[sims] Cant deploy SIMS to a new client - firewall disabled - DNS looks good

[TwistedHelixis]

So getting the message 'The remote machine connot be contacted' displayed in Solus when trying to deploy to a new laptop.

 

I have recently been setting up the Windows firewall on all clients so thought it was this. Same issue after disabling the firewall. Next I thought DNS, but that all looks look, there are no duplicate IP's etc.

 

Any ideas as its starting to drive me nuts.

[Boredguy]

Has the laptop got 2 IP addresses listed in DHCP/DNS from the ethernet and wireless NIC's?

If so remove the entry for 1 of them in DHCP/DNS and do a ipconfig /flushdns on the SIMS server and see if Solus will push the update out.

We used it get it often, and 9/10 times that would resolve the issue

[TwistedHelixis]

Has the laptop got 2 IP addresses listed in DHCP/DNS from the ethernet and wireless NIC's?/QUOTE]

 

No, this is a new laptop and has only been used with WiFi.

[Foresthippy]

Have you checked reverse lookup in DNS? If that doesn't match the forward lookup that can cause problems.

[TwistedHelixis]

Have you checked reverse lookup in DNS? If that doesn't match the forward lookup that can cause problems./QUOTE]

Just checked and it is the same IP

[Foresthippy]

No duplicate IPs pointing to other devices?

[TwistedHelixis]

No duplicate IPs pointing to other devices?

 

I'll need to double check tomorrow but don't think so.

[jthompson]

When you say you've checked DNS, have you checked that the SOLUS server itself is resolving the client hostname correctly? If not, flush the DNS cache on the server.

 

iirc that error message could also be the result of not having rules on the client to allow remote scheduled tasks and WMI, preventing the installation of the SOLUS agent. Those are done using the predefined rules in WDF. You say that the firewall is disabled so that might not be it.

[TwistedHelixis]

Getting things ready for when I go back tomorrow....

 

flush the DNS cache on the server.

Would that be on the DNS server or the SIMS server

 

iirc that error message could also be the result of not having rules on the client to allow remote scheduled tasks and WMI

These are my Allow SIMS firewall settings, although it also had issues when I disabled the firewall.

 

TCP ports 52965, 52966, 8739, 139

UDP ports 137 and 138, 139

windows management instrumentation (wmi)

Windows Remote Management

File and Printer Sharing

 

On the SIMS server

SQL Server Browser

SQL Server (SIMS)

SIMS .net Document Server

SIMS Services Manager

Edited May 25, 2021 by TwistedHelixis

[jthompson]

Getting things ready for when I go back tomorrow....

 

Would that be on the DNS server or the SIMS server

 

On the SIMS server, if the SIMS server isn't resolving the correct IP address when pinging the client's hostname.

[TwistedHelixis]

Im not at the school now but going to build up a new Windows 10 VM remotely, and see if I can deploy SIMS to that tonight

[TwistedHelixis]

Just found a duplicat IP in DNS (third time I looked). It was actually the WiFi IP which is static also had some laptop IP which was the same.

 

Almost setup my test VM, fingers crossed

[TwistedHelixis]

get a different error now :-(

 

When deploying to my Win10 VM I get 'unable to get an IP address for this agent'

[TwistedHelixis]

Worked out the issue, but not worked out a fix.

 

So it turns out it's not good enough to simple replace my staff firewall gpo with another policy where the firewall is tuned off, I had to completly remove my firewall policy and then on the actual client disable the firewall manually, SIMS then worked fine and deployed the agent.

 

Going to create a new post asking for help setting up a staff based firewall gpo, as I cant seem to get this right.

[Boredguy]

Just make sure your GPO with the correct firewall rules to enable solus is higher in the order than your firewall rule that doesn't have it open. No need to have it turned off entirely

[TwistedHelixis]

Just make sure your GPO with the correct firewall rules to enable solus is higher in the order than your firewall rule that doesn't have it open. No need to have it turned off entirely

Oh is that how it works with the firewall, I assumed it would just over write the previouse firewall settings.

 

- - - Updated - - -

 

So if I had a firewall with allow all first and my next firewall rule was locked down it would still be the allow all rule that worked?

[Boredguy]

GPO's are deployed from the bottom of the list upwards, so if you create a new policy for your firewall it is automatically at the bottom of your list, so if you allow a port there, and another policy higher up blocks the port, the net result will be that the GPO says "close port X"

 

GPP lists work from the top down just to confuse matters.

[TwistedHelixis]

so if you create a new policy for your firewall it is automatically at the bottom of your list

 

It's this sentance that has now confused me. Do I not choose where in the list the gpo is by putting it in an OU, or is there another ordering system I have completely missed?

[TwistedHelixis]

I have just found this which seems to suggest the opersite

 

 

What is the order of precedence in an OU hierarchy?GPOs linked to an organizational unit at the highest level in Active Directory are processed first, followed by GPOs that are linked to its child organizational unit, and so on. This means GPOs that are linked directly to an OU that contains user or computer objects are processed last, hence has the highest precedence.

 

In the example below the “Add Local Admins” GPO will have precedence over the “Enable SCCM Ports” GPO since it will be processed last and thus potentially overriding the settings in the GPO higher up in the hierarchy.

 

https://emeneye.wordpress.com/2016/02/16/group-policy-order-of-precedence-faq/

 

 

EDIT - Do you mean the link order?

Edited May 25, 2021 by TwistedHelixis

[BlueNine]

Try changing the name of the device and flushing the DNS, we get this quite often. Also check what OU it's in in AD, sometimes this can cause an issue.

[Boredguy]

EDIT - Do you mean the link order?

 

Yes the link order.

As you see in the (hopefully) attached image, anything in my "RM Safetynet" policy gets applied first as its the bottom of the list.

 

If I have a contradictory value in either of the 2 policies above it, they will take precedence.

 

However we don't actively put a value into the domain firewall policy for Solus, since the installation process sets it up on the station itself

[TwistedHelixis]

Come back in today and SIMS has installed :0)

 

I did a lot of tweeks last night so not 100% sure what fixed the issue, but I did find 1 duplicate IP in DNS and I also deployed my 'disable firewall' policy along with other changes.

 

Thanks to all that helped.

 

I will get back to my firewall policy in another post next week.

[jthompson]

Come back in today and SIMS has installed :0)

 

I did a lot of tweeks last night so not 100% sure what fixed the issue, but I did find 1 duplicate IP in DNS and I also deployed my 'disable firewall' policy along with other changes.

 

Thanks to all that helped.

 

I will get back to my firewall policy in another post next week.

 

I can recommend the Capita support document titled "SOLUS3 for Schools" (Applicable to 3.12.41 onwards) which has the detailed steps you need for configuring Windows firewall policies in Group Policy, plus the other bits like enabling WMI through the firewall. In that document, you want the section named "Configuring Windows Firewall" in chapter 02.

 

To find the doc, try searching the Capita support site for KB0035810.