<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:atom="http://www.w3.org/2005/Atom" xmlns:sy="http://purl.org/rss/1.0/modules/syndication/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:wfw="http://wellformedweb.org/CommentAPI/" xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
  version="2.0">
  <channel>
    <title>Renato Pacheco’s Blog</title>
    <atom:link
      href="https://docs.microsoft.com/archive/blogs/repach/feed.xml"
      rel="self"
      type="application/rss+xml" />
    <link>https://docs.microsoft.com/archive/blogs/repach/feed.xml</link>
    <description>My Journey learning System Center Configuration Manager</description>
    <lastBuildDate>Tue, 16 Apr 2019 06:15:11 GMT</lastBuildDate>
    <language>en-US</language>
    <sy:updatePeriod>hourly</sy:updatePeriod>
    <sy:updateFrequency>1</sy:updateFrequency>
    <item>
      <title>Ghost Management Point: Duplicate MP entries in the Location Services Log</title>
      <link>https://docs.microsoft.com/archive/blogs/repach/ghost-management-point-duplicate-mp-entries-in-the-location-services-log</link>
      <pubDate>Sat, 30 Jun 2018 02:49:28 GMT</pubDate>
      <dc:creator><![CDATA[Renato S. Pacheco]]></dc:creator>
      <guid
        isPermaLink="false">https://blogs.technet.microsoft.com/repach/?p=125</guid>
      <description><![CDATA[Hello Y ’all,

Here an interesting issue I recently work with, this is the case of the Ghost...]]></description>
      <content:encoded><![CDATA[Hello Y ’all,

Here an interesting issue I recently work with, this is the case of the Ghost Management Point. Spooky? Ow Yea.

<img src="https://msdnshared.blob.core.windows.net/media/2018/06/bill-murray-cazafantasmas-pic3-pxl2-300x149.jpg" alt="" width="344" height="171" class="alignnone wp-image-135" />

<strong>The Symptoms:</strong>

Client machines suddenly stopped getting new software, new updates, new policies.
Upon further investigation, <strong>LocationServices.log</strong> at the client machines, gave us the first clue:

LocationServices 14508 (0x38ac) Refreshing security settings over AD
LocationServices 14508 (0x38ac) Performing AD query: '(&amp;amp;(ObjectCategory=mSSMSManagementPoint)(mSSMSDefaultMP=TRUE)(mSSMSSiteCode=PRI))'
LocationServices 14508 (0x38ac) OperationalXml '&lt;clientoperationalsettings&gt;&lt;version&gt;5.00.8540.1005&lt;/version&gt;&lt;securityconfiguration&gt;&lt;securitymodemask&gt;0&lt;/securitymodemask&gt;&lt;securitymodemaskex&gt;224&lt;/securitymodemaskex&gt;&lt;httpport&gt;80&lt;/httpport&gt;&lt;httpsport&gt;443&lt;/httpsport&gt;&lt;certificatestorename&gt;&lt;/certificatestorename&gt;&lt;certificateissuers&gt;&lt;/certificateissuers&gt;&lt;certificateselectioncriteria&gt;&lt;/certificateselectioncriteria&gt;&lt;certificateselectfirstflag&gt;1&lt;/certificateselectfirstflag&gt;&lt;pkicertoptions&gt;0&lt;/pkicertoptions&gt;&lt;sitesigningcert&gt;&lt;/sitesigningcert&gt;&lt;/securityconfiguration&gt;&lt;rootsitecode&gt;PRI&lt;/rootsitecode&gt;&lt;ccm&gt; &lt;commandline&gt;SMSSITECODE=PRI&lt;/commandline&gt; &lt;/ccm&gt;&lt;fsp&gt; &lt;fspserver&gt;&lt;/fspserver&gt; &lt;/fsp&gt;&lt;capabilities schemaversion="1.0"&gt;&lt;property name="SSLState" value="0"&gt;&lt;/property&gt;&lt;/capabilities&gt;&lt;domain value="contoso.local"&gt;&lt;/domain&gt;&lt;forest value="contoso.local"&gt;&lt;/forest&gt;&lt;aadconfig version="1.0"&gt;&lt;timestamp&gt;2017-11-03 10:37:03&lt;/timestamp&gt;&lt;tenants&gt;&lt;/tenants&gt;&lt;/aadconfig&gt;&lt;/clientoperationalsettings&gt;'
LocationServices 14508 (0x38ac) !aadInfo.sTenantId.empty() &amp;amp;&amp;amp; !aadInfo.sClientAppId.empty() &amp;amp;&amp;amp; !aadInfo.sResourceUri.empty(), HRESULT=87d00215 (..\CcmToken.cpp,2337)
LocationServices 14508 (0x38ac) <span style="background-color: #ffff00">The MP name retrieved is 'MP01.contoso.local' with version '8540' and capabilities '&lt;capabilities schemaversion="1.0"&gt;&lt;property name="SSLState" value="0"&gt;&lt;/property&gt;&lt;/capabilities&gt;'</span>
<span style="background-color: #ffff00">LocationServices 14508 (0x38ac) MP 'MP01.contoso.local' is compatible</span>
LocationServices 14508 (0x38ac) !aadInfo.sTenantId.empty() &amp;amp;&amp;amp; !aadInfo.sClientAppId.empty() &amp;amp;&amp;amp; !aadInfo.sResourceUri.empty(), HRESULT=87d00215 (..\CcmToken.cpp,2337)
LocationServices 14508 (0x38ac) <span style="background-color: #ffff00">The MP name retrieved is 'MP01.contoso.local' with version '8634' and capabilities '&lt;capabilities schemaversion="1.0"&gt;&lt;property name="SSL" version="1"&gt;&lt;/property&gt;&lt;property name="SSLState" value="31"&gt;&lt;/property&gt;&lt;/capabilities&gt;'</span>
<span style="background-color: #ffff00">LocationServices 14508 (0x38ac) MP 'MP01.contoso.local' is not compatible</span>
LocationServices 14508 (0x38ac) !aadInfo.sTenantId.empty() &amp;amp;&amp;amp; !aadInfo.sClientAppId.empty() &amp;amp;&amp;amp; !aadInfo.sResourceUri.empty(), HRESULT=87d00215 (..\CcmToken.cpp,2337)
LocationServices 14508 (0x38ac) The MP name retrieved is 'MP02.contoso.local' with version '8634' and capabilities '&lt;capabilities schemaversion="1.0"&gt;&lt;property name="SSL" version="1"&gt;&lt;/property&gt;&lt;property name="SSLState" value="31"&gt;&lt;/property&gt;&lt;/capabilities&gt;'
LocationServices 14508 (0x38ac) MP 'MP02.contoso.local' is not compatible
LocationServices 14508 (0x38ac) Retrieved 1 MP records from AD for site 'PRI'
LocationServices 14508 (0x38ac) Received client operational settings: &lt;clientoperationalsettings&gt;&lt;version&gt;5.00.8540.1005&lt;/version&gt;&lt;securityconfiguration&gt;&lt;securitymodemask&gt;0&lt;/securitymodemask&gt;&lt;securitymodemaskex&gt;224&lt;/securitymodemaskex&gt;&lt;httpport&gt;80&lt;/httpport&gt;&lt;httpsport&gt;443&lt;/httpsport&gt;&lt;certificatestorename&gt;&lt;/certificatestorename&gt;&lt;certificateissuers&gt;&lt;/certificateissuers&gt;&lt;certificateselectioncriteria&gt;&lt;/certificateselectioncriteria&gt;&lt;certificateselectfirstflag&gt;1&lt;/certificateselectfirstflag&gt;&lt;pkicertoptions&gt;0&lt;/pkicertoptions&gt;&lt;sitesigningcert&gt;&lt;/sitesigningcert&gt;&lt;/securityconfiguration&gt;&lt;rootsitecode&gt;PRI&lt;/rootsitecode&gt;&lt;ccm&gt; &lt;commandline&gt;SMSSITECODE=PRI&lt;/commandline&gt; &lt;/ccm&gt;&lt;fsp&gt; &lt;fspserver&gt;&lt;/fspserver&gt; &lt;/fsp&gt;&lt;capabilities schemaversion="1.0"&gt;&lt;property name="SSLState" value="0"&gt;&lt;/property&gt;&lt;/capabilities&gt;&lt;domain value="contoso.local"&gt;&lt;/domain&gt;&lt;forest value="contoso.local"&gt;&lt;/forest&gt;&lt;aadconfig version="1.0"&gt;&lt;timestamp&gt;2017-11-03 10:37:03&lt;/timestamp&gt;&lt;tenants&gt;&lt;/tenants&gt;&lt;/aadconfig&gt;&lt;/clientoperationalsettings&gt;.

