Using a custom certificate store for SCCM 2012 clients and primary site server

I have read what seems to be all the pki related documentation out there for SCCM 2012. I have a PKI infrastructure up and running issueing certificates with an offline root through group policy autoenrollment. The problem that i'm faced with is we are migrating
from SCCM 2007 that was in native mode and we chose not to use the CA that we used for the old SCCM environment. When the clients attempt to communicate with the M.P. it runs through all of the different certificates and adds a tremendous amount of overhead
to the M.P. We will have ten's of thousands of clients by migration end. Could someone please point me to a document that goes over how to leverage a custom certificate store that I could then tell the new 2012 environment to use? I know that it's in there,
I've seen it in the console. The setup is one primary site server with SQL on box and the pki I just mentioned as well as the old 2007 environment that is still live.
I read that you can try and use SAN as a method of identifying the new certs but I haven't found a good document covering exactly how that works. Any info you could provide I would be very grateful for. Thanks.

Jason, thank you for your reply. I'm getting the impression that you have never been in the situation where you had to deal with 2 different PKI environments. Let me state that I understand what your saying about trust. We have to configure the trusted root
CA via GPO. That simply isn't enough, and I have a valid example to backup this claim. When the new clients got the advertisement and began the ccmsetup process I used the /pki switch among others. What the client end up doing was selecting a certificate that
had the longest validity period which was issued by our old CA. It checked the authentication chain, found it to be valid and selected it for communication. At that point the installation failed, period, no caveats as you say. The reason the install failed
because the new PKI infrastructure is integrated into the new environment, and the old is not. So when you said " that
are trusted and they can use *any* cert that is trusted because at the end of the day, there is no
difference between two valid certs that have the same purpose as long as they are trusted. "
that is not correct. Both certs are trusted, and use the same certificate template, but only one certificate would allow the install to complete successfully.
Once I started using the CCMCERTISSUERS
switch the client install went swimmingly. The only reason I'm still debating this point is because someone might read this thread see your comments and assume "well I've got my new PKI configured as a trusted root CA, I should be all set" and their
deployment will fail, just as my pilot did.
About Intune I'm looking forward to doing a POC in the lab i built with my Note 3. I'm hoping it goes well as I really want to have our MDM migrated into ConfigMgr... I think the
biggest obstacle outside of selling it to management will be the actual device migration from the current MDM solution. From what I understand of the enrollment process manual install and config is the only path forward.
Thanks Jason for your post and discussion.

