SOLVED SCCM Fails to Push client to Windows 11 Workstation

[Moranger18]

Hello Prajwal,

Your site has proved to be incredibly resourceful with amazing information. I come to you with an odd one. I am running a home lab to learn more about SCCM and have it installed on a Primary Site Server.

I installed version 2303 and configured it, however I cannot seem to automatically push the Client to Windows 11 due to Access Denied error 2147942405. I have tired doing this with the firewall completely off and with Inbound rules created from other sites. I have turned on NTLM Fallback method as well. It seems my issue lies with Kerberos authentication however I'm not sure what to try next after days of research.

Note: I do not have a service account and am only using Administrator account.
The workstation is called Client1.

ccm.log snippet:
----- Started a new CCR processing thread. Thread ID is 0x764. There are now 1 processing threads $$<SMS_CLIENT_CONFIG_MANAGER><10-09-2023 20:25:53.722+240><thread=8320 (0x2080)>
Submitted request successfully $$<SMS_CLIENT_CONFIG_MANAGER><10-09-2023 20:25:53.722+240><thread=8320 (0x2080)>
Getting a new request from queue "Retry" after 100 millisecond delay. $$<SMS_CLIENT_CONFIG_MANAGER><10-09-2023 20:25:53.722+240><thread=8320 (0x2080)>
Sleeping for 60 minutes for queue "Retry". $$<SMS_CLIENT_CONFIG_MANAGER><10-09-2023 20:25:53.722+240><thread=8320 (0x2080)>
======>Begin Processing request: "2097152001", machine name: "CLIENT1" $$<SMS_CLIENT_CONFIG_MANAGER><10-09-2023 20:25:53.722+240><thread=1892 (0x764)>
Execute query exec [sp_IsMPAvailable] N'LIV'~ $$<SMS_CLIENT_CONFIG_MANAGER><10-09-2023 20:25:53.722+240><thread=1892 (0x764)>
---> Trying each entry in the SMS Client Remote Installation account list~ $$<SMS_CLIENT_CONFIG_MANAGER><10-09-2023 20:25:53.722+240><thread=1892 (0x764)>
---> Attempting to connect to administrative share '\\Client1.LivoniaResident.com\admin$' using account 'LIVONIARESIDENT\Administrator'~ $$<SMS_CLIENT_CONFIG_MANAGER><10-09-2023 20:25:53.722+240><thread=1892 (0x764)>
---> Connected to administrative share on machine Client1.LivoniaResident.com using account 'LIVONIARESIDENT\Administrator'~ $$<SMS_CLIENT_CONFIG_MANAGER><10-09-2023 20:25:53.753+240><thread=1892 (0x764)>
---> Trying the 'best-shot' account which worked for previous CCRs (index = 0xFFFF)~ $$<SMS_CLIENT_CONFIG_MANAGER><10-09-2023 20:25:53.753+240><thread=1892 (0x764)>
---> Attempting to make IPC connection to share <\\Client1.LivoniaResident.com\IPC$> ~ $$<SMS_CLIENT_CONFIG_MANAGER><10-09-2023 20:25:53.753+240><thread=1892 (0x764)>
---> Searching for SMSClientInstall.* under '\\Client1.LivoniaResident.com\admin$\'~ $$<SMS_CLIENT_CONFIG_MANAGER><10-09-2023 20:25:53.753+240><thread=1892 (0x764)>
---> Unable to connect to remote machine "Client1.LivoniaResident.com" and namespace "root\cimv2" using Kerberos with alternate account, error - 0x80070005. $$<SMS_CLIENT_CONFIG_MANAGER><10-09-2023 20:25:53.769+240><thread=1892 (0x764)>
