SCCM Issue

[Oaktech]

My SCCM server ran out of RAM on Tuesday for some reason, and when it restarted it did the 2020 09 update KB4577015 and since then I've been getting errors that stop me from building machines...

 

Here's what I'm seeing.

 

MP Control is flagged at error in the site status monitor:

 MP Control Manager detected management point is not responding to HTTP requests.  The HTTP status code and text is 401, Unauthorized.

MPControl.log lists the following:

Immediately after restart:

ReadMPStringSettings(): RegQueryValueExW() failed - 0x80070002	SMS_MP_CONTROL_MANAGER	30/10/2020 14:30:30	4164 (0x1044)

Every 30 seconds until MP reports as initialised, then every 5 minutes:

Call to HttpSendRequestSync failed for port 80 with status code 401, text: Unauthorized	SMS_MP_CONTROL_MANAGER	30/10/2020 14:39:11	7072 (0x1BA0)

Every 5 minutes after MP reports as initialised:

 Http test request failed, status code is 401, 'Unauthorized'.	SMS_MP_CONTROL_MANAGER	30/10/2020 15:06:11	7072 (0x1BA0)

 

On the client I'm attempting to build, in the SMSTS.LOG file:

 

 
It's all 401 errors... I can confirm this behaviour by navigating to the URLs in question and indeed recieving a 401.
 
Additionally I can see this behaviour in the IIS logs: 
[code]mysccmserver ::1 GET /SMS_MP/.sms_aut MPLIST 80 - ::1 SMS_MP_CONTROL_MANAGER - 401 3 5 6205 0

[Steve21]

Is this the first time it’s been restarted since the upgrade? We’ve had issues before like that caused by a GPO modifying security that looks like IIS permissions were broken but weren’t really

 

In IIS logs what’s the 401.x code say?

 

Steve

[kevin_lane]

Different issue to I had but sounds similar in the end I had to remove my MP , Deployment server and IIS in order to get my situation sorted

 

Sccm is such a pig some times and It don’t help with everything being so integrated

[DarkenRahl]

Think i had something very similar recently. Check the server firewall status as mine is usually disabled on the device but reset back on for some reason and caused chaos with similar errors.

[Oaktech]

Think i had something very similar recently. Check the server firewall status as mine is usually disabled on the device but reset back on for some reason and caused chaos with similar errors.

 

Firewall on this server is disabled, and is still disabled.

[free780]

Sounds like an authentication issue. Hace you tried re creating the boot images so the Configmgr binaries are up to date. Also make sure no service accounts are locked out. Also make sure you server hasn't fallen off the domain with Test-ConputerSecureChannel in powershell.

[Oaktech]

Ok,

 

So, I've got to the bottom of it.

 

I turned on IIS failed request tracing and it showed up a TokenUser of a local machine user account associated with a service that no longer runs on this server! No idea where it's got it from as it was disabled when the product was uninstalled and I remember seeing it in user manager disabled about a month ago. There's no reason IIS can't impersonate this user, it doesn't have excessive permissions, so I just added it to the physical filesystem ACL for the 2 services that were failing and it all sprang into life.

 

Chalk that one up to experience.

Edited November 11, 2020 by Oaktech