Author: Bill Anderson
Program Manager: Tim McGilvery
Applies To: Microsoft Systems Management Server 2003
Document Version: Release 1.0
Intended Audience: SMS Administrators
Scope of the document: This document provides detailed information about troubleshooting management points in for Microsoft® Systems Management Server (SMS) 2003. This information includes low-level details, a success and failure checklist for setup, an installation walkthrough, key flowcharts, and troubleshooting tips. You can use this information to thoroughly understand how this feature works, to monitor the activity of components relevant to management points, and to troubleshoot problems associated with management points.
This article provides detailed information about management points in SMS 2003 and includes low-level details, troubleshooting tips, and key flowcharts. You can use this information to better understand how this feature works, to monitor the activity of components relevant to management points, and to troubleshoot problems associated with management points.
Before you read this article, you should first be familiar with the information contained in the following resources:
-
The Microsoft Systems Management Server 2003 Concepts, Planning, and Deployment Guide, on the Microsoft Web site at http://go.microsoft.com/fwlink/?linkid=19627, which contains an overview of all the features in SMS 2003.
-
The Scenarios and Procedures for Microsoft Systems Management Server 2003: Planning and Deployment Guide, on the TechNet Web site at http://go.microsoft.com/fwlink/?linkid=29105. This guide provides a roadmap for developing a deployment plan for your SMS 2003 and SMS 2003 Service Pack 1 (SP1) sites by offering a prescriptive guide with flowcharts, task lists, and job aids.
-
The Microsoft Systems Management Server 2003 Operations Guide, on the TechNet Web site at http://go.microsoft.com/fwlink/?linkid=27538, which provides information about configuring and using SMS.
-
The SMS 2003 Supported Configurations for SP1 technical article, on the Microsoft Web site at http://go.microsoft.com/fwlink/?linkid=46666, which specifies the hardware and software requirements necessary to implement and maintain SMS 2003 Service Pack 1 (SP1) in your environment.
-
The SMS 2003 Toolkit 2, on the Microsoft Web site at http://go.microsoft.com/fwlink/?linkid=25444, which contains downloadable tools to help you deploy and troubleshoot SMS 2003.
Understanding SMS 2003 Management Points
Before you begin troubleshooting management points for your SMS sites, you should be familiar with a few key concepts. These concepts are summarized in this document, but are covered in more detail in the Microsoft Systems Management Server 2003 Concepts, Planning, and Deployment Guide, and in the Microsoft Systems Management Server 2003 Operations Guide. The information presented in this document provides an itemization of the components required for clients to effectively receive instructions from a site server as well as to report data back to the site.
Advanced Clients communicate with SMS sites through management points. To be a management point, the server must have Internet Information Services (IIS) installed, enabled, and correctly configured. Additionally, the following considerations should be taken into account:
-
Every site should have a default management point specified.
-
Management points can be set to use the SMS site database or a replicated copy of the SMS site database.
-
Management points can be a single physical server or a single virtual server (multiple physical servers) that is accessed via a Network Load Balancing cluster.
The management point is the primary point of contact between Advanced Clients and the SMS site server. An SMS site has only one default management point. Similar to the relationship between client access points (CAPs) and Legacy Clients, a management point does the following:
-
Provides specific client configuration details (also known as the Advanced Client policy) for the Advanced Client after installation.
-
Uses the SMS_def.mof file that is stored in the site database to create the appropriate Advanced Client policy for Advanced Clients. Advanced Clients retrieve Advanced Client policies from management points.
-
The Advanced Client stores retrieved policies locally in Windows Management Instrumentation (WMI) in the form of instances and classes.
-
-
Serves as the location where Advanced Client computers check for advertisements.
-
Locates distribution points for Advanced Clients. Advanced Clients choose a distribution point at random from the list of available distribution points provided by the resident management point when making package source file requests.
-
Receives inventory, software metering, and status information from Advanced Clients and forwards the information to the SMS site server.
Note
If the Active Directory schema is not extended for SMS, you must register the management point in WINS.
Each site can only have one default management point at one time. Advanced Clients communicate only with the default management point. If you need additional management points for performance reasons or redundancy, combine multiple management points of one site into a Network Load Balancing cluster and configure the virtual IP address of the cluster as the default management point for that site.
If you configure additional management points but do not combine them into a Network Load Balancing cluster, those additional management points will not be used by the Advanced Clients. There is no automatic failover to additional management points. If the default management point goes offline, the SMS administrator must manually designate a different computer to be the default management point.
If you do not have a default management point, Advanced Clients cannot download policies or report data to the site.
For more information about site configuration, see Appendix E: Designing Your SMS Sites and Hierarchy, in the Microsoft Systems Management Server 2003 Concepts, Planning, and Deployment Guide at the Microsoft Web site http://go.microsoft.com/fwlink/?linkid=19627.
Installing Management Points
Properly installing a management point is a straightforward process if all requirements are met before installation. To summarize, management point installation results in the following actions occurring on the computer designated as the management point:
-
WMI namespaces are created.
-
Managed object format files are copied into the WMI namespaces.
-
IIS virtual directories are created.
-
Application pools are created on servers running Windows Server 2003.
-
System Monitor performance objects are created.
-
SMS Agent Host (CCMExec.exe) is installed and started.
-
Default policies are initialized.
Not all management point problems are immediately obvious. Review the following section if you suspect that your management point was not installed properly.
Before or after management point installation, consider using the SMS Troubleshooter tool to verify that your management point is installed and operating correctly. You can use this tool to check a computer system before or after management point installation to ensure that the installation meets the requirements for management points. When run, the tool indicates whether management point dependencies are met.
On This Page
Setup Success and Failure Checklist
Installation Verification Using Windows Audit Process Tracking
Management Point Installation Walkthrough
Setup Success and Failure Checklist
To successfully install a management point, the requirements in this checklist must be met. By answering the following questions, you can determine whether your management point has been successfully installed. Problem symptoms and recommended corrective actions are listed, as appropriate.
For more information about system requirements and supported platforms, see the SMS 2003 Supported Configurations for SP1 document at Microsoft Web site http://go.microsoft.com/fwlink/?linkid=46666.
Is an NTFS Disk Partition Present?
