Month: September 2013

Had an issue with some builds today where the mahcines appeared to Domain Join during T/S but the bombed-out on the Enable Bitlocker stage as they wer eunable to store the Recovery Key data in the Directory service… because they were not Domain Joined! To cut a long story short, SCCM and the Domain Join functionality cannot function in the event that the computer account already exists, in another Organizational Unit. This is a limitation in Windows Setup, not the SCCM Task Sequence.

We use a custom HTA to collect OU locations, machine names etc so I extended it with the function below to perform a comparision of the TS MachineObjectOU variable value, and the existing account distinguishedName value – using the MDT Web Service produced by Maik Koster.

It’s never easy with ConfigMgr… in fact it’s normally self inflicted! In this scenario the smsts.log showed the following “useful” information:

Initializing HTTP transport. OSDSMPClient 19/09/2013 16:21:52 2952 (0x0B88)
cannot create a certificate context from the given encoded string OSDSMPClient 19/09/2013 16:21:52 2952 (0x0B88)
Set authenticator in transport OSDSMPClient 19/09/2013 16:21:52 2952 (0x0B88)
Sending request to MP https://SRV.domain.local. OSDSMPClient 19/09/2013 16:21:52 2952 (0x0B88)
In SSL, but with no client cert OSDSMPClient 19/09/2013 16:21:52 2952 (0x0B88)
In SSL, but with no media cert OSDSMPClient 19/09/2013 16:21:52 2952 (0x0B88)
Received 12566 byte response. OSDSMPClient 19/09/2013 16:21:53 2952 (0x0B88)
Failed to decrypt state encryption key (0x80070057) OSDSMPClient 19/09/2013 16:21:53 2952 (0x0B88)
Failed to parse response from Management Point (0x80070057). OSDSMPClient 19/09/2013 16:21:53 2952 (0x0B88)
ExecuteCaptureRequestMP failed (0x80070057). OSDSMPClient 19/09/2013 16:21:53 2952 (0x0B88)
ExecuteCaptureRequest failed (0x80070057). OSDSMPClient 19/09/2013 16:21:53 2952 (0x0B88)
OSDSMPClient finished: 0x00000057 OSDSMPClient 19/09/2013 16:21:53 2952 (0x0B88)
Process completed with exit code 87 TSManager 19/09/2013 16:21:53 5556 (0x15B4)
!--------------------------------------------------------------------------------------------! TSManager 19/09/2013 16:21:53 5556 (0x15B4)
Failed to run the action: Request State Store. 
The parameter is incorrect. (Error: 00000057; Source: Windows) TSManager 19/09/2013 16:21:53 5556 (0x15B4)

In this case there was actually an old Computer Association defined in the ConfigMgr database which was stopping the capture from running. This could be viewed via SQL Management Studio, using the following query against the Primary/Central site database:

SELECT *
FROM [<SITE DB>].[dbo].[StateMigration]
WHERE SourceClientItemKey = <RESOURCE ID>

To rectify this, I adjusted the built-in Site Maint. Task “Delete Aged Computer Association Data” to run immediately, with a lower number of days configured to retain data.