rss.livelink.threads-in-node

System Center Operations Manager alerts I can't close?

JDGP — Thu, 16 Apr 2026 12:44:55 GMT

Hello,

(mind you I've just started really working with SCOM, prior to this I have known about it's existence and what it can do (globally)).

We have System Center 2022 version 10.22.10118.0 (Retail).
Recently we've been seeing how we can monitor Certificates for Agent Managed Windows Servers.
Through the out of the box Management Pack.

Since we enabled this, we received some alerts about for example expired certificates.
After we received these alerts we started looking into them and now seem to have run into an issue.

We now have a few alerts (which are monitor alerts) which we can't remove from the "Monitoring > Active Alerts" console view.
Manually closing them doesn't seem to do anything (i read about how I COULD be able to manually close them when they are generated through "Certificate Expiry Monitor".. (setting the Administration > Settings > Alerts > Alert Closure Experience (for example)).

So we have for example one alert which is the "Certificate Expiry Monitor" which is alerting for an Unhealthy Certificate.
The alert context mentions: Critical - The certificate is expired. It expired on *** blabla.

Another way I read was if you want to remove such alerts you could:
Disable the alert (or create an override) and then you should be able to close them (or they would get removed automatically if its set like auto-closure when underlying monitor health is resolved or reset manually).

Well none of this works.
I've also tried resolving them through powershell, but that also doesn't remove the alerts (i.e.. change it's ResolutionState to 255).
where i tied through get-scomalert -> set-scomalert when the override was in place for example SCOMClass -DisplayName "Microsoft Certificates Certificate"
Also tried to completely disable the Authoring > Monitors > Microsoft Certificates Certificate > Entity Health > For all objects of class....
and then trying to set the resolutionstate, also doesnt do anthing (not getting any error warnings when I do so in powershell).
Reverting that and overriding that Authoring > Monitors > Microsoft Certificates Certificate > Entity Health > For all objects of class....
and then trying to set the resolutionstate, also doesnt do anthing (not getting any error warnings when I do so in powershell).

Also removing for example the certificate from the server (it's in the \Personal store of this particular windows server) doesn't do anything.
(i've since re-imported it again)
So now I'm a bit lost.

If I go to Monitoring > Microsoft Certificate Monitoring > All certificates
I don't see the certificate mentioned for this host there.

Then we have another 3 certificate monitors in alert which we can't seem to remove, but those are "Certificate Chain Monitor" alerts.
For those we have the same issue, can't somehow close those.

Does anyone have any ideas what we can try next to get them removed from the Alert view?
So the end goal is to somehow set these alerts to ResolutionState 255, OR in the case for example for the certificate expiry alert, just remove the object/entity that it's alerting for from SCOM since I can just delete the certificate from the server, but ya, the object/entity in SCOM seems to stay (or at least the alert does).

I've also tried to see if it was some sort of console caching problem by clearing the console cache, but that doesn't seem to be the issue either.

Help is appreciated!

Kind regards,
JDGP

DPM 2025 UR1 Agent Install Failed

Antal_Kabatek — Thu, 26 Feb 2026 11:40:40 GMT

Hi,

I have fresh installed DMP server with the following stack:

Windows Server 2025 Standard

SQL Server 2022

Reporting Services 2022

After DPM install I updated to UR1 without agent deployment. I have new cluster Windows Server 2025 Cluster Nodes and I would like protect with the new DPM but agent install is failed with the following message:

Install protection agent on HOSTNAME failed:

Error 313: The agent operation failed because an error occurred while running the installation program on HOSTNAME.

Error details: Fatal error during installation (0x80070643)

Recommended action: Review the log files on HOSTNAME: [windir]\temp\msdpm*.log and take appropriate action. Retry the operation, and if the error persists, restart the computer and then retry the operation again.

I find this in the log:

Product: Microsoft System Center DPM Protection Agent -- Error 1723. There is a problem with this Windows Installer package. A DLL required for this install to complete could not be run. Contact your support personnel or package vendor. Action _CheckCertificatesConfigured, entry: CheckCertificatesConfigured, library: C:\WINDOWS\Installer\MSI6206.tmp

Error 1723. There is a problem with this Windows Installer package. A DLL required for this install to complete could not be run. Contact your support personnel or package vendor. Action _CheckCertificatesConfigured, entry: CheckCertificatesConfigured, library: C:\WINDOWS\Installer\MSI6206.tmp

Action ended 12:11:00: _CheckCertificatesConfigured. Return value 3.

