SCCM 2012 Network Access Account password problem

Hello Everyone,
I got a problem with the Network Access Account on SCCM 2012. I didn't have any problem previously and can deploy OS successfully. The problem started last week when I tried to deploy an OS. It gave me a error on Task Sequence then I searched for the error
and found that its related with the Network Access Account. On SCCM Config Manager I checked the Network Access Account and found that I had the wrong password. But the bigger problem starts here: on configManager Administration/Security/accounts window
I open my NAS properties and on the verify window tried to reach a simple network share and it says the password is wrong, then I change the password and tried to verify one more time and it successfully reaches the share, I simply click apply and
OK as usual but when I open the properties window I always see the old password stays there. I tried to change the password maybe 100 time but I didn't work. My NAS is a normal domain account with Domain Users permissions, I ve already
checked the password, account and password never expires options, they are all rightly configured. I also tried to make a new account to use as a NAS, then I set it on SCCM as a NAS but the result is always the same. Accounts
have wrong password and I cant change and save it. Actually I can change till I close the properties window then its all gone , reset to old wrong password. Please help me with that, I am googling it like 2 days and found that the same thing happened
to 2 other people, but there is no solution... 

That workaround seems to work.  Only verify when you first type the password and get the success/confirmation message.  Once you hit OK to save the password, something happens to it (probably encrypts the password entered). If you open the account
settings again, I assume SCCM takes the password from the database or task sequence in it's encrypted form and presents that in the text boxes.  Clicking OK will save the password again, but because it is presented in it's encrypted form, will re-encrypt
this as a new password and effectively change what you originally entered as the password.  Again, I'm just assuming this based on what I observed. If it's true, then definately a bug.
I think this is pretty correct. This whole (non?)-issue was a massive red-herring for me. I spent a week trying to understand what was wrong, but eventually discovered the issue was a couple of steps down the line. SCCM errors on the surface level are pretty
consistently confusing. 9 times out of ten, I have been lead astray by them. Crack open your log files, your real problems will be in there.

Similar Messages

  • SCCM 2012 R2 - Distribution Point untrusted domain - Not acknowledging Network Access Account (FYI)

