SCCM upgrade to 2303

Question

SCCM upgrade to 2303

PerserPolis-1732 1,971

Hi,

I want to upgrade my SCCM 2207 to 2303. After running Prerequisite check I am getting the following warning

Completed with warning]:The site server configured with HTTPS/Enhanced HTTP, does not require network access account. Please verify the minimum appropriate permission of this account(s) and remove the account(s) which has higher privileges. We recommend you remove the configured network access account(s) which are not leveraged. For more information about your network access account required permissions, see https://go.microsoft.com/fwlink/?linkid=2210348.

What is the minimum permissions of NAA account and what is required permissions???

What happend if I remove the NAA account???

here my NAA setting

NAA

I ignored it and install the new version 2303. After installing I did see that all my devices was unreachable

sccm devices

I could not be able to repair it and I have restored my backup again.

#Here my Communication Security Setting

siteserver

my questions:

How can I resolve the warning with network account? ( I am using only http and not https)
How can I be sure after upgrade to 2303 that my Devices are online?

Regards

Ihab Abedrabbo 36 Reputation points

2023-06-21T08:43:17.4666667+00:00

I see that you do not have a PKI, so you MUST select the option USE CONFIGURATION MANAGER-GENERATED CERTIFICATES FOR HTTP SITE SYSTEMS. Also since you don't have a valid PKI, remove the check CLIENTS CHECK THE CERTIFICATE RECOVATION LIST (CRL) FOR SITE SYSTEMS. Wait for a while to let clients download the new settings and policies so they create the self-signed certificate. It might take from few minutes to few hours to change depending on many factors

5 answers

Your answer

Ihab Abedrabbo 36 Reputation points

2023-06-21T08:43:17.4666667+00:00

I see that you do not have a PKI, so you MUST select the option USE CONFIGURATION MANAGER-GENERATED CERTIFICATES FOR HTTP SITE SYSTEMS. Also since you don't have a valid PKI, remove the check CLIENTS CHECK THE CERTIFICATE RECOVATION LIST (CRL) FOR SITE SYSTEMS. Wait for a while to let clients download the new settings and policies so they create the self-signed certificate. It might take from few minutes to few hours to change depending on many factors

Answer 1

PerserPolis-1732 1,971

Hi,

I have figured out that in IIS was all my MP entry away after Upgrade. Here my IIS before upgrade

0 comments

Answer 2

PerserPolis-1732 1,971

Hi,

I have upgraded yesterday my SCCM to 2303 and I have a big issue with MP. It showing me 0 Byte and I cannot start the SMS_MP_CONTROL_MANAGER. If I run query in Service Manager, Error communicating with component.

I have remove the MP role and add again. The same issue. I cannot deploy any Applications.

Can you help me?

Could give me the Microsoft Support where I can create a Ticket?

CherryZhang-MSFT 6,511 Reputation points

2023-05-05T09:41:59.4533333+00:00

Hi @PerserPolis-1732,

1, To narrow down the problem, we need more information. Please help check the following logs to see if there are any error:

(1) Check CMUpdate.log to see if there are any error when SCCM upgrade.

(2) Check MPSetup.log and mpMSI.log to monitor MP installation.

(3) Check mpcontrol.log to monitor MP statues.

2, You can create a Microsoft Support Ticket from this link:

https://support.serviceshub.microsoft.com/supportforbusiness

Thanks for your time and patience!

Best regards,
Cherry

Answer 3

PerserPolis-1732 1,971

Sorry Cherry,

Also that Link you send me, I know too. But I cannot understand what is exactly the required permission, what Microsoft recommend.

I have created a domain user named NAA without any Admin right or such.

Is that enough or should I add the domain user to the Computer account or local Administrator.

How I can to add the NAA on the same, I know that

CherryZhang-MSFT 6,511 Reputation points

2023-05-04T06:08:44.0366667+00:00

Yes, we can use a normal domain user and grant this account permission to Access the distribution point from the network.

