Failed TS cannot connect to server time sync

[ADMaster]

I've got a weird OS Deploy issue.

The smsts log says it cannot connect to the server so I've brought up the commend line at different stages to check.

During apply OS / Drivers still in win pe net use \\sccm\smspkge$ connects

After the first reboot when it starts apply customizations I get an error the clock is out of sync with the domain controller.

I have checked the date and time on both DCs, the SCCM server, the client OS and the client bios. All were correct.

 

Another weird issue with this one is I must delete the computer from SCCM before I can image again, otherwise I get an error stating no TS's available.

 

Here is the background on what I've done to get to this point...

I set a few computer labs to image via required TS

They all imaged except this one.

I attempted to run the TS again via pxe and it failed with no TS's

I removed the required deployment and went back to available via PXE

Tried again and same result, I then deleted the computer from SCCM it was listed twice for some reason.

Now I get a list of TS's and it goes as far as the first script needing to download a package then fails.

If i want to try the image again, I must delete the computer from SCCM.

 

This is a strange one, any ideas?

[ADMaster]

Bump these are the symptoms I have.

https://deploymentresearch.com/debugging-80070002-and-80190191-errors-during-configmgr-sccm-osd/

I have a network access account setup and other PCs image fine

I have windows authentication installed and again other PCs image fine.

Slow connection.. possible, but I've moved it to another location / socket / cable etc.

I have also tried net use \\server\share and get the domain controller time sync error.

It applies the OS / drivers during winPE then reboots to install apps etc and fails.

 

I tried add a w32tm /resync to the TS.

Here is a screenshot of the failing TS and my attempts to fix the time.

 

 

 

Ideas?

Edited September 11, 2019 by ADMaster

[DJ-1701]

Bump these are the symptoms I have.

https://deploymentresearch.com/debugging-80070002-and-80190191-errors-during-configmgr-sccm-osd/

I have a network access account setup and other PCs image fine

I have windows authentication installed and again other PCs image fine.

Slow connection.. possible, but I've moved it to another location / socket / cable etc.

I have also tried net use \\server\share and get the domain controller time sync error.

It applies the OS / drivers during winPE then reboots to install apps etc and fails.

 

I tried add a w32tm /resync to the TS.

Here is a screenshot of the failing TS and my attempts to fix the time.

 

[ATTACH=CONFIG]54935[/ATTACH]

 

 

Ideas?

 

Have you tried using the /computer: switch? Is the port open for non-domain devices to ask for the time? As WinPE is not joined to a domain it might not know where to go or be allowed.

 

Doesn’t negate the weird time not matching issue when it is... only issue I have had in the wild like this was with a Dell laptop which kept changing it’s time counting minutes like seconds.

[ADMaster]

@DJ-1701 I'll try that but...

Winpe works fine to download the OS, drivers etc.

Reboot into windows to finish the image is where it fails.

Also w32tm /resync reported successful.

Without doing a time sync just running the date / time commands reports the correct time. The bios time is correct too.

 

I'll start another image and report back on the /computer switch.

 

Thanks

[DJ-1701]

Don’t know if this would be any help then... https://blogs.technet.microsoft.com/configurationmgr/2017/03/06/device-fails-to-join-domain-during-a-configmgr-osd-task-sequence-due-to-dc-time-synchronization-issues/

[ADMaster]

I'm leaning toward a DNS issue now, but not sure what.

I brought up the cmd prompt again and attempted w32tm, all times look good.

I did another net use \\server\share and got the time error

I tried net use \\ip\share and it connected.

 

I suspect the first half of the image is using dc1 and the second half dc2 as the dns server.

 

running dcdiag looked fairly clean

doing an nslookup on the sccm server returned the same IP from both dns servers

nslookup on the domain name returned differed order of addresses depending on dcs

nslookup domainname dc1

dc2

dc1

nslookup domainname dc2

dc1

dc2

 

to the event logs I go

[free780]

I think I added a command to sync time with our Smoothwall box and use NTP. Because winpe isn't domain joined you can't sync against a DC.

Also check the timezone in winpe.

The no task sequences is usually because SCCM creates a device called Unknow if it doesn't recognise the device. Ideally you have you devices all in SCCM, even new devices but you need the Mac Address and SMSBIOSGUID I think. If you reuse devices and set a new name you might have a device within SCCM. You can search via mac address now to find it.

Edited September 12, 2019 by free780

[ADMaster]

A few updates

If I don't reboot the computer after the failed image I get the time sync error when trying to log in.

A reboot will allow me to log in.

Also if I allow the computer to boot into windows and reboot again before attempting another image I don't get the no TS errors.

I've found a few references to an old DC in DNS I've removed now, but that didn't change anything.

 

Running tzutil / g shows the correct time zone

Running test secure channel returns true

 

I have a user across the site who has connection issues that appear to be DNS related, I'm not sure if it is the same issue, my browsing is fine and there are no other tickets on it.

 

I've used repadmin to get a report and all is synced, I've also forced a sync.

 

I think the pinging with different addresses was just round robin, but shouldn't it realize it is offline.

pinging the netbios name of the domain returns DC1 and pinging the FQDN returns DC2 even when DC2 was offline.

However my PC returned dc1 for both, again just thinking round robin. I also used nltest to check what DC I was on and forced a switch, still the time error.

[ADMaster]

Finally fixed, an extra reboot in the TS has done it.

 

After figuring out the extra reboot fixed the time and ts listing issue I thought it was worth trying.

 

I have no idea the root cause, but I can get this one off my desk and back in the classroom.