If not, convert the disk partition to NTFS. If yes, continue to the next question.
Is the Server Running Windows Server 2003 a Domain Controller?
If yes, you might encounter any of the following symptoms:
Symptoms
The management point is not successfully installed.
The Mpmsi.log that is located in the /SMS/Logs folder on the SMS 2003 site system computer may contain errors such as the following:
Note: The line has been split into multiple lines for readability. However, while trying it out on a system you must enter it as one line without breaks.
2.00.3790.00 Calling process: D:/SMS/bin/i386/MPsetup.exe === MSI (c) (A0:18): Resetting cached policy values MSI (c) (A0:18): Machine policy value 'Debug' is 0 MSI (c) (A0:18): ******* RunEngine: ******* Product: D:/SMS/bin/i386/mp.msi ******* Action: ******* CommandLine: ********** MSI (c) (A0:18): Client-side and UI is none or basic: Running entire install on the server. MSI (c) (A0:18): Failed to grab execution mutex. System error 258. MSI (c) (A0:18): Cloaking enabled. MSI (c) (A0:18): Attempting to enable all disabled privileges before calling Install on Server MSI (c) (A0:18):Incrementing counter to disable shutdown. Counter after increment: 0 MSI (c) (A0:18): Decrementing counter to disable shutdown. If counter >= 0,shutdown will be denied. Counter after decrement: -1 MSI (c) (A0:18): MainEngineThread is returning 1618
The management point may appear to have been installed correctly but running the diagnostic query URL, http://<ManagementPointComptuerName>/sms_mp/.sms_aut?mplist, returns the following error:
401.3 Unauthorized due to ACL on resource
The Mpcontrol.log file that is located in the /SMS/Logs folder on the SMS 2003 site server may contain the following error:
Note: Some of the lines in the following code have been displayed on multiple lines for better readability.
Http verification .sms_aut failed with status code 401, Unauthorized $$<SMS_MP_CONTROL_MANAGER><date time year time zone><thread=2648 (0xA58)>
Cause
The preceding symptoms can occur if the following two domain user accounts have logon restrictions set on one or more computers that are members of the domain:
-
IWAM_name of the domain controller
-
IUSER_name of the domain controller
These accounts are typically created as local accounts on the computer where you installed IIS. However, when IIS is installed on a Windows Server 2003 domain controller that does not have local user accounts, these accounts are created as domain accounts.
The IWAM_<DomainControllerName> and the IUSER_<DomainControllerName> domain accounts are copies of the Domain Guest Account and are created during the IIS Setup process. Therefore, when you make changes to the Domain Guest Account before you install IIS on a domain controller, the changes are inherited by the IWAM_<DomainControllerName> Domain Account and the IUSER_<DomainControllerName> Domain Account during the IIS installation process.
Additionally, you must make sure that the IWAM_<DomainControllerName> Domain Account is included as part of the domain's IIS_WPG group. If IIS is removed from the domain controller computer, the removal process also removes the IIS_WPG group from all domain controllers because they share the same account database.
Workaround
To work around the problem of account logon restrictions, you must make sure that the Domain Guest Account has the correct attributes you need before you install IIS on any domain controller in your domain.
Make sure the IWAM_<DomainControllerName> account is a member of the <domain>/IIS_WPG group. If you have removed IIS from the domain controller, you must manually add the account as a member of the <domain>/IIS_WPG group for the management point to work. To do this, perform the following procedure.
To remove log on restrictions
-
Click Start, point to Administrative Tools, and click Active Directory Users and Computers.
-
In Active Directory Users and Computers, expand the name of your domain and click Users.
-
In the right pane, double-click the IIS_WPG group.
-
In the IIS_WPG Properties dialog box, click the Members tab and make sure that the IWAM_<DomainControllerName> account is listed.
-
If the IWAM_<DomainControllerName> account is not listed, click Add.
-
In the Users, Computers, or Groups dialog box, type IWAM_<DomainControllerName> in the Enter Object names to select box and then click OK twice.
For more information about installing an SMS 2003 management point role on Windows Server 2003 domain controllers, see article 886213 in the Microsoft Knowledge Base at http://go.microsoft.com/fwlink/?LinkId=46612.
Is IIS Installed?
IIS must be installed for the management point to operate. Otherwise, the following symptom may occur.
Symptom
The following MPSetup.log symptom is seen when IIS is not installed:
Note: Some of the lines in the following code have been displayed on multiple lines for better readability.
<12-02-2004 16:06:32> ================================================= ================== <12-02-2004 16:06:32>MP Setup Started.... <12-02-2004 16:06:32>Parameters: //COMPUTER/C$/SMS/bin/i386/MPsetup.exe /install /siteserver:SERVER1 <12-02-2004 16:06:32> Installing the MP <12-02-2004 16:06:32> Passed OS version check. <12-02-2004 16:06:32> Error - IIS Service is not installed on the Machine - MP Installation cannot continue.
If IIS is installed, continue to the next question. Otherwise, perform the following procedure.
To install BITS Server Extensions
-
Open Add/Remove Programs, and then open Windows Components.
-
Double-click Application Server, select Internet Information Services (IIS), and click OK.
Are BITS Server Extensions Installed?
If you are trying to install a management point on Windows Server 2003, Background Intelligent Transfer Service (BITS) Server Extensions are not installed by default. To determine whether BITS Server Extensions are installed, make sure that the BITS Server Extensions check box is selected, as follows:
-
Open Add/Remove Programs, and then open Windows Components
-
Double-click Application Server, select Internet Information Services (IIS), and click OK.
-
If BITS Server Extensions are installed, continue to the next question.
Is the Default Web Site Configured for Port 80?
If yes, continue to the next question.
To determine the port of the default Web site, perform the following steps.
To determine the port of the default Web site
-
Open Internet Information Services (IIS) Manager, and expand Web Sites.
-
Right-click Default Web Site, and click properties.
-
On the Web Site tab, verify that the TCP port is set to 80.
Other services can bind to port 80 before the default Web site does. If the default Web site is configured to use port 80 and Setup failures indicate that a service is not listening, perform the following step.
-
Open a command prompt and type Netstat –a –n –o.
