The focus of this blog is to detail solutions to common and unique issues involving ConfigMgr OSD that we see within CSS. We will also be sharing best practices and lessons learned from handling support cases involving OSD.
In System Center 2012 Configuration Manager, if the Management Point is in HTTPS mode but the Distribution Point hosting the PXE server is in HTTP mode, the PXE boot may fail. Examining the SMSPXE.log may reveal the following errors:
ProcessMessage: Context:0015B270 dTime:0 SMSPXE!sTempString.empty(), HRESULT=80070057 (e:\nts_sccm_release\sms\framework\core\ccmcore\string.cpp,1023) SMSPXEMAC=<MAC_Address> SMBIOS GUID=<SMBIOS_GUID> > DHCP Discover received. SMSPXESet enterpirse certificate in transport SMSPXESet media certificate in transport SMSPXESet authenticator in transport SMSPXECLibSMSMessageWinHttpTransport::Send: URL: <ConfigMgr_MP_Server>:443 GET /SMS_MP_AltAuth/.sms_aut?MPKEYINFORMATION SMSPXEIn SSL, but with no client cert SMSPXERequest was succesful. SMSPXESet authenticator in transport SMSPXESetting message signatures. SMSPXESetting the authenticator. SMSPXECLibSMSMessageWinHttpTransport::Send: URL: <ConfigMgr_MP_Server>:443 CCM_POST /ccm_system_AltAuth/request SMSPXEIn SSL, but with no client cert SMSPXERequest was succesful. SMSPXEpNext != NULL, HRESULT=80004005 (e:\nts_sccm_release\sms\framework\osdmessaging\libsmsmessaging.cpp,1967) SMSPXEreply has no message header marker SMSPXEDoRequest (sReply, true), HRESULT=80004005 (e:\nts_sccm_release\sms\framework\osdmessaging\libsmsmessaging.cpp,6202) SMSPXESMSClientLookup.RequestLookup(smbiosGUID, macAddress, dwItemKey, bUnknown), HRESULT=80004005 (e:\nts_sccm_release\sms\server\pxe\smspxe\database.cpp,221) SMSPXEPXE::DB_LookupDevice failed; 0x80004005 SMSPXESet enterpirse certificate in transport SMSPXESet media certificate in transport SMSPXESet authenticator in transport SMSPXECLibSMSMessageWinHttpTransport::Send: URL: <ConfigMgr_MP_Server>:443 GET /SMS_MP_AltAuth/.sms_aut?MPKEYINFORMATION SMSPXEIn SSL, but with no client cert SMSPXERequest was succesful. SMSPXESet authenticator in transport SMSPXESending StatusMessage SMSPXESetting message signatures. SMSPXESetting the authenticator. SMSPXECLibSMSMessageWinHttpTransport::Send: URL: <ConfigMgr_MP_Server>:443 CCM_POST /ccm_system_AltAuth/request SMSPXEIn SSL, but with no client cert SMSPXERequest was succesful. SMSPXEpNext != NULL, HRESULT=80004005 (e:\nts_sccm_release\sms\framework\osdmessaging\libsmsmessaging.cpp,1967) SMSPXEreply has no message header marker SMSPXEDoRequest (sReply, false), HRESULT=80004005 (e:\nts_sccm_release\sms\framework\osdmessaging\libsmsmessaging.cpp,4045) SMSPXEFailed to send status message (80004005) SMSPXEsmStatusMessage.Send(), HRESULT=80004005 (e:\nts_sccm_release\sms\server\pxe\smspxe\database.cpp,444) SMSPXEFailed to send the status message SMSPXEPXE::DB_ReportStatus failed; 0x80004005 SMSPXEGetOrCreateDeviceFromPacket(pRequest, deviceInfo, 1, 1), HRESULT=80004005 (e:\nts_sccm_release\sms\server\pxe\smspxe\pxehandler.cpp,1475) SMSPXEPXE Provider failed to process message. Unspecified error (Error: 80004005; Source: Windows) SMSPXERejecting PXE request SMSPXE
This problem is caused if a self-signed certificate is specified in the properties of the Distribution Point.
During a PXE boot, clients will use the certificate specified in the "Distribution Point Properties" window to talk to both the MP and to the DP. If the MP is in HTTPS mode, the client needs a PKI certificate to talk to the MP. However if a self-signed certificate has been specified in the "Distribution Point Properties" window, it will use a self-signed certificate instead of a PKI certificate to try and talk to the MP, causing it to fail.
A PKI certificate can be used for the Distribution Point in HTTP mode.
To resolve the problem, in the properties of the Distribution Point, specify to use a PKI certificate instead of a self-signed certificate. For more information about creating a PKI certificate for use in the Distribution Point, see the section "Boot images for deploying operating systems" under "PKI Certificates for Clients" at the below link:
PKI Certificate Requirements for Configuration Managerhttp://technet.microsoft.com/en-us/library/gg699362.aspx