Yes, I know what you are thinking, somewhere in one of the related domains we will find a duplicated msSMSManagementPoint for MP01, right? That is what I thought so too, but we could not find it, anywhere. Worse yet, more and more clients were failing to retrieve the proper Management Point, because of the duplicate Management Point that was set to be HTTP, the true MP01 and MP02 are in fact HTTPS configured.

<strong>The Investigation:</strong>

It is time to bring the big guns, yes, the Directory Services Team!
By the way, Thank you very much for the help <strong>Renato Pagan</strong> , <strong>Mike Resnick and Clint Koenig</strong>.
We initially through that there was some Domain Controller, some Domain that we were not thinking of that may contained the Ghost Management Point entry somewhere.

I initially found this article from the Scripting Guys,

<a target="_blank" href="https://blogs.technet.microsoft.com/heyscriptingguy/2010/12/01/use-powershell-to-query-active-directory-from-the-console/" rel="noopener">Use PowerShell to Query Active Directory from the Console</a>

And Did this PowerShell Monstrosity:

LocationServices 9172 (0x23d4) Performing AD query: <code>'(&amp;(ObjectCategory=mSSMSManagementPoint)(mSSMSDefaultMP=TRUE)(mSSMSSiteCode=PRI))'</code>

<!-- HTML generated using hilite.me -->
<div style="background: #ffffff;overflow: auto;width: auto;border: solid gray;border-width: .1em .1em .1em .8em;padding: .2em .6em">
<pre style="margin: 0;line-height: 125%">((<span style="color: #007020">New-Object</span> DirectoryServices.DirectorySearcher <span style="background-color: #fff0f0">"ObjectCategory=mSSMSManagementPoint"</span>).findall()).Properties
</pre>
</div>
The goal was to go through as many domains that were related to the client machine as possible.
Later on talking to Renato Pagan he suggested to use this PowerShell that could be used and also point the Domain Controller we directly contacting”

<!-- HTML generated using hilite.me -->
<div style="background: #ffffff;overflow: auto;width: auto;border: solid gray;border-width: .1em .1em .1em .8em;padding: .2em .6em">
<pre style="margin: 0;line-height: 125%"><span style="color: #007020">Get-ADObject</span> -SearchBase (<span style="background-color: #fff0f0">"CN=System Management,"</span> + (<span style="color: #007020">Get-ADDomain</span>).SystemsContainer) -LDAPFilter <span style="background-color: #fff0f0">"(&amp;amp;(objectClass=mSSMSManagementPoint))"</span> -Property * -Server DC01
</pre>
</div>
And to find which Domain Controller the client machine was connected to, we did not use SET LOGONSERVER, in fact we used nltest, as this example:

<!-- HTML generated using hilite.me -->
<div style="background: #ffffff;overflow: auto;width: auto;border: solid gray;border-width: .1em .1em .1em .8em;padding: .2em .6em">
<pre style="margin: 0;line-height: 125%">nltest /sc_query: contoso.local
Flags: 30 HAS_IP HAS_TIMESERV
Trusted DC Name \\DC01. contoso.local
Trusted DC Connection Status Status = 0 0x0 NERR_Success
The command completed successfully
</pre>
</div>
With this in hand we tried to run the PowerShell again, but still, we were unable to find the Ghost Management Point.
We also used ldifde queries to have a broader search, nothing

<code>ldifde -f contoso_local.ldf -d dc=contoso,dc=local -r "(objectclass=msSMSManagementPoint)" -l cn,msSMSVersion</code>

Things were getting desperate, and more and more clients were getting assigned to the Ghost Management Point. So, Mike Resnik suggested to capture a trace from the client machine, that would help us identify the specific LDAP query results we were getting from those clients. Two scripts:

<strong>START.CMD and STOP.CMD</strong>

<strong>START.CMD</strong> contains the capture, that includes the ccmxec.exe that is pushing the LDAP query, a network trace, and also enabling Verbose Logs for NetLogon for good mPRIure:

<code>Reg add HKLM\System\CurrentControlSet\Services\ldap\Tracing\ccmexec.exe /f
netsh trace start capture=yes maxsize=2048 tracefile=c:\temp\%computername%.etl
REM Option to specify process ID (see KB 2221529):
REM Reg add HKLM\System\CurrentControlSet\Services\ldap\Tracing\&amp;ProcessName.exe&amp; /v PID /t REG_DWORD /d PID /f
REM You can also trace multiple processes at the same time by creating multiple registry keys
logman create trace "ds_ds" -ow -o c:\temp\ds_ds.etl -p "Microsoft-Windows-LDAP-Client" 0x1a59afa3 0xff -nb 16 16 -bs 1024 -mode Circular -f bincirc -max 4096 -ets
logman update trace "ds_ds" -p "Microsoft-Windows-ADSI" 0xffffffffffffffff 0xff -ets
nltest /dbflag:ffffffff</code>

<strong>STOP.CMD</strong> simply condensates the results, and saves them nice and pretty:

<code>logman stop "ds_ds" -ets
netsh stop
Reg delete HKLM\System\CurrentControlSet\Services\ldap\Tracing\ccmexec.exe /f
nltest /dbflag:2080ffff
copy c:\windows\debug\netlogon.log C:\temp\.</code>

So, we prepared the machine, by removing the registry value under:

<strong>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CCM\Security</strong>
And wiped the value of the key SigningCertificate to force the client to register.
From a command prompt as Admin we executed the START.CMD and started the ccmexec service.
Observing the LocationServices.log we saw the behavior happening and executed the STOP.CMD.