    Hello!
    Scenario
    Built a single primary site server in one domain with multiple distribution points. All site servers are member of this one site.
    The distribution points in the primary site servers' domain function as expected. The distribution point deployed to an untrusted domain does not. The primary site server can see all objects in the domain, publishes successfully, and CCM client on the
    DP in the untrusted domain knows its part of the site, knows its AD site (according to locationservices.log). The DP role is installed properly, logs are populating, queries are being made for application lists and updates. nfortuantely authentication
    errors indicate that this software can'tbe downloaded.
    In essence the DP in the untrusted domain can't pull down content from the primary site server. The role uses BITS to download content from IIS on the primary site server, but the requests each throw a 401 error. Unauthorised. This should be an easy fix.
    Create a Network Access Account in the primary site server's domain, assign it to the site (Software Distribution setting), wait for the DP to pick up the setting and watch it retrieve its content. The DP in the untrusted domain is configured as a Pull DP,
    implying it has to use a Network Access Account to download content. It knows the content is available and makes every effort to download it.
    Problem
    The DP in the untrusted domain doesn't know a Network Access Account (NAA) has been defined for the site.
    The account does exist, created in the primary site server's domain and assigned to the site. Its not a password issue. IIS has not been set for Anonymous access as this isn't needed - the NAA should provide the credentials it requires to pull down content.
    A manual check using the URL of the package confirms the package is accessible from the DP when using the NAA's credentials. I've allowed enough time (i think) for the DP to acknowledge the NAA. For fun the DP role was removed, and the CCM agent removed. Both
    were reinstalled. A fresh install didn't detect the NAA.
    Solution
    After some soul searching and a little frustration, it came down to this: A Pull DP always uses the Network Access Account. If the DP can't find a Network Access account it will fail to pull down content. This is undisputed. Found an article that states
    the Pull DP always uses the CCM client configuration to do its dirty work. At that point the CCM client was checked. It had the classic problem of only displaying two Actions - Machine Policy Retrieval & Evaluation Cycle, User policy Retrieval & Evaluation
    Cycle. Most components were installed but not enabled. This is fairly common. Looked at the console, found the device, added the Approval column. Turns out it wasn't auto-approved. Reason being that the client is in an untrusted domain and clients in untrusted
    domains aren't approved automatically (by default).
    In this case something as simple as an Approving the client fixed these issues. 
    The DataTransferService.log highlights the issue:
    <![LOG[CDTSJob::JobError: DTS Job ID='{17E0B672-F699-434D-B063-87CC2ACF715C}' BITS Job ID='{38B81ADE-55B5-4BD7-A881-DBFF13943EDE}' ErrorCode=0x80190191]LOG]!><time="18:25:54.264+00" date="02-19-2015" component="DataTransferService"
    context="" type="1" thread="3136" file="dtsjob.cpp:3501">
    <![LOG[CDTSJob::JobError: DTS Job ID='{17E0B672-F699-434D-B063-87CC2ACF715C}' URL='http://PRIMARYSERVER.A.B.COM:80/SMS_DP_SMSPKG$/5af1680e-4a14-4dc5-8a60-bda7370e6d68'
    ProtType=1]LOG]!><time="18:25:54.264+00" date="02-19-2015" component="DataTransferService" context="" type="1" thread="3136" file="dtsjob.cpp:3504">
    <![LOG[Authentication required by the proxy, DTS Job ID='{17E0B672-F699-434D-B063-87CC2ACF715C}' BITS Job ID='{38B81ADE-55B5-4BD7-A881-DBFF13943EDE}'.]LOG]!><time="18:25:54.264+00" date="02-19-2015" component="DataTransferService"
    context="" type="3" thread="3136" file="dtsjob.cpp:3513">
    <![LOG[DTSJob {8814E9A1-3D26-4089-83CF-3C7D17BCEC6E} in state 'Cancelled'.]LOG]!><time="18:25:54.264+00" date="02-19-2015" component="DataTransferService" context="" type="1" thread="3688"
    file="dtsjob.h:166">
    <![LOG[DTS job {17E0B672-F699-434D-B063-87CC2ACF715C} BITS job
    {38B81ADE-55B5-4BD7-A881-DBFF13943EDE} encountered Access Denied error during download.  Will retry using Network Access Account.]LOG]!><time="18:25:54.264+00" date="02-19-2015" component="DataTransferService"
    context="" type="2" thread="3136" file="dtsjob.cpp:3652">
    <![LOG[DTSJob {8814E9A1-3D26-4089-83CF-3C7D17BCEC6E} cancelled by client.]LOG]!><time="18:25:54.280+00" date="02-19-2015" component="DataTransferService" context="" type="1" thread="3688"
    file="dtsjob.cpp:3205">
    <![LOG[No network access account info found.]LOG]!><time="18:25:54.327+00" date="02-19-2015" component="DataTransferService" context="" type="1"
    thread="3136" file="netaccessaccount.cpp:288">
    <![LOG[The network access account is not defined.]LOG]!><time="18:25:54.327+00" date="02-19-2015" component="DataTransferService" context=""
    type="1" thread="3136" file="netaccessaccount.cpp:858">
    <![LOG[DTSJob {17E0B672-F699-434D-B063-87CC2ACF715C} encountered error setting BITS job to use Network Access Account
    (0x00000000).]LOG]!><time="18:25:54.327+00" date="02-19-2015" component="DataTransferService" context="" type="3" thread="3136" file="dtsjob.cpp:1885">
    The IIS server logs u_ex150219.log captures the request:
    2015-02-19 123.11.12.13 GET /SMS_DP_SMSPKG$/5af1680e-4a14-4dc5-8a60-bda7370e6d68/sccm /windows6.1-kb3021917-x64.cab 80 - 9.10.11.12 Microsoft+BITS/7.7 -
    401 2 5 1509 2
    2015-02-19 123.11.12.13 GET /SMS_DP_SMSPKG$/5af1680e-4a14-4dc5-8a60-bda7370e6d68/sccm /windows6.1-kb3021917-x64.cab 80 - 9.10.11.12 Microsoft+BITS/7.7 -
    401 1 3221225581 1509 4
    2015-02-19 123.11.12.13 GET /SMS_DP_SMSPKG$/5af1680e-4a14-4dc5-8a60-bda7370e6d68/sccm /windows6.1-kb3021917-x64.cab 80 - 9.10.11.12 Microsoft+BITS/7.7 -
    401 1 3221225581 1509 3
    2 x Domains: DomainA and DomainX
    - Single domain forests
    - No trusts between domains/forests
    DomainA\PRIMARYSERVER
    - Primary Site Server, MP, DP, IIS, all roles
    DomainX\DP1
    - Distribution Point, IIS, etc
    - CCM client installed

    Based on the above, you are using a PullDP. If so, have you installed the client agent on this system? The client agent is required on PullDPs in untrusted domains so that they can acquire the NAA.
    Jason | http://blog.configmgrftw.com | @jasonsandys

  • 2012 R2 OSD refresh WinPE Network Access Account issue?