Similar Messages

  • SCCM 2012 Clients at Secondary Site don't update and shows status as INACTIVE

    I have 1 Primary site and 1 Secondary sites. I have setup Secondary site Boundaries using IP subnet.  I see that the systems from secondary
    site show in the console and they all have clients installed but however 60% of the system shows client activity as INACTIVE and not receiving any heartbeat DDR none of the system showing hardware inventory.   I am not positive
    where to look as far as logs are concerned.  I think the clients aren't receiving policy like they should.
    Just to give a brief idea, Secondary Site server crashed and we had to rebuild the server and re install secondary site after rebuilding all the
    problem. Everything is working fine in Primary site.
    Secondary site is communicating with primary site MP and DP
    I have checked MPcontrol.log it shows status as OK
    I am able to install client through console but yes when I check the configuration manager properties it shows CCM Notification Agent as DISSABLED
    and in the Action Tab Machine and User policy are the only cycles showing.
    Checked replmgr.log and rclctrl.log but it’s not showing any error
    Only log file which shows error is bgdserver.log  ( pasting log errors )
    ERROR: SQL exception when retrieve client certificate from DB. Exception: The EXECUTE permission was denied on the object 'sp_GetPublicKeyForSMSID', database 'CM_PRI',
    schema 'dbo'. -2146232060           SMS_NOTIFICATION_SERVER     05-07-2014 12:09:01               3968 (0x0F80)
    ERROR: Can't do post authentication without client certificate stored in regsitration.            SMS_NOTIFICATION_SERVER    
    05-07-2014 12:09:01                3968 (0x0F80)
    ERROR: Failed to authenticate with client [::ffff:10.5.55.88]:49623.        SMS_NOTIFICATION_SERVER     05-07-2014
    12:09:01               3968 (0x0F80)
    ERROR: SQL exception when retrieve client certificate from DB. Exception: The EXECUTE permission was denied on the object 'sp_GetPublicKeyForSMSID', database 'CM_PRI',
    schema 'dbo'. -2146232060           SMS_NOTIFICATION_SERVER     05-07-2014 12:09:01               3968 (0x0F80)
    ERROR: Can't do post authentication without client certificate stored in regsitration.            SMS_NOTIFICATION_SERVER    
    05-07-2014 12:09:01                3968 (0x0F80)
    ERROR: Failed to authenticate with client [::ffff:10.5.62.68]:49923.        SMS_NOTIFICATION_SERVER     05-07-2014
    12:09:01               3968 (0x0F80)
    ERROR: SQL exception when retrieve client certificate from DB. Exception: The EXECUTE permission was denied on the object 'sp_GetPublicKeyForSMSID', database 'CM_PRI',
    schema 'dbo'. -2146232060           SMS_NOTIFICATION_SERVER     05-07-2014 12:09:06               3968 (0x0F80)
    ERROR: Can't verify signature in message without client certificate for client SCCM GUID:B47059B1-D4E4-41A2-BC88-486A597FE399               
    SMS_NOTIFICATION_SERVER     05-07-2014 12:09:06               3968 (0x0F80)
    ERROR: Invalid hook to be decoded. Authentication                SMS_NOTIFICATION_SERVER    
    05-07-2014 12:09:06               3968 (0x0F80)
    ERROR: Failed to decode message body (<BgbSignInMessage TimeStamp="2014-07-05T06:39:01Z"><ClientType>SCCM</ClientType><ClientVersion>5.00.7804.1000</ClientVersion><ClientID>GUID:B47059B1-D4E4-41A2-BC88-486A597FE399</ClientID></BgbSignInMessage>)
    with message header
    Help me resolve this issue as I am struggling to resolve this for almost 2 weeks.
    Please let me know which logs are helpful and I'll try to add it to replies.

    Hi,
    Quote:"see that the systems from secondary site show in the console and they all have clients installed but however 60% of the system shows client activity as INACTIVE and not receiving any heartbeat DDR none of the system showing hardware inventory. "
    So not all the clients show inactive? Have you checked the logs in an inactive client? Such as ClientIDManagerStartup.log.
    Have you checked Secondary Site server's computer name from SQL logins? You could try to remove this account, wait a while, recreate the same computeraccount login with sysadmin access. (http://social.technet.microsoft.com/Forums/en-US/d5383c23-6b71-47cc-9fad-fda82a44a3aa/secondary-site-showing-inactive-clients?forum=configmanagerdeployment)
    You could use Configuration Analyzer for System Center 2012 R2 to troubleshoot issues.
    http://technet.microsoft.com/en-us/library/dn469435.aspx
    Best Regards,
    Joyce
    We
    are trying to better understand customer views on social support experience, so your participation in this
    interview project would be greatly appreciated if you have time.
    Thanks for helping make community forums a great place.

  • How can I remove the SCCM 2012 client and reinstall SCCM 2007 client on all of our computers

    Hello All
    We have  bit of a problem. Our virtual SCCM 2012 r2 server was deleted and the back solution we had in place keeps failing.
    We do have our sccm 2007 server still in place but its only role was imaging as we transferred roles from one to another.
    My question is now our support needs to remote into pcs but cant because the CM12 server is gone. How can I remove the 2012 client from all of our companies computers and reinstall the CM07 client so we can remote into computers again.
    Thanks in advance!
    Phil
    Phil Balderos