With the results in hand, it is time to look at them. So close now, I promise!
Using Microsoft Message Analyzer, we opened the ds_ds.etl from the results, and started looking for the 8540 version, that was being returned for the client, a quick tip is select all the message in Message Analyzer and paste in Notepad++, much faster to find what you are looking for, especially with text.
And, behold! There is your Ghost Management Point, first hand:

<code>zCN=SMS-MP-PRI-MP01.CONTOSO.LOCAL\0ACNF:dee8d902-4b84-4eac-ab11-765116270f53,CN=System.Management,CN=System,DC=contoso,DC=local0.....0.......distinguishedName1....|.zCN=SMS-MP-PRI-MP01.CONTOSO.LOCAL\0ACNF:dee8d902-4b84-4eac-ab11-765116270f53,CN=System.Management,CN=System,DC=contoso,DC=local0....(..dNSHostName1.......MP01.contoso.local0....(..mSSMSMPName1.......MP01.CONTOSO.LOCAL0.......mSSMSVersion1.......85400.......mSSMSCapabilities1....w.....q5.00.8540.1005</code>

<strong>The light at the end of the tunnel:</strong>

Great, we found it, now what?
So, this, this is a conflict record in active directory, that happened somehow during a Domain Controller replication or other situation in which two records with the same name existed simultaneously.
To fix that? LOL, yes, I am serious, LOL…

<a target="_blank" href="https://support.microsoft.com/en-us/help/3141939/description-of-the-lingering-object-liquidator-tool" rel="noopener">Description of the Lingering Object Liquidator tool</a>

<a target="_blank" href="https://www.microsoft.com/en-us/download/details.aspx?id=56051" rel="noopener">Lingering Object Liquidator (LoL)</a>

Once we used the Lingering Object Liquidator, LoL, and Purged the Unclean, ok, Dawn of War references at this point, seriously Renato? The good news is, once the Object was removed from Active Directory the clients are now able to properly return the values for the two existing Management Points, register, and live happily ever after.]]></content:encoded>
    </item>
    <item>
      <title>Unable to Install Dmp Connector with error: Bootstrap operation failed with error code 183</title>
      <link>https://docs.microsoft.com/archive/blogs/repach/unable-to-install-dmp-connector-with-error-bootstrap-operation-failed-with-error-code-183</link>
      <pubDate>Sun, 20 May 2018 09:46:51 GMT</pubDate>
      <dc:creator><![CDATA[Renato S. Pacheco]]></dc:creator>
      <guid
        isPermaLink="false">https://blogs.technet.microsoft.com/repach/?p=115</guid>
      <description><![CDATA[Hello Y'all,

It has a been a while since I wrote, and I will try to keep writing more stories...]]></description>
      <content:encoded><![CDATA[Hello Y'all,

It has a been a while since I wrote, and I will try to keep writing more stories about my experiences.
For this story, another long tale and a short answer, however my intent with this blog is not to give and answer to an error or a magic pill.
I want to open my toolbox and show something that can be used to help your troubleshooting and understanding of the product.


<strong>[The Scenario:]</strong>


The issue was discover when trying to upgrade the environment to 1802, there was no updates available in the SCCM console.
And looking at the DMPDownloader.log and DMPUploader.log, the last entry was from January of 2018.
And if we tried to restart one of those two components using compmgr.exe, we would get an error saying that we were unable to connect to the component.
Lets start the detective work.
The first step is to check the <strong>sitecomp.log</strong>, that is responsible for the installation of the components, in my logic, that's the place to start.

And here is what we could see:

====================================================================
SMS_SITE_COMPONENT_MANAGER 5880 (0x16f8) Reinstalling component SMS_CLOUD_USERSYNC...
SMS_SITE_COMPONENT_MANAGER 5880 (0x16f8) STATMSG: ID=1018 SEV=I LEV=M SOURCE="SMS Server" COMP="SMS_CLOUD_USERSYNC" SYS= SITE=RSP PID=4520 TID=5880 GMTDATE=Sun May 20 03:04:49.248 2018 ISTR0="" ISTR1="" ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=0
SMS_SITE_COMPONENT_MANAGER 5880 (0x16f8) LogEvent(): Successfully logged Event to NT Event Log (4, 110, 1073742842, (null)).
SMS_SITE_COMPONENT_MANAGER 5880 (0x16f8) Writing component specific registry values.
SMS_SITE_COMPONENT_MANAGER 5880 (0x16f8) Registry keys Operations Management\SMS Server Role\SMS Dmp Connector already exists on server .
SMS_SITE_COMPONENT_MANAGER 5880 (0x16f8) Writing SQL Alias registry values.
SMS_SITE_COMPONENT_MANAGER 5880 (0x16f8) Configure Sql server alias DBMSSOCN,,1433
SMS_SITE_COMPONENT_MANAGER 5880 (0x16f8) Installed CloudUserSync for .
SMS_SITE_COMPONENT_MANAGER 5880 (0x16f8) Found 1 files to register with Regasm.exe
SMS_SITE_COMPONENT_MANAGER 5880 (0x16f8) The server already contains some of the required files for this component. A disk space check will not be made.
SMS_SITE_COMPONENT_MANAGER 5880 (0x16f8) Installed service SMS_SERVER_BOOTSTRAP_RP-PRI-01.
SMS_SITE_COMPONENT_MANAGER 5880 (0x16f8) Starting service SMS_SERVER_BOOTSTRAP_RP-PRI-01 with command-line arguments "RSP E:\Program Files\Microsoft Configuration Manager /regasm E:\Program Files\Microsoft Configuration Manager\bin\x64\Microsoft.ConfigurationManager.DmpConnector.Usersync.dll none"...
SMS_SITE_COMPONENT_MANAGER 5880 (0x16f8) E:\Program Files\Microsoft Configuration Manager\bin\x64\Microsoft.ConfigurationManager.DmpConnector.Usersync.dll is done successfully.
SMS_SITE_COMPONENT_MANAGER 5880 (0x16f8) Bootstrap operation successful.
SMS_SITE_COMPONENT_MANAGER 5880 (0x16f8) Deinstalled service SMS_SERVER_BOOTSTRAP_.
SMS_SITE_COMPONENT_MANAGER 5880 (0x16f8) Bootstrap operations completed.
SMS_SITE_COMPONENT_MANAGER 5880 (0x16f8) All files installed.
SMS_SITE_COMPONENT_MANAGER 5880 (0x16f8) Starting bootstrap operations...
SMS_SITE_COMPONENT_MANAGER 5880 (0x16f8) Installed service SMS_SERVER_BOOTSTRAP_.
SMS_SITE_COMPONENT_MANAGER 5880 (0x16f8) Starting service SMS_SERVER_BOOTSTRAP_ with command-line arguments "RSP E:\Program Files\Microsoft Configuration Manager /install E:\Program Files\Microsoft Configuration Manager\bin\x64\rolesetup.exe CONNECTOR "...
SMS_SITE_COMPONENT_MANAGER 5880 (0x16f8) <strong><mark>Bootstrap operation failed with error code 183</mark></strong>
SMS_SITE_COMPONENT_MANAGER 5880 (0x16f8) "E:\Program Files\Microsoft Configuration Manager\bin\x64\rolesetup.exe /install /siteserver:" executed successfully on server .
SMS_SITE_COMPONENT_MANAGER 5880 (0x16f8) Bootstrap operation successful.
SMS_SITE_COMPONENT_MANAGER 5880 (0x16f8) Deinstalled service SMS_SERVER_BOOTSTRAP_.
SMS_SITE_COMPONENT_MANAGER 5880 (0x16f8) Bootstrap operations aborted.
SMS_SITE_COMPONENT_MANAGER 5880 (0x16f8) Reinstallation failed and will be retried in the next polling cycle.
====================================================================