This command outputs a list of all listening ports, associated process IDs, and the port number, as shown in the following example:
Note: Some of the lines in the following code have been displayed on multiple lines for better readability.
Proto Local Address Foreign Address State PID TCP 0.0.0.0:80 0.0.0.0: LISTENING 1732
-
Match the output information against he processes running in the task list by opening a command prompt and then running tasklist /svc.
This command displays running tasks sorted by process ID. The SVC switch displays the services hosted in each process. Because the W3SVC service runs inside an instance of svchost.exe, the switch is required to verify the World Wide Web service is listening on the port identified previously with the Netstat command, as shown in the following example:
Image Name PID Services =============================== svchost.exe 1732 W3SVC
The following MPControl.log symptoms are seen when the port of the default Web site has been changed. Although the management point setup completes, an error appears in the log file.
Note: Some of the lines in the following code have been displayed on multiple lines for better readability.
Failed to send http request /SMS_MP/.sms_aut? MPLIST. Error 12029 SMS_MP_CONTROL_MANAGER 12/2/2004 4:35:05 PM 2532 (0x09E4) Http verification .sms_aut failed with no header received SMS_MP_CONTROL_MANAGER 12/2/2004 4:35:05 PM 2532 (0x09E4)
Note
The MP Troubleshooter tool does not detect whether the port for the default Web site has been changed.
Is Windows Management Instrumentation Enabled and Running?
Check the Computer Management console, and locate the Services node. Verify that WMI is started. If WMI is disabled, the management point install process enables and restarts WMI.
Is the Task Scheduler Service Enabled and Running?
Check the Computer Management console and locate the Services node. Verify that Task Schedule service is enabled and running.
Symptom: Symptoms encountered in MPmsi.log when Task Scheduler is disabled:
Note: The line has been split into multiple lines for readability. However, while trying it out on a system you must enter it as one line without breaks.
<12-02-2004 16:51:56> Installing C:/SMS/bin/i386/ mp.msi CCMINSTALLDIR="C:/SMS_CCM" CCMSERVERDATAROOT= "C:/SMS" CCMENABLELOGGING=TRUE CCMLOGLEVEL=1 CCMLOGMAXSIZE=1000000 CCMLOGMAXHISTORY=1 <12-02-2004 16:54:27> Unknown error code: 452765 <12-02-2004 16:54:27> [16:54:27] @@ERR:25006 <12-02-2004 16:54:27> Setup was unable to create the Internet virtual directory CCM_Incoming The error code is 80041315 <12-02-2004 16:55:01> MP.MSI exited with return code: 1603 <12-02-2004 16:55:01> Backing up MPMSI.log to C:/SMS/logs/MPMSI.log.LastError <12-02-2004 16:55:01> Fatal MSI Error - MP.MSI could not be installed.
Is the Distributed Transaction Coordinator Service Running?
Verify that the Distributed Transaction Coordinator (DTC) is running. If the DTC is disabled, the MPSetup.log might contain the following errors:
Note: The line has been split into multiple lines for readability. However, while trying it out on a system you must enter it as one line without breaks.
<12-06-2004 10:34:04> ============================================= ====================== <12-06-2004 10:34:04> MP Setup Started.... <12-06-2004 10:34:04> Parameters: //COMPUTERNAME/ C$/SMS/bin/i386/MPsetup.exe /install /siteserver:SERVERNAME <12-06-2004 10:34:04> Installing the MP <12-06-2004 10:34:04> Passed OS version check. <12-06-2004 10:34:04> IIS Service is installed. <12-06-2004 10:34:04> No versions of MP are installed. Installing new MP. <12-06-2004 10:34:04> Enabling MSI logging. MP.MSI will log to C:/SMS/logs/MPMSI.log <12-06-2004 10:34:04> Installing C:/SMS/bin/i386/mp.msi CCMINSTALLDIR="C:/SMS_CCM" CCMSERVERDATAROOT="C:/SMS" CCMENABLELOGGING=TRUE CCMLOGLEVEL=1 CCMLOGMAXSIZE=1000000 CCMLOGMAXHISTORY=1 <12-06-2004 10:36:16> Unknown error code: 452765 <12-06-2004 10:36:16> [10:36:16] @@ERR:25006 <12-06-2004 10:36:16> Setup was unable to create the Internet virtual directory CCM_Incoming The error code is 80020009 <12-06-2004 10:36:42> MP.MSI exited with return code: 1603 <12-06-2004 10:36:42> Backing up MPMSI.log to C:/SMS/logs/MPMSI.log.LastError <12-06-2004 10:36:42> Fatal MSI Error - MP.MSI could not be installed.
Is the System Account of the Server Hosting the Management Point a Member of the SMS_SiteSystemToSQLConnection_<Sitecode> Group?
During installation of the management point, the computer account of the server hosting the management point is added to the group. If the management point does not have permission to add its computer account to the SMS_SiteSystemToSQLConnection_<SiteCode> group on the computer that is running SQL Server, status message 5414 is generated on the site server.
In addition, the following status message might be generated:
Note: Some of the lines in the following code have been displayed on multiple lines for better readability.
4908 - Site Component Manager could not add machine account "%1" to the SQL Access Group "%2"on the SQL Server machine "%3".
To resolve this problem, manually add the computer account of the management point computer to the SMS_SiteSystemToSQLConnection_<SiteCode> group on the computer that is running SQL Server. In the SMS Administrator console, remove and then re-install the management point. For more information about required permissions that a management point needs to add its computer account to the SMS_SiteSystemToSQLConnection_site code group, see article 829861 in the Microsoft Knowledge Base at http://go.microsoft.com/fwlink/?linkid=46668.
To verify that the computer account of the management point computer has adequate credentials to access the SMS site database, perform the following steps.
To verify that the management point computer account has adequate credentials
-
Install the SQL Server Client tools on the computer hosting the management point.
-
Log on to the computer hosting the management point with credentials equivalent to the SMS Service Account.
-
Click Start, and then click Run.
-
Type cmd, and then click OK.
If your SMS site is configured for standard security mode, skip the next step. If your SMS site is configured for advanced security mode, continue to the next step.
