The Mobile Device Manager Support Team Blog : Enrollment

SCMDM: Enrollment fails with "Unknown error in Enrollment service: System.ArgumentNullException: Value cannot be null"

jchornbe — Mon, 05 Jan 2009 17:29:00 GMT

Here's another MDM enrollment failure issue we ran across recently that's caused by the CA not being available when the SCMDM Enrollment Service starts. Fortunately the solution to this one is pretty easy:

========

Issue: Enrollment fails and the following event is logged on the Enrollment Server:

Unknown error in Enrollment service:
System.ArgumentNullException: Value cannot be null.
Parameter name: data
   at Microsoft.Mobile.ManagementServices.EnrollmentServer.CryptoService.ComputeHmac(Byte[] data, Byte[] sessionKey)
   at Microsoft.Mobile.ManagementServices.EnrollmentServer.Authentication.AuthenticateServer(BootstrappingRequest rc)
   at Microsoft.Mobile.ManagementServices.EnrollmentServer.Authentication.Authenticate(RequestContext rc)

Cause: This can occur if the Certificate Authority (CA) was not running when the SCMDM Enrollment Service started.

Resolution: Restart the SCMDM Enrollment Service.

========

J.C. Hornbeck | Manageability Knowledge Engineer

SCMDM: Enrollment fails if a port other than 443 is used for the Enrollment Service

jchornbe — Wed, 17 Dec 2008 16:45:01 GMT

Here's another SP1 issue that we came across. If your server and client logs indicate that Enrollment failed because it could not resolve the Enrollment server URL and you changed the port then this may be your issue:

========

Issue: The server and client logs indicate that enrollment failed because it could not resolve the enrollment server URL.

Cause: Enrollment can fail if PAT (Port Address Translation) is used or if an alternate port other than 443 is used for the Enrollment Service.

Setup itself does not allow you to specify an alternate port number for the enrollment server when it is installed, so if an alternate port is specified in IIS after installation, and the SCP value for the enrollment server is not changed, then client auto discovery breaks. What happens is that the client is sent back a request to switch to the URI of an enrollment server without the alternate port causing the enrollment to fail.

Resolution: If the port number in IIS is changed to a port other than 443, the SCP value must also be changed.

To change the SCP value follow these steps:

1. Launch ADSIEDIT.MSC.

2. Right click on “CN=Instance” to bring up the property dialog box.

3. Check the ‘Show only attributes that have values’ checkbox.

4. Double click on ‘keywords’ attribute.

5. Change the “enurl= …” value to the new port number.

========

J.C. Hornbeck | Manageability Knowledge Engineer

SCMDM: Set-EnrollmentPermissions returns "Error encountered when delegating container..."

jchornbe — Tue, 16 Dec 2008 18:51:00 GMT

Here's another MDM SP1 issue for you. This one involves the Set-EnrollmentPermissions command and an error you can receive if SCMDMEnrollmentServers has full permissions on the specified OU:

========

Issue: When running the Set-EnrollmentPermissions command you may receive the following error:

Set-EnrollmentPermissions : Error encountered when delegating container "OU=SCMDM Managed Devices (Instance1),DC=yonaloc,DC=nttest,DC=microsoft,DC=com" permission to Enrollment Server.
At line:1 char:26
+ Set-EnrollmentPermissions <<<< "SCMDM MAnaged Devices (Instance1)"

Cause: The Set-EnrollmentPermissions command verifies what permissions SCMDMEnrollmentServers has on the specified OU (i.e. the OU that is passed in the command). There is a known issue in this verification process where it will return false if Full Permissions are enabled.

Resolution: Do not enable full permission for SCMDMEnrollmentServers group on the device OU. To workaround this issue delete the SCMDMEnrollmentServers group from Security. To do this follow these steps:

Run DSA.MSC.
Find the OU where you were trying to set permissions.
Right click on the OU and select Properties.
On the Security tab, click on SCCMEnrollmentServers(<your instance name>) and remove it.

The last step is to run the Set-EnrollmentPermissions command again. This time it should succeed without error.

========

J.C. Hornbeck | Manageability Knowledge Engineer