The operation starts, it calls the service SMS_SERVER_BOOTSTRAP, and <strong>Bootstrap(srvboot.exe)</strong> calls the rolesetup.exe.
Looking at the error 183, there isn't much to it, and one would think, maybe it was trying to look at something that was already there... hold that though.

====================================================================
Error Code: 0xB7 (183)
Error Name: ERROR_ALREADY_EXISTS
Error Source: Windows
<strong><mark>Error Message: Cannot create a file when that file already exists.</mark></strong>
====================================================================

So using our good friend Procmon from <a target="_blank" href="http://live.sysinternals.com" rel="noopener">Sysinternals Suite</a> I tracked only the rolesetup.exe.

====================================================================
rolesetup.exe 7476 RegQueryKey HKLM SUCCESS Query: HandleTags, HandleTags: 0x0
rolesetup.exe 7476 RegOpenKey HKLM\Software\Microsoft\Rpc SUCCESS Desired Access: Query Value
rolesetup.exe 7476 RegQueryValue HKLM\SOFTWARE\Microsoft\Rpc\IdleTimerWindow NAME NOT FOUND Length: 144
rolesetup.exe 7476 RegCloseKey HKLM\SOFTWARE\Microsoft\Rpc SUCCESS
rolesetup.exe 7476 CreateFile E:\Program Files\Microsoft Configuration Manager\Logs\ConnectorSetup.log SUCCESS Desired Access: Generic Write, Read Attributes, Disposition: OpenIf, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Write, AllocationSize: 0, OpenResult: Opened
<mark>rolesetup.exe 7476 QueryStandardInformationFile E:\Program Files\Microsoft Configuration Manager\Logs\<strong>ConnectorSetup.log</strong> SUCCESS AllocationSize: 204,800, EndOfFile: 204,376, NumberOfLinks: 1, DeletePending: False, Directory: False</mark>
rolesetup.exe 7476 QueryStandardInformationFile E:\Program Files\Microsoft Configuration Manager\Logs\ConnectorSetup.log SUCCESS AllocationSize: 204,800, EndOfFile: 204,376, NumberOfLinks: 1, DeletePending: False, Directory: False
rolesetup.exe 7476 QueryStandardInformationFile E:\Program Files\Microsoft Configuration Manager\Logs\ConnectorSetup.log SUCCESS AllocationSize: 204,800, EndOfFile: 204,376, NumberOfLinks: 1, DeletePending: False, Directory: False
rolesetup.exe 7476 WriteFile E:\Program Files\Microsoft Configuration Manager\Logs\ConnectorSetup.log SUCCESS Offset: 204,376, Length: 135, Priority: Normal
rolesetup.exe 7476 CloseFile E:\Program Files\Microsoft Configuration Manager\Logs\ConnectorSetup.log SUCCESS
rolesetup.exe 7476 QueryOpen E:\Program Files\Microsoft Configuration Manager\EasySetupPayload SUCCESS CreationTime: 7/24/2017 6:20:29 PM, LastAccessTime: 5/18/2018 11:09:41 PM, LastWriteTime: 5/18/2018 11:09:41 PM, ChangeTime: 5/19/2018 9:59:42 PM, AllocationSize: 4,096, EndOfFile: 4,096, FileAttributes: D
rolesetup.exe 7476 RegQueryKey HKLM SUCCESS Query: HandleTags, HandleTags: 0x0
====================================================================

Good boy! Procmon directed us to where we needed to go, looking at the entries when we restart the Site Component service the command line for the installation is writing to the log(ConnectorSetup.log).
And looking at the end or the Connector setup log, we see that we are getting an access denied to the folder EasySetupPayload
And we also get the error we were seeing in the sitecomp.log when the bootstrap service was failing: CONNECTOR could not be installed. The return code was 183