I tied these steps:

1. I can deploy dpm agent from my previous dpm 2022 server with success to the host

2. I copied the dmp agent installer to the host from the original DPM 2025 installer 10.25.25.0 and I can install the agent with success

3. I copied the dmp agent installer to the host from the updated UR1 environment 10.25.39.0 but i can't install and got this error message witch is almost the same what I find in the log

I think something is wrong with the updated UR1 agent.

I am looking for solution.

deployment script fails with division through zero when deploying

HorNet505 — Tue, 30 Dec 2025 19:38:50 GMT

I created an installation script with this batch line:

setup.exe -s -l1031 -f1".\Provi75inst.iss"

This is put into a install.bat file that gets deployed with the software package.

I tested it with admin-rights and the software installs fine.

When I depoloy it through system center and run it in my softwarecenter, I get this error:

0xC0000094 (-1073741676)

I researched that it is a "division through zero" error. What the heck.

Does anyone know what is going on here? Is there a difference running the installation in SYSTEM context? Due to company restrictions I can't use PSEXEC to verify this.

Any idea?

System Center 2025 Update Rollup 1 and more

AakashMSFT — Mon, 06 Apr 2026 15:23:24 GMT

We are excited to announce that System Center 2025 Update Rollup 1 (UR1) is now generally available! This update brings important enhancements and fixes across the System Center suite, with a focus on security, compatibility, and reliability improvements.

What's New in System Center 2025 UR1

Enhanced Security and Compatibility

TLS v1.3 Support

System Center 2025 now supports TLS v1.3, enhancing security and compliance with the latest encryption standards across all components.

Microsoft SQL Server 2025 Support

All System Center components now support SQL Server 2025, providing improved performance and scalability for your datacenter operations. Existing deployments on SQL Server 2022 can upgrade seamlessly to SQL Server 2025.

Expanded Linux/Unix Platform Support

Operations Manager 2025 UR1 extends monitoring capabilities to the latest enterprise Linux distributions:

Oracle Linux 10
Rocky Linux 10
Alma Linux 10
Red Hat Enterprise Linux (RHEL) Server 10
Debian 13

The Operations Manager Linux Agent now supports OpenSSL 3.x distributions, ensuring compatibility with modern security requirements.

System Center Virtual Machine Manager (SCVMM)

VMM 2025 UR1 introduces several features enabling you to improve your security posture and update the workloads managed by VMM to the latest versions:

Virtual Trusted Platform Module (vTPM) support: VMM 2025 UR1 provides GUI and PowerShell experience to run vTPM-enabled virtual machines. You can enable vTPM while creating a new virtual machine and while modifying the properties of an existing virtual machine, and thus improving your security posture.
Support for SQL 2025 and SQL Contained Availability Group: You can use SQL 2025 for VMM 2025's database. To improve your resiliency posture, you can choose to use a SQL Contained Availability Group.
Support for the latest Linux distros: With VMM 2025 UR1, you can manage RHEL 10, SUSE Linux 15, Debian 13, Oracle Linux 10, Rocky Linux 10, and OpenEuler 24.03 flavored Linux virtual machines. Along with the updated Operating Systems support, VMM recognizes and supports storing network settings of Linux machines in keyfile format.
Support for the management of VMs in the latest versions of Azure Local: VMM 2025 UR1 comes with updated support for the management of VMs running on latest versions of Azure Local. See the full list of supported and unsupported scenarios for Azure Local operability with SCVMM.
A bunch of bugfixes. See the VMM 2025 UR1 KB article for the full list of issues fixes with this update.

System Center Operations Manager (SCOM)

Issues Fixed

Console content blocking, monitor authoring failures, web console dashboard improvements, S2D workflow WMI errors, topology widget issues, and GB18030-2022 compliance for Chinese character set resolved.

System Center Data Protection Manager (SCDPM)

New Features

Hyper-V Select Disk Exclusion:: DPM 2025 UR1 introduces the ability to exclude specific disks from Hyper-V VM backups. Administrators can now selectively omit disk contents from restore points, ensuring that excluded disks aren't overwritten during VM restoration. This provides greater flexibility in managing backup storage and recovery scenarios.
Exchange Subscription Edition Support:: DPM 2025 UR1 now supports Exchange Subscription Edition as an application-aware backup, expanding protection options for organizations using Microsoft 365 hybrid deployments.
Enhanced Security and Runtime:: DPM 2025 UR1 requires the latest Visual C++ Redistributable packages (2013, 2015-2022 x64), ensuring the runtime environment is compliant and secure with the latest security updates.