-
If your SMS site is configured for advanced security, open a command prompt window with LocalSystem account credentials. To do this, type the following at a command prompt and press ENTER:
AT FutureTime /interactive cmd
At the time that you specify, a new Command Prompt window opens that runs under the context of Svchost.exe.
Note
FutureTime is any time that is later than the current time, in 24-hour format. -
At a command prompt, type the following and press ENTER:
osql -S SQLServer -d SMSdbname -E
SQLServer is the name of the server that is running SQL Server. SMSdbname is the name of the SQL Server database for your SMS site (SMS site database).
If the command succeeds, your management point has the necessary permissions to access the SQL Server database. The command is successful if the 1> prompt is returned.
-
Type exit, and press ENTER to return to the command prompt. Continue to the next step if you receive the following error message:
Note: Some of the lines in the following code have been displayed on multiple lines for better readability.
Login failed for user '(null)'. Reason: Not associated with a trusted SQL Server connection.
-
If you received the "Login failed" error message in the previous step, repeat the command but use the Fully Qualified Domain Name (FQDN) of the server that is running SQL Server. For example, type the following:
osql -S SQLServer.europe.corp.microsoft.com -d SMSdbname -E
If the command does not succeed, review the DNS settings for the domain where the computer hosting the management point is located.
Have SQL Server Service Principle Name Attributes Been Configured?
The appropriate Service Principal Name (SPN) attributes may not be generated for the account that started the SQL services. To resolve this issue, you must manually create the fully qualified domain name (FQDN) and NetBIOS SPN entries. To do this, you can use the SetSPN utility from the Windows 2000 Server Resource Kit. You can download the SetSPN utility from the Microsoft Web site at http://go.microsoft.com/fwlink/?LinkId=46635.
You must run the SetSPN utility on a computer that resides in the SQL Server's domain, and you must use Domain Administrator credentials. Also, you need to determine whether the SQL services run as a domain account or as the local computer account. To use the SetSPN utility to manually create the appropriate SPNs, follow these steps:
-
Use the SetSPN utility when the SQL service is started with a user account.
-
To create the FQDN SPN at a command prompt window, type the following command: setspn -A MSSQLSvc/ SqlHostname.mydomain.com :1433 SqlServiceAccount .
-
-
Use the SetSPN utility when the SQL service is started with the SQL Server's System Account:
-
To create the FQDN SPN, type the following command at a command prompt: setspn -A MSSQLSvc/ SqlHostname.mydomain.com :1433 SqlHostname .
-
To create the NetBIOS SPN at the command window, type the following command: setspn -A MSSQLSvc/ SqlHostname :1433 SqlHostname .
-
For more information about problems that might exist with SQL Server SPN registration, see article 832109 in the Microsoft Knowledge Base at http://go.microsoft.com/fwlink/?LinkId=46639.
Have Kerberos Tickets Expired?
The Kerberos ticket cache might have to be reset. Use the Kerbtray tool from the Windows 2000 Server Resource Kit to clear the existing Kerberos ticket cache. You can download the Kerbtray tool from the Microsoft Web site at http://go.microsoft.com/fwlink/?LinkId=46641.
For more information about how to use the Kerbtray tool, see article 232179 in the Microsoft Knowledge Base at http://go.microsoft.com/fwlink/?LinkId=46642.
For more information about problems that might exist with Kerberos or the Domain Name System (DNS) protocol, see article 832109 in the Microsoft Knowledge Base at http://go.microsoft.com/fwlink/?LinkId=46639.
Does Kerberos Authentication Fail Between Client and Management Point When the Active Directory Has Not Been Extended?
If your site is in an Active Directory environment where the SMS 2003 installation has extended the Active Directory schema, Advanced Clients communicate with the management point by using the management point computer name. In this scenario, Kerberos authentication should work.
If your site is in an Active Directory environment where the SMS 2003 installation has not extended the Active Directory schema, clients communicate with the management point by using the IP address of the management point. In this scenario, Kerberos authentication might fail if there is no registered Service Principal Name (SPN) for the management point IP address. To fix this issue, you must register an SPN for the IP address of the SMS management point. To do so, use the Setspn.exe utility.
Does the Management Point MPLIST Command Return a Blank Screen?
From the SMS Advanced Client, run http://< managementpointname >/sms_mp.sms_aut?mplist. This should return a blank screen.
If a blank screen is not displayed and an error in the title bar appears, the client is unable to contact the management point successfully. In this case, the client does not receive policy and might not completely install all of its client components.
Check the MPcontrol.log file for errors. If the management point is operating correctly, entries similar to the following should be in the log:
Note: Some of the lines in the following code have been displayed on multiple lines for better readability.
Http verification .sms_aut succeeded with status code 200, OK SMS_MP_CONTROL_MANAGER 12/6/2004 5:25:06 PM 2008 (0x07D8) Http verification .sms_aut succeeded with status code 200, OK SMS_MP_CONTROL_MANAGER 12/6/2004 5:35:08 PM 2008 (0x07D8) Http verification .sms_aut succeeded with status code 200, OK SMS_MP_CONTROL_MANAGER 12/6/2004 5:45:08 PM 2008 (0x07D8)
You can test the mplist test URL with Internet Explorer. To bypass possible name resolution issues, substitute the site server name with the word localhost when testing this URL on the management point—for example, http://localhost/sms_mp.sms_aut?mplist.
Does the Management Point MPCERT Command Return a Long List of Letters and Numbers?
From an SMS Advanced Client, run http://< managementpointname >/sms_mp.sms_aut?mpcert. This command should return a long list of letters and numbers. If the command does not return these results, the client cannot communicate with the database and management point and further troubleshooting is required.
Have You Used the MPGetPolicy Tool?
The purpose of the MPGetPolicy tool is to determine whether the management point is functional and returning the policies. This tool is available in the SMS 2003 Toolkit 2. You can download Toolkit 2 from the Microsoft Web site at http://go.microsoft.com/fwlink/?linkid=25444. From an SMS Advanced Client, run the MPGetPolicy tool.
Is the SMS Agent Host Running on the Management Point?