====================================================================
CONNECTOR Setup Started....
Parameters: E:\Program Files\Microsoft Configuration Manager\bin\x64\rolesetup.exe /install /siteserver:RP-PRI-01 CONNECTOR 0
Installing Pre Reqs for CONNECTOR
======== Installing Pre Reqs for Role CONNECTOR ========
Found 1 Pre Reqs for Role CONNECTOR
Pre Req SqlNativeClient found.
SqlNativeClient already installed (Product Code: {1385D3DB-8E80-427B-91D2-B7535862B8E4}). Would not install again.
Pre Req SqlNativeClient is already installed. Skipping it.
======== Completed Installation of Pre Reqs for Role CONNECTOR ========
Installing the CONNECTOR
Passed OS version check.
.NET Framework 4.0 Full profile is installed.
.NET Framework 4.5 or later Full profile is installed.
CTool::RegisterManagedBinary: run command line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe" "E:\Program Files\Microsoft Configuration Manager\bin\x64\Microsoft.ConfigurationManager.DmpConnector.DataUpload.dll"
CTool::RegisterManagedBinary: Registered E:\Program Files\Microsoft Configuration Manager\bin\x64\Microsoft.ConfigurationManager.DmpConnector.DataUpload.dll successfully
Registered DLL E:\Program Files\Microsoft Configuration Manager\bin\x64\Microsoft.ConfigurationManager.DmpConnector.DataUpload.dll
CTool::RegisterManagedBinary: run command line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe" "E:\Program Files\Microsoft Configuration Manager\bin\x64\Microsoft.ConfigurationManager.DmpConnector.MessageDownload.dll"
CTool::RegisterManagedBinary: Registered E:\Program Files\Microsoft Configuration Manager\bin\x64\Microsoft.ConfigurationManager.DmpConnector.MessageDownload.dll successfully
Registered DLL E:\Program Files\Microsoft Configuration Manager\bin\x64\Microsoft.ConfigurationManager.DmpConnector.MessageDownload.dll
CTool::RegisterManagedBinary: run command line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe" "E:\Program Files\Microsoft Configuration Manager\bin\x64\Microsoft.ConfigurationManager.DmpConnector.Usersync.dll"
CTool::RegisterManagedBinary: Registered E:\Program Files\Microsoft Configuration Manager\bin\x64\Microsoft.ConfigurationManager.DmpConnector.Usersync.dll successfully
Registered DLL E:\Program Files\Microsoft Configuration Manager\bin\x64\Microsoft.ConfigurationManager.DmpConnector.Usersync.dll
CTool::RegisterManagedBinary: run command line: "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegAsm.exe" "E:\Program Files\Microsoft Configuration Manager\bin\x64\IntuneContentManager\Microsoft.ConfigurationManager.IntuneContentManager.dll" /codebase
CTool::RegisterManagedBinary: Failed to register E:\Program Files\Microsoft Configuration Manager\bin\x64\IntuneContentManager\Microsoft.ConfigurationManager.IntuneContentManager.dll with .Net Fx 2.0
CTool::RegisterManagedBinary: run command line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe" "E:\Program Files\Microsoft Configuration Manager\bin\x64\IntuneContentManager\Microsoft.ConfigurationManager.IntuneContentManager.dll" /codebase
CTool::RegisterManagedBinary: Registered E:\Program Files\Microsoft Configuration Manager\bin\x64\IntuneContentManager\Microsoft.ConfigurationManager.IntuneContentManager.dll successfully
Registered DLL E:\Program Files\Microsoft Configuration Manager\bin\x64\IntuneContentManager\Microsoft.ConfigurationManager.IntuneContentManager.dll
<strong><mark>Creating EasySetupPayload share to point to: E:\Program Files\Microsoft Configuration Manager\EasySetupPayload
Failed to create share EasySetupPayload (0x00000005)
CreateLocalShare failed; 0x80070005
Failed to create EasySetupPayload share
CONNECTOR could not be installed. The return code was 183
~RoleSetup().</mark></strong>

====================================================================


<strong>[The resolution:]</strong>


Reviewing the EasySetupPayload share and comparing the Permissions to my lab server, the SYSTEM account was removed both from the share and from the Security Tab.
Once we added the SYSTEM account with Full Permissions to the Share and to the Security TAB the next polling cycle, the installation was successful:

====================================================================
Creating EasySetupPayload share to point to: E:\Program Files\Microsoft Configuration Manager\EasySetupPayload
Succesfully created share EasySetupPayload
EasySetupPayload share was created successfully
Creating AdminUIContentPayload share to point to: E:\Program Files\Microsoft Configuration Manager\AdminUIContentPayload
Succesfully created share AdminUIContentPayload
<strong>AdminUIContentPayload share was created successfully
<mark>Installation was successful.</mark></strong>
~RoleSetup().
====================================================================]]></content:encoded>
    </item>
    <item>
      <title>Unable to process new DDRs in SCCM: A long tale and a short answer</title>
      <link>https://docs.microsoft.com/archive/blogs/repach/a-long-tale-and-a-short-answer</link>
      <pubDate>Mon, 12 Jun 2017 08:03:11 GMT</pubDate>
      <dc:creator><![CDATA[Renato S. Pacheco]]></dc:creator>
      <guid
        isPermaLink="false">https://blogs.technet.microsoft.com/repach/?p=45</guid>
      <description><![CDATA[Hello Y’all,

This is an interesting problem that I worked a couple of weeks ago, and it was a...]]></description>
      <content:encoded><![CDATA[Hello Y’all,

This is an interesting problem that I worked a couple of weeks ago, and it was a thought-provoking mystery until we figured out what was happening, as always, with a little help from my friends.

<strong>The mystery and the problem:</strong>

Here is the deal, no new computer objects that were being discovered by SCCM were showing up under

Assets and <strong>Compliance\Overview\Devices</strong>, but why?

We started looking for clues under the <strong><a href="https://docs.microsoft.com/en-us/sccm/core/plan-design/hierarchy/log-files#BKMK_DiscoveryLog">Data Discovery Manager logs</a></strong>, DDM.log:

*** Exec spGetNextIDInARange N'NextIds', N'NextMachineID', N'System_DISC', 16777216, 25165823, N'ItemKey' SMS_DISCOVERY_DATA_MANAGER
<span style="background-color: #ffff00">*** [42000][229][Microsoft][SQL Server Native Client 11.0][SQL Server]The SELECT permission was denied on the object 'NextIds', database 'CM_PRI', schema 'dbo'. SMS_DISCOVERY_DATA_MANAGER</span>
WARNING - GetNextIDInARange() failed to execute SMS_DISCOVERY_DATA_MANAGER CDiscoveryDataManager::ProcessDDR - could not get next available item key. SMS_DISCOVERY_DATA_MANAGER
CDiscoverDataManager::ProcessDDRs_PS - SQL problem detected. Will retry later. SMS_DISCOVERY_DATA_MANAGER CDiscoverDataManager::THREAD_ProcessNonUserDDRs - Failed to manage files in inbox. Will retry in at least 60 seconds SMS_DISCOVERY_DATA_MANAGER
Refreshing site settings..... SMS_DISCOVERY_DATA_MANAGER
Processing file adum3ayb.DDR SMS_DISCOVERY_DATA_MANAGER *** Exec spGetNextIDInARange N'NextIds_G', N'NextUserID', N'User_DISC', 2063597568, 2080374783, N'ItemKey' SMS_DISCOVERY_DATA_MANAGER
<span style="background-color: #ffff00">*** [42000][229][Microsoft][SQL Server Native Client 11.0][SQL Server]The SELECT permission was denied on the object 'NextIds_G', database 'CM_PRI, schema 'dbo'. SMS_DISCOVERY_DATA_MANAGER</span>
WARNING - GetNextIDInARange() failed to execute SMS_DISCOVERY_DATA_MANAGER CDiscoveryDataManager::ProcessDDR - could not get next available item key. SMS_DISCOVERY_DATA_MANAGER
CDiscoverDataManager::ProcessUserDDRs_PS - SQL problem detected. Will retry later. SMS_DISCOVERY_DATA_MANAGER CDiscoverDataManager::THREAD_ProcessUserDDRs - Failed to manage files in inbox. Will retry in at least 60 seconds SMS_DISCOVERY_DATA_MANAGER

What we were seeing was an access denied for the '<strong>NextIds</strong>' and <strong>'NextIds</strong>_G'. OK, we get that, without a <strong>NextId</strong>, no new computers will be added… but who was trying to select those objects? I<strong>mportant: the SCCM environment was a Primary Site and a Remote SQL Database</strong>, so maybe the Computer account did not have the necessary access to the database, or something corrupted the access of the Primary server computer account in the SQL database. That was the theory, and theories are nothing if you can’t test them, right?

