 2012 R2). As you may already be aware, support for Configuration Manager 2012 versions lower than 5.00.8239.1000 ended on 7/12/2016.

This does not necessarily mean that Microsoft CTS Support Engineers will refuse to help customers who are running these older versions, however it’s important to understand that in order to be in a fully supported state, you will need to upgrade to a supported version as soon as possible. When contacting Microsoft for support related to these products, Support Engineers will first try to determine if the reported problem is due to a known issue which has been addressed in a later product version. If this is the case, the customer will be asked to upgrade to the latest supported version of Configuration Manager which includes the related fix.

There have been many issues fixed in the years since ConfigMgr 2012 SP1 and ConfigMgr 2012 R2 were released, and as a result, it is possible that you may encounter a known problem that has already been resolved in a later version. Upgrading to the latest versions will resolve these issues.

More details for each version and the associated support end dates can be found at the links below.

• Microsoft Support Lifecycle – Microsoft System Center 2012 Configuration Manager
• Microsoft Support Lifecycle – Microsoft System Center 2012 R2 Configuration Manager

Currently, the Microsoft Support Lifecycle policy requires that the product’s supported service pack be installed to receive technical support and security updates. For detail on this as well as answers to other related support policy questions, please see the Support lifecycle policy – FAQ.

Eric Ellis, Senior Support Escalation Engineer
Support Engineering | Cloud & Infrastructure Solutions

When you do site maintenance to move a Configuration Manager site database to a new standalone instance of Microsoft SQL Server, or to a new SQL Server AlwaysOn availability group, you m ay encounter a problem where the Configuration Manager setup process fails and generates error messages that resemble the following in the ConfigMgrSetup.log file:

Error message 1

INFO: SQL Connection succeeded. Connection: SMS ACCESS, Type: Secure
INFO: SQL Server Native Client: SQLNCLI11 version:<11.0.2100.60>
ERROR: Failed to find folder of SQL Server assembly setup msi.

Error message 2

ERROR: SQL Connection failed. Connection: SMS ACCESS, Type: Secure
ERROR: Failed to get SQL Server connection.
INFO: SQL Server Native Client: SQLNCLI11 version:<11.2.5641.0>
ERROR: Failed to find file: c:\temp\redist\msxml6_x64.msi.

If you encounter this problem, Microsoft has published a new KB article that details the cause as well as steps to work around the issue. Please see the following for more information:

3189594 – “Failed to find folder” or “Failed to find file” error when you move a ConfigMgr site database (https://support.microsoft.com/en-us/kb/3189594)

J.C. Hornbeck, Solution Asset PM
Microsoft Enterprise Cloud Group

Hi everyone, my name is Bindusar Kushwaha and I’m a Support Escalation Engineer on the Configuration Manager team. I ran into an interesting case the other day so I thought I’d take a minute to share it with you in case you happen to see it in your environment.

The Problem

Let’s say you’re running multiple WSUS computers, maybe integrated with Configuration Manager Software Update Points (SUPs), maybe not, and they share the same SUSDB as the master front end server, which is the only server allowed to go online and sync. Everything works fine for a while, then all of the sudden you find that your security compliance is changed and the sync with Microsoft Update is NOT working. You receive the following timeout error when trying to contact the update server:

WebException: Unable to connect to the remote server —> System.Net.Sockets.SocketException: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond 134.170.53.30:443

at System.Net.HttpWebRequest.GetRequestStream(TransportContext& context)
   at System.Net.HttpWebRequest.GetRequestStream()
   at System.Web.Services.Protocols.SoapHttpClientProtocol.Invoke(String methodName, Object[] parameters)
   at Microsoft.UpdateServices.ServerSyncWebServices.ServerSync.ServerSyncProxy.GetAuthConfig()
   at Microsoft.UpdateServices.ServerSync.ServerSyncLib.InternetGetServerAuthConfig(ServerSyncProxy proxy, WebServiceCommunicationHelper webServiceHelper)
   at Microsoft.UpdateServices.ServerSync.ServerSyncLib.Authenticate(AuthorizationManager authorizationManager, Boolean checkExpiration, ServerSyncProxy proxy, Cookie cookie, WebServiceCommunicationHelper webServiceHelper)
   at Microsoft.UpdateServices.ServerSync.CatalogSyncAgentCore.SyncConfigUpdatesFromUSS()
   at Microsoft.UpdateServices.ServerSync.CatalogSyncAgentCore.ExecuteSyncProtocol(Boolean allowRedirect)

Note that you are able to go to manually connect to the IP address listed in the error just fine using the System context.