    Run a ccmsetup /uninstall on the clients. You may need to run via PSExec. Then push out the SCCM 2007 client via the 2k7 console.
    Cheers
    Paul | sccmentor.wordpress.com
    Thanks Paul!
    I have to do this on over 350 computers and 110 servers. How can I do it on a more massive scale?
    Phil Balderos
    I would check Torsten's approach first and see if the ccmsetup will uninstall the 2012 version. I'm not sure. Obviously the other way round is fine.
    Using PSexec you can script this to call up a txt file of all your servers/computers and run the uninstall.
    e.g. 
    for /f "tokens=*" %a in (computers.txt) do psexec \\%a %WINDIR%\ccmsetup\ccmsetup.exe /uninstall 
    If your account has privileges on all devices you won't need to add in any username/password credentials. Obviously only devices that are switched on and you have access to will run this.
    Cheers
    Paul | sccmentor.wordpress.com

  • SCCM 2012 Client and Workstation Audio and Video Problems

    SCCM 2012 SP1 environment.
    We have pushed out the SCCM Client successfully to our systems - however we have found that on some computers the SCCM Client is causing an audio/video problem - specifically it appears to be with computers that connect monitors via DVI.  As an example,
    on my laptop (Dell e6420, Win7 x64) I have a docking station that connects my laptop to 2 external monitors.  With the SCCM Client installed I cannot listen to music or watch videos - the result is an unusable choppiness/stuttering listening to music
    and with a video the audio and video get out of sync.  As well, my mouse no longer functions smoothly - it jumps around.  This happens whether accessing content from a website or simply a local file on my computer.  If I uninstall the SCCM client,
    the issue goes away entirely.  I have tried disabling the SMS and Remote control services but doing so does not resolve the issue, only a client uninstall. Note that this only happens when the laptop is on the docking station - with DVI - it doesn't
    happen when the laptop is running without an external monitor or if plugged into an HDMI output device.
    At first we believed this was limited to this model of laptop in our environment (Win8 or Win7 - both result in the same problem), but now we are hearing about "audio and video issues" on Dell 990 workstations as well.  I believe these stations
    have DVI connected monitors.  Driver updates do not appear to resolve the issue.
    Has anyone experienced this in their environment?  Note that this happens on imaged workstations and workstations installed from a vanilla Windows 7 or 8 CD.

    Try installing the client without Silverlight and see if it helps (this is only used for the Application Catalog).
    ccmsetup.exe /skipprereq:silverlight.exe
    Gerry Hampson | Blog:
    www.gerryhampsoncm.blogspot.ie | LinkedIn:
    Gerry Hampson | Twitter:
    @gerryhampson

  • Unable to install Cumulative Update 2 for SCCM 2012 R2

    Hi,
    I am trying to install the CU2 update for SCCM 2012 R2 and I am getting the following error during prerequisite checks:
    Server update status: This update applies to product version 5.0.7958. The installed version on this computer is 5.0.7804.1000. This update is not applicable to this computer.
    Console update status: No serviceable configuration manager role was found on the local system.
    Can anyone provide me some guidance or thoughts on how to get to the correct version to install this update?
    Thank you

    You are running 
    ConfigMgr 2012 SP1 – 5.00.7804.1000 - build 7804
    The CU2 you are trying to apply is for SCCM 2012 R2.
    http://www.systemcenterdudes.com/sccm-2012-version-numbers/
    For SP1 the latest CU is CU5 : http://support.microsoft.com/kb/2978017/en-us
    Benoit Lecours | Blog: System Center Dudes

  • Im in maldives and i been using the singapore store for a long time. and i used my credit card issued in maldives but with a singapore store and its been working well until one day my card expired and i reissued a new card. a different security number onl

    i been using the singapore app store for a long time. and my credit card is issued in maldives and it was working well until one day my card got expired so i reissued it again here in maldives.and i was updates my payment methid only my having a new security number.and yet there came an error msg saying my payment is not valid.so now i cant buy any apps
    so please help me out.

    so adjust your iTunes account settings to reflect the new card...

  • Required access for SCCM 2012 R2 Client End

    Hi all,
    What is minimum level of access required for SCCM 2012 client machines management ( Deploy , Discovery , agent install …etc) , we have an account called clientdeploy , is that account is mandatory
    to have local administrators  privilege on all client machine to manage everything , is that Microsoft recommended one ?
    Sengo

    No, Not required this account to be local admin in all client.
    If you want access required for sccm 2012, for deploying app., O.s and managing client, this account must be member of sms group such as configmgr remote control users for remote tool
    For more details, you can refer below link
    http://technet.microsoft.com/en-us/library/hh427337.aspx
    Also I recommended to ask your question in
    SCCM Forum
    Please remember, if you see a post that helped you please click "Vote As Helpful" and if it answered your question, please click "Mark As Answer"
    Mai Ali | My blog: Technical | Twitter:
    Mai Ali

  • SCCM central site and primary site use the same SQL SERVER with two Instance.