    Hi, 
    Environment: SCCM 2012 R2/MDT2013
    Since upgrading to R2 we're experiencing failures during an OS refresh task sequence. But only in one physical location.
    The same MDT task sequence runs fine for new computer builds (in both locations)
    Hardware is identical in both locations. One location completes the refresh correctly. The other location prestages content correctly, reboots into WinPE then immediately fails as soon as it attempts to download the first item (MDT toolkit package) from
    the distribution point. 
    SMSTS.log (below) logs 'no credential information in environment' and fails when attempting to pull from the dp. 
    This implies the network access account is not set.
    It is set and it works correctly at the other location (for the same refresh task sequence) 
    I know that R2 allows for multiple network access accounts. We've made no changes. We're just using the same account we used before the upgrade. 
    Boundaries are set correctly. Not sure what else to look for. 
    The error:
    Start executing an instruction. Instruction name: Use Toolkit Package. Instruction pointer: 61 TSManager 22/11/2013 12:41:45 p.m. 1072 (0x0430)
    Set a global environment variable _SMSTSCurrentActionName=Use Toolkit Package TSManager 22/11/2013 12:41:45 p.m. 1072 (0x0430)
    Set a global environment variable _SMSTSNextInstructionPointer=61 TSManager 22/11/2013 12:41:45 p.m. 1072 (0x0430)
    Set a global environment variable _SMSTSLogPath=X:\windows\TEMP\SMSTSLog TSManager 22/11/2013 12:41:45 p.m. 1072 (0x0430)
    Expand a string: smsswd.exe /run:NZX000FC cscript.exe Scripts\ZTISCCM.wsf TSManager 22/11/2013 12:41:45 p.m. 1072 (0x0430)
    Expand a string: TSManager 22/11/2013 12:41:45 p.m. 1072 (0x0430)
    Command line for extension .exe is "%1" %* TSManager 22/11/2013 12:41:45 p.m. 1072 (0x0430)
    Set command line: smsswd.exe /run:NZX000FC cscript.exe Scripts\ZTISCCM.wsf TSManager 22/11/2013 12:41:45 p.m. 1072 (0x0430)
    Start executing the command line: smsswd.exe /run:NZX000FC cscript.exe Scripts\ZTISCCM.wsf TSManager 22/11/2013 12:41:45 p.m. 1072 (0x0430)
    !--------------------------------------------------------------------------------------------! TSManager 22/11/2013 12:41:45 p.m. 1072 (0x0430)
    Expand a string: WinPEandFullOS TSManager 22/11/2013 12:41:45 p.m. 1072 (0x0430)
    Executing command line: smsswd.exe /run:NZX000FC cscript.exe Scripts\ZTISCCM.wsf TSManager 22/11/2013 12:41:45 p.m. 1072 (0x0430)
    [ smsswd.exe ] InstallSoftware 22/11/2013 12:41:45 p.m. 1176 (0x0498)
    PackageID = 'NZX000FC' InstallSoftware 22/11/2013 12:41:45 p.m. 1176 (0x0498)
    BaseVar = '', ContinueOnError='' InstallSoftware 22/11/2013 12:41:45 p.m. 1176 (0x0498)
    ProgramName = 'cscript.exe Scripts\ZTISCCM.wsf' InstallSoftware 22/11/2013 12:41:45 p.m. 1176 (0x0498)
    SwdAction = '0001' InstallSoftware 22/11/2013 12:41:45 p.m. 1176 (0x0498)
    ResolveSource flags: 0x00000000 InstallSoftware 22/11/2013 12:41:45 p.m. 1176 (0x0498)
    SMSTSPersistContent: . The content for package NZX000FC will be persisted InstallSoftware 22/11/2013 12:41:45 p.m. 1176 (0x0498)
    DownloadOnDemand flag is true. Attempting to download content locally for Package NZX000FC. InstallSoftware 22/11/2013 12:41:45 p.m. 1176 (0x0498)
    Locations: Multicast = 0, HTTP = 2, SMB = 0. InstallSoftware 22/11/2013 12:41:46 p.m. 1176 (0x0498)
    Package Flags: 0x00000000 InstallSoftware 22/11/2013 12:41:46 p.m. 1176 (0x0498)
    Multicast is not enabled for the package. InstallSoftware 22/11/2013 12:41:46 p.m. 1176 (0x0498)
    Trying https://SCCM.domain.local/NOCERT_SMS_DP_SMSPKG$/NZX000FC. InstallSoftware 22/11/2013 12:41:46 p.m. 1176 (0x0498)
    GetDirectoryListing() entered InstallSoftware 22/11/2013 12:41:46 p.m. 1176 (0x0498)
    No credential information in environment. InstallSoftware 22/11/2013 12:41:46 p.m. 1176 (0x0498)
    Initializing HTTP transport. InstallSoftware 22/11/2013 12:41:46 p.m. 1176 (0x0498)
    Setting URL = https://SCCM.domain.local/NOCERT_SMS_DP_SMSPKG$/NZX000FC. InstallSoftware 22/11/2013 12:41:46 p.m. 1176 (0x0498)
    Address=https://SCCM.domain.local, Scheme=https, Object=/NOCERT_SMS_DP_SMSPKG$/NZX000FC, Port=443. InstallSoftware 22/11/2013 12:41:46 p.m. 1176 (0x0498)
    Setting Authenticator. InstallSoftware 22/11/2013 12:41:46 p.m. 1176 (0x0498)
    Set authenticator in transport InstallSoftware 22/11/2013 12:41:46 p.m. 1176 (0x0498)
    Setting Media Certificate. InstallSoftware 22/11/2013 12:41:46 p.m. 1176 (0x0498)
    Media pfx is empty InstallSoftware 22/11/2013 12:41:46 p.m. 1176 (0x0498)
    CLibSMSMessageWinHttpTransport::Send: URL: SCCM.domain.local:443 PROPFIND /NOCERT_SMS_DP_SMSPKG$/NZX000FC InstallSoftware 22/11/2013 12:41:46 p.m. 1176 (0x0498)
    In SSL, but with no client cert InstallSoftware 22/11/2013 12:41:46 p.m. 1176 (0x0498)
    In SSL, but with no media cert InstallSoftware 22/11/2013 12:41:46 p.m. 1176 (0x0498)
    401 - Unsuccessful with anonymous access. Retrying with context credentials. InstallSoftware 22/11/2013 12:41:46 p.m. 1176 (0x0498)
    Using thread token for request InstallSoftware 22/11/2013 12:41:46 p.m. 1176 (0x0498)
    401 - Unsuccessful with context credentials. Retrying with supplied credentials. InstallSoftware 22/11/2013 12:41:46 p.m. 1176 (0x0498)
    Network access account credentials not supplied. InstallSoftware 22/11/2013 12:41:46 p.m. 1176 (0x0498)
    401 - Unsuccessful on all retries. InstallSoftware 22/11/2013 12:41:46 p.m. 1176 (0x0498)
    SendResourceRequest() failed. 80190191 InstallSoftware 22/11/2013 12:41:46 p.m. 1176 (0x0498)
    SendResourceRequest(), HRESULT=80190191 (e:\nts_sccm_release\sms\framework\tscore\downloadcontent.cpp,516) InstallSoftware 22/11/2013 12:41:46 p.m. 1176 (0x0498)
    oDavRequest.GetDirectoryListing (setDirs, setFiles), HRESULT=80190191 (e:\nts_sccm_release\sms\framework\tscore\resolvesource.cpp,2516) InstallSoftware 22/11/2013 12:41:46 p.m. 1176 (0x0498)
    Download() failed. 80190191. InstallSoftware 22/11/2013 12:41:46 p.m. 1176 (0x0498)
    Here's the log from the location that works correctly. 
    Start executing an instruction. Instruction name: Use Toolkit Package. Instruction pointer: 19 TSManager 21/11/2013 5:17:12 p.m. 536 (0x0218)
    Set a global environment variable _SMSTSCurrentActionName=Use Toolkit Package TSManager 21/11/2013 5:17:12 p.m. 536 (0x0218)
    Set a global environment variable _SMSTSNextInstructionPointer=19 TSManager 21/11/2013 5:17:12 p.m. 536 (0x0218)
    Set a global environment variable _SMSTSLogPath=X:\WINDOWS\TEMP\SMSTSLog TSManager 21/11/2013 5:17:12 p.m. 536 (0x0218)
    Expand a string: smsswd.exe /run:NZX000FC cscript.exe Scripts\ZTISCCM.wsf TSManager 21/11/2013 5:17:12 p.m. 536 (0x0218)
    Expand a string: TSManager 21/11/2013 5:17:12 p.m. 536 (0x0218)
    Command line for extension .exe is "%1" %* TSManager 21/11/2013 5:17:12 p.m. 536 (0x0218)
    Set command line: smsswd.exe /run:NZX000FC cscript.exe Scripts\ZTISCCM.wsf TSManager 21/11/2013 5:17:12 p.m. 536 (0x0218)
    Start executing the command line: smsswd.exe /run:NZX000FC cscript.exe Scripts\ZTISCCM.wsf TSManager 21/11/2013 5:17:12 p.m. 536 (0x0218)
    !--------------------------------------------------------------------------------------------! TSManager 21/11/2013 5:17:12 p.m. 536 (0x0218)
    Expand a string: WinPEandFullOS TSManager 21/11/2013 5:17:12 p.m. 536 (0x0218)
    Executing command line: smsswd.exe /run:NZX000FC cscript.exe Scripts\ZTISCCM.wsf TSManager 21/11/2013 5:17:12 p.m. 536 (0x0218)
    [ smsswd.exe ] InstallSoftware 21/11/2013 5:17:12 p.m. 460 (0x01CC)
    PackageID = 'NZX000FC' InstallSoftware 21/11/2013 5:17:12 p.m. 460 (0x01CC)
    BaseVar = '', ContinueOnError='' InstallSoftware 21/11/2013 5:17:12 p.m. 460 (0x01CC)
    ProgramName = 'cscript.exe Scripts\ZTISCCM.wsf' InstallSoftware 21/11/2013 5:17:12 p.m. 460 (0x01CC)
    SwdAction = '0001' InstallSoftware 21/11/2013 5:17:12 p.m. 460 (0x01CC)
    ResolveSource flags: 0x00000000 InstallSoftware 21/11/2013 5:17:12 p.m. 460 (0x01CC)
    SMSTSPersistContent: . The content for package NZX000FC will be persisted InstallSoftware 21/11/2013 5:17:12 p.m. 460 (0x01CC)
    DownloadOnDemand flag is true. Attempting to download content locally for Package NZX000FC. InstallSoftware 21/11/2013 5:17:12 p.m. 460 (0x01CC)
    Locations: Multicast = 0, HTTP = 1, SMB = 0. InstallSoftware 21/11/2013 5:17:12 p.m. 460 (0x01CC)
    Package Flags: 0x00000000 InstallSoftware 21/11/2013 5:17:12 p.m. 460 (0x01CC)
    Multicast is not enabled for the package. InstallSoftware 21/11/2013 5:17:12 p.m. 460 (0x01CC)
    Trying https://SCCM.domain.local/NOCERT_SMS_DP_SMSPKG$/NZX000FC. InstallSoftware 21/11/2013 5:17:12 p.m. 460 (0x01CC)
    GetDirectoryListing() entered InstallSoftware 21/11/2013 5:17:12 p.m. 460 (0x01CC)
    Initializing HTTP transport. InstallSoftware 21/11/2013 5:17:12 p.m. 460 (0x01CC)
    Setting URL = https://SCCM.domain.local/NOCERT_SMS_DP_SMSPKG$/NZX000FC. InstallSoftware 21/11/2013 5:17:12 p.m. 460 (0x01CC)
    Address=https://SCCM.domain.local, Scheme=https, Object=/NOCERT_SMS_DP_SMSPKG$/NZX000FC, Port=443. InstallSoftware 21/11/2013 5:17:12 p.m. 460 (0x01CC)
    Setting Authenticator. InstallSoftware 21/11/2013 5:17:12 p.m. 460 (0x01CC)
    Set authenticator in transport InstallSoftware 21/11/2013 5:17:12 p.m. 460 (0x01CC)
    Setting Media Certificate. InstallSoftware 21/11/2013 5:17:12 p.m. 460 (0x01CC)
    WinHttp credentials set InstallSoftware 21/11/2013 5:17:12 p.m. 460 (0x01CC)
    CLibSMSMessageWinHttpTransport::Send: URL: SCCM.domain.local:443 PROPFIND /NOCERT_SMS_DP_SMSPKG$/NZX000FC InstallSoftware 21/11/2013 5:17:12 p.m. 460 (0x01CC)
    In SSL, but with no client cert InstallSoftware 21/11/2013 5:17:12 p.m. 460 (0x01CC)
    401 - Unsuccessful with anonymous access. Retrying with context credentials. InstallSoftware 21/11/2013 5:17:12 p.m. 460 (0x01CC)
    Using thread token for request InstallSoftware 21/11/2013 5:17:12 p.m. 460 (0x01CC)
    401 - Unsuccessful with context credentials. Retrying with supplied credentials. InstallSoftware 21/11/2013 5:17:12 p.m. 460 (0x01CC)
    Request was successful. InstallSoftware 21/11/2013 5:17:15 p.m. 460 (0x01CC)
    Cheers

