SCCM - Build and Capture - Application installation while on PKI for workgroup clients not working

Question

Hello,

I'm trying to do a Build and Capture task sequence but the TS always fail at the Install Application step. This step works when the client join the domain but not on workgroup.

I already checked many forums but I'm not able to find a solution.

I found errors in the LocationService.log, it seems that the problem is because the clients don't have a certificate. I don't know how to import the certificate for workgroup clients in Build and Capture TS and if it is what I need to do.

[CCMHTTP] ERROR: URL=https://FQDN_TO_SERVER/SMS_MP/.sms_aut?SITESIGNCERT, Port=0, Options=31, Code=0, Text=CCM_E_NO_CLIENT_PKI_CERT
[CCMHTTP] ERROR INFO: StatusCode=<unknown> StatusText=

I use the following parameters to install the SCCM Client : SMSCACHESIZE=10240 SMSMP=FQDN /UsePKICert /NoCRLCheck CCMHTTPSSTATE=31 DNSSUFFIX=DOMAIN

Can you help me on this ?

Do you need to see a specific log ?

Answer 1

Are you using boot media or PXE for this?

Directly using CCMHTTPSSTATE is unsupported.

Answer 2

As noted, no, manually specifying CCMHTTPSSTATE is unsupported.

On the PXE enabled DP, is there a valid PKI-issued, client auth certificate configured as part of the DPs configuration?

Answer 3

Hello Jason,

I'm currently using PXE.

Is it not supported on Boot Media or PXE ?

Answer 4

Yes, I think that I configured the IIS, DP and Client certificates correctly following the Microsoft article :

https://learn.microsoft.com/en-gb/mem/configmgr/core/plan-design/network/example-deployment-of-pki-certificates

DP Cert has been configured for Intranet clients only (Subject blank and added FQDN for DNS).

I also added the Root certificate on Site properties.

Answer 5

The log above is showing an error of having no PKI cert though. During OSD when PXE booted, the client auth cert assigned to the DP is used throughout the process.

You need to review the entire smsts.log here to help in tracking down the issue.

Although why perform a build and capture at all? That is generally considered an antiquated approach that requires additional time and overhead. The commonly used path with Windows 10 is to use and deploy the image from the media, serviced to include the latest CU, and then layer on all additional customizations, applications, settings, etc. during the deployment task sequence. This eliminates a ton or work and re-work in the long run and greatly simplifies the process.