    Hi  Guys,
    I want deploy SCCM 2012 central site and primary site in my domain. But Only one Sql server for me. Any one can tell me how to install the central site server and primary site server with the same SQL SERVER with two instance.
    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    Sean Xiao
    TechNet Community Support

    Although you can install like the configuration you said above, we do not recommend you do it this way. If your SQL box has  problems, all the data will go away and you will not have data redundancy.
    You need to configure the different SQL Port and SQL Broke service port e.g.
    SQL port 4023  SQL Broke Service port 4022 for CAS instance
    SQL port 4024  SQL Broke Service port 4021 for PRI instance
    Juke Chou
    TechNet Community Support
    I agree with Johan and this configuration should not be used. But I want to clarify that the default ports for "SQL port" (actually, SQL over TCP) is 1433 and the SQL Broker Service uses 4022. The configuration above should work but the "correct" would be
    to use 1433 and 4022 for the CAS and 10434 and 4023 for the Primary :)
    You can read more about Network Ports used by Configuration Manager here
    http://technet.microsoft.com/en-us/library/hh427328.aspx#BKMK_CommunicationPorts
    /Tim
    Tim Nilimaa | Blog: http://infoworks.tv | Twitter: @timnilimaa

  • How to Custom Report using sql server report builder for SCCM 2012 SP1

    Hi ,
    I am new to database, if i want to create a manual report using sql server report builder for SCCM 2012 SP1, what step should i take.
    i want to create a report in which computer name, total disk space, physical disk serial no come together. i already added class (physical disk serial no.) in hardware inventory classes. refer snapshot

    Hi,
    Here is a guide on how to create custom reports in Configuration Manager 2012, it is a great place to start, change to the data you want to display instead.
    http://sccmgeekdiary.wordpress.com/2012/10/29/sccm-2012-reporting-for-dummies-creating-your-own-ssrs-reports/
    Regards,
    Jörgen
    -- My System Center blog ccmexec.com -- Twitter
    @ccmexec

  • SQL Connection Failed for SCCM 2012 R2 (Unable to load user-specified certificate)

    We've recently completed an upgrade from SCCM 2012 SP1 to 2012 R2 and have been running in the new environment for about a week. As of this morning, The consoles failed to connect to the CAS' and one of the Primary Site's database. The issue was resolved
    easily enough by addressing a certificate issue in SQL, but I'm left wondering if there's a correlation between the SP1-to-R2 upgrade that would cause the cert to fail. Anyone have experience with this?
    2014-01-21 22:10:11.81 Server      The server could not load the certificate it needs to initiate an SSL connection. It returned the following error: 0x8009030d. Check certificates to make sure they are valid.
    2014-01-21 22:10:11.81 Server      Error: 26014, Severity: 16, State: 1.
    2014-01-21 22:10:11.81 Server      Unable to load user-specified certificate [Cert Hash(sha1) "haaaaassssshhhh"]. The server will not accept a connection. You should verify that the certificate is correctly installed. See
    "Configuring Certificate for Use by SSL" in Books Online.
    2014-01-21 22:10:11.81 Server      Error: 17182, Severity: 16, State: 1.
    2014-01-21 22:10:11.81 Server      TDSSNIClient initialization failed with error 0x80092004, status code 0x80. Reason: Unable to initialize SSL support. Cannot find object or property.
    2014-01-21 22:10:11.81 Server      Error: 17182, Severity: 16, State: 1.
    2014-01-21 22:10:11.81 Server      TDSSNIClient initialization failed with error 0x80092004, status code 0x1. Reason: Initialization failed with an infrastructure error. Check for previous errors. Cannot find object or property.
    2014-01-21 22:10:11.81 Server      Error: 17826, Severity: 18, State: 3.
    2014-01-21 22:10:11.81 Server      Could not start the network library because of an internal error in the network library. To determine the cause, review the errors immediately preceding this one in the error log.
    2014-01-21 22:10:11.81 Server      Error: 17120, Severity: 16, State: 1.
    2014-01-21 22:10:11.81 Server      SQL Server could not spawn FRunCM thread. Check the SQL Server error log and the Windows event logs for information about possible related problems.