So, let’s test the theory by removing the computer account from the SQL database, and re-adding it. Well, THAT was something I haven’t done before, and it was a great learning experience.

(SPOILER ALERT! The steps below to remove and re-add the account did <strong><em>not</em> </strong>solve the problem, but they were part of the process that I went through to try solve the problem, and of course, this is the whole idea of these posts, so that even though some troubleshooting I'm showing you here did not solve the problem, it may help you to resolve yours, because although the problems and error messages may be similar, what I have learned is that understanding <em><strong>why</strong> </em>you took some troubleshooting steps can be as important as solving the problem itself.

To remove and re-add the account:
<ol>
 	<li>You need to be logged in via an account with SA (aka sysadmin) permissions for the database.</li>
 	<li>PLAN! Find a maintenance window, because we'll have to drop the connections between the Primary server and the database, and that will be downtime! Because that was the only functionality that we could see that was not working, (package and application deployment seemed ok, and software updates also ok) we didn't want to cause any new problems while fixing the current one.</li>
 	<li>From the Primacy Site Server we manually stopped all SMS services, and as a good reminder, try to use the command <strong>preinst /stopsite</strong>, because this will trigger a site reset once you start the server again. (You don’t have to believe me, you can read this <strong><a href="https://technet.microsoft.com/en-us/library/hh847647.aspx">article</a></strong> that explains it.)</li>
 	<li>From the SQL box, we restarted the SQL Server service, and monitored the connection using the <strong>sp_who2</strong>, very useful Stored procedure built-in that will show us all the current connections. Once you don’t see the primary server connections, we are ready to go.</li>
</ol>
<strong><em>Here is an example from my lab on how to remove, and re-add the computer account:</em></strong>

Once all the Services are stopped, we will delete the computer account from the User’s Security Node for the SCCM database: in my example, the CMCB\TX-PRI-01.

<img width="214" height="300" class="alignnone size-medium wp-image-55" alt="" src="https://msdnshared.blob.core.windows.net/media/2017/06/001-214x300.png" />

Now we will remove the account from the Security Node

<img width="214" height="300" class="alignnone size-medium wp-image-65" alt="" src="https://msdnshared.blob.core.windows.net/media/2017/06/002-214x300.png" />

Next we will re-add the account, right click under logins and under login name, we use <strong>domain\computername$ i.e CMCB\TX-PRI-01$</strong>

<img width="300" height="297" class="alignnone size-medium wp-image-75" alt="" src="https://msdnshared.blob.core.windows.net/media/2017/06/003-300x297.png" />

Once added, right click and under properties &gt; Server Roles, make sure to add the account as SYSADMIN

<img width="300" height="298" class="alignnone size-medium wp-image-77" alt="" src="https://msdnshared.blob.core.windows.net/media/2017/06/004-300x298.png" />

Under User Mapping, select the SCCM Database and make sure to use the default schema as dbo, and as a role, add it with <strong>db_owner</strong>.

<img width="300" height="298" class="alignnone size-medium wp-image-85" alt="" src="https://msdnshared.blob.core.windows.net/media/2017/06/005-300x298.png" />

After that, you should be able to start the SCCM services at the Primary site server.

I warned you, right? Yes, it did not work…

And we don’t give up just because one action plan didn’t work. Time to bring the big guns, the SQL Profiler. That dude will tell us what is happening, right? Partially… Damn spoil alerts again!

SQL profiler is a snitch, but this time, it was hiding something from us. This is where the mystery gets very interesting, at least for me.

So we ran a SQL Profiler, no big deal, selected the SQL server name, connect, event selection, show all events, show all columns, right click errors and warnings, select all, right click Security Audit and Sessions, deselect all and right click TSQL and Store Procedures and select all. Easy, right? More than we need, but sometimes in SQL Profiler, it's good to have that extra.

So, we ran SQL Profiler for about 5 mins, just to be sure, and stopped the trace. I know, I know, I should have used SQL Profiler from the beginning, and I did, and I am showing you what I saw…

<!-- HTML generated using hilite.me -->
<div style="background: #ffffff;overflow: auto;width: auto;border: solid gray;border-width: .1em .1em .1em .8em;padding: .2em .6em">
<pre style="margin: 0;line-height: 125%"><span style="color: #008800;font-weight: bold">User</span> Error Message        The <span style="color: #008800;font-weight: bold">SELECT</span> permission was denied <span style="color: #008800;font-weight: bold">on</span> the <span style="color: #008800;font-weight: bold">object</span> <span style="background-color: #fff0f0">'NextIds_G'</span>, <span style="color: #008800;font-weight: bold">database</span> <span style="background-color: #fff0f0">'CM_PRI'</span>, <span style="color: #008800;font-weight: bold">schema</span> <span style="background-color: #fff0f0">'dbo'</span>.     SMS_DISCOVERY_DATA_MANAGER        S<span style="color: #333333">-</span><span style="color: #0000dd;font-weight: bold">1</span><span style="color: #333333">-</span><span style="color: #0000dd;font-weight: bold">9</span><span style="color: #333333">-</span><span style="color: #0000dd;font-weight: bold">3</span><span style="color: #333333">-</span><span style="color: #0000dd;font-weight: bold">1264295285</span><span style="color: #333333">-</span><span style="color: #0000dd;font-weight: bold">1190618126</span><span style="color: #333333">-</span><span style="color: #0000dd;font-weight: bold">1402209955</span><span style="color: #333333">-</span><span style="color: #0000dd;font-weight: bold">3677970905</span>        S<span style="color: #333333">-</span><span style="color: #0000dd;font-weight: bold">1</span><span style="color: #333333">-</span><span style="color: #0000dd;font-weight: bold">9</span><span style="color: #333333">-</span><span style="color: #0000dd;font-weight: bold">3</span><span style="color: #333333">-</span><span style="color: #0000dd;font-weight: bold">1264295285</span><span style="color: #333333">-</span><span style="color: #0000dd;font-weight: bold">1190618126</span><span style="color: #333333">-</span><span style="color: #0000dd;font-weight: bold">1402209955</span><span style="color: #333333">-</span><span style="color: #0000dd;font-weight: bold">3677970905</span>