    So, still having issues after a lot of testing. Same machine type as before, I feel like this is a bug in R2 but I can't find a lot of information on it around the web. same thing every time.
    401 - Unsuccessful with anonymous access. Retrying with context credentials. InstallSoftware 22/11/2013 12:41:46 p.m. 1176 (0x0498)
    Using thread token for request InstallSoftware 22/11/2013 12:41:46 p.m. 1176 (0x0498)
    401 - Unsuccessful with context credentials. Retrying with supplied credentials. InstallSoftware 22/11/2013 12:41:46 p.m. 1176 (0x0498)
    Network access account credentials not supplied. InstallSoftware 22/11/2013 12:41:46 p.m. 1176 (0x0498)
    401 - Unsuccessful on all retries. InstallSoftware 22/11/2013 12:41:46 p.m. 1176 (0x0498)
    SendResourceRequest() failed. 80190191 InstallSoftware 22/11/2013 12:41:46 p.m. 1176 (0x0498)
    SendResourceRequest(), HRESULT=80190191 (e:\nts_sccm_release\sms\framework\tscore\downloadcontent.cpp,516) InstallSoftware 22/11/2013 12:41:46 p.m. 1176 (0x0498)
    oDavRequest.GetDirectoryListing (setDirs, setFiles), HRESULT=80190191 (e:\nts_sccm_release\sms\framework\tscore\resolvesource.cpp,2516) InstallSoftware 22/11/2013 12:41:46 p.m. 1176 (0x0498)
    Download() failed. 80190191. InstallSoftware 22/11/2013 12:41:46 p.m. 1176 (0x0498)
    The only information I can find on this regarding 2012 R2 is what Torsten posted in his blog. Although he doesn't post a solution to the problem.
    I believe there needs to be a KB hotfix released regarding the issue. at least some steps we can take to resolve it.
    the only thing I haven't tried that I believe could help is to recreate the boot images from scratch instead of just re distributing them to the DP. From scratch using the latest 8.1 ADK WinPE tools.
    Other info: when the SCCM 2012 R2 update became available, the 8.1 ADK that was available at the time had many bugs and was re released almost immediately!:
    http://www.deploymentresearch.com/Research/tabid/62/EntryId/114/Windows-ADK-8-1-re-released.aspx
    I only mention this because in my case, I updated my SCCM server to R2 within hours of the update becoming available which means I most likely had the "bad" 8.1 ADK before the re released it            ^
    recreating the boot images from the newly downloaded 8.1 ADK could be the solution to our problems! 
    This is the best guide that I have found about how to create boot images from scratch (meaning that no current media on the server is used to create the boot image(s)) :
     http://myitforum.com/myitforumwp/2013/08/01/how-to-create-configmgr-2012-boot-images-from-scratch/
    For now, the only work around (which I hate) is to enable anonymous access to the Distribution Point.. when I do this the task sequences complete without error.....
    some input from Microsoft would be AMAZING at this point.