    We got the same certificate related error events after a fresh install of SCCM 2012 R2 on a new server. It happened during the first reboot after SCCM was installed. In the Certificates mmc, I right-clicked on the certificate used by SQL and chose Manage
    Private Keys. Giving the service account that runs the MSSQLSERVER service read rights to the private key allowed SQL to start. However, after a day or so we rebooted the server again, and SQL wouldn't start. Something had removed the service account's read
    permission. Since the SCCM configuration wasn't that far along, we uninstalled SCCM. After giving the service account read rights again, and rebooting several times over a few days, and SQL started every time. We then installed SCCM 2012 R2 again, and checked
    the certificate's permissions before rebooting. The service account still had read permissions when the install completed, but as soon as the server was rebooted, it lost the permissions again.
    The Certificates mmc was then used to request a second computer certificate and then SQL was configured to use that new certificate via SQL Server Configuration Manager. After several days and a number of reboots the SQL services have started normally every
    time so the second certificate seems to have fixed the issue. I have kept the original certificate for fear that removing it will cause whatever part of SCCM 2012 R2 that modifies the original certificate to start removing permissions from the new certificate
    as well.

  • Can we assign 2 IPs for a SCCM 2012 primary site server and use 1 IP for communicating with its 2 DPs and 2nd one for communicating with its upper hierarchy CAS which is in a different .Domain

    Hi,
    Can we assign 2 IPs for a SCCM 2012 primary site server and use 1 Ip for communicating with its 2 DPs and 2nd one for communicating with its upper hierarchy CAS . ?
    Scenario: We are building 1 SCCM 2012 primary site and 2 DPs in one domain . In future this will attach to a CAS server which is in different domain. Can we assign  2 IPs in Primary site server , one IP will use to communicate with its 2 DPs and second
    IP for communicating with the CAS server which is in a different domain.? 
    Details: 
    1)Server : Windows 2012 R2 Std , VM environment .2) SCCM : SCCM 2012 R2 .3)SQL: SQL 2012 Std
    Thanks
    Rajesh Vasudevan

    First, it's not possible. You cannot attach a primary site to an existing CAS.
    Primary sites in 2012 are *not* the same as primary sites in 2007 and a CAS is 2012 is completely different from a central primary site in 2007.
    CASes cannot manage clients. Also, primary sites are *not* used for delegation in 2012. As Torsten points out, multiple primary sites are used for scale-out (in terms of client count) only. Placing primary sites for different organizational units provides
    no functional differences but does add complexity, latency, and additional failure points.
    Thus, as the others have pointed out, your premise for doing this is completely incorrect. What are your actual business goals?
    As for the IP Addressing, that depends upon your networking infrastructure. There is no way to configure ConfigMgr to use different interfaces for different types of traffic. You could potentially manipulate the routing tables in Windows but that's asking
    for trouble IMO.
    Jason | http://blog.configmgrftw.com | @jasonsandys

  • Deploying the SCCM 2012 Client to WES 7 devices that are locked down with the FBWF using 2007 task sequence via WEDM.