Issues Fixed

SQL Server force encryption protection, VMware backup transport mode (NBDSSL), and recovery page localization resolved. Includes all SCDPM 2022 UR3 and DPM 2025 RTM fixes.
GB18030-2022 compliance for Chinese character set included where applicable.

System Center Service Manager (SCSM)

New in Update Rollup 1

Latest MSOLEDBSQL19 provider support
Enhanced Orchestrator Integration:: Connects to Orchestrator Web API 2022/2025, with backward compatibility for SCO 2019 Web Service

Issues Fixed

GB18030-2022 compliance for Chinese character set in all input fields
Self-Service Portal: Knowledge article images display correctly, Share button no longer cropped for non-English characters, and Review decision error with HTML tags resolved
MonitoringHost and GroupCalc stability improvements

System Center Orchestrator (SCO)

Issues Fixed

Read Line activity special character handling, Monitor Event Log crashes, Invoke-Runbook credential persistence, and GB18030-2022 compliance for Chinese character set in runbook tester display resolved.

Why Update to UR1?

Enhanced Security: TLS v1.3 support ensures your infrastructure meets the latest encryption and compliance standards.
Improved Reliability: Multiple fixes across console operations, monitoring workflows, and backup processes deliver a more stable experience.
Broader Platform Support: Extended Linux distribution support and SQL Server 2025 compatibility keep your infrastructure current.
Better Performance: Fixes for memory leaks, workflow failures, and transport mode issues improve overall system performance.

Additional Resources

VMM 2025 UR1 (link)
SCOM 2025 UR1 (link)
Service Manager 2025 UR1 (link)
Orchestrator 2025 UR1 (link)
DPM 2025 UR1 (link)

Recent Highlights for System Center 2022

In addition to the 2025 Update Rollup, we continue to invest in System Center 2022 with targeted hotfixes and compliance updates to ensure all customers benefit from the latest security, language, and platform improvements:

Orchestrator 2022 Hotfix: (link) GB18030-2022 compliance for Chinese character set.
VMM 2022 Console Hotfix: (link) GB18030-2022 compliance for Chinese character set.
SCOM 2022 Hotfix: (link) GB18030-2022 compliance for Chinese character set, Unix/Linux agent certificate fixes, PowerShell widget security, agent discovery, and web console view fixes.
VMM 2025 Console Hotfix: (link) GB18030-2022 compliance for Chinese character set.
SM 2022 Hotfix (link) GB18030-2022 compliance for Chinese character set.

What's Next?

Thank you for being part of the System Center community. We look forward to supporting your hybrid datacenter management needs!

Unable to update Service request via SCO runbook

Hjb118 — Mon, 24 Nov 2025 07:32:32 GMT

Good afternoon, Everyone,

I’ve started developing a series of runbooks for our new service desk implementation, and one of the key requirements is the ability to automatically update Service Requests and other work items during the workflow. However, I’m running into an issue when attempting to pass the GUID of the Service Request into the “Update Object” activity.

Even though the GUID is successfully retrieved from the Service Request and passed into the runbook as an input parameter, the activity reports that the value is an invalid GUID. This suggests that either the GUID is being transformed somewhere in the process, isn’t being interpreted correctly by the activity, or the wrong property is being supplied even though the value appears correct when inspected within the runbook.

At this stage, I’m trying to determine whether the issue is caused by the way SCSM exposes the GUID, how the runbook passes the parameter, or a limitation quirk within the Update Object activity itself. Any guidance or examples of correctly updating Service Requests via runbooks especially when using GUID values dynamically would be greatly appreciated.

System Center Orchestrator 2022

good1228 — Fri, 14 Nov 2025 17:19:43 GMT

I have automations set up for user terminations. When a user is termed, i want to be able to give the manager access to their one drive (sharepoint module issues).

The way i am authenticating is with a cert, app-only authentication. the problem that i have found with connect-sposervice is that the module is older than the connect-exchange online module and it only looks in the current users cert store so when i run a command it says it cant find it. so Ok, i connected to powershell with the orchestrator service account and imported the cert to that local store but it still didnt work.

I then tried to use the newer powershell module, connect-pnponline but that requires powershell 7.x.x to even run and orchestrator is using powershell 5 (at least its 64 bit)

So i then try to run powershell 7 with a run .net activity but when i use orchestrator variables, it just comes out as garbled text since the activity isnt the one running the command.

Any suggestions on how i make this work?