--> NTLM fallback is enabled, remote machine "Client1.LivoniaResident.com" is continuing with client push. $$<SMS_CLIENT_CONFIG_MANAGER><10-09-2023 20:25:53.769+240><thread=1892 (0x764)>
---> Unable to connect to WMI (root\cimv2) on remote machine "Client1.LivoniaResident.com", error = 0x80070005. $$<SMS_CLIENT_CONFIG_MANAGER><10-09-2023 20:25:53.785+240><thread=1892 (0x764)>
---> Unable to connect to remote machine "CLIENT1" and namespace "root\cimv2" using Kerberos with machine account, error - 0x80070005. $$<SMS_CLIENT_CONFIG_MANAGER><10-09-2023 20:25:53.785+240><thread=1892 (0x764)>
--> NTLM fallback is enabled, remote machine "CLIENT1" is continuing with client push. $$<SMS_CLIENT_CONFIG_MANAGER><10-09-2023 20:25:53.785+240><thread=1892 (0x764)>
---> Unable to connect to WMI (root\cimv2) on remote machine "CLIENT1", error = 0x80070005. $$<SMS_CLIENT_CONFIG_MANAGER><10-09-2023 20:25:53.785+240><thread=1892 (0x764)>
---> Deleting SMS Client Install Lock File '\\Client1.LivoniaResident.com\admin$\SMSClientInstall.LIV'~ $$<SMS_CLIENT_CONFIG_MANAGER><10-09-2023 20:25:53.785+240><thread=1892 (0x764)>
Execute query exec [sp_CP_SetLastErrorCode] 2097152001, -2147024891~ $$<SMS_CLIENT_CONFIG_MANAGER><10-09-2023 20:25:53.785+240><thread=1892 (0x764)>
Stored request "2097152001", machine name "CLIENT1", in queue "Retry". $$<SMS_CLIENT_CONFIG_MANAGER><10-09-2023 20:25:53.785+240><thread=1892 (0x764)>
Execute query exec [sp_CP_SetPushRequestMachineStatus] 2097152001, 2~ $$<SMS_CLIENT_CONFIG_MANAGER><10-09-2023 20:25:53.801+240><thread=1892 (0x764)>
Execute query exec [sp_CP_SetLatest] 2097152001, N'10/10/2023 00:25:53', 23~ $$<SMS_CLIENT_CONFIG_MANAGER><10-09-2023 20:25:53.816+240><thread=1892 (0x764)>
<======End request: "2097152001", machine name: "CLIENT1". $$<SMS_CLIENT_CONFIG_MANAGER><10-09-2023 20:25:53.832+240><thread=1892 (0x764)>
CCR count in queue "Retry" is 1. $$<SMS_CLIENT_CONFIG_MANAGER><10-09-2023 20:27:51.269+240><thread=7608 (0x1DB8)>
Sleeping for 620 seconds... $$<SMS_CLIENT_CONFIG_MANAGER><10-09-2023 20:27:51.269+240><thread=7608 (0x1DB8)>
Thread has been inactive too long. Closing thread~ $$<SMS_CLIENT_CONFIG_MANAGER><10-09-2023 20:35:53.847+240><thread=1892 (0x764)>
--- This thread is terminating due to inactivity $$<SMS_CLIENT_CONFIG_MANAGER><10-09-2023 20:35:53.847+240><thread=1892 (0x764)>
----- Terminated CCR processing thread. There are now 0 processing threads $$<SMS_CLIENT_CONFIG_MANAGER><10-09-2023 20:35:53.847+240><thread=1892 (0x764)>
The Site Control File has not changed since the last parameter update. $$<SMS_CLIENT_CONFIG_MANAGER><10-09-2023 20:38:11.268+240><thread=7608 (0x1DB8)>
Updating Site Parameters $$<SMS_CLIENT_CONFIG_MANAGER><10-09-2023 20:38:11.268+240><thread=7608 (0x1DB8)>
~MP Ports: 80 $$<SMS_CLIENT_CONFIG_MANAGER><10-09-2023 20:38:11.268+240><thread=7608 (0x1DB8)>
~IISPreferedPort: 80 $$<SMS_CLIENT_CONFIG_MANAGER><10-09-2023 20:38:11.268+240><thread=7608 (0x1DB8)>
