2012 SCCM SP1 Distribution Point Certificate store error on Server 2003 R2

Has anyone had this issue on Server 2003 R2 where you are getting this error listed below? All content is being distributed ok. But, monitoring is showing errors with all my Distribution points and I want these errors to go away so I don't have to sift through
all the darn errors.
Thanks for your help. Daniel.
Report status message 0x40000952 to MP
Failed to create certificate store from encoded certificate.. This is usually caused by a problem with the program. Please check the Microsoft Knowledge Base to determine if this is a known issue or contact Microsoft Support Services for further assistance.
The parameter is incorrect. (Error: 80070057; Source: Windows)
Status message has been successfully sent to MP from remote DP

I have found the error message in the smsdpmon.log on a Windows Server 2003 SP2 system acting as a Distribution Point (only). The error shows up when / during a scheduled content validation on that server and is repeated after each package is "validated".
From the smsdpmon.log:
- Start to evaluate package share for package 'XXX0004F' version 5 ...
- Package XXX0004F is verified successfully
- Report state message 0x40000950 to MP
- Failed to create certificate store from encoded certificate.. This is usually caused by a problem with the program. Please check the Microsoft Knowledge Base to determine if this is a known issue or contact Microsoft Support Services for further assistance. The parameter is incorrect. (Error: 80070057; Source: Windows)
- Report Body: <ReportBody><StateMessage MessageTime="20140315150802.000000+000" SerialNumber="5"><Topic ID="XXX0004F" Type="901" IDType="0"/><State ID="2384" Criticality="0"/><UserParameters Flags="0" Count="2"><Param>XXX0004F</Param><Param>["Display=\\DPSERVNAME.domain.com\"]MSWNET:["SMS_SITE=XXX"]\\DPSERVNAME.domain.com\</Param></UserParameters></StateMessage></ReportBody>
- Report status message 0x40000950 to MP
- Failed to create certificate store from encoded certificate.. This is usually caused by a problem with the program. Please check the Microsoft Knowledge Base to determine if this is a known issue or contact Microsoft Support Services for further assistance. The parameter is incorrect. (Error: 80070057; Source: Windows)
- Status message has been successfully sent to MP from remote DP
- Report status message 0x80000954 to MP
- Failed to create certificate store from encoded certificate.. This is usually caused by a problem with the program. Please check the Microsoft Knowledge Base to determine if this is a known issue or contact Microsoft Support Services for further assistance. The parameter is incorrect. (Error: 80070057; Source: Windows)
- Status message has been successfully sent to MP from remote DP
I tried to pretty up the above - not sure that I was successful.
The site server is a Windows Server 2012 R2 Standard running SCCM 2012 R2.

Similar Messages

Distribution point, a TFTP error message

Hello,
I have a problem when I tried to migrate
a computer via PXE Network in an Annex or
there is a distribution point, a TFTP
error message appears as follows:
PXE-E32: TFTP
open timeout.
TFTP.
knowing that this problem does not arise
at the main site.
please help me and thank you in advance.
cdt.
Rayo_Muchacho

As Torsten mentionned, review the requirements for PXE boot.
http://prajwaldesai.com/boot-images-distribution-point-configuration-osd-sccm-2012-r2/
http://gerryhampsoncm.blogspot.ca/2013/02/sccm-2012-sp1-step-by-step-guide-part_9487.html
Benoit Lecours | Blog: System Center Dudes

SCCM 2007 Distribution Point Share on a Failover Clustered File Server.

Is SCCM 2007 Distribution Point Share supported on a Windows 2008 R2 Failover Clustered File Server? I can get the packages to copy to the DP Share. But if I create them on a non clustered server it works fine. Are there any special settings that need top
be configured for clustered shares?
Thanks,
Steve
Steve

Hi Steve,
As far as I know this scenario is not supported scenario, In Windows Server® 2008 R2, the Cluster Shared Volumes feature included in failover clustering is only supported for
use with the Hyper-V server role.
The creation, reproduction, and storage of files on Cluster Shared Volumes that were not created for the Hyper-V role, including any user or application data stored under the
ClusterStorage folder of the system drive on every node, are not supported and may result in unpredictable behavior, including data corruption or data loss on these shared volumes. Only files that are created for the Hyper-V role can be stored on Cluster Shared
Volumes. An example of a file type that is created for the Hyper-V role is a Virtual Hard Disk (VHD) file.
More information:
Deploying Cluster Shared Volumes (CSV) in Windows Server 2008 R2 Failover Clustering
http://blogs.msdn.com/b/clustering/archive/2009/02/19/9433146.aspx
Backing Up Cluster Shared Volumes in a Failover Cluster in Windows Server 2008 R2
http://technet.microsoft.com/en-us/library/ff182356(WS.10).aspx
I’m glad to be of help to you!
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