As i have said, i just need orchestrator to be able to assign the manager as full control over a terminated user's onedrive. The exchange modules work great for app only auth, but the sharepoint ones just arent working for me. I used to pass a password using basic auth but that is now deprecated, (and its not a good practice to do that anyways).

Thank you so much in advance for any tips or tricks to get this working.

Unable to patch Windows Server 2025/24H2

BigGreen2014 — Fri, 14 Nov 2025 16:53:28 GMT

Windows updates will not display in software center for 2025/24H2 clients.

Currently running SCCM version 2503 hotfix rollup KB32851084. SCCM client version on test server is 5.00.9135.1013. Test server OS is 24H2 build 2600.2894.
I have verified that the 24H2 product is enabled in the software update point configuration and within the ADR. ADR preview shows the 24H2 update (KB5068861).

I see KB5068861 under the deployments tab of the test server device. I have a daily maintenance window on the collection, and this shows on the test client within "installation status -->upcoming" tab in software center. I do realize that this hotfix rollup included a fix for 2025 OS.

Windows Server 2025 updates use the incorrect Maximum run time value in the properties for the software update component. The value can lead to update installations being incorrectly canceled.

I did change the maximum run time for KB5068861 from 10 minutes to 60 minutes. Could this be a metadata related issue with the existing KB that is currently downloaded to SCCM (via WSUS)? I hope I'm not missing something obvious but do welcome an easy resolution if that's the case. Thanks for any suggestions or troubleshooting suggestions.

need help with a problem related to the system center

Hamza-Alzaidi — Sun, 09 Nov 2025 07:06:44 GMT

This problem started after the September database server update. I can't access the system center interface to view reports, see devices, check updates, track device status, etc. When I try to open it, I see the attached image. Has anyone else experienced this problem and resolved it? What is the solution for this issue?

How to Configure SCOM 2025 Email Alerts with Microsoft Graph or SMTP OAuth (SMTP AUTH Deprecation)

mrlovett — Mon, 03 Nov 2025 16:01:51 GMT

Hi all,

I'm just getting started with SCOM 2025 and need help configuring email notifications to use modern authentication. I understand that SMTP AUTH is being deprecated by Microsoft in April 2026, so I want to set up either:

Microsoft Graph API for sending alerts
Or SMTP with OAuth 2.0 (e.g., via Office 365)

I haven’t done any configuration yet—just looking for clear guidance on how to get started. Specifically:

What steps are needed to register an app in Entra ID (Azure AD) to support this?
What permissions should the app have (e.g., Mail.Send)?
How do I configure the notification channel in SCOM to use OAuth?
Is Microsoft Graph supported directly in SCOM 2025, or is SMTP with OAuth the only option?
Do I need to manually generate tokens, or does SCOM handle that automatically once the app is registered?

Any documentation, walkthroughs, or examples would be hugely appreciated. Thanks in advance!

Cannot update to Update Rollup 3 for System Center 2022

Antal_Kabatek — Sun, 02 Nov 2025 08:41:52 GMT

Hi,

I tried update my DPM 2022 to the latest version. I tried also via Windows Update and manually but both method is unsuccessful. When I tried windows update method I got the following error message:
There were some problems installing updates, but we'll try again later. If you keep seeing this and want to search the web or contact support for information, this may help: (0x80070643)

For manually update I run this package but the setup wizard didn't show up:
dataprotectionmanager-kb5059073_ce4e4e4b8dd358bd0b79e77235e9945dc96131fa.exe

I restarted the server as recommended by Microsoft and tried again but not helped for me.
My dpm setup:
Virtual Machine
Windows Server 2022 Standard
Language: English
Region: Hungarian

System Center Orchestrator SSL error when running DBConfig against existing DB

ElDaverino — Thu, 25 Sep 2025 21:40:59 GMT

Hey all, I migrated the server to a new AD domain, and ran a repair on SQL, and re installed Orchestrator.

SQL is working as expected. but when Orchestrator goes to configure the Database, it gives an ssl error. I told it to trust the server cert,

SQL is on the same server.

It sees the existing Orchestrator DB, but gives ssl error, even i try to use it, or try and create a new DB.

Orchestrator 2025, SQL 2022

This is in the dbconfig error log

The certificate chain was issued by an authority that is not trusted.

Do I need to delete the certs form the old domain or something weird? (We don't have the new CA set up yet; I just need to run locally for now)

Orchestrator 2025 Security Credentials Problem

AndreasBon — Thu, 25 Sep 2025 12:48:54 GMT

Hi,

I’m experiencing an issue in SCO 2025 that has occurred across three different installations.