When the WMI stops or is shut down, the SMS Agent Host (CCMexec) service is also stopped because the SMS Agent Host service is dependent on the WMI service. When the SMS Agent Host service is shut down, the SMS 2003 management point cannot respond to SMS 2003 client requests. For more information about WMI stopping or shutting down, see article 830016 in the Microsoft Knowledge Base at http://go.microsoft.com/fwlink/?linkid=46643.
Was the IIS Lockdown Tool Applied to the Site Server?
If yes, check the IIS.log file on the management point computer and look for an entry similar to the following:
Note: Some of the lines in the following code have been displayed on multiple lines for better readability.
DateTimeSourceIP - DestinationIPPortNumber GET /<Rejected-By-URLScan>~/ccm_system/request 404 ccmhttp
Notes
-
The IIS.log file is located in the %Windir%/System32/Logfiles/W3svc folder.
-
On management point computers, the SMS 2003 Advanced Client log files are located in the DriveLetter:/SMS_CCM/Logs folder. On all other computers, the SMS 2003 Advanced Client log files are located in the %Windir%/System32/CCM/Logs folder.
Cause: If the URLScan security tool is installed and an SMS 2003 Toolkit 2 URLScan template is not applied, Advanced Clients are prevented from installing.
Workaround: Apply an SMS 2003 Toolkit 2 URLScan template to any computer that has SMS 2003 installed and that uses the URLScan security tool. To do this, obtain and install SMS 2003 Toolkit 2.
You can download SMS 2003 Toolkit 2 from the Microsoft Web site at http://go.microsoft.com/fwlink/?linkid=25444. For information about how to apply an SMS 2003 Toolkit 2 URLScan template, see the SMS 2003 Toolkit 2 documentation that is installed with the toolkit.
For more information about the URLScan security tool being installed when an SMS 2003 Toolkit 2 URLScan template is not applied, see article 888936 in the Microsoft Knowledge Base article at http://go.microsoft.com/fwlink/?LinkId=46645.
Was Express Setup Used to Install SMS 2003?
When the Express Setup option is used to install an SMS 2003 site server, Setup automatically configures the site server as a management point but not as the default management point for the site. To resolve this issue, you can manually designate the server as the default management point for the site.
To designate the server as the default management point
-
In the SMS Administrator console, navigate to Component Configuration.
Systems Management Server ( Site Database (site code - site name) ( Site Hierarchy ( <site code - site name> ( Site Settings ( Component Configuration
-
In the details pane, right-click Management Point, and then click Properties.
-
On the General tab, click Management Point.
-
On the Server name drop-down list, select the site server and click OK.
For more information about Express Setup not setting the default management point, see article 830616 in the Microsoft Knowledge Base at http://go.microsoft.com/fwlink/?linkid=46647.
Installation Verification Using Windows Audit Process Tracking
If your site uses Active Directory, you can enable the process tracking policy on the site server to verify the process start sequence outlined in the following procedure.
To enable process tracking on a Windows member server
-
In the Group Policy Object Editor, navigate to Audit Policy.
Local Computer Policy ( Windows Settings ( Security Settings ( Local Policies ( Audit Policy
In the details pane, right-click Audit process tracking and select both Success and Failure.
After process tracking is enabled, the following process tracking events occur when a management point is installed:
-
Service.exe starts SMSExec.exe.
-
The Site Component Manager calls on Services.exe to start the bootstrap service.
-
Services.exe starts Srvboot.exe.
-
Srvboot.exe starts MPsetup.exe. When MPsetup.exe is started, it calls MSIExec.exe. At this point, MSIExec.exe installs the BITS 1.5 Server service by calling BITS_V15_Server_Setup.exe, which in turn starts BITSSetup_Srv_Installer.exe.
-
After the BITS installer is started, it forces an iteration of IISreset.exe. Svchost.exe runs IISRstas.exe.
-
Services.exe restarts Inetinfo.exe.
-
When IIS has been restarted, MSIExec starts several different instances of MSIExec, possibly up to three instances.
-
Services.exe starts Winmgmt.exe, which starts another iteration of Winmgmt.exe.
-
MSIExec starts rundll32.exe.
-
Winmgmt.exe starts another iteration of Winmgmt.exe.
-
A separate iteration of MSIEexec starts another instance of Rundll32.exe.
-
Services.exe starts CCMExec.exe.
-
Services.exe starts a new instance of Srvboot.exe, which is used to start Regfile.exe.
-
Svchost starts Dllhost.
-
Installation of the management point is complete.
Management Point Installation Walkthrough
You can use the following detailed walkthrough to see what occurs when a management point is successfully installed:
-
The SMS Administrator designates a new site system as a management point in the Site System Properties dialog box in the SMS Administrator console.
-
The Site Component Manager performs the following actions:
-
When the Site Component Manager is notified that a site system role, in this case a management point, has been assigned to a server, it records the details in the SiteComp.log file, such as the following:
Note: Some of the lines in the following code have been displayed on multiple lines for better readability.
Assigned the "SMS Component Server" role to server MGTPOINT1.SMS_SITE_COMPONENT_MANAGER 12/6/2004 1:21:35 PM 1700 (0x06A4) Synchronizing component server SERVER1... SMS_SITE_COMPONENT_MANAGER 12/6/2004 1:21:35 PM 1700 (0x06A4) Synchronization complete. SMS_SITE_COMPONENT_MANAGER 12/6/2004 1:21:36 PM 1700 (0x06A4) Synchronizing component server MGTPOINT1... SMS_SITE_COMPONENT_MANAGER 12/6/2004 1:21:36 PM 1700 (0x06A4) Component SMS_MP_CONTROL_MANAGER flagged for installation. SMS_SITE_COMPONENT_MANAGER 12/6/2004 1:21:36 PM 1700 (0x06A4)
-
Review the Component Status messages for the server on which the management point is being installed. Status message 1013 should be present and should resemble the following sample:
Note: The line has been split into multiple lines for readability. However, while trying it out on a system you must enter it as one line without breaks.
SMS Site Component Manager detected that this component should be installed on this site system. SMS Site Component Manager will attempt to install the component every 60 minutes until the installation succeeds.
This is normally followed by status messages 1014 and 1015, indicating that the management point is being installed and that the management point was installed, respectively. If status message 1015 is not present after 10–15 minutes, this could indicate that the installation of the management point has failed. Error status messages detailing possible causes should be evident in place of status message 1015.