    I'm wondering how people are migrating their embedded devices that are using the FBWF. I've done some googling and it seems like most people are just re-imaging the devices and after migrating a single device i see why. Its not a pretty process. This will
    be a long description but ultimately my question stems more from trying to find a better way to execute the device migration from 2007 to 2012.
    Some back ground on my situation might be in order here. I'm in the process of wrapping up our 2007 to 2012 migration. We have a 2007 infrastructure that was a central server with 2 primaries and 286 secondary site servers. I've consolidated that to a single
    2012 primary site server that hosts all the main roles. There are 2 more servers in the data centers both operating solely as push distribution points I'll refer to them as 2012 01 02 and 03. I'm over half way through the migration and so far haven't needed
    to offload any site roles. There are almost 10,000 clients now reporting to the 2012 site server and almost a 100 field servers pulling content from 2012 02 as their source dp as pull dp is the only way forward for this many devices. I've read the horror stories
    of trying spin up 200 plus push dps. We are running PKI. I'm at the point now where i need to start migrating the Windows Embedded Seven Standard clients that have the 2007 sccm client on them with WEDM for write filter handling.
    What i'm wondering is if anyone has any pointers for me regarding migrating the WES 7 devices. My plan that i've come up with is to somehow script the process using a 2007 WEDM Task Sequence to try and migrate them over to 2012. Things are complicated as
    I need to somehow script the install, the policy checkin, hardware inventory, software inventory, and validate the SCEP client installs before I reboot the device one last time to enable the FBWF. How I handled the SCCM 2007 client install on these devices
    when they were provisioned was to just create a batch file that would sleep for ten minutes then check to see if the inventoryagent.log file had been created yet. I realize now that is inefficient as i can kick off the inventory using a WMI method once the
    client has installed. Also I need to make sure the machine gets its first policy as that is how it creates the communication using PKI through that first policy transfer and that also finalizes the client install. The biggest piece i'm uncertain about in this
    regard is the SCEP client.
    I had to change the SCEP client install from yes to no in the default client settings as we have some Mcaffee servers that can't have the SCEP client on them. I have incremental updates enabled on the collection that has the policy that installs the SCEP
    client but this will take an unknown amount of time unless i force the environment to update as the device starts in 2012 install, or if I could kick off the SCEP isntall... IDK. I'm also wondering if i should keep the device in the migration process until
    i validate it has its proper scep policy applied which I believe can be validated by a registry key somewhere.
    Once the 2012 client gets installed will that cause it to lose its place within the 2007 Task Sequence? Considering its going to take a minimum of 2 reboots I'd normally use the task sequence to handle its progression through the process.
    I'm also considering trying to use an Orchestrator runbook, as that would be a good way to keep track of the migration process as each device migrates. Especially since this might take several seperate scripts.
    I'm going to take a stab at scripting the migration process, but if anyone has any pointers that might make this a less complicated I'd really appreciate it as I've got about 3000 of these devices that need to be migrated over. The other things i've learned
    the hard way is any time you have something this complicated over the course of 3000 devices you will run into unknowns and the failure rate increases. I'm in the precarious position of having to not only build this process out but in some situations have
    it complete in the shortest amount of time possible as we have sites running 24x7. I know the end users behavior all to well and they will just keep hitting the power button sometimes even though their not supposed to so they can get their device functional
    again. In those situations i'd end up, if i'm lucky with a device that no longer has a healthy SCCM client in either environment and the write filter disabled.
    So like i said any pointers anyone could throw my way i'd really appreciate. I manually went through the migration process on a single device for proof of concept and ended up with almost 2 pages of pseudo code for my migration script/scripts.
    Thanks,
    -K.R.

    Hi,
    In R2 there are some new variables you can use to solve this,
    http://ccmexec.com/2014/12/smstsmplistrequesttimeout-value-in-milliseconds/
    In Sp1 though adding a step to sleep for 2-5 minuter after reboot and before the application install step is a common workaround.. a powershell command with "Start-Sleep
    -s 120" should do it. 
    /Jörgen
    -- My System Center blog ccmexec.com -- Twitter
    @ccmexec

  • Configuring Reporting services for SCCM 2012

    Hi,
    I just finish create SQL reporting services ( configure Database, report manager URL) in SQL 2008 R2 for SCCM 2012. When I open the Report option in SCCM console (Monitoring --> Report), no report listed there and then I try to add in Reporting service
    point for it, but get an error message
    "There is a problem connecting to the specific reporting server. Please check the connection and make sure SQL reporting service is running on the specified server"
    I manually browse to http://sqlserver/reportserver or
    http://sqlserver/reports , that is no any folder exist there (I assume when I configure reporting service it will automatic create a folder for it with all report inside?). Anyone can guide me on how to solve this issue?
    Regards,

