Internet explorer 11 deployment issues and few solution step

I know this blog is the old one but hope it will help someone. Microsoft released IE11 on 06-11-2013 and till now most of the organization on their way to deploy it.

Therefore I am trying to list down some of the issues and steps to resolve it.

• First of all, Microsoft has already released deployment tool kit for IE11. Link
• Second there is a log file for checking the deployment issues which is I have always preferred IE11_main.log (typically c:\windows). Other log files are link.

Most of the time found an issue with prerequisite failure (based on log IE11_main.log) 

~Version Check for (KB2834140) of C:\WINDOWS\System32\d3d11.dll: 6.1.7601.17514 >= 6.2.9200.16570 (False)

~Version Check for (KB2882822) of C:\WINDOWS\System32\tdh.dll: 6.1.7600.16385 >= 6.1.7601.18247 (False)

And after that if we integrate this to script / admin kits then it will success.

Here is few prerequisite for IE11

KB2834140, KB2670838, KB2639308, KB2533623, KB2731771, KB2729094, KB2786081, KB2888049, KB2882822

Message ID: 4912 Configuration Manager cannot update the already existing object "SMS-Site-SXX" in Active Directory (XXX.XXX)

Error in component SMS_HIERARCHY_MANAGER

Possible cause: The site server's machine account may not have full control rights for the "System Management" container in Active Directory
Solution: Give the site server's machine account full control rights to the "System Management" container, and all child objects in Active Directory.

Possible cause: The Active Directory object "SMS-Site-S15" has been moved to a location outside of the "System Management" container, or has been lost.
Solution: Delete the object from its current location, and let the site create a new object.

Possible cause: The Active Directory schema has not been extended with the correct ConfigMgr Active Directory classes and attributes.
Solution: Turn off Active Directory publishing for each site in the forest, until the schema can be extended.  The schema can be extended with the tool "extadsch.exe" from the installation media.

Solution which is worked for me :

1. Open Active Directory Users and Computers.
2. Click View and select Advanced Features.
3. Expand your site->System->System Management and select Properties.
4. On the System Management Properties dialog box select the Security Tab
5. Click Add.. on the Security Tab
6. Click the Object Type->check Computers->click OK
7. Type in the computer’s name and click OK
8. Check Full Control on the Security Permissions for your SCCM machine
9. Click the Advanced button->select the computer account->click Edit
10. Select This object and all descendant objects in the Applies to section and click OK
11. Restart the SMS_SITE_COMPONENT_MANAGER and service on defective server.

OR

If above mentioned settings are already there then just simply delete the instance (i.e.SMS-MP-S15-XXX.XXX ) from System Management folder. 

Help link : https://technet.microsoft.com/en-us/library/bb633169.aspx

Download fail for Adobe product-SCUP issue

I just faced this problem in one of my customer project. And not found any relevant solution. Then I decided to raise this in Tech Net forum.

Hope the solution will help you guys.

Problem logged in Tech Net.

Solution :

First of all as always need to check log file. But there are trick here SCUP log location is different .

SCUP.log --> C:\Users\ABC\AppData\Local\Temp  (Replace ABC with your current log on user)

Pactchdownloader.log --> c:\users\%username%\appdata\local\temp' 

Patchdownloader log says that HttpSendRequest failed HTTP_STATUS_NOT_FOUND , seems like its a IIS issue.

So my first attempt now to dig into IIS . 

1. Open inetmgr from effected server using run command.(use my admin credential here)

2. Then expand the server node.

3. Next Sites and expand WSUS Administration 

4. Next R/c on Content folder and try to browse it. (on a effected server its showing you the error in IE HTTP 403). 

5. Now again click on Content folder(this time click means left buton). And right side double click on Handler Mappings.

6. In Action panel on right side open Edit feature Permission and select which is relevant (my case I will select all).

7. Next go to WSUS Administration home page and choose Directory Browsing . Below screen will show you the details.

8. Now again go to step 4 and try to browse the content folder.

9. At last reset the IIS and try to download the adobe update from CM2012 again.

I have tried this with my Adobe product but may be helpful for other product as well.

SCCM 2012 Client Package waiting for prestaged content

During DP installation on CM 2012 some of my friends are getting this error like “Distribution Manager is waiting for Package XXX00001 content to be prestaged on the distribution point” in DP details view .isn’t it ?

So where is the issue then, very strange...? Think about package distribution in SCCM 2007 there is error in package source version mismatch right! 

This error is quite similar in CM 2012 and in troubleshooting of this part which I have noticed just redistribute the package again or the last option update the DP which is strongly prohibited in all DP’s infrastructure.

Please see below the screenshot hope it will help.

1. First of all check the DP is having Prestage option enable or not. If yes then disable it for short term.

2. Now locate the package and redistribute the package.

And the last option is update the DP, which is update the all DP (might be a bad suggestion)

WSUS database error 'RESET SERVER NODE'

Number of times we faced this issue, but sometimes it works and sometimes not. So today I spent lots of time on this issue. and after that I logged a call to MS.  They just digging into this and provide us the way which solved our problem. Hope this solution will help you most of the colleagues.

Problem: when I am going to run server cleanup wizard after few minutes showing error like above.