  • Network Access Account tab is unavailable

    Hello and Happy new year,
    I just finished to install SCCM 2012 R2 and the installation was successful.
    I now want to configure the Network Access Account but when I go to Administration -> Site Configuration -> Sites -> Configure Site Components -> Software Distribution, I just see the general tab but not the network access account tab.
    Could you please tell me if I forgot to do something which prevent me to see this tab ?
    Best Regards.
    Seb.
    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

    Hello Peter,
    Thanks for your help.
    As I begin with SCCM I don't really know what you want to mean with CAS.
    I Imagine it's for central administration site.
    I followed a MOAC lesson which told me to choose "Install a configuration manager central administration site" which was apparently not the good option.
    I uninstalled SCCM and choose install a configuration manager primary site.
    This time it's seems to be ok.
    Thank you.
    Best regards.
    Seb.
    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

  • Network Access Account, used by only Workgroup Computers or Domain Computers also?

    Our environment has a few servers that are in a workgroup (not ideal, but is an application requirement on these few boxes) rather than being on the domain.  We have to patch these servers routinely and would like to use SCCM 2012 to do so.  As
    I understand it all that is needed is to configure the Network Access Account for the site and install the client manually on the workgroup computers, correct?  My next question is, do the domain computers continue to use their computer accounts to access
    network locations during content deployment or will they too use the newly configured  network access account?  Or, does the client first attempt to use its computer account and if that fails then results to using the SCCM Network Access Account?
     I've searched everywhere and can't seem to find this info.  Thanks in advance if you can point me in the right direction.