For more information about status messages contained in this section and elsewhere in this document, review the Status Messages section.
-
-
Site Component Manager polls all of the site server’s components to verify they are running. When the site server components have been verified as installed, Site Component Manager begins installing the management point on the site system that will host the management point role. Reviewing Sitecomp.log reveals that the Site Component Manager performs the following actions during management point installation:
Note: The line has been split into multiple lines for readability. However, while trying it out on a system you must enter it as one line without breaks.
Installing server... SMS_SITE_COMPONENT_MANAGER 12/6/2004 1:21:37 PM 1700 (0x06A4) Attempting to obtain an IAbstractNetwork interface from NAL... SMS_SITE_COMPONENT_MANAGER 12/6/2004 1:21:37 PM 1700 (0x06A4) Successfully obtained the IAbstractNetwork interface. SMS_SITE_COMPONENT_MANAGER 12/6/2004 1:21:37 PM 1700 (0x06A4) Attempting to call IAbstractNetwork::CreatePath() with NAL path "MSWNET://MGTPOINT1/admin$/"... SMS_SITE_COMPONENT_MANAGER 12/6/2004 1:21:37 PM 1700 (0x06A4) Successfully called IAbstractNetwork::CreatePath() with NAL path "MSWNET://MGTPOINT1/admin$/". SMS_SITE_COMPONENT_MANAGER 12/6/2004 1:21:37 PM 1700 (0x06A4) Attempting to obtain an INetworkObject interface from NAL for this server... SMS_SITE_COMPONENT_MANAGER 12/6/2004 1:21:37 PM 1700 (0x06A4) Successfully obtained the INetworkObject interface. SMS_SITE_COMPONENT_MANAGER 12/6/2004 1:21:37 PM 1700 (0x06A4) Testing connectivity to this server using NAL INetworkObject::IsAccessible()... SMS_SITE_COMPONENT_MANAGER 12/6/2004 1:21:37 PM 1700 (0x06A4) NAL INetworkObject::IsAccessible() succeeded. The server is accessible. SMS_SITE_COMPONENT_MANAGER 12/6/2004 1:21:37 PM 1700 (0x06A4) Server's platform type is X86. SMS_SITE_COMPONENT_MANAGER 12/6/2004 1:21:37 PM 1700 (0x06A4) Server is running Microsoft Windows NT Server 5.0 Service Pack 4. SMS_SITE_COMPONENT_MANAGER 12/6/2004 1:21:37 PM 1700 (0x06A4) Checking if the SMS installation directory exists. SMS_SITE_COMPONENT_MANAGER 12/6/2004 1:21:37 PM 1700 (0x06A4) Attempting to create the SMS installation directory.SMS_SITE_COMPONENT_MANAGER 12/6/2004 1:21:37 PM 1700 (0x06A4) Attempting to find the best drive for the SMS installation directory on server 'MGTPOINT1'. SMS_SITE_COMPONENT_MANAGER 12/6/2004 1:21:37 PM 1700 (0x06A4) Enumerating drives A through Z for the NTFS drive with the most free space. SMS_SITE_COMPONENT_MANAGER 12/6/2004 1:21:37 PM 1700 (0x06A4) Attempting to connect to install drive ' //MGTPOINT1/A$/'. SMS_SITE_COMPONENT_MANAGER 12/6/2004 1:21:37 PM 1700 (0x06A4) Testing connectivity to this path using NAL INetworkObject::IsAccessible()... SMS_SITE_COMPONENT_MANAGER 12/6/2004 1:21:37 PM 1700 (0x06A4)
-
Site Component Manager then attempts to connect to all drive letters, A$ though Z$ on the target management point. It does this to mount all possible drives on the target management point to determine available free space on all possible volumes:
Note: The line has been split into multiple lines for readability. However, while trying it out on a system you must enter it as one line without breaks.
Attempting to connect to install drive ' //MGTPOINT1/N$/'. SMS_SITE_COMPONENT_MANAGER Testing connectivity to this path using NAL INetworkObject::IsAccessible(). SMS_SITE_COMPONENT_MANAGER ERROR: NAL failed to access NAL path 'MSWNET: //MGTPOINT1/N$/', probably because the machine is down, the network is down,or the Site System Connection Accounts are misconfigured. NAL INetworkObject::IsAccessible() returned 0x80070043: The operation completed successfully. SMS_SITE_COMPONENT_MANAGER Attempting to connect to install drive '//MGTPOINT1/O$/'.SMS_SITE_COMPONENT_MANAGER Testing connectivity to this path using NAL INetworkObject::IsAccessible()... SMS_SITE_COMPONENT_MANAGER ERROR: NAL failed to access NAL path 'MSWNET: //MGTPOINT1/O$/', probably because the machine is down, the network is down, or the Site System Connection Accounts are misconfigured. NAL INetworkObject::IsAccessible()returned 0x80070043: The operation completed successfully. SMS_SITE_COMPONENT_MANAGER
-
When all drives are enumerated, Site Component Manager determines the partition on which to install the management point:
Note: The line has been split into multiple lines for readability. However, while trying it out on a system you must enter it as one line without breaks.
Drive 'C:/' is the best drive for the SMS installation directory. SMS_SITE_COMPONENT_MANAGER There is not a connection to the install drive.SMS_SITE_COMPONENT_MANAGER Attempting to connect to install drive '//MGTPOINT1/C$/'. SMS_SITE_COMPONENT_MANAGER Testing connectivity to this path using NAL INetworkObject::IsAccessible()... SMS_SITE_COMPONENT_MANAGER NAL INetworkObject:: IsAccessible() succeeded. SMS_SITE_COMPONENT_MANAGER Making this new connection the current install driveconnection. SMS_SITE_COMPONENT_MANAGER The install drive path is accessible. SMS_SITE_COMPONENT_MANAGER Successfully created and to set permissions on the SMS installation directory. SMS_SITE_COMPONENT_MANAGER. Created SMS installation directory C:/SMS. SMS_SITE_COMPONENT_MANAGER Wrote HKEY_LOCAL_MACHINE /SOFTWARE/Microsoft/ SMS/ Identification keyto server's registry. SMS_SITE_COMPONENT_MANAGER Wrote HKEY_LOCAL_MACHINE /SOFTWARE/Microsoft/ SMS/ Tracing key to server's registry. SMS_SITE_COMPONENT_MANAGER Installation complete. SMS_SITE_COMPONENT_MANAGER
-
Site Component Manager connects to the C:/ drive in this case, creates the C:/SMS directory, and writes the Identification and Tracing keys to the server’s registry, as indicated in the previous log sample.
