How does Config Manager client determine it is internet or intranet connected?

Question

Hi,

How does SCCM Config Manager client determine it is internet or intranet connected?

Thanks,

Muja

Answer 1

Hello Muja,

Thank you for your question regarding how the SCCM (System Center Configuration Manager) client determines if it is connected to the internet or intranet. The SCCM client uses several mechanisms to make this determination. Here’s a detailed explanation:

Mechanisms for Determining Connection Type

1. Management Point (MP) Availability:
   • The SCCM client attempts to connect to Management Points (MPs) that are either configured for the intranet or internet.
   • Intranet MPs: Typically accessible only within the corporate network and might use internal DNS names.
   • Internet MPs: Accessible from outside the corporate network, often through public DNS names or internet-facing URLs.
2. Service Location Management (SLM) Cache:
   • The client uses the SLM cache to store information about available MPs.
   • The client first attempts to connect to intranet MPs using the SLM cache. If it fails, it tries to connect to internet MPs.
3. Network Location Awareness (NLA):
   • The client uses Network Location Awareness to determine the type of network it is connected to (e.g., domain network vs. public network).
   • If the client is connected to a domain network, it assumes it is on the intranet.
   • If the client is connected to a public network, it assumes it is on the internet.
4. Boundary Group:
   • SCCM uses boundary groups to define network locations and assign clients to site systems.
   • Boundaries can be based on IP subnets, IP address ranges, Active Directory sites, or IPv6 prefixes.
   • The client checks its current network location against these boundaries to determine if it is within an intranet or internet boundary.
5. Fallback Status Point (FSP):
   • The client may use the Fallback Status Point to send state messages when it cannot contact an MP.
   • The ability to reach the FSP can help the client determine its network location.
6. Client Settings and Network Configuration:
   • Specific client settings and network configurations in SCCM can influence how the client determines its connection type.
   • The client evaluates its network adapter settings, DNS suffixes, and other network attributes.

Troubleshooting Connection Type Determination

If the SCCM client is incorrectly determining its connection type, you can troubleshoot by:

1. Reviewing Client Logs:
   • LocationServices.log: Provides information about how the client finds MPs and distribution points.
   • ClientLocation.log: Logs details about the client’s network location determination process.
2. Checking Boundary Group Configuration:
   • Ensure that boundary groups are correctly configured in the SCCM console under **Administration** > **Hierarchy Configuration** > **Boundary Groups**.
3. Validating MP Accessibility:
   • Confirm that the MPs are correctly set up for both intranet and internet access.
   • Verify that the client can resolve and reach the appropriate MPs based on its network location.

If you have any further questions or need additional assistance, please let me know.

Best regards,

Rosy

Answer 2

Hi Rosy,

Thank you and you have explained me very well.

Thank you

Muja

Answer 3

Feel free to contact me anytime if you have any questions.

Rosy

Answer 4

I have some SCCM clients that incorrectly think they are on the internet (ccmsetup.log), keep trying to find a proxy server, and fail because the MP in their site only accepts intranet connections. There are servers in the same subnet that can communicate just fine. They have the same GPO's, same subnet, both running windows server 2022 (21H2).

This is SCCM 2403, HTTPS only, with internal PKI servers, 78 servers in the site and 15 are unhappy but the others are communicating fine. Certificates are good on both the server and client. Boundry and boundary groups settings are confirmed. The servers do not have any communications issues with the domain controllers either. All were communicating fine prior to the 2403 upgrade. Here is a couple of log entries from the ccmsetup.log

IsSslClientAuthEnabled - Determining provisioning mode state failed with 80070002. Defaulting to state of 31. ccmsetup 1/16/2025 2:15:58 PM 8200 (0x2008)

Client is on internet ccmsetup 1/16/2025 2:15:58 PM 8200 (0x2008)

Any ideas you have would be tremendously helpful!