How to install sccm client/configure on RD/load balancer server

lalajee 1,811

Hi,

We have 20 RD/ load balancer server.

19 server show that sccm client is not install on console but when I login to some server I can see sccm client is install and its working.

At an time one 1 server show as active/client install in sccm console.

How do I make all show as being install/active and will this effect the windows update

1 answer

Jason Sandys 31,171 Reputation points Microsoft Employee

2022-10-04T13:56:48.447+00:00

Do these servers share a common client authentication certificate stored in the system account's personal store? If so, exactly what you are seeing will happen as the ConfigMgr client uses a qualifying cert to establish its identity which will thus be the same for all systems with that shared cert. You can validate which (if any) cert that the client is choosing by reviewing the clientidmanagerstartup.log on the client.
Please sign in to rate this answer.

1 person found this answer helpful.
lalajee 1,811 Reputation points

2022-10-04T14:27:11.043+00:00

Is that cert for client authentication?
We havn't turn on any https or cert authentication within our sccm

lalajee 1,811 Reputation points

2022-10-04T14:27:11.077+00:00

Is that cert for client authentication?
We havn't turn on any https or cert authentication within our sccm

lalajee 1,811 Reputation points

2022-10-04T14:32:02.51+00:00

Looking at clientidmanagerstartup.log

I can see below on few server which I check (same on all of them)

Begin validation of Certificate [Thumbprint xxxx01] issued to 'SMS' ClientIDManagerStartup 04/10/2022 08:49:24 14780 (0x39BC)
Completed validation of Certificate [Thumbprint xxxx01] issued to 'SMS' ClientIDManagerStartup 04/10/2022 08:49:24 14780 (0x39BC)
PopulateRegistrationHint: Using the CertificateID to set the hint. Cert thumbprint 'xxxx01', SMSID 'GUID:xxxx' ClientIDManagerStartup 04/10/2022 08:49:24 14780 (0x39BC)

Jason Sandys 31,171 Reputation points Microsoft Employee

2022-10-04T17:23:21.173+00:00

Yes, it is for client auth. Whether you have HTTPS client communication enabled or not is irrelevant.

You need to validate that the same client auth cert does not exist on each of these systems because, as noted, this will cause these systems to all generate the same client GUID and thus the site will see them all as the same client.

Assuming they all share a client auth cert, the question becomes why do they do this? My guess is that someone incorrectly generated a server auth cert that was meant to be shared among them with the client auth capability which is in general bad practice (having a cert with both client and server auth capabilities).

There is an option on the client communication tab of the site's properties that enabled disables client use of a PKI cert. You can disable this and reinstall the client agent and that should (to my knowledge) change the behavior. However, this is only correcting the symptom and not the problem of the certs having both capabilities which I suggest actually get addressed.

lalajee 1,811 Reputation points

2022-10-05T11:45:51.2+00:00

You need to validate that the same client auth cert does not exist on each of these systems because, as noted, this will cause these systems to all generate the same client GUID and thus the site will see them all as the same client.

How do I do that?

Assuming they all share a client auth cert, the question becomes why do they do this? My guess is that someone incorrectly generated a server auth cert that was meant to be shared among them with the client auth capability which is in general bad practice (having a cert with both client and server auth capabilities).

All these 20 severs are part of rdp and they do have an wild card cert apply to them (Cert does have Intended Purposes for Server and Client Authentication)

There is an option on the client communication tab of the site's properties that enabled disables client use of a PKI cert. You can disable this and reinstall the client agent and that should (to my knowledge) change the behavior. However, this is only correcting the symptom and not the problem of the certs having both capabilities which I suggest actually get addressed.

This is not configure

Jason Sandys 31,171 Reputation points Microsoft Employee

2022-10-05T14:30:51.477+00:00

How do I do that?

There are many ways to compare certs to see if they are in fact the same cert, but the easiest way is to compare their thumbprint.

All these 20 severs are part of rdp and they do have an wild card cert apply to them (Cert does have Intended Purposes for Server and Client Authentication)

As noted, this is generally a terrible practice. Client auth certs should always be unique and certs should never share these two intended purposes. Also as noted, my suggestion is to reissue the cert without the client auth purpose. Using a shared server auth cert is fine (whether it's a wildcard of not), it's the fact that cert also is enabled for client auth. From memory, I think you may be able to just disable the client auth purpose on a cert instead of having to reissue the certs. If possible, you can do this in the certs MMC snap-in.

This is not configure

I don't remember the exact behavior, but if this was disabled after the clients were installed, it may not have any impact on the cert being chosen thus you may need to reinstall the client agent for this to truly be impactful. You can test this if desired.

Frank Dong 171 Reputation points

2022-10-06T08:37:30.04+00:00

Check on each system side - Certlm.msc - Certificates ( local Computer) - Personal - Certificates. Certificate in this store will be picked up during client registration.

lalajee 1,811 Reputation points

2022-10-17T10:06:47.25+00:00

The issue was that, machine was created and duplcate without doing any sysprep.

This is the reason why machine is having same GUID/Cert as sccm thinks its same machine for these 20 servers

Jason Sandys 31,171 Reputation points Microsoft Employee

2022-10-17T17:41:29.307+00:00

The issue was that, machine was created and duplcate without doing any sysprep.

That's a bigger issue here than and is completely unsupported. Nothing you do or can do will change this. These systems must be rebuilt from properly syspreped images or the installation media.
Sign in to comment