Answer 4

PerserPolis-1732 1,971

Hi,

Did you read my question carefully? I don't thing so. I have asked you the follwoing

What is the minimum permissions of NAA account and what is required permissions???

That link you send me, I know it and there is the exact text you wrote me. Please remove the NAA and add a new.

But I ask you again what is "with only the required permissions" Did you see my screenshot for the Account NAA?

Regards

Nick

CherryZhang-MSFT 6,511 Reputation points

2023-05-02T09:45:31.3533333+00:00

Hi @PerserPolis-1732,

Thanks for the reminder!

What is the minimum permissions of NAA account.

1, Client computers use the network access account when they can't use their local computer account to access content on distribution points. It mostly applies to workgroup clients and computers from untrusted domains. This account is also used during OS deployment, when the computer that's installing the OS doesn't yet have a computer account on the domain.

>> what is required permissions.

2, For what is NAA account required permissions, please refer to this link:

How to Configure Network Access Account in SCCM ConfigMgr (prajwaldesai.com)

Note: Microsoft provides third-party contact information to help you understand the problem. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.

Thanks for your time and patience!

Best regards,
Cherry
Ihab Abedrabbo 36 Reputation points

2023-06-21T08:07:12.1466667+00:00

This account should simply be a DOMAIN USER only with no other privileges. Other Microsoft articles also suggest to use a GPO to deny interactive logon to this user (i.e., this user must not perform any logon to any device, rather than be used only to access the DP content while in Windows PE during OSD).

The problem with the Prerequisite Check (which I think it is a bug), is that it cannot verify the membership of this account and will always report a warning even if you configure it correctly.

Remaining on the same topic, this is what I see from my own C:\ConfigMgrPrereq.log

**Network Access Account (NAA) account usage alert; Warning; The site server configured with HTTPS/Enhanced HTTP, does not require network access account. Please verify the minimum appropriate permission of this account(s) and remove the account(s) which has higher privileges. We recommend you remove the configured network access account(s) which are not leveraged. For more information about your network access account required permissions, see https://go.microsoft.com/fwlink/?linkid=2210348**.

This is quite confusing. It first says: ***The site server configured with HTTPS/Enhanced HTTP, does not require network access account. ***Then it says: Please verify the minimum appropriate permission of this account(s) and remove the account(s) which has higher privileges. If it is not required, then why suggest to use the minimum privileges rather than suggesting to remove it completely?

Answer 5

Hi @PerserPolis-1732,

1, For prerequisite check warning, please try to remove the NNA and add a new one with only the required permissions and run prerequisite check again.

This reference link for your reference:

https://blog.hametbenoit.info/2022/12/07/sccm-the-new-2211-version-of-sccm-is-now-available-and-has-a-new-prerequisite/#.ZEueP3ZByUk

Note: Microsoft provides third-party contact information to help you understand the problem. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.

2, However, the client device displayed as unreachable may be caused by other reasons.

(1) Please upgrade to the new version again and check if the problem also occurs.

If the problem recurs, please help check if the server version has been completely upgraded and if there are any other issues. Besides, if there are any other issues present, please help upload CMUpdate.log for our reference.

To check SCCM version we can refer to this link:

Complete SCCM 2303 Upgrade Guide | Update to ConfigMgr 2303 (prajwaldesai.com)

Note: Microsoft provides third-party contact information to help you understand the problem. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.

(2) Please help check whether your "Fast Channel Push Notification" works properly? Please help check the following logs to see if there are any error. If so, please upload full log for our reference.

Notification manager(Located in site servers): BGBmgr.log.
Notification server(Located in MP): BGBServer.log.
Notification Agent(Located in client): CcmNotificationAgent.log and locationservices.log.

This similar case for your reference:

SCCM Client icons showing offline - how to fix this? - Microsoft Q&A

Looking forward to your feedback.

Best regards

Cherry

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Share via

SCCM upgrade to 2303

5 answers

Your answer