    Hi,
    I haven't seen any table like this for the Configuration Manager 2012 so this is for 2007, I haven't heard of any changes to this and the conclusion is that the account is used more often than you would think depending on what you are doing with the client.
    http://technet.microsoft.com/en-us/library/bb680398.aspx
    Regards,
    Jörgen
    -- My System Center blog ccmexec.com -- Twitter
    @ccmexec

  • How to replace or change SCCM 2012 R2 install account

    Hello,
    If we have a need to off-board/replace/change the user (Bob) who originally installed SCCM with, what would the reprocussions of such action be? Anyone attempted to do such a thing before? Is this 'supported'?
    Details:
    This user used their 'extra' account (Let's call it "BobAdmin") that had domain admin rights to install SCCM with, however since then have moved onto another role within the organization which is now not related to SCCM. While they have
    retained their accounts "Bob" and "BobAdmin" we want to prevent this user from accessing/managing/logging into SCCM.
    When we review the properties of any objects, we see this user's 'extra' account (BobAdmin) is listed as "Created by, Modified by" for most objects, including but not limited to:
    "All Users" "All computers",
    Security Scopes "Default" , "All"
    Client Settings "Default Client Settings"
    Boundaries, Sites, etc...
    Not to mention SQL connectivity - this user is listed as having "public" and "smsdbrole_AITool" role memberships with "public" Server role.
    Current role this user has (BobAdmin) is Full Administrator/all scopes/all collections, however, it is not listed in the "Administration | Security | Accounts" section.
    Original install details: (clean/new) 2012 Datacenter edition, upgraded to SP1 CU3, then R2 CU1; SQL is 2008 R2 with plenty of resources etc. Primary Site only, Single AD domain, Multiple DP servers w PXE boot,
    Single Reporting Server, Single Application web service/website, Software Update point... AD schema extended.
    Option 1:
    Rename user to something other than "BobAdmin" & change that accounts password (Not sure if this is the best option given how engrained some SCCM things are with Windows User profiles etc...)
    Option 2:
    Leave the user's name as is ("BobAdmin") & just change the password? Change the user's first/last name/description to reflect what it's used for now. (i.e. treat it like any other service account?)
    Option 3:
    Verify that we have other Full Administrators defined (Already done.)
    Disable the user ("BobAdmin") and then in 30 days or so, delete this account if all works fine.
    What happens to the "Created by, Modified by: verbiage if that happens"? (Prefer not to have to dig through the AD recycle bin to fix a broken SCCM...)
    NOTE: Assume that we have full AD, site, sql & vm backups of these servers systems etc...
    References
    https://technet.microsoft.com/en-us/library/gg682088.aspx
    What is the minimum I have to configure if I don’t want to use role-based administration while I’m testing System Center 2012 Configuration Manager?
    If you install System Center 2012 Configuration Manager, there is no additional configuration because the Active Directory user account used to install Configuration Manager is automatically assigned to the
    Full Administrator security role, assigned to All Scopes, and has access to the
    All Systems and All Users and User Groups collections. However, if you want to provide full administrative permissions for other Active Directory users to access System Center 2012 Configuration Manager, create new administrative
    users in Configuration Manager using their Windows accounts and then assign them to the
    Full Administrator security role.
    https://technet.microsoft.com/en-us/library/hh427337.aspx
    https://technet.microsoft.com/en-us/library/hh427332.aspx

    Option 1 or 2 are fine. Changing the user name has no effect as just like all good Windows apps, it doesn't reference the actual name but instead uses the SID.
    Option 3 is not sufficient for every single thing delegated to this account. Granted, I can't name what these things are and they are very, very little used, but they do exist. If you do delete the account, the only way to get an equivalent one back is to
    call support as it involves updating the DB directly.
    Jason | http://blog.configmgrftw.com | @jasonsandys

  • Sccm 2012- remote access to client

    Hi
    We have SCCM 2012 and enabled the remote tools  to the workstation
    I noticed when I used a ccount with local admin I able to access the machine properly
    But when I used account "without" local admin account in the computer I'm getting "prompt" to enter user name and password and even I input the account I;m getting still prompt option.
    Please advise why the NON/Without "local admin" can't access the machine and pompting a user name  and password
    The remot tools required local admin ???
    although the user have local admin can do ..
    Robert