Solution: 

1. On the box first of all install SQL mgmt studio express edition (we have tried to connect it from a remote but no luck). 
2. Then connect the SUSDB (as per my box the location is \\.\pipe\MSSQL$MICROSOFT##SSEE\sql\query)
3. Next run this below query.

DECLARE @var1 INT

DECLARE @msg nvarchar(100)

CREATE TABLE #results (Col1 INT)

INSERT INTO #results(Col1) EXEC spGetObsoleteUpdatesToCleanup

DECLARE WC Cursor

FOR

SELECT Col1 FROM #results

OPEN WC

FETCH NEXT FROM WC

INTO @var1

WHILE (@@FETCH_STATUS > -1)

BEGIN SET @msg = 'Deleting ' + CONVERT(varchar(10), @var1)

RAISERROR(@msg,0,1) WITH NOWAIT EXEC spDeleteUpdate @localUpdateID=@var1

FETCH NEXT FROM WC INTO @var1 END

CLOSE WC

DEALLOCATE WC

DROP TABLE #results

4. Next execute this exec spGetObsoleteUpdatesToCleanup

5.  Last again try to run server cleanup wizard.

Note: Before trying it on the Production, recommended to try it on test first.

Failed to create instance of Microsoft.SystemsManagementServer.WSUS.WSUSServer. error = The parameter is incorrect

Today I have faced one issue with my running WSUS behave likToday I have faced one issue with my running WSUS behave like its not working properly. So as always first point to check is wsusctrl.log and the error is "Failed to create an instance of Microsoft.SystemsManagementServer.WSUS.WSUSServer. error = The parameter is incorrect"

I have checked the other log like wcm.log and found that "Failed to create an instance of Microsoft.SystemsManagementServer.WSUS.WSUSServer. error = The parameter is incorrect...............remote configuration failed at the WSUS server."

As you can see the log properly the error comes after verify the .dll version. After googling found a similar kb and reference blog which is indicating the same thing. 

Solution : 

1.      Open a CMD with elevated privilege window and go to c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\

2.    Then put the below commands in cmd for re-registering the WSUS .dll files   

• RegAsm.exe C:\Program Files\Microsoft Configuration Manager\bin\i386\wsyncact.dll /unregister 

• RegAsm.exe C:\Program Files\Microsoft Configuration Manager\bin\i386\wsyncact.dll 

• RegAsm.exe C:\Program Files\Microsoft Configuration Manager\bin\i386\wsusmsp.dll /unregister 

• RegAsm.exe C:\Program Files\Microsoft Configuration Manager\bin\i386\wsusmsp.dll 

     The above commands register the                              Microsoft.SystemsManagementServer.SoftwareUpdatesManagement.WSyncAction.WSyncAction  class     and the Microsoft.SystemsManagementServer.WSUS.WSUSServer class successfully. 

You can verify the settings after that which is also mentioned by MS.

Run Regedit.exe and verify that the following registry keys exist: 

• HKEY_CLASSES_ROOT\Microsoft.SystemsManagementServer.SoftwareUpdatesManagement.WSyncAction.WSyncAction 
• HKEY_CLASSES_ROOT\CLSID\{E5272449-2083-4020-ACEE-18A145F79A75} 

At last run, the WSUS sync again and check the log file.

Help link: http://support.microsoft.com/kb/962224

http://pratik-pawar.blogspot.co.uk/2014/05/failed-to-create-instance-of.html 

Creation of SCUP 2011 certificate manually

How to Create SCUP 2011 Certificate Manually.

By default first time, after SCUP install there is a create button in Option tab to create the certificate. But sometime we have faced issue that, we are not able to create the certificate .And that time the below mentioned procedure help you to create the SCUP certificate and attach the cert click on browse button.

Hope this procedure makes you happy J

My environment : Windows 2012 , SCUP 2011 , WSUS and SCCM 2012 (all in one server)

1. Open Certification authority console from administrative tool and connect the CA machine.
2. Expand certification authority (CA) machine, and then click Certificate Templates. 
3. Next right-click on Certificate Templates and click on Manage.
4. Now on the right hand side in template display name section find Code Signing certificate.
5. R/c on it and choose duplicate template.
6. Next find the screenshot below and create the certificate.

 

 

 

 

 

 

 

 

 

 

Rest of the setting leave default.

 

7. Now go to the machine where SCUP installed and

    Open MMC.exe console->File ->Add/remove snapin ->Certificate->my user account-> Finish.

    Now expand Certificates - Current User ->R/c on Personal -> all tasks -> Request new certificate-     Next -> Next -> Choose your certificate -> then click Enroll.

 

8. After enroll succeed check the new certificate under Certificates - Current User -> Personal -    > Certificates.

 

9. Next option is to export this certificate from the above location but using two option.

• Using private key (for using in SCUP ):

 

 

•  Without private key (For Client): Same procedure but except this step.

 

 

 10. Now add the .cert file in Trusted Publisher and Trusted Root Certificate Authorities  (follow the above 7 and 8 step.)

 

At last using the private key certificate (.pfx file) , add this to SCUP certificate option.

 

 

Help link : http://blogs.technet.com/b/jasonlewis/archive/2011/07/12/system-center-updates-publisher-signing-certificate-requirements-amp-step-by-step-guide.aspx