SOLVED SCCM Agent shown as "Client NO" in console from untrusted Domain

[zolkin]

Hi Prajwal,


I am having issue with the client Status of devices that are part of an untrusted domain. This is a newly added forest that I would like to manage with our current sccm environment, but for several considerations there is no trust set between the forests.

I used some online guidance to setup the new forest in SCCM, and what I have so far:

- All the ports: 80,443,8530,8531,10123,3268 are open from the clients

- Boundaries for the new Forest are set in SCCM

- The discovery and publishing is Successful to the new forest in SCCM

- Clients are visible in the console, but shown as "NO" (The clients were installed manually also by using the switches for the MP and DNSSuffix). I only see two actions in the control panel.

- nslookup can resolve the FQDN of the management point from the client

Things that I noticed:

When I was checking the connectivity to the management point from the client in the new forest, I noticed that if I type the management point name/IP to the web browser, it cannot reach the page.

Also some additional info from logs:

ccmeval.log (just the most recent errors):

Failed in WinHttpReceiveResponse API, ErrorCode = 0x2efe

[CCMHTTP] ERROR: URL=http://Managementpoint/SMS_MP/.sms_aut?MPLIST, Port=80, Options=1216, Code=12030, Text=ERROR_WINHTTP_CONNECTION_ERROR

Failed to queue event on HTTP/HTTPS failure for server 'managementpoint'. Error 0x87d00202

Can't get MP list from MP

Client registered check: FAILED

Communication with MP check: FAILED

Failed to get MDM_ConfigSetting instance, 0x80041013

No errors in the ClientLocation.log, it seems to see there the Assigned Site and MP.

smscliui.log:

Failed to set DNSSuffix value to the registry.

ccmmessaging.log:

Post to managementpoint failed with 0x87d00231.

locationservices.log:

Failed to send management point list Location Request Message to managementpoint



I am searching around in google but nothing helped so far.



Have you had a similar behavior like this already?

Thanks!

 

[SaurabhK92]

Even i am facing the same issue.
Failed in WinHttpReceiveResponse API, ErrorCode = 0x2efe

 

[Garth]

Even i am facing the same issue.
Failed in WinHttpReceiveResponse API, ErrorCode = 0x2efe

Check your firewall, TLS setting, PKI, etc.
0x2efe = The connection with the server was terminated abnormally

Source: Winhttp
-----

 

[SaurabhK92]

Check your firewall, TLS setting, PKI, etc.
0x2efe = The connection with the server was terminated abnormally

Source: Winhttp
-----

No issue with the firewall and TLS. With same firewall rules and TLS protocols are working in Staging and Prod environment but not in Dev environment.
Logs below:
Failed to get MDM_ConfigSetting instance, 0x80041013
Failed to get client version for sending state messages. Error 0x8004100e
[] Params to send '5.0.9088.1001 Deployment Error: 0x0, '
Sending Fallback Status Point message to 'SCCM-Server', STATEID='100'.
<ClientDeploymentMessage ErrorCode="0"><Client Baseline="1" BaselineCookie="" Platform="2" Langs=""/></ClientDeploymentMessage>
receiving response with winhttp failed; 80072efe
ccmsetup: Host=SCCM-Server, Path=/ccm_system/request, Port=80, Protocol=http, CcmTokenAuth=0, Flags=0x54301, Options=0x5e0
Created connection on port 80
Trying without proxy.
Failed in WinHttpReceiveResponse API, ErrorCode = 0x2ee2
[CCMHTTP] ERROR: URL=http://SCCM-Server/ccm_system/request, Port=80, Options=1504, Code=12002, Text=ERROR_WINHTTP_TIMEOUT
[CCMHTTP] ERROR INFO: StatusCode=200 StatusText=
Failed (0x80072ee2) to send location request to 'SCCM-Server'. StatusCode 200, StatusText ''
GetDPLocations failed with error 0x80072ee2
Failed to get DP locations as the expected version from MP 'http://SCCM-Server'. Error 0x80072ee2
CcmSetup failed with error code 0x80072efe

 

[Garth]

No issue with the firewall and TLS. With same firewall rules and TLS protocols are working in Staging and Prod environment but not in Dev environment.
Logs below:
Failed to get MDM_ConfigSetting instance, 0x80041013
Failed to get client version for sending state messages. Error 0x8004100e
[] Params to send '5.0.9088.1001 Deployment Error: 0x0, '
Sending Fallback Status Point message to 'SCCM-Server', STATEID='100'.
<ClientDeploymentMessage ErrorCode="0"><Client Baseline="1" BaselineCookie="" Platform="2" Langs=""/></ClientDeploymentMessage>
receiving response with winhttp failed; 80072efe
ccmsetup: Host=SCCM-Server, Path=/ccm_system/request, Port=80, Protocol=http, CcmTokenAuth=0, Flags=0x54301, Options=0x5e0
Created connection on port 80
Trying without proxy.
Failed in WinHttpReceiveResponse API, ErrorCode = 0x2ee2
[CCMHTTP] ERROR: URL=http://SCCM-Server/ccm_system/request, Port=80, Options=1504, Code=12002, Text=ERROR_WINHTTP_TIMEOUT
[CCMHTTP] ERROR INFO: StatusCode=200 StatusText=
Failed (0x80072ee2) to send location request to 'SCCM-Server'. StatusCode 200, StatusText ''
GetDPLocations failed with error 0x80072ee2
Failed to get DP locations as the expected version from MP 'http://SCCM-Server'. Error 0x80072ee2
CcmSetup failed with error code 0x80072efe

It doesn't change the fact that all of your errors are network related.
0x80072ee2 = The operation timed out
0x80072efe = The connection with the server was terminated abnormally

As such temporarily disable the firewall on CM and client. This will tell you if the problem is firewall or lower level such as TLS settings.