Last week I had a nasty issue, where a lot of clients didn't receive new packages and Windows/Endpoint Protection updates. Sometimes you where seeing new folders created in ccmcache, but they were deleted empty a few seconds later. When looking in Monitoring on the package the following status was seen: Failed to download update(s), error 0x80070005 (Access is denied) and Failed to install update(s), 0x80070005 (Access is denied). What's going on here?
Client Updates
Definition Updates
Looking in multiple logfiles I saw the following errors:
CAS.log
Download failed for content XYZ under context System, error 0x80070005
Download failed for download request {DCE900A1-B51F-46A6-B278-167C2F94C307}
User policy requested with no user credentials.
DataTransferService.log
Sending location services HTTP failure message.
Successfully sent location services HTTP failure message.
Error sending DAV request. HTTP code 401, status 'Unauthorized'
GetDirectoryList_HTTP('http://<FQDN>/SMS_DP_SMSPKG$/90812187-ade0-4dd8-b29f-66f5db5af2c1') failed with code 0x80070005.
UpdatesHandler.log
CAS failed to download update (6983a782-828c-40b8-bf9c-c8e381e25f5e). Error = 0x80070005. Releasing content request.
ContentAvailable notification received from CAS.
I did a lot troubleshooting the issue (ConfigMgr client repair, ConfigMgr cache clear, Update distribution point), but in the end it was IIS Security. On 3 of 6 remote Site servers, IIS security (Windows authentication) was missing. After installing the role feature, the issue was solved right away! Still strange how this could happen, because in the past everything worked fine. When having the 0x80070005 error in the future, verify that Windows authentication is installed.
Hope it helps!
Source: SCCM 2012 - client waiting for content
When creating a Build and Capture image, the system will be most of time in a WORKGROUP and not in a domain. On the image used for this, you can make usage on Offline Servicing for integrating Windows updates in the image. On Windows 7 SP1 this will be around 100+ updates already! When installing applications during Build and Capture however, additional updates are needed. This for applications like Internet Explorer, DotNet Framework and Microsoft Office. You can add a "Install Software Updates" step for that in the task sequence, but error 0x80070005 will be showed in the smsts.log probably. This because the system isn't allowed to download the updates (access denied). Let's have a look on that.
Before installing updates it's needed to install a hotfix first. This is KB2522623, which is needed because: "InitializeSecurityContext function might not fall back to NTLM authentication in Windows 7 or in Windows Server 2008 R2 when Kerberos fails and has the STATUS_NO_LOGON_SERVERS status". After installing the hotfix, additional updates will be installed without a problem. On above applications there will be almost 50 updates more installed! Just great to have around 160/170 updates in your image that way ;)
Hotfix installation: wusa <file>.msu /quiet /norestart
Source: A guide to Microsoft Products
Download: KB2522623
At a customer location ConfigMgr was installed on a SQL cluster. ConfigMgr was running fine, and Reporting services was installed on a single node. All went fine. After a few months customer deciced to break down the SQL cluster and migrate databases to single servers. The ConfigMgr database is migrated with help from MS TechNet: Manage Site and Hierarchy Configurations
All seems okay after the migration. The ConfigMgr console can be started and no direct errors are seen. After a week looking in the configuration, multiple errors are seen in the logfiles:
CCMSETUP.LOG (from a client)
- GetDPLocations failed with error 0x87d00215
- Failed to get DP locations as the expected version from MP "SCCM Server". Error 0x87d00215
CERTMGR.LOG
- Error: Failed to write certificate from server (SQL SERVER\TrustedPeople).
- ERROR: Failed to open certificate store (HRESULT=0x5)
HMAN.LOG
- SMS-Site-S01 could not be created, error code = 8203.
- Failed to connect to remote WMI repository on machine "SQL Server"
ConnectServer(Namespace) failed. - 0x80070005
POLICYPV.LOG
- Failed to sign Policy Assignment, Error code = 0x8009200b
- Error signing policy assignments (0x80004005).
Also multiple errors are seen in the ConfigMgr console:
SMS_HIERARCHY_MANAGER
- Configuration Manager cannot create the object "SMS-Site-S01" in Active Directory
- Hierarchy Monitoring detected that the SQL Server machine certificate has missed. It is failed to remediate with Error.
- Hierarchy Monitoring detected that the SQL Server machine certificate has missed.
SMS_SITE_COMPONENT_MANAGER
- Site Component Manager failed to reconfigure site system "SQL Server" to receive Configuration Manager Server Components.
- Site Component Manager could not access site system "SQL Server". The operating system reported error 2147942467: The network name cannot be found.
SMS_POLICY_PROVIDER
- Policy Provider has failed to sign one or more policy assignments. It will retry this operation automatically.
Does anyone has a clue why communication to the ConfigMgr database fails? It seems to be something with permissions, WMI and certiticates. Also reporting isn't functional anymore. ConfigMgr computeraccount is an administrator on both ConfigMgr and SQL Server. Site Reset didn't help me unfortunately.
Update 30-1-2013: Solved with assistance from Stephan Wibier (@StephanWibier) Thanks!
Update 15-5-2013: The trick is to re-create the certificate which is needed for communication between ConfigMgr and SQL Server. Then everything will be okay again. Just follow steps from this blogpost for the permissions needed: "Fail to create SQL Server Certificate" during installation.
As described on Microsoft TechNet also a new self signed certificate is needed which much be assigned in the SQL Server Configuration Manager / SQL Server Network Configuration / Protocols for MSSQLSERVER. Hope it helps!
