PENDING Cannot PXE Boot After Disabling NAA

[gworkacc]

I am trying to remove the NAA account from my SCCM since we are fully HTTPS now, and theoretically the NAA account is not necessary anymore. However, the moment I remove the account, OSD fails on the "Apply Operating System Image" step.

Troubleshooting I have done so far:

• Verify that the OS package is NOT set to "access content directly from the DP" in the task sequence step options.
• OS image package is NOT set to "copy the content in this package to a package share on DPs" in data access tab.
• Task sequence DP deployment option is set to "Download content locally when needed by the running task sequence".
• Recreate client certificate for DP according to the PKI certificate requirements.
• Redistribute boot image to the DP after recreating client certificate.
• Verified that IIS cert is bound.
• Verified root cert is installed in SCCM primary site.

In the smsts.log on the client I'm getting the errors in the attached pictures.

 

[Prajwal Desai]

I believe you have done the basic troubleshooting. From the screenshot, I see the image with package 0100048E is failing to download. I believe this is an OS image file. Remove this file from the DP, redistribute it back and check if the TS works.

 

[gworkacc]

I believe you have done the basic troubleshooting. From the screenshot, I see the image with package 0100048E is failing to download. I believe this is an OS image file. Remove this file from the DP, redistribute it back and check if the TS works.

Hi Prajwal, thanks for the reply. I have tried that and that didn't fix the issue. If I turn on the NAA account, the problem goes away. It's only turning off the NAA account that the problem happens, but according to all the documentation I've read if you have HTTPS enabled in SCCM, the NAA is not required for OSD.

 

[wadeslcsd]

Hi Prajwal, thanks for the reply. I have tried that and that didn't fix the issue. If I turn on the NAA account, the problem goes away. It's only turning off the NAA account that the problem happens, but according to all the documentation I've read if you have HTTPS enabled in SCCM, the NAA is not required for OSD.

Are you using multicast during imaging? From other things I've read, multicast is dependent on the NAA account. See https://learn.microsoft.com/en-ie/a...need-to-remove-the-network-access-account-and

I've gone away from multicast in my environment and have no issues after NAA account being removed.