SCCM 0x87d00215

Question

Hello Everyone

I know this question has been asked on this forum multiple times, but I could not find any solution to my problem for this.

Recently I have added a new CA server to my environment, decommissioning the old one.

I used the following video to create necessary certificate for PKI certificate assignment:
https://www.youtube.com/watch?v=nChKKM9APAQ&ab_channel=PatchMyPC

However, after deploying updates, I noticed some devices are not getting updates and I see the error (0x87d00215) in multiple logs (CCMExec, Updates Deployment).

WUHandler shows not problem.

The problem is its only happening to some computers and not all . I tired reinstalling the client multiple times, using parameters, pushing it through SCCM console with no luck.

Any help is appreciated as someone else might have this problem as well

Answer 1

Sorry for the late reply

I was wrapping things up to come up with a final solution

So here are the steps I took to resolve my issue:

1 - Delete the old cert manually from problematic devices (and later from non-problematic devices to be on the safe side)

2 - Do as @AllenLiu-MSFT mentioned:

1. Stop the Windows Update service by running the following command: net stop wuauserv
2. Rename the C:\Windows\SoftwareDistribution folder to C:\Windows\SoftwareDistribution.old.
3. Start the Windows Update service by running the following command: net start wuauserv

3 - Reinstall the client by pushing it from the site server and checking (Uninstall current SCCM client)

Thank you @AllenLiu-MSFT , your note definitely helped

Answer 2

We're glad the problem is solved now.

Answer 3

Hi, @Anthony Vand

Thank you for posting in Microsoft Q&A forum.

Since the issue is only happening on some computers, it could be related to the certificate configuration on those specific devices. I would recommend checking the certificate configuration on the affected devices to ensure that they are using the correct certificate and that it is properly installed.

Additionally, you could try resetting the Windows Update Agent data store on the affected devices by following these steps:

1. Stop the Windows Update service by running the following command: net stop wuauserv
2. Rename the C:\Windows\SoftwareDistribution folder to C:\Windows\SoftwareDistribution.old.
3. Start the Windows Update service by running the following command: net start wuauserv
4. Start a software update scan cycle.

And what type of boundaries are you using? Is it Ip ranges only?

---

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Add comment".

Answer 4

I know this post is 2yrs old, but can you all share where you looked for the certificate at? In the target/client device's Personal Store? Is/was it the sccm cert or a self-named cert for the target/client?

Thanks!