PENDING Problems with sccm Management Point (critical state) on server with WSUS Role

[LucianMari]

Hello.
I deployed a SCCM server on Server 2019 Datacenter with WSUS role installed, but i have a problem with MP role.....is in Critical State. Installation was successfully (attached some info from logs files).
Is there a problem with my config?......SCCM on same WSUS server?
Thanks for your time.

 

[Adamou]

I have the same problem on a Windows server 2022 with eventId:10022. Please help

 

[Stanley Road]

What do your IIS logs look like if you open them with cmtrace, are they all red?
If you try to open the virtual directories on your Default Site or WSUS site using http, do the web pages look correct?

What happens when you try to open these urls

http://servername/sms_mp/.sms_aut?mplist

http://servername/sms_mp/.sms_aut?mpcert

http://servername/sms_mp/.sms_aut?MPKEYINFORMATION

 

[LucianMari]

What do your IIS logs look like if you open them with cmtrace, are they all red?
If you try to open the virtual directories on your Default Site or WSUS site using http, do the web pages look correct?

What happens when you try to open these urls

http://servername/sms_mp/.sms_aut?mplist

http://servername/sms_mp/.sms_aut?mpcert

http://servername/sms_mp/.sms_aut?MPKEYINFORMATION

Sorry for the delayed answer.​

I also see that only 2 actions are available in Configuration Manager Properties​

 

[LucianMari]

Sorry for the delayed answer.​

View attachment 7182

I also see that only 2 actions are available in Configuration Manager Properties​

What do your IIS logs look like if you open them with cmtrace, are they all red?
If you try to open the virtual directories on your Default Site or WSUS site using http, do the web pages look correct?

What happens when you try to open these urls

http://servername/sms_mp/.sms_aut?mplist

http://servername/sms_mp/.sms_aut?mpcert

http://servername/sms_mp/.sms_aut?MPKEYINFORMATION

 

[Stanley Road]

Ok i personally would forget what your sccm client looks like and concentrate on iis as every communication is getting page 500. you should be able to open all of the nodes under Default Website in a web browser, if you cannot then check the permissions, also check that directory browsing is enabled and handler mappings are not restricted. Also enable failed request tracing. What permissions are set for the virtual directories in iis?

 

[LucianMari]

Ok i personally would forget what your sccm client looks like and concentrate on iis as every communication is getting page 500. you should be able to open all of the nodes under Default Website in a web browser, if you cannot then check the permissions, also check that directory browsing is enabled and handler mappings are not restricted. Also enable failed request tracing. What permissions are set for the virtual directories in iis?

i enabled directory browsing.....enabled failed request tracing.....

 

[Stanley Road]

Does IUSR have permissions? I would go down all those nodes and open them in a browser, it will reveal a lot.

 

[LucianMari]

Does IUSR have permissions? I would go down all those nodes and open them in a browser, it will reveal a lot.

only one node with access......

 

[Stanley Road]

so if you highlight sms_mp_windowsauth node, click on basic settings, test connection, what happens. It's really a permissions issue imo buit i will fire up iis in my lab to check. Also check that the Physical Path has really inherited the permissions that you have on your working node

 

[LucianMari]

so if you highlight sms_mp_windowsauth node, click on basic settings, test connection, what happens. It's really a permissions issue imo buit i will fire up iis in my lab to check. Also check that the Physical Path has really inherited the permissions that you have on your working node

"Also check that the Physical Path has really inherited the permissions that you have on your working node"....how?

 

[Stanley Road]

You are using PassThru authentication, try connect as...

 

[LucianMari]

You are using PassThru authentication, try connect as...

browse 443

 

[Stanley Road]

Have you enable anonymous authentication?

 

[Stanley Road]

 

[LucianMari]

Have you enable anonymous authentication?

yes

 

[Stanley Road]

Can you show what permissions you have on the physical path of that node?

 

[Stanley Road]

I wrote a doc about this for work, I will upload it later

 

[LucianMari]

I wrote a doc about this for work, I will upload it later

did you manage to upload the doc?. thx

 

[Stanley Road]

Sure, i was a bit busy to upload. What is missing from this doc is the permissions i have on the physical folder path. They are.....

IUSER
IIS_IUSRS
IIS AppPool\DefaultAppPool

All with Read only access

Also when testing the connection through Basic Settings, i created a service account and used that instead of Pass Through