<span style="color: #008800;font-weight: bold">User</span> Error Message        The <span style="color: #008800;font-weight: bold">INSERT</span> permission was denied <span style="color: #008800;font-weight: bold">on</span> the <span style="color: #008800;font-weight: bold">object</span> <span style="background-color: #fff0f0">'NextIds_G'</span>, <span style="color: #008800;font-weight: bold">database</span> <span style="background-color: #fff0f0">'CM_PRI'</span>, <span style="color: #008800;font-weight: bold">schema</span> <span style="background-color: #fff0f0">'dbo'</span>.     SMS_DISCOVERY_DATA_MANAGER        S<span style="color: #333333">-</span><span style="color: #0000dd;font-weight: bold">1</span><span style="color: #333333">-</span><span style="color: #0000dd;font-weight: bold">9</span><span style="color: #333333">-</span><span style="color: #0000dd;font-weight: bold">3</span><span style="color: #333333">-</span><span style="color: #0000dd;font-weight: bold">1264295285</span><span style="color: #333333">-</span><span style="color: #0000dd;font-weight: bold">1190618126</span><span style="color: #333333">-</span><span style="color: #0000dd;font-weight: bold">1402209955</span><span style="color: #333333">-</span><span style="color: #0000dd;font-weight: bold">3677970905</span>        S<span style="color: #333333">-</span><span style="color: #0000dd;font-weight: bold">1</span><span style="color: #333333">-</span><span style="color: #0000dd;font-weight: bold">9</span><span style="color: #333333">-</span><span style="color: #0000dd;font-weight: bold">3</span><span style="color: #333333">-</span><span style="color: #0000dd;font-weight: bold">1264295285</span><span style="color: #333333">-</span><span style="color: #0000dd;font-weight: bold">1190618126</span><span style="color: #333333">-</span><span style="color: #0000dd;font-weight: bold">1402209955</span><span style="color: #333333">-</span><span style="color: #0000dd;font-weight: bold">3677970905</span>
</pre>
</div>
Interesting, right? So tell me: who is <strong>S-1-9-3-1264295285-1190618126-1402209955-3677970905</strong>?

That is the big question. He's the one to blame for those access denied errors and the root cause of me not being able to sleep at night, but, what, who, how, where, when?

I was expecting to see an account, like the computer account and/or user account. No, it was not that easy to find that GUID, and it was not in the Active Directory, we checked, so what on earth is happening?

Researching the Interwebs we found this very interesting function that would convert GUIDs to SIDs. Now we're on the right track, so let’s keep going. Here is the function, in case you don’t already have it in your database:

<!-- HTML generated using hilite.me -->
<div style="background: #ffffff;overflow: auto;width: auto;border: solid gray;border-width: .1em .1em .1em .8em;padding: .2em .6em">
<pre style="margin: 0;line-height: 125%"><span style="color: #008800;font-weight: bold">CREATE</span> <span style="color: #008800;font-weight: bold">FUNCTION</span> fn_SIDToString
(
<span style="color: #333333">@</span>BinSID <span style="color: #008800;font-weight: bold">AS</span> VARBINARY(<span style="color: #0000dd;font-weight: bold">100</span>)
)
<span style="color: #008800;font-weight: bold">RETURNS</span> <span style="color: #007020">VARCHAR</span>(<span style="color: #0000dd;font-weight: bold">100</span>)
<span style="color: #008800;font-weight: bold">AS</span> <span style="color: #008800;font-weight: bold">BEGIN</span>

IF LEN(<span style="color: #333333">@</span>BinSID) <span style="color: #333333">%</span> <span style="color: #0000dd;font-weight: bold">4</span> <span style="color: #333333">&lt;&gt;</span> <span style="color: #0000dd;font-weight: bold">0</span> <span style="color: #008800;font-weight: bold">RETURN</span>(<span style="color: #008800;font-weight: bold">NULL</span>)

<span style="color: #008800;font-weight: bold">DECLARE</span> <span style="color: #333333">@</span>StringSID <span style="color: #007020">VARCHAR</span>(<span style="color: #0000dd;font-weight: bold">100</span>)
<span style="color: #008800;font-weight: bold">DECLARE</span> <span style="color: #333333">@</span>i <span style="color: #008800;font-weight: bold">AS</span> <span style="color: #007020">INT</span>
<span style="color: #008800;font-weight: bold">DECLARE</span> <span style="color: #333333">@</span>j <span style="color: #008800;font-weight: bold">AS</span> <span style="color: #007020">INT</span>

<span style="color: #008800;font-weight: bold">SELECT</span> <span style="color: #333333">@</span>StringSID <span style="color: #333333">=</span> <span style="background-color: #fff0f0">'S-'</span>
<span style="color: #333333">+</span> <span style="color: #008800;font-weight: bold">CONVERT</span>(<span style="color: #007020">VARCHAR</span>, <span style="color: #008800;font-weight: bold">CONVERT</span>(<span style="color: #007020">INT</span>, <span style="color: #008800;font-weight: bold">CONVERT</span>(VARBINARY, <span style="color: #008800;font-weight: bold">SUBSTRING</span>(<span style="color: #333333">@</span>BinSID, <span style="color: #0000dd;font-weight: bold">1</span>, <span style="color: #0000dd;font-weight: bold">1</span>)))) 
<span style="color: #008800;font-weight: bold">SELECT</span> <span style="color: #333333">@</span>StringSID <span style="color: #333333">=</span> <span style="color: #333333">@</span>StringSID <span style="color: #333333">+</span> <span style="background-color: #fff0f0">'-'</span>
<span style="color: #333333">+</span> <span style="color: #008800;font-weight: bold">CONVERT</span>(<span style="color: #007020">VARCHAR</span>, <span style="color: #008800;font-weight: bold">CONVERT</span>(<span style="color: #007020">INT</span>, <span style="color: #008800;font-weight: bold">CONVERT</span>(VARBINARY, <span style="color: #008800;font-weight: bold">SUBSTRING</span>(<span style="color: #333333">@</span>BinSID, <span style="color: #0000dd;font-weight: bold">3</span>, <span style="color: #0000dd;font-weight: bold">6</span>))))

<span style="color: #008800;font-weight: bold">SET</span> <span style="color: #333333">@</span>j <span style="color: #333333">=</span> <span style="color: #0000dd;font-weight: bold">9</span>
<span style="color: #008800;font-weight: bold">SET</span> <span style="color: #333333">@</span>i <span style="color: #333333">=</span> LEN(<span style="color: #333333">@</span>BinSID)

