SOLVED SCCM PXE Boot WinPE Task wizard cannot retrieve policies

[mpowis]

I have been looking at the logs on the SCCM server (MPControl / CCM / SMSPXE & distmgr), they all suggest everything is working as it should be, no errors, they can see the WIM boot images (Boot Images have been updated), they suggest the connection with IIS and the MP are working.
I boot any device that i was able to image before, the PXE connects, receives the IP address etc and boots the WinPE interface and asks for the password, i put in the password and it sits for ages searching for the policy for the device (tried multiple devices all the same).
I look in the SMSTS log on the client and its showing the following errors:

AsyncCallback(): WINHTTP_CALLBACK_STATUS_SECURE_FAILURE Encounted
:dwStatusInformationLength is 4
:*IpvStatusInformation is 0x2
:WINHTTP_CALLBACK_STATUS_FLAG_INVALID_CERT is set
AsyncCallback()----------------------------------------------

Sending with winhttp failed; 80072f8f
Retrying and Ignoring date security failures.

AsyncCallback(): WINHTTP_CALLBACK_STATUS_SECURE_FAILURE Encounted
:dwStatusInformationLength is 4
:*IpvStatusInformation is 0x2
:WINHTTP_CALLBACK_STATUS_FLAG_INVALID_CERT is set
AsyncCallback()----------------------------------------------

Sending with winhttp failed; 80072f8f

failed to send the request. 80072f8f

Failed to get Client identity (80072f8f)

failed to request for client
SyncTimeWithMP() failed 80072f8f
Failed to get time information from MP https://my server name

Failed to select MP

It doesn't say which certificate it doesn't like, i also checked the device time and date and they are correct, i did however notice on the distmgr log it shows the iis date and time as wrong

Successfully saved IIS settings.
1998-01-01T00:00:00

 

[Prajwal Desai]

I have covered the solution to SyncTimeWithMP() failed 80072f8f issue in my blog post - https://www.prajwaldesai.com/sending-with-winhttp-failed-80072f8f-sccm-osd/

Try the solutions that I have covered and if that doesn't help, let us know and we will troubleshoot it further.

 

[mpowis]

Hi Prajwal,
I saw that post and i have remade the certificates several times but each time i get this error and this time it just says a certificate, it doesn't specify the CA cert.

 

[mpowis]

FIXED!!!!
So it was the root CA certificate, i had recreated it many times following your guides and others but made no difference but this time i tried your guide on using the command line, certutil -ca.cert C:\RootCA_name.cer
This time when i imported it into the personal certificate store and instead of it coming up Server or Client it now says All, updated boot image and all good now.