Adding New SCCM 2012 SP1 Distribution Point To Replace Existing Distribution Point

We currently in the process of the doing a site server refresh at all our remote sites. Each remote site currently has a physical 2012 SP1 DP, and will be replaced with a new DP at each location, and will eventually decommission the current one.
What's the best way to introduce a new DP and remove the old one?
Thanks
Bern

You can use this method if distributing through the WAN is not an option.
http://blogs.technet.com/b/kensmith/archive/2013/08/01/migrating-the-content-library-between-distribution-points-in-sccm-2012-sp1.aspx
If you don't care, just add it to SCCM and replicate your content. Modify your boundary once done.
I hope you have a DP Group, if so, just make it member of the group and all your content will be copied. If not, you'll have to go through all your content and add it manually or script the process using PowerShell.
To remove your existing it's simply a matter of removing the "Distribution Point" role on your Server using the SCCM Console. (Administration / Site Configuration /Site Server, select your distribution point, right click Remove)
Benoit Lecours | Blog: System Center Dudes

SCCM 2012 SP1 Distribution points not updating

The package that holds my MS updates is not updating on my distribution points ever since I upgraded to SP1. If I remove the package from the distribution points and then add it back it will work fine. This is happening to me every I add updates to this
package. Below is part of the smsdpprov.log file from one of my distro points.
[C90][Thu 02/14/2013 11:03:51]:Content 'f16906f8-d1d4-44df-8cf7-35dd7428893a' for package 'ENS00006' has been added to content library successfully
[C90][Thu 02/14/2013 11:03:55]:Content '1ebc4751-063f-46dd-a7ae-096cce3545dc' for package 'ENS00006' has been added to content library successfully
[C90][Thu 02/14/2013 11:03:56]:Content 'b2903470-59e0-4d89-a1a5-808b58c9fd4e' for package 'ENS00006' has been added to content library successfully
[C90][Thu 02/14/2013 11:03:58]:Content 'f058ee07-a66e-4bdf-8a53-7cc30affe333' for package 'ENS00006' has been added to content library successfully
[C90][Thu 02/14/2013 11:04:00]:Content '03546ec3-2613-46ce-bf0c-a6064149f2c6' for package 'ENS00006' has been added to content library successfully
[C90][Thu 02/14/2013 11:04:03]:Content '7492e432-b69c-478c-8c7b-7c2396302eb4' for package 'ENS00006' has been added to content library successfully
[C90][Thu 02/14/2013 11:04:05]:Content '995a1a82-6d7c-4fb6-9e1b-8cfac070b787' for package 'ENS00006' has been added to content library successfully
[C90][Thu 02/14/2013 11:04:06]:Content 'a0a2a75d-beab-49ca-96e5-e03afa98dc8f' for package 'ENS00006' has been added to content library successfully
[C90][Thu 02/14/2013 11:04:08]:Content '21061204-1d54-4262-bc90-cf5922191940' for package 'ENS00006' has been added to content library successfully
[C90][Thu 02/14/2013 11:04:11]:Content 'ce9e07ad-1467-4da5-bf03-8c7013743d34' for package 'ENS00006' has been added to content library successfully
[C90][Thu 02/14/2013 11:04:14]:MoveFile failed for \\?\C:\SCCMContentLib\DataLib\6178f7ae-a640-4e04-a851-abd13239a50f.ENS00006.temp to \\?\C:\SCCMContentLib\DataLib\6178f7ae-a640-4e04-a851-abd13239a50f
[C90][Thu 02/14/2013 11:04:14]:FileRename failed; 0x80070005
[C90][Thu 02/14/2013 11:04:14]:CContentDefinition::Finalize failed; 0x80070005
[C90][Thu 02/14/2013 11:04:14]:Failed to finalize content '6178f7ae-a640-4e04-a851-abd13239a50f' for package 'ENS00006'. Error code: 0X80070005