    Hi,
    hi ,
    I am new to SCCM 2012 group and i have knowledge on sccm2007. i want to discuss some issue what i have with SCCM2012 installtion. The issue is my machine got rebooted while installing sccm 2012 SP1.i have already installed all the prerequisites for SCCM2012.i
    am installing sccm2012 on Hyper-V machine.
    Please see my system configuration below:
    DomainController(2008R2 server) : 512MB RAM, AD things and DNS ,DHCP has installed on it.
    System center server(2008R2) : 1028MB RAM , Sql 2008 server installed on it.
    i tried to install it many times but still i got the same issue.
    Could anybody please help me with this ?
    This is a new question. So please ask this question on a new thread in this forum.
    Thank you.
    Best Regards,
    Joyce Li
    We
    are trying to better understand customer views on social support experience, so your participation in this
    interview project would be greatly appreciated if you have time.
    Thanks for helping make community forums a great place.

  • How to setup IPV6 boundary for SCCM 2012 R2 Primary Site?

    How to setup IPV6 boundary for SCCM 2012 R2 Primary Site?
    I have Direct Access implemented in my environment. I have Windows 8.1 machine connecting through direct access.
    I want to manage the windows 8.1 through SCCM. How do I setup IPV6 boundary. Can someone guide me through?
    Below are the Windows 8.1 client IP Configuration
    C:\Windows\system32>ipconfig
    Windows IP Configuration
    Wireless LAN adapter Local Area Connection* 3:
       Media State . . . . . . . . . . . : Media disconnected
       Connection-specific DNS Suffix  . :
    Wireless LAN adapter Wi-Fi:
       Connection-specific DNS Suffix  . : home
       Link-local IPv6 Address . . . . . : fe80::7466:11a5:39ed:ffb0%4
       IPv4 Address. . . . . . . . . . . : 192.168.1.5
       Subnet Mask . . . . . . . . . . . : 255.255.255.0
       Default Gateway . . . . . . . . . : 192.168.1.1
    Tunnel adapter isatap.home:
       Media State . . . . . . . . . . . : Media disconnected
       Connection-specific DNS Suffix  . : home
    Tunnel adapter Teredo Tunneling Pseudo-Interface:
       Connection-specific DNS Suffix  . :
       IPv6 Address. . . . . . . . . . . : 2001:0:5ef5:79fd:1494:1339:93d6:439c
       Link-local IPv6 Address . . . . . : fe80::1494:1339:93d6:439c%9
       Default Gateway . . . . . . . . . :
    Tunnel adapter iphttpsinterface:
       Connection-specific DNS Suffix  . :
       IPv6 Address. . . . . . . . . . . : fd64:fc00:d17b:1000:e1a7:9cc8:c3c7:d819
       Temporary IPv6 Address. . . . . . : fd64:fc00:d17b:1000:206c:f857:ddbe:2f2b
       Link-local IPv6 Address . . . . . : fe80::e1a7:9cc8:c3c7:d819%10
       Default Gateway . . . . . . . . . :
    Below are the IPConfiguration details for Direct Access server
    C:\Windows\system32>PsExec.exe \\MURA01 ipconfig
    PsExec v1.98 - Execute processes remotely
    Copyright (C) 2001-2010 Mark Russinovich
    Sysinternals - www.sysinternals.com
    Windows IP Configuration
    Ethernet adapter Ethernet:
       Connection-specific DNS Suffix  . :
       IPv6 Address. . . . . . . . . . . : fd64:fc00:d17b:3333::1
       Link-local IPv6 Address . . . . . : fe80::b1ad:1c29:b4a:9125%15
       IPv4 Address. . . . . . . . . . . : 10.192.1.25
       Subnet Mask . . . . . . . . . . . : 255.255.255.0
       Default Gateway . . . . . . . . . : 10.192.1.1
    Tunnel adapter Teredo Tunneling Pseudo-Interface:
       Media State . . . . . . . . . . . : Media disconnected
       Connection-specific DNS Suffix  . :
    Tunnel adapter isatap.{3D6A5E86-D85A-46C8-B69B-FFCF6D5D849C}:
       Connection-specific DNS Suffix  . :
       IPv6 Address. . . . . . . . . . . : fd64:fc00:d17b:1:0:5efe:10.192.1.25
       Link-local IPv6 Address . . . . . : fe80::5efe:10.192.1.25%18
       Default Gateway . . . . . . . . . :
    Tunnel adapter 6TO4 Adapter:
       Media State . . . . . . . . . . . : Media disconnected
       Connection-specific DNS Suffix  . :
    Tunnel adapter IPHTTPSInterface:
       Connection-specific DNS Suffix  . :
       IPv6 Address. . . . . . . . . . . : fd64:fc00:d17b:1000::1
       IPv6 Address. . . . . . . . . . . : fd64:fc00:d17b:1000::2
       IPv6 Address. . . . . . . . . . . : fd64:fc00:d17b:1000:2552:e9f8:87d3:ed8e
       Link-local IPv6 Address . . . . . : fe80::2552:e9f8:87d3:ed8e%20
       Default Gateway . . . . . . . . . :
    ipconfig exited on MURA01 with error code 0.
    Below are the IPCONFIG Details for SCCM Server:
    C:\Windows\system32>PsExec.exe \\sccm01 ipconfig
    PsExec v1.98 - Execute processes remotely
    Copyright (C) 2001-2010 Mark Russinovich
    Sysinternals - www.sysinternals.com
    Windows IP Configuration
    Ethernet adapter Ethernet:
       Connection-specific DNS Suffix  . :
       Link-local IPv6 Address . . . . . : fe80::9f0:86f9:441d:bc07%12
       IPv4 Address. . . . . . . . . . . : 10.192.1.30
       Subnet Mask . . . . . . . . . . . : 255.255.255.0
       Default Gateway . . . . . . . . . : 10.192.1.1
    Tunnel adapter isatap.{0749E47D-AE0A-4D47-9D37-BDDC848E56F6}:
       Media State . . . . . . . . . . . : Media disconnected
       Connection-specific DNS Suffix  . :
    ipconfig exited on sccm01 with error code 0.
    What will be the IPV6 values to configure boundary?