-
The management point setup files are copied from the site server by Site Component Manager to the site system in the /SMS/bin/i386 directory, including the following:
-
Baseobj.dll
-
Basesql.dll
-
Basesvr.dll
-
Baseutil.dll
-
Dumpexcp.exe
-
Mp.msi
-
Mpcontrol.dll
-
Mpfdm.dll
-
Mpsetup.exe
-
Ntcrypto.dll
-
Regfile.exe
-
Sms1x.dll
-
Smsexec.dll
-
Smsexecd.exe
-
Smssvreh.dll
-
Smsunzip.dll
-
Smszip.dll
-
Srvboot.exe
And also /SMS/bin/i386/00000409/baserc.dll
-
-
You can view the file copy status in the Sitecomp.log file, similar to the following example:
Note: Some of the lines in the following code have been displayed on multiple lines for better readability.
12196017 bytes are required for this component's files.SMS_SITE_COMPONENT_MANAGER Installed file //MGTPOINT1/C$/SMS/bin /i386smsexec.exe.SMS_SITE_COMPONENT_MANAGER Installed file //MGTPOINT1/C$/SMS/bin/i386 /baseutil.dll.SMS_SITE_COMPONENT_MANAGER Installed file //MGTPOINT1/C$/SMS/bin/i386 /smssvreh.dll.SMS_SITE_COMPONENT_MANAGER Installed file //MGTPOINT1/C$/SMS/bin/i386 /dumpexcp.exe.SMS_SITE_COMPONENT_MANAGER Installed file //MGTPOINT1/C$/SMS/bin/i386 /baseobj.dll.SMS_SITE_COMPONENT_MANAGER Installed file //MGTPOINT1/C$/SMS/bin/i386 /basesql.dll.SMS_SITE_COMPONENT_MANAGER Installed file //MGTPOINT1/C$/SMS/bin/i386 /basesvr.dll.SMS_SITE_COMPONENT_MANAGER Installed file //MGTPOINT1/C$/SMS/bin/i386 /ntcrypto.dll.SMS_SITE_COMPONENT_MANAGER Installed file //MGTPOINT1/C$/SMS/bin/i386 /sms1x.dll.SMS_SITE_COMPONENT_MANAGER Installed file //MGTPOINT1/C$/SMS/bin/i386 /smszip.dll.SMS_SITE_COMPONENT_MANAGER Installed file //MGTPOINT1/C$/SMS/bin/i386 /smsunzip.dll.SMS_SITE_COMPONENT_MANAGER Installed file //MGTPOINT1/C$/SMS/bin/i386/ srvboot.exe.SMS_SITE_COMPONENT_MANAGER Installed file //MGTPOINT1/C$/SMS/bin/i386 /smsexecd.exe.SMS_SITE_COMPONENT_MANAGER Installed file //MGTPOINT1/C$/SMS/bin/i386/ 00000409/baserc.dll.SMS_SITE_COMPONENT_MANAGER Installed file //MGTPOINT1/ADMIN$/system32/ smsmsgs/srvmsgs.cmd.SMS_SITE_COMPONENT_MANAGER Installed file //MGTPOINT1/ADMIN$/system32/ smsmsgs/climsgs.cmd.SMS_SITE_COMPONENT_MANAGER Installed file //MGTPOINT1/ADMIN$/system32/smsmsgs /provmsgs.cmd.SMS_SITE_COMPONENT_MANAGER All files installed. SMS_SITE_COMPONENT_MANAGER
-
Site Component Manager then attempts to add the computer account of the site system hosting the management point to the SMS_SiteSystemToSQLConnection_<SiteCode> group. If it fails to add the account to the SQL Server connection group, status message 4908 is generated.
-
Site Component Manager uses the Server Message Block protocol to connect to the Remote Registry Service on the prospective management point. Site Component Manager installs the bootstrap service, srvboot.exe, and then uses the remote registry service to make an RPC call to start it. Log times have been removed for ease of reading. Typically the setup process does not exceed 10 minutes. Output similar to the following appears in SiteComp.log:
Note: The line has been split into multiple lines for readability. However, while trying it out on a system you must enter it as one line without breaks.
Starting bootstrap operations... SMS_SITE_COMPONENT_MANAGER Installed service SMS_SERVER_BOOTSTRAP_SERVER1. SMS_SITE_COMPONENT_MANAGER Starting service SMS_SERVER_BOOTSTRAP_SERVER1 with command-line arguments"GTB C:/SMS /install //MGTPOINT1/ADMIN$/system32/smsmsgs/srvmsgs.cmd"... SMS_SITE_COMPONENT_MANAGER "//MGTPOINT1/ADMIN$/system32/smsmsgs/srvmsgs.cmd /install/siteserver:SERVER1" executed successfully on server MGTPOINT1. SMS_SITE_COMPONENT_MANAGER
-
Bootstrap calls the MPSetup.exe where the check for IIS is made, as is noted in the MPsetup.log file:
Note: The line has been split into multiple lines for readability. However, while trying it out on a system you must enter it as one line without breaks.
<12-06-2004 15:35:41> ============================================= ======================= <12-06-2004 15:35:41> MP Setup Started.... <12-06-2004 15:35:41> Parameters: //MGTPOINT1 /C$/SMS/bin/i386/MPsetup.exe/install /siteserver: SERVER1 <12-06-2004 15:35:41> Installing the MP <12-06-2004 15:35:41> Passed OS version check. <12-06-2004 15:35:41> IIS Service is installed. <12-06-2004 15:35:41> No versions of MP are installed.Installing new MP. <12-06-2004 15:35:41> Enabling MSI logging. MP.MSI will log to C:/SMS/logs/MPMSI.log <12-06-2004 15:35:41> Installing C:/SMS /bin/i386/mp.msi CCMINSTALLDIR="C:/SMS_CCM" CCMSERVERDATAROOT= "C:/SMS" CCMENABLELOGGING=TRUECCMLOGLEVEL=1 CCMLOGMAXSIZE=1000000 CCMLOGMAXHISTORY=1
-
If the site system has the Advanced Client installed, the installation directory is set to %windir%/System32/CCM. If the Advanced Client is not installed, the installation directory is set to the SMS_CCM folder on the SMS installation drive.