In the Text File Management and File Management IPs, I’m unable to save the security credentials information for the activities. In other activities, such as Get Service Status, it works as expected.

If I enter the account information, click Finish, and then reopen the properties, the fields are empty. As a result, the activity runs using the service account specified for the Orchestrator Runbook Service.

Has anyone else experienced the same issue, or could there be something wrong with my installations?

Get file status:

Get service status:

All Clients Showing with Question Mark in MECM Console - ResourceID Issue

shocko — Wed, 24 Sep 2025 13:41:15 GMT

All of a sudden (2 weeks ago) all my MECM Clients (~ 4000) in MECM 2409 are showing with a question mark (?) in the console and no values in Last Online Time, Last Activity or HeartBeatDDR. Upon investigation in the statesy.log file on our single site server we see the following message for all clients:

SQL MESSAGE: dbo.spProcessStateReport - The record for machine MYCLIENT (GUID:CF5413C8-1DA7-450D-9243-33DB539DE8FF) was not found in the database. SMS_STATE_SYSTEM 24/09/2025 10:36:45 15356 (0x3BFC)

We then ran MS SQL profiler and see that this external CLR stored proceedure checks for the existince of the client in the SQL view vLocalSystemIDXRef. This view is defined as follows:

create view [dbo].[vLocalSystemIDXRef] as select MachineID, GUID from MachineIdGroupXRef where ArchitectureKey=5 and MachineID between dbo.fnGetSiteRangeStart() and dbo.fnGetSiteRangeEnd()

The issue is that all clients are actually in the underlying table MachineIdGroupXRef but due to the filter dbo.fnGetSiteRangeStart() and dbo.fnGetSiteRangeEnd() they are not part of the view. The reason is their ResourceID is only 4 digits and the value returend from fnGetSiteRangeStart is 16777216.

Q: How could the clients be getting this 4-digit resourceID all of a sudden? We have made no chnagesto MECM (no upgrades, DB restores etc. ).

DPM used for Sharepoint doesn't clean catalog table

aviggiano — Wed, 24 Sep 2025 12:05:36 GMT

Hi All,

we are using DPM for saving our SP farms in DEV, TEST and PROD environment.

On DEV farm (quite small) we don't have any kind of issue and both recovery point tasks and SharePoint Catalog Task are executed without errors.

On TEST and PROD, instead we are often facing some errors (MDF in use, VSS issues and so on) and for this reason we had to completely delete and re-create the protection groups and we even deleted the data inside. So we started from the scratch.

Nevertheless even if we completely deleted ALL the protection groups without retaining data, our DPM database kept growing steadily and no data have been cleaned or removed.

Above all we noticed the following table continuing to grow: tbl_RM_SharePointRecoverableObject

In addition we found in some DPM database tables that the deleted protection group are still present in the table but they are marked as deleted.

But even if they are in this state, the DPM doesn't clean anything and the DB still growing...

The MaintenanceJob CatalogPruning it's executed but it does absolutely anything.

So my question is:

Are there jobs that clean up all this obsolete data? Isn’t there any maintenance to clear everything out?

Thanks

Antonio

DPM Backup Issue – Replica Inconsistent

Whatever1 — Mon, 08 Sep 2025 12:31:05 GMT

Hi,

We are using Microsoft SCDPM and everything was working fine until recently. We suddenly started receiving the error “replica is inconsistent.” There were no VM migrations and no configuration changes. Running a consistency check does not fix the problem. The only way we can make it work is to remove the machine from the protection group, select the option to delete the existing data, and then re-add it. This means we lose all previous backups. After four to six days the same issue comes back again, affecting random VMs and not always the same ones.
Is there any other way to resolve this without losing backup history? Where can I look at the logs to understand the root cause? Is there still any way to get Microsoft support for DPM?

No management pack in recommendation

Marek_Belan — Mon, 08 Sep 2025 04:59:47 GMT

Hi all

yesterday i install new server on 2025, install SCOM 2025 on SQL 2022.

I add 3 servers one standard, one SCCM and one from citrix.

For today i have no recommended management pack.

Anyone can help what to check?

Internet connection is OK on server.

System Center 2022 Update Rollup 3

AakashMSFT — Mon, 25 Aug 2025 08:36:26 GMT

We’re pleased to announce Update Rollup 3 (UR3) for System Center 2022. This release continues our commitment to stability, security, and platform currency across on‑premises datacenter operations, with targeted fixes and compatibility improvements for Operations Manager, Service Manager, Virtual Machine Manager, and Orchestrator. Details below.