Why This Happens

As per the blog post below, the first installed WSUS computer should go online and sync, and the rest should accept the changes since they use the same SUSDB:

https://blogs.msdn.microsoft.com/steverac/2013/02/06/configuring-multiple-software-update-points-in-a-configmgr-2012-primary-site-what-to-expect/

Normally that all works fine. Now as you may know, the first WSUS computer installed gets ownership of SUSDB (called MasterFrontEndServer), and when a sync is triggered, the computer with ownership of SUSDB must be allowed to go online to sync. However, let’s say that the MasterFrontEndComputer that has ownership of SUSDB is turned off, or that the WSUS service is stopped. When this happens, spUpdateServerHealthStatus checks the next WSUS computer with componentName=WSUSService and isRunning=1 and fires a stored procedure to update this computer as the new owner of SUSDB (New MasterFrontEndServer) in the tbReference table. This is as expected, however if this new MasterFrontEndServer is not allowed to go online then you will get the error mentioned above. This happens even after the previous owner comes back online because it’s no longer listed as the owner of SUSDB or MasterFrontEndServer.

The Solution

In order to keep this from happening you have a couple options:

Option 1: Do not share the SUSDB used by the MasterFrontEndServer with any other WSUS computers. Let all WSUS computers that are sharing the same SUSDB sync with another local server instead.

Option 2: If you do share a master front end server’s SUSDB, allow all WSUS computers that share that SUSDB to go online and sync so that a change of MasterFrontEndServer should not impact connectivity.

If you are unable to implement option 1 or 2 above you can complete the following steps to get things working again:

1. Stop the WSUS service on all other WSUS computers that don’t have Internet access and that share the same SUSDB.

2. Trigger a WSUS sync on the computer you want to be the SUSDB owner\MasterFrontEndServer.

3. Once the sync starts, start the WSUS service on all other WSUS computers sharing same SUSDB.

That should get things straightened out for the moment, but if you choose not to change your configuration, be sure to always keep an eye on things and make sure the MasterFrontEndServer’s WSUS service is not stopped during a scheduled sync time.

Note: If WSUS is integrated with Configuration Manager, this setting can be pushed by ConfigMgr as well. This setting is configured in Site Control File. We recommend that customers open a support case with Microsoft product support before making any changes to the database.

Hopefully this will help you avoid this potential issue in your environment.

Bindusar Kushwaha | Support Escalation Engineer

Just in case you didn’t see the announcement, the Configuration Manager team has released update 1609 for System Center Configuration Manager Technical Preview. These Technical Preview releases give you an opportunity to try out new Configuration Manager features in a test environment before they are made generally available so you’ll definitely want to take a look at this. For all the details regarding this month’s new preview features, please see the following:

Update 1609 for Configuration Manager Technical Preview – Available Now!

J.C. Hornbeck, Solution Asset PM
Microsoft Enterprise Cloud Group

Hi everyone, I just wanted to take a minute and let you know that we have a new KB article out for an issue where SQL queries may time out, or the admin console may be slow when running certain Configuration Manager database queries. Note that this issue is specific to environments running Microsoft SQL Server 2016 or Microsoft SQL Server 2014.

The reason this can happen is because of SQL Server Cardinality Estimation (CE) changes that were introduced with SQL 2014 and SQL 2016 that can cause performance issues with certain Configuration Manager queries in some environments, depending on variables such as site configuration, environment complexity, and the general state of load and performance of the SQL server.

For all the details as well as a resolution, please see the following:

3196320 – SQL query times out or console slow on certain Configuration Manager database queries (https://support.microsoft.com/en-us/kb/3196320)

J.C. Hornbeck, Solution Asset PM
Microsoft Enterprise Cloud Group