I've got the same issue. When I look at the smsdpprov.log on the distribution point, this is what I see.
[EB0][Thu 10/31/2013 08:39:08]:Content '0a3fe62c-58ce-47c7-b635-e23407515ecb' for package 'ONB0007A' has been added to content library successfully
[EB0][Thu 10/31/2013 08:39:08]:Content '809b4727-78b3-48bd-85ca-f2fdcf668297' for package 'ONB0007A' has been added to content library successfully
[EB0][Thu 10/31/2013 08:39:08]:MoveFile failed for
\\?\E:\SCCMContentLib\DataLib\5263454e-e3de-49e5-a077-48dba0eefe93.ONB0007A.temp to
\\?\E:\SCCMContentLib\DataLib\5263454e-e3de-49e5-a077-48dba0eefe93
[EB0][Thu 10/31/2013 08:39:08]:FileRename failed; 0x800700b7
[EB0][Thu 10/31/2013 08:39:08]:CContentDefinition::Finalize failed; 0x800700b7
[EB0][Thu 10/31/2013 08:39:08]:Failed to finalize content '5263454e-e3de-49e5-a077-48dba0eefe93' for package 'ONB0007A'. Error code: 0X800700B7
If I reboot the DP, then the package gets updated. I'd like to figure out how to make this not happen :)

SCCM 2012: Reinstall remote distribution point?

Hi,
We have a remote distribution point to which we can't deploy packages anymore. Several attempts to repair it failed.
I'd like to remove the distribution point and reinstall it via SCCM 2012 console.
However, I'd like to know the impact since it contains GB of packages already.
Note: the DP has been removed for clients (temorarely) so no impatc there.
My questions:
-what is best practises: can I just remove and add it in 1 go (or need to wait before re-adding, reboot needed in between)?
-will all data be pulled in again (I activated pull and would reactivate it after reinstall)?
-what's your experience in this procedure? does it work in general or is it preferrable I continue troubleshooting the current situation?
Please advise.
J.
Jan Hoedt

I can see there was installed a new dotnet version C:\Windows\Microsoft.NET\Framework64\v4.0.30319
recently.
Can/should I register this to IIS?
http://stackoverflow.com/questions/22952115/asp-net-iis-7-5-http-500-21-error
C:\Windows\Microsoft.NET\Framework\v4.0.30319>aspnet_regiis.exe -i
Jan Hoedt

SCCM 2012 R2 & Pull Distribution Point Casuing 0 Byte amd64 folders

Experiencing an extremely frustrating problem.
ENVIRONMENT:
1 Primary Site Server / DP (Main Office)
40 DP's (Remote School Locations)
- Hosted on a file server VM
- Contains 3 partitions: C: (System), E: (Data), I: (PKG share)
OS: Server 2008 R2 (Primary Site Server and File Servers / DP's)
SCCM Version: SCCM 2012 R2
We recently upgrade to SCCM 2012 R2. I have confirmed that this has not caused the problem I am about to describe. The only other change that has occurred recently is that we configured all of our DP's at each of our 40 sites to be pull distribution points.
While this seems to be working fine we are now seeing a whole bunch of 0 Byte alpha numeric folders with a 0 Byte amd64 subfolder. These folders seem to attach to the E: drive on all of our File server distribution points....for the life of me I cannot figure
out why and this occurred as soon as we switched to pull distribution points. While this does not seem to be having an erroneous effect on our environment, it is annoying and somewhat disconcerting as I have not been able to ascertain what is causing it. Any
SCCM admins out their ever encountered this?
Thanks

Yes, I have examined the logs using cmtrace and done a search for the amd64 string to see if any of the logs indicate its creation as part of the pull dp process. I have not found anything as of yet.
Thanks

SCCM 2012 cannot access distribution point as a data source for OS image

I am trying to path a data source to one of our file servers and get the following error:
I am guessing this is a permissions issue. The path is correct. This is also a distribution point and I have no trouble distributing content to it. The SCCM server is set to have local admin and network share rights to this file server. Any
ideas?

Of course - that would be too easy... had to ask though :)
Hmm, sounds odd. I'm guessing that since you're using it as a DP you're on Windows Server... You might try browsing there in your runline but instead of doing
\\server\share\OS.WIM try doing
\\Server.FQDN\Share\OS.WIM
I've seen some odd issues where I need to specify FQDN but it's pretty rare. I do remember an issue where my own account would not go through even though it had rights and I could navigate. I used a different account and I think after a while
it cleared up. My guess is something got rebooted and it "righted the ship" so-to-speak. I'm sorry I don't remember more, that particular client had multiple accounts so I just switched to a different one and by the time I had to do the same function
again the issues had resolved itself so I just moved on.

