[SCCM 1802] SPN Issue - Clients stopped talking to SCCM after MBAM installation

[CHiLL]

I have recently installed MBAM 2.5 SP1 on the same server as our SCCM installation (Server 2012 R2 VM).It appeared to be working fine, but I've found that since I've configured the SPN for MBAM, our SCCM are not talking to the server any more. I performed the following commands for SPN:

 

setspn -s http/ \

 

setspn -s http/ \

 

If I remove those SPNs entirely, our SCCM clients will start talking to the server again...but the MBAM client cannot talk to the server. So it appears only one can be enabled.

 

I've found an error in the System Logs of a client that attempts to authenticate with the SCCM server whilst the SPN is registered for MBAM:

[ATTACH=CONFIG]48914[/ATTACH]

When the SPN is deregistered and the SMS Agent Host service is restarted on the client, the error doesn't reappear and the client receives the applications/updates.

 

What's the best solution to get both services running on the same server?

Edited May 11, 2018 by CHiLL

[CHiLL]

Turns out - Don't install MBAM on the SCCM server. SCCM is so reliant on IIS for the clients to connect that when the SPN was specified for MBAM, it caused the clients to stop communicating. Removing MBAM and the SPN configuration and installing it on another server worked fine.

 

Moral of the story? Leave the SCCM server the hell alone!