    When I add the "remote control  or remote viewer in local administrator of the machine, the thing work smoothly 
    The only issues are , when the remote viewer is NOT part of local administrator I can't able to remote the machine 
    addiotinal info for port listening for further troubleshooting 
    need your help .. is there any relation for the gpo ? because if local admin it work fine 
    Active Connections
      Proto  Local Address          Foreign Address        State
      TCP    0.0.0.0:135            SCCMTEST05:0           LISTENING
      TCP    0.0.0.0:445            SCCMTEST05:0           LISTENING
      TCP    0.0.0.0:2701           SCCMTEST05:0           LISTENING
      TCP    0.0.0.0:49152          SCCMTEST05:0           LISTENING
      TCP    0.0.0.0:49153          SCCMTEST05:0           LISTENING
      TCP    0.0.0.0:49154          SCCMTEST05:0           LISTENING
      TCP    0.0.0.0:49182          SCCMTEST05:0           LISTENING
      TCP    0.0.0.0:49183          SCCMTEST05:0           LISTENING
      TCP    0.0.0.0:49184          SCCMTEST05:0           LISTENING
      TCP    192.168.24.218:139      SCCMTEST05:0           LISTENING
      TCP    192.168.24.218:2701     server6032:60104         TIME_WAIT
      TCP    192.168.24.218:57163    server5092:10123         ESTABLISHED
      TCP    192.168.24.218:57265    server06:microsoft-ds   ESTABLISHED
      TCP    127.0.0.1:57280        SCCMTEST05:0           LISTENING
      TCP    [::]:135               SCCMTEST05:0           LISTENING
      TCP    [::]:445               SCCMTEST05:0           LISTENING
      TCP    [::]:2701              SCCMTEST05:0           LISTENING
      TCP    [::]:49152             SCCMTEST05:0           LISTENING
      TCP    [::]:49153             SCCMTEST05:0           LISTENING
      TCP    [::]:49154             SCCMTEST05:0           LISTENING
      TCP    [::]:49182             SCCMTEST05:0           LISTENING
      TCP    [::]:49183             SCCMTEST05:0           LISTENING
      TCP    [::]:49184             SCCMTEST05:0           LISTENING
      UDP    0.0.0.0:123            *:*
      UDP    0.0.0.0:500            *:*
      UDP    0.0.0.0:4500           *:*
      UDP    0.0.0.0:5355           *:*
      UDP    192.168.24.218:137      *:*
      UDP    192.168.24.218:138      *:*
      UDP    192.168.24.218:1900     *:*
      UDP    192.168.24.218:54661    *:*
      UDP    127.0.0.1:1900         *:*
      UDP    127.0.0.1:52574        *:*
      UDP    127.0.0.1:54575        *:*
      UDP    127.0.0.1:54662        *:*
      UDP    127.0.0.1:56463        *:*
      UDP    127.0.0.1:59546        *:*
      UDP    127.0.0.1:59642        *:*
      UDP    127.0.0.1:63001        *:*
      UDP    127.0.0.1:63986        *:*
      UDP    [::]:123               *:*
      UDP    [::]:500               *:*
      UDP    [::]:4500              *:*
      UDP    [::]:5355              *:*
      UDP    [::1]:1900             *:*
      UDP    [::1]:54660            *:*
      UDP    [fe80::9ddb:5483:f053:126e%11]:1900  *:*
      UDP    [fe80::9ddb:5483:f053:126e%11]:54659  *:*
    Robert

  • SCCM 2012 Configuration Manager R2 installation Problem

    Hi Guys,
    I just installed on one of my server SCCM 2012 R2 for testing and after install I have a strange issue,
    When I go to the \\SERVER\SMS_SITECODE ALL SMS SHARES has the same error. share I get access denied and I go to the server share which is under C: program files 
    It says you must have at least read permission for to see the permissions even the owner is not visible.
    At the time of the install I used DC admin account to install SCCM R2.
    Is this a normal behavior or is there something wrong with my install...
    Regards,
    Gokhan Cil

    This is default behavior.  You should never really need to administer anything from this viewpoint anyhow, you can just ignore these errors.

  • SCCM 2012 - Network requirements for Client communication to primary in a Cross Forest Environment

    Hello, I have been trying to get some definitive answers on what network traffic is required between a client and a primary site versus a secondary in a cross forest scenario.
    Here is the scenario:
    Company A has an existing SCCM 2012 primary Site. Company B (Separate Forest) has now been brought in. One subnet on each side can route to each other and using that one subnet a two way forest
    trust has been setup. But the remote offices have IP address overlaps between companies. At some point in the future all assets on company B will be re-IP and brought over to Company A domain. But in the interim it would be nice to get SCCM cross forest clients
    working. Upgrading to a CAS model with two Primaries would not be preferred here as this is a temporary solution. 
    My questions are as follows.
    If a secondary site is deployed into Company B Forest/Network. I have seen people online elude to that clients will still need to communicate to the Primary located at Company A, even though they
    are assigned to a secondary on Company B’s network. Is this true? Is there any workarounds for this? Is a NAT back to the primary acceptable, or is reverse lookup required?
    Will the Primary need to communicate directly to the clients in Company B? If this is in fact a requirement, then this would be a show stopper. But if its only needed for things like client pushes,
    then we could work around it.
    Thanks

    "But the remote offices have IP address overlaps between companies"
    Technically, this is unsupported because clients, depending upon your boundaries, will not be able to find a local DP since they use IP addresses for this. The only way to work around this is to use AD Site boundaries.
    "though they are assigned to a secondary"
    Clients are *never* assigned to a secondary site -- that's not what secondary sites are for. Yes, clients require communication with an MP in the primary site where they are assigned. There is no way to change this or work-around this except to put
    an MP from the primary site closer to those clients and use the new MP affinity option in R2 CU3.
    Reverse lookups are only used to verify names by applications that wish to have this type of functionality (which are very few in number) and have nothing to do with true network traffic. NATing is an issue for the reason I gave above -- DP location.
    Remote control, client push, and WoL won't work either because there is no way for the traffic to reach the destination behind the NAT.
    All client *agent* communication in ConfigMgr is client initiated in ConfigMgr (remote control, client push, and WoL -- as just mentioned -- are sort of exceptions to this but they don't really involve the client *agent*.)
    Jason | http://blog.configmgrftw.com | @jasonsandys

  • SCCM 2012 Network Discovery Issue

    Dear Team,
    I want to discover my client less devices (routers, switches, & printers) in SCCM 2012 R2 via SNMP or Subnet Mask, we don't have DHCP in environment. How do I discover this client less devices what are the settings require on SCCM server & on
    client less devices (routers, switches, & printers)

    The subnet information can be retrieved from a device specified on the SNMP Devices tab or you need to configure the subnet manually in Subnet tab, then Network Discovery will query the network devices.
    Juke Chou
    TechNet Community Support

  • Network Access Account issues..