Virtual Machine Manager

Support for additional Guest OSes & UX improvements

Added Windows Server 2025 guest OS support

Expanded Linux guest OS coverage: Ubuntu 24.04, RHEL 9, Debian 12, Rocky Linux 8 & 9.

Availability Sets are now listed alphabetically to streamline selection.

Storage provider security hardening

Secure‑by‑default: Adding new storage providers now uses HTTPS by default.

Learn more: Update Rollup 3 for System Center 2022 Virtual Machine Manager.

Operations Manager

Operations & Web Console are more stable since multiple issues are fixed such as console crashes, dashboard performance, favorite report issue.

Addressed failures in workflows that use WMIProbe, ensuring the probe correctly falls back and executes.

Restored Microsoft Teams notification functionality for environments impacted after UR2.

Learn more: Update Rollup 3 for System Center 2022 Operations Manager.

Service Manager

Platform Stability on New CPUs/OS Builds

Eliminated MonitoringHost instability observed on newer processors/OS builds and addressed a GroupCalc‑related crash scenario.

Multiple Bug fixes on Self‑Service Portal & Knowledge Article Rendering

Note: UR3 can be applied even where UR2 installation had failed, and it includes the bug fixes and enhancements that shipped with UR2.

Learn more: Update Rollup 3 for System Center 2022 Service Manager.

Orchestrator

Platform Updates

.NET 8 (LTSC) is now supported.

Group Managed Service Accounts (gMSA) are supported.

Security improvements

Support for TLS 1.3 protocol is enabled.

Learn more about bugs fixes: Update Rollup 3 for System Center 2022 Orchestrator

We are committed to delivering new features and quality updates with UR releases at regular cadence. For any feedback and queries, you can reach us at systemcenterfeedback@microsoft.com.

Unable to import drivers into SCCM 2503

ManeshAppukkuttan1983 — Mon, 18 Aug 2025 14:45:04 GMT

While trying to import the LAN drivers into SCCM version 2503, I encountered an error.

The errors are,
1. Error: Some driver(s) can not be imported successfully.
2. Error: Failed to import the following drivers:
• Realtek PCIe GbE Family Controller - An error occurred while importing the selected driver.

Can anyone help me resolve this issue?

Orchestrator Designer 10.25.1.7 VMware Integration Guest OS version

RodPayne — Tue, 12 Aug 2025 16:38:13 GMT

We are new to System Center 2025 Orchestrator Runbook Designer and the VMware Integration. We would like to use the native functionality to create virtual machines, but in the Create VM activity, the Guest OS property has a list of possibilities that only goes up to Windows 7 and Windows Server 2008 R2.

Does anyone else use the VMware Integration Create VM activity, and does it show supported operating system versions? If so, what could we be doing wrong?

SCSM 2025 installation failure - _PopulateUserRoles

Rafael_Monteiro — Mon, 21 Jul 2025 16:36:01 GMT

Let me lay out the full picture first.

Windows Server 2025, Remote SQL Server 2022 CU 20 FCI (used for internal reasons, but I also tried using Always On and encountered the same error), and a clean installation of SCSM 2025 Management Server. I also tried CU19, but the same issue occurs.

The installation starts without any problems. It goes through all the steps: creates the database, configures registry settings, configures the server, installs services, and imports management packs. But right after that, I get the following error:

_"An error occurred while executing a custom action: PopulateUserRoles
This upgrade attempt has failed before permanent modifications were made. Upgrade has successfully rolled back to the original state of the system. Once the corrections are made, you can retry the upgrade for this role."

Immediately after this, the Event Viewer logs the following Event ID 36882:

"The certificate received from the remote server was issued by an untrusted certificate authority. Because of this, none of the data contained in the certificate can be validated. The TLS connection request has failed. The attached data contains the server certificate.
The SSPI client process is rundll32 (PID: 5084).”

SQL does not require encryption and is not using any custom certificate. Just to clarify, the internal CA certificate is installed on all servers.

The event is weird because, at this point, the installation has already created and configured the database. It doesn’t make sense to me, but the event appears at the exact same moment the installation fails.

I’ve already checked permissions on both SQL and SCSM. The service account is a local administrator, has "Log on as a service" rights, and is a sysadmin on SQL.

I’ve searched everywhere online but haven’t found a solution...

Any ideas?

Thanks.