SCCM - Branch Distribution point and Management point on the same server

Hi All,
Would like to know if any other SCCM roles like management point , distribution can be installed on the same server on which a branch distribution point is installed?
Rgs,

Hi,
Branch Distribution Points no longer exist in Configuration Manager 2012 and above.
I'm assuming you want to install additional roles on an existing server that is currently only acting as a Distribution Point and the answer is yes, this is possible, but it depends on which other roles you want to install and there will probably be some
prerequisites needed.
Can you elaborate on which roles you are considering installing?
Steven Hodson | http://www.stevenhodson.com | @_hodders

Cisco CTC 6.0 gives NTVDM error in Server 2003?

Hi
We've got Cisco CTC 6.0 installed on the network and when we try to use this application from a Windows XP or older machine, it loads up just fine. But when trying to use this via a Windows Server 2003 or newer, it fails with an NTVDM Hard Error.
Can anyone give any insight into what could be causing this? The version of Java on both the XP and the 2003 is the same, same browser, same network segment...
Thanks
J

Hi
When I go to the java website and say verify java, it says I have the most recent version installed...the same version that works on Xp or older. I've read a bunch of other posts regarding local rights and giving domain admin access, but none of that helped. I tried from an enterprise admin account and it fails in the same way.
Thanks again.
Jason

11g performance counters error on Server 2003

Environment - fresh install of 11g (11.1.0.6.0) on a fresh Server 2003 R2 box. All configuration is largely out-of-the-box.
When I start the "Oracle Counters for Windows Performance Monitor" item from the start menu, I get a dialog box error with the following:
Unable to add these counters:
\Oracle11 Sorts(0)\sorts in memory/sec
\Oracle11 Sorts(0)\sorts on disk/sec
Clicking OK to that error, Performance Monitor does come up but when I try to add a counter, there is no Oracle-related Performance Object to choose, just the standard Windows, ASP, etc. ones.
Any ideas?

Personally I'd rather use Grid Control on x86-64 Linux.
But, I was asking about the error message I'm getting in hopes that perhaps someone else has seen this to. I wasn't asking what operating system to choose for Oracle, nor what management tool is best, though I do appreciate your feedback. As for why: simple curiousity. I want to poke around to see how 11g metrics are exposed and instrumented within Windows' own management frameworks, since I run into Oracle-on-Windows quite a bit. Pushing buttons in test environments just to see what they do is how we learn the strengths and weaknesses of all these technology products.

SCEP 2012 R2 - Remote Distribution Point

Can I set up a SCEP 2012 web site or portal located in my DMZ that my remote users can connect to if their definition files are out of date.
I would like the portal to be made accessible so that updates can be applied by the end user manually when there AV is out of date and they can not connect to services because of the out of date files.

Apologies Jeff - The following two options look good
Updates distributed from Microsoft Update – This method allows computers to connect directly to Microsoft Update in order to download definition and engine updates. This method can be useful for computers that are not often connected to the business
network.
Updates distributed from Microsoft Malware Protection Center – This method will download definition updates from the Microsoft Malware Protection Center.
Looking at them though there looks like to much for a user to do - We all know what users are like. I want something more like this to be hosted so once advised the AV files are out of data by the gateway devices the user is redirected to a page
that will present a screen like the extract below and then all user has to do is click "update"

Certificate Enroll Errors RPC Server Is Unavailable

I have a scenario in which I would like some advice before moving on. We have a Server 2012 root CA that was put in about a year-year and a half ago and at the same time there was another 2008 R2 root CA that was installed on a DC that was hosting FSMO roles.
Well that DC started to die so we transferred the FSMO roles and removed certificate services. However, we only uninstalled the role but as I understand, there is a bit of cleanup to do in AD beyond just removing the role. So when we started to perform the
first step, I noticed remnants of old servers that are no longer around. I've discovered that our previous admin had made 3 other servers (I believe all 2003) that have all completely gone away and yet are still listed in the Trusted Root Certification Authorities
on all computers and I find in the event log the following error when I log in to our domain machines of them trying to contact each of the old CA servers:
Certificate enrollment for Local system failed to enroll for a Machine certificate with request ID N/A from server.domain.org\server (The RPC server is unavailable. 0x800706ba (WIN32: 1722)).
Now I have no way of knowing whether or not this admin actually properly removed the role before decommissioning these servers and I have no idea why we needed so many servers to be root CA's in the first place? Anyhow, I was wondering if the proper procedure
would be to remove the root trusted certs from group policy and then clean up the remnant entries in AD as described in the Microsoft documentation of removing a root CA from your environment. I still see some errors and machines requesting to check for stuff
like CRL with the most recent root CA that we removed so I just wanted to check to see if all of these errors will go away once we finish the cleanup and if there is anything special that needs to be done for the potentially orphaned root CA's. We did take
a backup of the 2008R2 CA (the one that was on the dying DC) before we removed the role and I have confirmed that our production CA (the one that we would like to remain in production - is a sub CA of an offline root) has already issued new machine and DC
certs to our domain machinese and domain controllers.
Sorry for the lengthy post. Please let me know if any more information is required and thank you in advance!