    Depending on how the clients connect use the IPv6 prefix of their 6to4, Teredo, and/ or IP-HTTPS tunnel. Just keep in mind that it could become a long list...
    My Blog: http://www.petervanderwoude.nl/
    Follow me on twitter: pvanderwoude

  • Problem to generat an report on an SSRS for SCCM 2012 R2 SP1. I got error has occurred during report processing.

    Hi,
    Problem to generat an report on an SSRS for SCCM 2012 R2 SP1. I got error has occurred during report processing.
    In general it is no problem to generat SSRS reports, but an custom one i get issue with.
    The Error:
    An
    error has occurred during report processing. (rsProcessingAborted)
    Query
    execution failed for dataset 'DataSet1'. (rsErrorExecutingCommand)
    ExecuteReader:
    CommandText property has not been initialized

    Hi SaiTech,
    According to your description, when you render report on SCCM 2012 R2, you got the error message.
    According to my knowledge, the issue can be caused by following reasons:
    Select permission not granted to ConfigMgr reporting account. We need to open the SQL management console and open the properties dialog box of configmgr db, grant select and execute permission to ConfigMgr reporting account.
    Reporting Services Web Service URL or Report Manager is false. Make sure Web Service URL and Report Manager URL are correct. Restart SMS_Executive service and reinstall Reporting Service Point, then please render the report again.
    Report timeout. Increase query and report timeout.
    If the problem remain unresolved, please provide detailed information of SRSRP.log (default location: %programfiles%\Microsoft  and Configuration Manager\Logs) and reporting services error log(default location: %programfiles%\Microsoft SQL Server\<SQL
    Server Instance>\Reporting Services\LogFiles), it will help us move more quickly toward a solution.
    If you have any more questions, please feel free to ask.
    Thanks,
    Wendy Fu
    If you have any feedback on our support, please click
    here.
    Wendy Fu
    TechNet Community Support

Maybe you are looking for