Error opening remote console after Configuration Manger in place OS upgrade

Quick post about issues connecting to site with remote console after upgrading the server OS from Windows 2008 R2 to Windows Server 2012 R2

After the upgrade all remote console were unable to connect to the site

console-error

After reviewing the SMSAdminUI.log  on one of the remote devices, there were access denied errors.

\r\nSystem.Management.ManagementException\r\nAccess denied \r\n   at System.Management.ManagementException.ThrowWithExtendedInfo(ManagementStatus errorCode)
:System.Management.ManagementException\r\nAccess denied \r\n   at System.Management.ManagementException.ThrowWithExtendedInfo(ManagementStatus errorCode)

I granted one user local admin rights to the SCCM server, which was hosting the SMS Provider and the console access was restored.

I reviewed the DCOM permissions which were fine, however, the WMI permissions for the SMS Admins group were missing!

I check the WMI permissions using wmimgmt.msc and added the required permissions

wmi.PNG

and

wmi1.PNG

I removed the local admin permissions and tested again. Console access was working again

More detail

In order to access a local or remote SMS Administrator console, users must be members of the SMS Admins local group. The SMS Admins group is explicitly granted Enable Account and Remote Enable on the Root\SMS namespace. The SMS Admins group provides its members with access to the SMS Provider, through WMI. Add Users to the SMS Admins group when they need to access the SMS Administrator console, but do not have to be Local Administrators

Console access troubleshooting

https://support.microsoft.com/en-us/kb/317872

 

Advertisements

How to verify if site maintenance tasks are running successfully

If you would like to know if the site maintenance tasks are running successfully you can either check the site status for errors or use the below SQL query

select *,
floor(DATEDIFF(ss,laststarttime,lastcompletiontime)/3600) as Hours,
floor(DATEDIFF(ss,laststarttime,lastcompletiontime)/60)- floor(DATEDIFF(ss,laststarttime,lastcompletiontime)/3600)*60 as Minutes,
floor(DATEDIFF(ss,laststarttime,lastcompletiontime))- floor(DATEDIFF(ss,laststarttime,lastcompletiontime)/60)*60 as TotalSeconds
from SQLTaskStatus

Completion status – 0 = Success

SMT

Use the Configuration Analyzer to troubleshoot System Center components

It’s no secret that the many tools in System Center 2012, and the new features in Service Pack 1 (SP1) to System Center 2012, present a vast array of architecture and configuration decisions. While all the components work together to deliver data center management and cloud services, each formerly-separate product like Operations Manager (SCOM) or Configuration Manager (SCCM), does requires its own configuration. Missteps, oversights, or just typos in setting up System Center 2012 SP1 can vex admins when components don’t work or interoperate as needed-and each component needs to be set up “just so” to achieve their collective potential.

Microsoft has released a way to discover how to optimally configure System Center 2012 SP1 components: The System Center 2012 SP1 Configuration Analyzer is your new first-line troubleshooting tool for issues with System Center 2012 SP1 server-side components. Keeping true to the theme that System Center 2012 SP1 is one product with various components, Microsoft released this single analyzer for the entire System Center 2012 SP1 suite, rather than individual tools for each component. The business benefit is that you can make sure you are getting the most value from your management software with little additional effort and at no cost.

A best practice analyzer for your management tools

I lost my primary site in my hierarchy, what I do now?

I few weeks ago this happened to one of you, I know the frustration that this may have caused when you initially saw it. Either the server files where corrupted or the vhd was lost on a power lost, what happened now you are on a panic state. You need to recover one of your primary site in your hierarchy, don’t worry we got you covered. Click here

Troubleshooting application deployment issues – Tips

If you experience any of the following problems, check these recommended troubleshooting steps and information.

Problem 1 – application download failures:
Client stuck downloading an application
Client failed to download application
Client stuck at 0% while downloading software

Possible solutions and troubleshooting information:
Missing or misconfigured boundaries and boundary groups: If the client is on the intranet and is not configured for Internet-only client management, the client’s network location must be in a configured boundary and there must be a boundary group assigned to this boundary for the client to be able to download content. For more information about boundaries and boundary group, see the following TechNet information.

Planning for Boundaries and Boundary Groups: http://technet.microsoft.com/en-us/library/gg712679.aspx. Configuring Boundaries and Boundary Groups: http://technet.microsoft.com/en-us/library/hh427326.aspx

Content might not be distributed to the distribution points yet, which is why it is not available for clients to download. Use the in-console monitoring facilities to monitor content distribution to the distribution points. For more information about monitoring content, see the following blog post: http://blogs.technet.com/b/inside_osd/archive/2011/04/06/configuration-manager-2012-content-monitoring-and-validation.aspx

Problem 2 – application deployment compliance stuck at 0%

Possible solution and troubleshooting information:
When compliance is 0%, check for the following deployment status for the application in the Monitoring workspace, Deployments node:
“In progress”: The client could be stuck downloading content. Check problem 1, above.
“Error”: For more information about this status, see the following blog post: http://blogs.technet.com/b/configmgrteam/archive/2012/03/23/tips-and-tricks-how-to-take-action-on-assets-that-report-a-failed-deployment-in-system-center-2012-configuration-manager.aspx

“Unknown”: This implies that the client has not received policy. Try manually initiating client policy and if this does not work, use client status to help verify client functionality. For more information, see the following TechNet information: Initiate Policy Retrieval for a Configuration Manager Client: http://technet.microsoft.com/en-us/library/gg712288.aspx#BKMK_PolicyRetrieval Monitoring the Status of Client Computers in Configuration Manager: http://technet.microsoft.com/en-us/library/gg682132.aspx#BKMK_ClientHealth