Hello,
the root CA normally is the first one in a forest issuing the certificates for the subordinate CAs if required or for certificates.
http://technet.microsoft.com/en-us/library/cc731183.aspx
SO there is no need for multiple root CAs.
To get rid of everything old and be sure the CA is configured correct for your needs I suggest to ask this in
http://social.technet.microsoft.com/Forums/windowsserver/en-US/home?forum=winserversecurity
Best regards
Meinolf Weber
MVP, MCP, MCTS
Microsoft MVP - Directory Services
My Blog: http://msmvps.com/blogs/mweber/
Disclaimer: This posting is provided AS IS with no warranties or guarantees and confers no rights.

"Enable distribution-point sharing for this source site" did not showing SCCM 2007 DPs as SCCM 2012 content shares for CM12 clients

Hi
We have one central site server and three primary site servers in SCCM 2007 and completed the SCCM 2012 migration as single hierarchy.
During the migration, We have configured SCCM 2007 Central site server as source hierarchy for data gathering process and configured the "Enable distribution-point sharing for this source site" to make SCCM 2007 distribution points
as SCCM 2012 content shares to serve SCCM 2012 migrated clients. Now we are facing a problem that one of the primary site server's data gathering process did not gather SCCM 2007 DPs even though we configured "Enable distribution-point sharing for this
source site" but data gathering process is completing successfully.
Is anyone have idea, why these SCCM 2007 DPs did not appearing as SCCM 2012 content shares under "Shared Distribution Points"
Thanks in Advance
srkr

Now we are facing a problem that one of the primary site server's data gathering process did not gather SCCM 2007 DPs even though we configured "Enable distribution-point sharing for this source
site" but data gathering process is completing successfully.
Earlier all the shared DPs are showing under Shared Distribution Points ? Or since starting itself these DPs are not showing down? Have you checked migmctrl.log for some clue?
Anoop C Nair (My Blog www.AnoopCNair.com)
- Twitter @anoopmannur -
FaceBook Forum For SCCM

SCCM 2012 and SCCM 2007 Shared Distribution Points

I am building a new SCCM 2012 site (primary and 4 secondaries) besides a SCCM 2007 site (primary, 3 secondaries and 65 DPs).
I migrated all objects from SCCM 2007 to SCCM 2012 which worked well.
I migrated a client from SCCM 2007 to my SCCM 2012 environment and that worked well. Then i push some packages from SCCM 2012 to my migrated client which worked as well either.
Then I switch on the SHARED DISTRIBUTION option in the migration section and now my migrated SCCM 2012 client only can access the SCCM 2007 DPs and packages from SCCM 2012 DP can't be accessed anymore...in Software Center the packages will stay at 0% downloading....
Is that normal behavior after enabling shared DPs ?

Did you ever find a solution for this? I am experiencing the same issue.
I have an IP address range boundary for testing SCCM 2012. After enabling shared distribution option SCCM 2012 migrated boundaries from SCCM 2007. My test IP address range boundary has two boundary groups... One is the SCCM 2012 Boundary group
pointing towards the SCCM 2012 DPs. The 2nd is the automatically created "Boundary Group for SCCM 2007 distribution point."
With both of those in there I can only push SCCM 2007 packages to the SCCM 2012 clients. SCCM 2012 packages come back in the logs as "Calling back with empty distribution points list." If I remove the automatically created "Boundary Group for SCCM 2007 distribution
point" from the test IP boundary then SCCM 2012 clients will properly download from the SCCM 2012 DPs, but now the SCCM 2007 packages fail to download to the SCCM 2012 test clients.
I assume I have some kind of boundary issue but am at a loss of resolving it. Either that or I have the shared dp concept down incorrectly. Shouldn't I be able to have a boundary that has SCCM 2012 clients that uses the 2012 DP for 2012 content but the 2007
DP for 2007 content while I am migrating?
Thanks for any help
- Ryan

2012 SCCM SP1 Distribution Point Certificate store error on Server 2003 R2

Similar Messages

Maybe you are looking for