This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(16, 43%, 11%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EP1%3C/text%3E%3C/svg%3E)
Hi,
I want to upgrade my SCCM 2207 to 2303. After running Prerequisite check I am getting the following warning
Completed with warning]:The site server configured with HTTPS/Enhanced HTTP, does not require network access account. Please verify the minimum appropriate permission of this account(s) and remove the account(s) which has higher privileges. We recommend you remove the configured network access account(s) which are not leveraged. For more information about your network access account required permissions, see https://go.microsoft.com/fwlink/?linkid=2210348.
What is the minimum permissions of NAA account and what is required permissions???
What happend if I remove the NAA account???
here my NAA setting
I ignored it and install the new version 2303. After installing I did see that all my devices was unreachable
I could not be able to repair it and I have restored my backup again.
#Here my Communication Security Setting
my questions:
Regards
I see that you do not have a PKI, so you MUST select the option USE CONFIGURATION MANAGER-GENERATED CERTIFICATES FOR HTTP SITE SYSTEMS. Also since you don't have a valid PKI, remove the check CLIENTS CHECK THE CERTIFICATE RECOVATION LIST (CRL) FOR SITE SYSTEMS. Wait for a while to let clients download the new settings and policies so they create the self-signed certificate. It might take from few minutes to few hours to change depending on many factors
1, For prerequisite check warning, please try to remove the NNA and add a new one with only the required permissions and run prerequisite check again.
This reference link for your reference:
Note: Microsoft provides third-party contact information to help you understand the problem. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.
2, However, the client device displayed as unreachable may be caused by other reasons.
(1) Please upgrade to the new version again and check if the problem also occurs.
If the problem recurs, please help check if the server version has been completely upgraded and if there are any other issues. Besides, if there are any other issues present, please help upload CMUpdate.log for our reference.
To check SCCM version we can refer to this link:
Complete SCCM 2303 Upgrade Guide | Update to ConfigMgr 2303 (prajwaldesai.com)
Note: Microsoft provides third-party contact information to help you understand the problem. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.
(2) Please help check whether your "Fast Channel Push Notification" works properly? Please help check the following logs to see if there are any error. If so, please upload full log for our reference.
This similar case for your reference:
SCCM Client icons showing offline - how to fix this? - Microsoft Q&A
Looking forward to your feedback.
Best regards
Cherry
If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Hi,
Did you read my question carefully? I don't thing so. I have asked you the follwoing
What is the minimum permissions of NAA account and what is required permissions???
That link you send me, I know it and there is the exact text you wrote me. Please remove the NAA and add a new.
But I ask you again what is "with only the required permissions" Did you see my screenshot for the Account NAA?
Regards
Nick
Thanks for the reminder!
What is the minimum permissions of NAA account.
1, Client computers use the network access account when they can't use their local computer account to access content on distribution points. It mostly applies to workgroup clients and computers from untrusted domains. This account is also used during OS deployment, when the computer that's installing the OS doesn't yet have a computer account on the domain.
>> what is required permissions.
2, For what is NAA account required permissions, please refer to this link:
How to Configure Network Access Account in SCCM ConfigMgr (prajwaldesai.com)
Note: Microsoft provides third-party contact information to help you understand the problem. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.
Thanks for your time and patience!
Best regards,
Cherry
This account should simply be a DOMAIN USER only with no other privileges. Other Microsoft articles also suggest to use a GPO to deny interactive logon to this user (i.e., this user must not perform any logon to any device, rather than be used only to access the DP content while in Windows PE during OSD).
The problem with the Prerequisite Check (which I think it is a bug), is that it cannot verify the membership of this account and will always report a warning even if you configure it correctly.
Remaining on the same topic, this is what I see from my own C:\ConfigMgrPrereq.log
**Network Access Account (NAA) account usage alert; Warning; The site server configured with HTTPS/Enhanced HTTP, does not require network access account. Please verify the minimum appropriate permission of this account(s) and remove the account(s) which has higher privileges. We recommend you remove the configured network access account(s) which are not leveraged. For more information about your network access account required permissions, see https://go.microsoft.com/fwlink/?linkid=2210348**.
This is quite confusing. It first says: ***The site server configured with HTTPS/Enhanced HTTP, does not require network access account. ***Then it says: Please verify the minimum appropriate permission of this account(s) and remove the account(s) which has higher privileges. If it is not required, then why suggest to use the minimum privileges rather than suggesting to remove it completely?
Sorry Cherry,
Also that Link you send me, I know too. But I cannot understand what is exactly the required permission, what Microsoft recommend.
I have created a domain user named NAA without any Admin right or such.
Is that enough or should I add the domain user to the Computer account or local Administrator.
How I can to add the NAA on the same, I know that
Yes, we can use a normal domain user and grant this account permission to Access the distribution point from the network.
Hi,
I have upgraded yesterday my SCCM to 2303 and I have a big issue with MP. It showing me 0 Byte and I cannot start the SMS_MP_CONTROL_MANAGER. If I run query in Service Manager, Error communicating with component.
I have remove the MP role and add again. The same issue. I cannot deploy any Applications.
Can you help me?
Could give me the Microsoft Support where I can create a Ticket?
1, To narrow down the problem, we need more information. Please help check the following logs to see if there are any error:
(1) Check CMUpdate.log to see if there are any error when SCCM upgrade.
(2) Check MPSetup.log and mpMSI.log to monitor MP installation.
(3) Check mpcontrol.log to monitor MP statues.
2, You can create a Microsoft Support Ticket from this link:
https://support.serviceshub.microsoft.com/supportforbusiness
Thanks for your time and patience!
Best regards,
Cherry
Hi,
I have figured out that in IIS was all my MP entry away after Upgrade. Here my IIS before upgrade
After Upgrade I could see only the following
It means all the SMS_MPs was away.
Here the prerequisite check
Only two warning. and the installation was successfully too.
I have no Idea why.
I have restored my SCCM from Backup and see the different IIS to the new IIS