    Help!!!!,
     I have been trying for 2 days to get this working again and having no luck... So to give all the steps Ive taken thus far.
    Upgraded to SCCM 2012 R2
    Uninstalled ADK 8.0 and installed 8.1
    Installed MDT 13
    Patched Primary and Clients hotfix (KB2905002)
    After hoping the hotfix would correct my issues with the upgrade Im still dealing with what seems to be related to NAA. I have seen this issue in the forums and tried to resolve using the create new, delete and select old naa account with no luck.
    DownloadFile() failed for
    http:\\site server /SMS_DP_SMSPKG$/NTE000F3/sccm?/Scripts/DeployWiz_ProductKeyVista.vbs, C:\_SMSTaskSequence\Packages\NTE000F3\Scripts/DeployWiz_ProductKeyVista.vbs.
    80072ee2.
    Does anyone have any ideas??? Thank you in advance!

    Sorry Jason,
     You are correct, I copied in the wrong code... Error: 80070002
    Failed to run the action: Use Toolkit Package. 
    The system cannot find the file specified. (Error: 80070002; Source: Windows)
    Im running the TS again it looks like the SMSPKG was missing the toolkit package.
    Not sure why that would happen as it was working fine but I decided to select the copy content to DP option and issue is resolved. Thank you for the follow up!

  • SCCM 2012 cannot access distribution point as a data source for OS image

    I am trying to path a data source to one of our file servers and get the following error:
    I am guessing this is a permissions issue.  The path is correct. This is also a distribution point and I have no trouble distributing content to it.  The SCCM server is set to have local admin and network share rights to this file server.  Any
    ideas?

    Of course - that would be too easy... had to ask though :)
    Hmm, sounds odd.  I'm guessing that since you're using it as a DP you're on Windows Server... You might try browsing there in your runline but instead of doing
    \\server\share\OS.WIM try doing
    \\Server.FQDN\Share\OS.WIM
    I've seen some odd issues where I need to specify FQDN but it's pretty rare.  I do remember an issue where my own account would not go through even though it had rights and I could navigate.  I used a different account and I think after a while
    it cleared up.  My guess is something got rebooted and it "righted the ship" so-to-speak.  I'm sorry I don't remember more, that particular client had multiple accounts so I just switched to a different one and by the time I had to do the same function
    again the issues had resolved itself so I just moved on.

  • Admin Account password problem

    I have a new Mac with no installation cd ,the owner is a 10 years old girl that is
    "Sure she didn't put a password on her account ( only account ,admin)
    1. is there a default password ?
    2. how can i reset the password ?
    3. how can i get the installation CD ?
    Thank you for reading my post.

    Thank you for you reply , i was found this solution googling before posting here
    Problem is that they do not have the DVD .
    Is there any other solution ?
    Can i download or order it for reasonable price from apple ?
    the Mac is kind of new
    any default password i can check ?

  • Account Password Problems...HELP PLEASE

    I am having sever difficulty setting up a "new" account on my friends G4iBook.
    The MAIL APPLICATION keeps asking me to put in the "password" and I do it repeatedly but it never works.
    I went into the "preferences" and the account setup to revise the password and then try it but it still wouldn't work. Am I missing something or is it a "port issue"? My friend has 1 account (which is an AOL account) that she wants to forward to her mail program.
    Finally I would type in the password that I revised (from the preferences) and then it would tell me that server wasn't accurate since it said it couldn't find port 25?
    I checked my settings to make sure her's was just like mine - except for the "outgoing mail server" since hers is earthlink....
    What am I missing?? I know this isn't a difficult thing to deduce but clearly I am frustrated...
    ANY HELP IS GREATLY APPRECIATED........Thanks!
    FRIENDS CPU is G4 iBook   Mac OS X (10.4.3)  

    Is your friend trying to create/access an AOL email account with Mail or is she trying to create/access an Earthlink account? If she has 1 email account that is an AOL account, what does she have an Earthlink SMTP server available with Mail?"
    587 should be used for the Outgoing Mail Server (SMTP) port for AOL's authenticated SMTP server.
    I also have an Earthlink account (an old dial-up account that I rarely use anymore and probably should cancel) and I also use 587 for Earthlink's authenticated SMTP server.

  • Guest Network on E3000 / Password problem

    Hi,
    I have the E3000, I want to use the Guest Network for wireless access.  Using Cisco Connect I add a password to the Guest Network. The Guest network then shows up as open or unsecure on laptop and phone.  I have renamed my network and changed the main password and nothing seems to help, Guest always shows up as unsecure or open. I tried Cisco chat and they were no help.
    Any ideas on how I can get the password to work on the Guest Network?
    OS Windows Vista SP2
    Using Cisco Connect
    Firmware: 1.0.04 build 6
    Thanks for your help.
    Jay
    Solved!
    Go to Solution.

    How to get Guest password on E3000

Maybe you are looking for