-
MP.msi checks the following items:
-
Is a management point already installed with a later version?
If yes, an error is logged and the setup process stops.
-
Is there at least 70 MB of free disk space?
If not, an error is logged and the setup process stops.
-
Do the IUSR_<ComputerName> and IWAM_<ComputerName> user accounts exist?
If not, an error is logged and the setup process stops.
-
Are BITS Server Extensions installed?
If not, an operating system version check occurs. If the operating system is Windows 2000 Server and the BITS Server Extensions are not installed, MP.msi installs the required hotfixes and then installs the BITS Server Extensions.
If not, and the operating system is Windows Server 2003, MP.msi logs an error and stops the installation process.
If BITS Server Extensions are installed, a check is made to verify that the proper BITS hotfixes are installed. If they are not installed, MP.msi installs them.
-
MP.msi checks to make sure MSXML is installed. If it is not installed, MP.msi installs it.
-
-
MP.msi also performs the following actions:
-
Creates the WMI namespaces
-
Compiles MOF files into WMI namespaces
-
Creates the following IIS virtual directories:
CCM_Incoming
CCM_Outgoing
CCM_System
SMS_MP
-
If the server hosting the management point is running Windows Server 2003, MP.msi creates the following IIS application pools:
CCM Server Framework
SMS Management Point
-
MP.msi then registers the following System Monitor performance objects:
SMS-MP
CCM
-
MP.msi installs CCMEXEC.EXE (the SMS Agent Host), initializes default policies, starts the SMS Agent Host, and writes the results to MPMSI.log.
-
Upon completion, MP.msi exits and reports success or failure to MPSetup.exe.
-
-
MPSetup.exe receives the exit code from MP.MSI and logs the following entry:
Note: Some of the lines in the following code have been displayed on multiple lines for better readability.
<12-06-2004 15:43:41> MP.MSI exited with return code: 0 <12-06-2004 15:43:41>Installation was successful.
An MP.msi return code of 0 indicates that MP.msi completed successfully. Codes other than 0 in the MPSetup.log indicate installation failure.
-
Site Component Manager logs the successful installation, similar to the following:
Note: The line has been split into multiple lines for readability. However, while trying it out on a system you must enter it as one line without breaks.
Bootstrap operation successful. SMS_SITE_COMPONENT_MANAGER Starting service SMS_SERVER_BOOTSTRAP_SERVER1 with command-line arguments "GTB C:/SMS /install //MGTPOINT1/ADMIN$/system32/smsmsgs/ climsgs.cmd"... SMS_SITE_COMPONENT_MANAGER "//MGTPOINT1/ADMIN$/system32/smsmsgs/ climsgs.cmd/install/siteserver:SERVER1" executed successfully on server MGTPOINT1. SMS_SITE_COMPONENT_MANAGER Bootstrap operation successful. SMS_SITE_COMPONENT_MANAGER Starting service SMS_SERVER_BOOTSTRAP_SERVER1 with command-line arguments "GTB C:/SMS /install //MGTPOINT1/ADMIN$/system32/smsmsgs/provmsgs.cmd"... SMS_SITE_COMPONENT_MANAGER "//MGTPOINT1/ADMIN$/system32/smsmsgs/provmsgs.cmd /install /siteserver:SERVER1" executed successfully on server MGTPOINT1. SMS_SITE_COMPONENT_MANAGER Bootstrap operation successful. SMS_SITE_COMPONENT_MANAGER Deinstalled service SMS_SERVER_BOOTSTRAP_SERVER1. SMS_SITE_COMPONENT_MANAGER Bootstrap operations completed. SMS_SITE_COMPONENT_MANAGER Installed the performance counters. SMS_SITE_COMPONENT_MANAGER Installed as autostarting service SMS_EXECUTIVE. SMS_SITE_COMPONENT_MANAGER Started. SMS_SITE_COMPONENT_MANAGER Installation successful. SMS_SITE_COMPONENT_MANAGER 12/6/2004 3:35:36 PM 1640 (0x0668)
The SMS 2003 Toolkit 2, available from the Microsoft Web site at http://go.microsoft.com/fwlink/?linkid=25444, contains downloadable tools to help you deploy and troubleshoot SMS 2003. The following tools in SMS 2003 Toolkit 2 are especially useful when you troubleshoot management points.
On This Page
SMS Trace
Management Point Troubleshooter
Management Point Spy
SMS Trace
SMS Trace allows you to view and monitor all SMS log files, including log files in SMS or CCM format and plain ASCII or Unicode text files, such as Windows Installer logs. The tool also simplifies reading and helps you analyze log files by highlighting, filtering, and performing error lookups.
Management Point Troubleshooter
The Management Point Troubleshooter is a tool that checks a computer system before and after a management point installation to help ensure that the installation meets the requirements for management points. The tool indicates whether numerous management point dependencies, which are not obvious during installation, are met. The tool runs a number of tests to help ensure that the management point will run. You can use the tool to run numerous tests after a management point is installed to help ensure that the management point is operational.
The results of the tests are straightforward, indicating any action you must take to help ensure that the management point functions properly. For example, assume that you have recently upgraded from Windows 2000 Server to Windows Server 2003 on the computer where the management point is installed and that, subsequently, your Advanced Clients do not operate properly. In this case, the Default Web site is stopped by default and the management point is not functional. Running the tool would indicate that the Default Web site is disabled.
Management Point Spy
Management Point Spy verifies that a management point is functional and is returning policies. The tool connects with the SMS site database, retrieves all policies, and then displays them with policy versions. The tool also sends HTTP requests to the management point to view the policy. The management point can also be queried for the management point certificate.
2万+
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
