MECM client over CMG

[PaulKlerkx]

Hi,

I have recently upgraded from MECM 1910 to 2002.  the client is deploying ok to intranet based devices, but no devices on CMG are getting the new client.  

Where do I go to troubleshoot this?

How can I force an install to a cmg connected device to test if that part works?

Note that I had CMG issues as part of the 2002 upgrade as per this post.   - https://techcommunity.microsoft.com/t5/system-center/cmg-broken-after-upgrade-to-mecm-2002-resolved/... 

also note that I had to redo the remove / re-add of the roles a second time after CMG stopped working again the night I did this fix.  

Point being, maybe my original issues are the cause of my client install issues.  

[#2]

@PaulKlerkx For automatic client upgrades to work over the CMG, you'll need to allow it to serve content to clients by enabling the Allow CMG to function as a cloud distribution point and serve content from Azure storage option. You'll also need to enable the Allow access to cloud distribution point option in the client settings for the affected clients. Without these two options, CMG connected clients won't be able to download the client upgrade package they need in order to perform the automatic upgrade.

[#3]

@Michiel Overweel . thanks for the information.  we do have the cmg configured as a distribution point.  

CMG distro was up and working prior to the upgrade, however this would be the first time a client upgrade would have happened over cmg.  we now have around 20 devices with a client, however I believe these were likely devices that came back on the intranet and got the client while onsite.  

Client settings, under cloud services, all are enabled - distro, register with AAD and enable CMG for clients.  

I verified the new client package appears under content tab in properties for the CMG.

on the cmg connected device in configuration manager applet, network tab, the internet based management point is configured, none of the proxy options have entries.  (if this refers to a standard proxy, we don't use one so that is OK, if it refers to cmg as the proxy, then wondering if anything maybe should be in there.  

in Ccmsetup.log on a cmg connected device, the log finishes with the following (only thing changed is I changed our cmg name and site code.  )

Created connection on port 443

Enabled SSL revocation check.

Trying without proxy.

Received a proxy error(0x2ee7), recycling the request object and will try another proxy type, if available.

MapNLMCostDataToCCMCost() returning Cost 0x1

Enabled SSL revocation check.

Querying proxy information as 'S-1-5-18'

Performing proxy auto-detection.

Using fast DNS for Auto proxy detection.

DNS detection was not successful. Using DHCP for Auto proxy detection.

Proxy auto detection was not successful.

Failed to retrieve proxy information.

No proxy was found.

Failed to get CMG metadata 0x80004005

No MP or source location has been explicitly specified.  Trying to discover a valid content location...

Looking for MPs from AD...

Unexpected row count (0) retrieved from AD.

GetADInstallParams failed with 0x80004005

Couldn't find an MP source through AD. Error 0x80004005

No valid source or MP locations

Sending state '322'...

Updating MDM_ConfigSetting.ClientDeploymentErrorCode with value 2147500037

[5.00.8913.1012] Params to send '5.0.8913.1013 Deployment "C:\WINDOWS\ccmsetup\ccmsetup.exe" /runservice  AADCLIENTAPPID="09770777-410a-4b8e-9df6-a1a60c11438d" AADRESOURCEURI="https://ConfigMgrService" CCMHOSTNAME="OURCMG.FQDNREMOVED/ccm_proxy_mutualAuth/72057594038008067" SMSSITECODE="XXX"'

<ClientDeploymentMessage ErrorCode="-2147467259"><Client Baseline="1" BaselineCookie="" Platform="2" Langs=""/></ClientDeploymentMessage>

Raised pending client deployment state message.

Sending state '301'...

Updating MDM_ConfigSetting.ClientDeploymentErrorCode with value 2147500037

CcmSetup failed with error code 0x80004005

[#4]

@PaulKlerkx The only thing I can think of right now is based on the fact that an 0x2ee7 (ERROR_WINHTTP_NAME_NOT_RESOLVED) error is generated when the client tries to retrieve the CMG metadata. Are you sure the CMG FQDN can be resolved by clients while they are on the Internet? You might want to disconnect a client from the corporate network and try to resolve the CMG FQDN to make sure. Maybe the CNAME record was deleted from your public DNS zone or something like that.

[#5]

@Michiel Overweel - sorry for not replying soon, got a bit busy.  

when you say "try to resolve the CMG FQDN" If i type in the ProxyServiceFQDN, it returns an ip and alias, if that is what you meant then yes that works.  

[#6]

@ forgot to mention, that was with NSLookup, assuming that was the requirement.  

[#7]

@PaulKlerkx you can use standalone SCCM client package to upgrade the Client version. Use the following SCCM client installation parameter 

"C:\windows\ccmsetup\ccmsetup.exe" /nocrlcheck /mp:https://CMG.CLOUDAPP.NET/CCM_Proxy_MutualAuth/6257556037928694 CCMHTTPSSTATE=31 CCMHOSTNAME=CMG.CLOUDAPP.NET/CCM_Proxy_MutualAuth/62057556037928694 SMSSiteCode=PS1 AADTENANTID=5004305e-6764-4e6b-b9a4-c4d5ccfd1524 AADCLIENTAPPID=3C6a28b2-9d0a-484d-8553-7cb0d4897512 

[#8]

@Anandkumar Thanks for that info,  I'll try to take a look tomorrow.  

One thing I thought of, since I configured CMG, I haven't modified the Client Push installation properties for our site.  Should I have?  We currently only have the SMSSITECODE property in there.  (could this be the reason for the CMG client install failures??)

*************************************************************************

I had quick look at the command line you posted

"CCMHTTPSSTATE=31" - the documentation doesn't seem to mention this.  I have looked at the logs of an internal machine and it has  CCMHTTPSSTATE="1472" , any idea what the different numbers equate to or what the purpose of the property is?  the only google results I can find don't have much information on it.  

https://docs.microsoft.com/en-us/mem/configmgr/core/clients/deploy/about-client-installation-propert...

https://docs.microsoft.com/en-us/mem/configmgr/core/clients/deploy/deploy-clients-cmg-azure

[#9]

@PaulKlerkx There's no need to add anything to the Client Push Installation properties. Client Push, by definition, can be used on the intranet only. After the agent is installed, the client will receive the CMG location(s) as part of its policy.

Using the client package with a command line, as @Anandkumar suggested, will probably work, but it shouldn't be necessary in my opinion.

[#10]

@Michiel Overweel thanks for the reply.  we have had issues with our server infrastructure and I am currently in the process of migrating to new hardware.  as part of that, I had to uninstall our CMG, so once I tidy up, I'll reinstall the CMG and get back to sorting this out.  

[#11]

@Michiel Overweel thankyou for the assistance, after restoring MECM to new hardware, CMG was completely dead and we had to remove from both MECM and Azure and completely recreate.  Two days after doing this I have found that all our internet connected devices are on the latest client, so I'm making the assumption that this has resolved our problem.  We have the 2006 upgrade scheduled for about 4 weeks from now, so I guess I'll know for sure after that, but for now, issue resolved, thanks again.