~MP SSL Ports: 443 $$<SMS_CLIENT_CONFIG_MANAGER><10-09-2023 20:38:11.268+240><thread=7608 (0x1DB8)>
~IISSSLPreferedPort: 443 $$<SMS_CLIENT_CONFIG_MANAGER><10-09-2023 20:38:11.268+240><thread=7608 (0x1DB8)>
~Default MP: MECMPS.LivoniaResident.com $$<SMS_CLIENT_CONFIG_MANAGER><10-09-2023 20:38:11.268+240><thread=7608 (0x1DB8)>
~Default MP Type: 1 $$<SMS_CLIENT_CONFIG_MANAGER><10-09-2023 20:38:11.268+240><thread=7608 (0x1DB8)>
~Default MP: [None] $$<SMS_CLIENT_CONFIG_MANAGER><10-09-2023 20:38:11.268+240><thread=7608 (0x1DB8)>
~Certificate Selection Criteria: $$<SMS_CLIENT_CONFIG_MANAGER><10-09-2023 20:38:11.268+240><thread=7608 (0x1DB8)>
~Certificate Store: $$<SMS_CLIENT_CONFIG_MANAGER><10-09-2023 20:38:11.268+240><thread=7608 (0x1DB8)>
~SSL State: 1248 $$<SMS_CLIENT_CONFIG_MANAGER><10-09-2023 20:38:11.268+240><thread=7608 (0x1DB8)>
~PKI Cert Options: 0x1 $$<SMS_CLIENT_CONFIG_MANAGER><10-09-2023 20:38:11.268+240><thread=7608 (0x1DB8)>
~Select First Certificate: 1 $$<SMS_CLIENT_CONFIG_MANAGER><10-09-2023 20:38:11.268+240><thread=7608 (0x1DB8)>
~Certificate Issuers: $$<SMS_CLIENT_CONFIG_MANAGER><10-09-2023 20:38:11.268+240><thread=7608 (0x1DB8)>
Checking configuration information for server: MECMPS.LIVONIARESIDENT.COM.~ $$<SMS_CLIENT_CONFIG_MANAGER><10-09-2023 20:38:11.268+240><thread=7608 (0x1DB8)>
~No Fallback Status Point installed on the Site $$<SMS_CLIENT_CONFIG_MANAGER><10-09-2023 20:38:11.268+240><thread=7608 (0x1DB8)>
~Install on DC: True $$<SMS_CLIENT_CONFIG_MANAGER><10-09-2023 20:38:11.268+240><thread=7608 (0x1DB8)>
~Option for installing using IP address: 0 $$<SMS_CLIENT_CONFIG_MANAGER><10-09-2023 20:38:11.268+240><thread=7608 (0x1DB8)>
Sleeping for 1200 seconds... $$<SMS_CLIENT_CONFIG_MANAGER><10-09-2023 20:38:12.065+240><thread=7608 (0x1DB8)>

 

[Garth]

Note: I do not have a service account and am only using Administrator account.
The workstation is called Client1.

Is the site server account a member of the local administrator group?

 

[Moranger18]

In my lab the Site Server Account is the Administrator Account which is a member of the Domain Admins Security Group. This account is a member of the Local Admin Group on all machines. I have a Domain Controller, MECM Primary Server, and 1 Windows 11 Client in my Lab. All Machines on the same Subnet, I have a boundary group setup as well.

 

[Garth]

The log snip shows access denied. So... Check your permissions.

 

[Moranger18]

HI Garth,

I did some digging and found this





It seems the permissions to the WMI Namespace are denied from the MECMPS server to my client workstation.

I'm trying to find out how to change the permissions.

 

[Moranger18]

I got the client files to push to the client but it does not install

ccmsetup log attached.

 

[Moranger18]

I was unfortunately unsure what permissions to check so I dismantled the entire Lab and gave up.

I got a new class and followed a different teacher and my lab works like a charm now! Still don't know why the old lab wouldn't work, which is a real bummer.