WHILE <span style="color: #333333">@</span>j <span style="color: #333333">&lt;</span> <span style="color: #333333">@</span>i
<span style="color: #008800;font-weight: bold">BEGIN</span>
<span style="color: #008800;font-weight: bold">DECLARE</span> <span style="color: #333333">@</span>val <span style="color: #007020">BINARY</span>(<span style="color: #0000dd;font-weight: bold">4</span>)
<span style="color: #008800;font-weight: bold">SELECT</span> <span style="color: #333333">@</span>val <span style="color: #333333">=</span> <span style="color: #008800;font-weight: bold">SUBSTRING</span>(<span style="color: #333333">@</span>BinSID, <span style="color: #333333">@</span>j, <span style="color: #0000dd;font-weight: bold">4</span>)
<span style="color: #008800;font-weight: bold">SELECT</span> <span style="color: #333333">@</span>StringSID <span style="color: #333333">=</span> <span style="color: #333333">@</span>StringSID <span style="color: #333333">+</span> <span style="background-color: #fff0f0">'-'</span>
<span style="color: #333333">+</span> <span style="color: #008800;font-weight: bold">CONVERT</span>(<span style="color: #007020">VARCHAR</span>, <span style="color: #008800;font-weight: bold">CONVERT</span>(<span style="color: #007020">BIGINT</span>, <span style="color: #008800;font-weight: bold">CONVERT</span>(VARBINARY, REVERSE(<span style="color: #008800;font-weight: bold">CONVERT</span>(VARBINARY, <span style="color: #333333">@</span>val))))) 
<span style="color: #008800;font-weight: bold">SET</span> <span style="color: #333333">@</span>j <span style="color: #333333">=</span> <span style="color: #333333">@</span>j <span style="color: #333333">+</span> <span style="color: #0000dd;font-weight: bold">4</span>
<span style="color: #008800;font-weight: bold">END</span>
<span style="color: #008800;font-weight: bold">RETURN</span> ( <span style="color: #333333">@</span>StringSID ) 
<span style="color: #008800;font-weight: bold">END</span> 
</pre>
</div>
After creating the function. we tried to look inside the server principals, but nothing was found there with that SID.

Any more ideas? Yes! Always! What about<strong> EXEC sp_helprolemember</strong>?

And what if we could use the Function we inserted before to convert the MemberSID into a GUI?

Yes! SQL Again!

<!-- HTML generated using hilite.me -->
<div style="background: #ffffff;overflow: auto;width: auto;border: solid gray;border-width: .1em .1em .1em .8em;padding: .2em .6em">
<pre style="margin: 0;line-height: 125%"><span style="color: #888888">--Step 1 - Creating a TEMP TABLE to later on, insert the value of the sp_helprolemember SPROC</span>
 <span style="color: #008800;font-weight: bold">CREATE</span> <span style="color: #008800;font-weight: bold">TABLE</span> <span style="color: #333333">#</span>temp_table(DBROLE <span style="color: #007020">varchar</span>(<span style="color: #0000dd;font-weight: bold">30</span>), MemberName <span style="color: #007020">varchar</span>(<span style="color: #0000dd;font-weight: bold">30</span>), MemberSID varbinary(<span style="color: #0000dd;font-weight: bold">200</span>))

<span style="color: #888888">-- Step 2 - Inseting the output of the sp_helprolemember into the TEMP TABLE</span>
 <span style="color: #008800;font-weight: bold">INSERT</span> <span style="color: #008800;font-weight: bold">INTO</span> <span style="color: #333333">#</span>temp_table
 <span style="color: #008800;font-weight: bold">EXEC</span> sp_helprolemember

<span style="color: #888888">-- Step 3 - Using the function we previously created to convert the Hexadecimal into the readable SID</span>

<span style="color: #008800;font-weight: bold">select</span> <span style="color: #333333">*</span>, dbo.fn_SIDToString(MemberSID) <span style="color: #008800;font-weight: bold">from</span> <span style="color: #333333">#</span>temp_table

<span style="color: #888888">-- Last Step after you are done with step 3, Dropping the Table.</span>
 <span style="color: #008800;font-weight: bold">drop</span> <span style="color: #008800;font-weight: bold">table</span> <span style="color: #333333">#</span>temp_table
</pre>
</div>
That part of the mystery solved, we were now able to see what account was using that GUID, but why was this account <strong>'smsdbuser_ReadWrite'</strong> being used, and why was this account not showing up as <strong>'smsdbuser_ReadWrite'?</strong> Instead, it was showing as S-1-9-3-1264295285-1190618126-1402209955-3677970905. We needed answers, so with assistance of an SQL guy, the great PFE George Manson, we solved the problem by opening one of the store procedures that were being used in the process of the data discovery. The answer was in the sproc!

<!-- HTML generated using hilite.me -->
<div style="background: #ffffff;overflow: auto;width: auto;border: solid gray;border-width: .1em .1em .1em .8em;padding: .2em .6em">
<pre style="margin: 0;line-height: 125%">spGetNextIDInARange_internal <span style="color: #008800;font-weight: bold">ALTER</span> <span style="color: #008800;font-weight: bold">PROCEDURE</span> [dbo].[spGetNextIDInARange_internal]
<span style="color: #333333">@</span>NextIDsTableName sysname,
<span style="color: #333333">@</span>IDName nvarchar(<span style="color: #0000dd;font-weight: bold">30</span>),
<span style="color: #333333">@</span>ArchTableName sysname,
<span style="color: #333333">@</span>RangeStart <span style="color: #007020">int</span>,
<span style="color: #333333">@</span>RangeEnd <span style="color: #007020">int</span>,
<span style="color: #333333">@</span>ColumnName sysname <span style="color: #333333">=</span> N<span style="background-color: #fff0f0">'ItemKey'</span>
<span style="color: #888888">-- This uses dynamic SQL so default permission chaining doesn't work.</span>
<span style="color: #008800;font-weight: bold">WITH</span> <span style="color: #008800;font-weight: bold">EXECUTE</span> <span style="color: #008800;font-weight: bold">AS</span> <span style="background-color: #fff0f0">'smsdbuser_ReadWrite'</span> <span style="color: #888888">-- needed to provide permissions for dynamic SQL statements</span>
</pre>
</div>
And we can see that the stored procedure is calling the account with the code: <strong>WITH EXECUTE AS 'smsdbuser_ReadWrite'</strong>

If you want to read more about the <strong>EXECUTE AS</strong> argument here is the <strong><a href="https://docs.microsoft.com/en-us/sql/t-sql/statements/execute-as-transact-sql">documentation</a></strong>.

So that answered a lot of the questions I had, because another thing I was seeing in the SQL profiler traces was that the computer account was being used, to the point of the error. When the error started happening, the account changed to that GUID. we just needed to add the accesses back, but which ones? Looking at my lab, that was not altered: <strong>db_datareader</strong> and <strong>db_datawriter</strong>. Under the security node for the CM_PRI database &gt; Security &gt; Users &gt;, right click on the <strong>smsdbuser_ReadWrite</strong> and in Membership, add those accesses.

Told ya, the answer was boring, but not the journey! Root cause? Someone looked at that guy and said, you should not have access to anything, I never heard of you, I will fix you, bye bye accesses, and…from what we could see…bye bye discovery.

Thanks to Umair Khan and Arjun Mohan for their time and help to tackle this problem and the wife for correcting the text.

See you next time!

<strong>Renato Pacheco | Support Engineer | Microsoft Configuration Manager</strong>
<h5><span><em><strong>Disclaimer:</strong> <strong>This posting is provided "AS IS" with no warranties and confers no rights.</strong></em></span></h5>]]></content:encoded>
    </item>
  </channel>
</rss>