Hi All,Yet another question from me I'm afraid :(I've had a bit of time recently to try getting our publicnetwork clients setup in SCCM and I've run into a problem which I can't seem to fix.All of our public network clients are protected by Deepfreeze (think Microsoft SteadyState) which rolls back all changes done to the OS at reboot/shutdown.First problem I got around by creating a "thawed" drive that doesn't get reverted, this is named T:\Used this command line to install:CCMSETUP.EXE CCMINSTALLDIR="T:\SCCM" SMSCACHEDIR="T:\SCCM\Cache"This installs the client fine, no errors in either ccmsetup.log or client.msi.log (at least none that indicate problems)The install is done when the system is "thawed" so no changes are performed during a reboot.Problem is once the client is installed none of the components change from an installed state to enabled and the execmgr.log has these lines in it:Software Distribution Site Settings for the client are missing from WMI.Common Client Agent Settings for the client are missing from WMI.ccmexec.log is clear of errors.So far I have tried:uninstall/reinstall.Forced update of policiesRebuilt of WMISearching endless posts on the internet.All of this is done while Deepfreeze is inactive, so that's not an issue yet, just mentioned it before you asked why I'm installing it to the T drive ;)Any ideas anyone?Cheers,SBhttp://www.microsoft.com/technet/security/Bulletin/MS08-067.mspx If you don't ever patch anything, for god sake make sure this patch is on.......

Stevyb69 said: Software Distribution Site Settings for the client are missing from WMI.Common Client Agent Settings for the client are missing from WMI I am not familiar with those products, but this message usually means that the client is not able to retrieve policies from the management point. Check locationservices.log, ccmexec.log and clientlocation.log if the client is able to retrieve its MP.

Hi Torsten,LocationServices.log and Clientlocation.log are both free from errors :(Both logs show it's picked up the MP fine and resolving AD Sites correctly.http://www.microsoft.com/technet/security/Bulletin/MS08-067.mspx If you don't ever patch anything, for god sake make sure this patch is on.......

Is the client actually assigned to the proper site? Does it appear in the All Systems collection with client = yes?Jason | http://myitforum.com/cs2/blogs/jsandys

Yes it is.It's a client, approved, Advanced Client, not blocked, not obsolete and is active.http://www.microsoft.com/technet/security/Bulletin/MS08-067.mspx If you don't ever patch anything, for god sake make sure this patch is on.......

Then any errors in Policy*.log?

Just checked the PolicyAgent log... got a lot of errors like:Download of policy CCM_Policy_Policy4.PolicyID="{a258771e-f2a9-4e2b-acc7-28258f6ae9f4}",PolicySource="SMS:SC2",PolicyVersion="3.00" failed (DTS Job ID: {D0585319-9304-4BCA-B52C-832A3A99C4DA})And I was just typing this when you replied Torsten ;)http://www.microsoft.com/technet/security/Bulletin/MS08-067.mspx If you don't ever patch anything, for god sake make sure this patch is on.......

Well, the WMI repository and registry are stored on the system drive which it looks like gets rolled back on reboot.Since client operational and configuration data are stored in the file system, registry and WMI this is not something that will work without being able to persist state in all 3.Bottom line - not supported without the ability to persist state. Stan

Hi Stan,That may be the case, but.......I've not even got to that stage of resetting the system state yet.Ignore the Deepfreeze issue, I mentioned it to outline my end goal and to stop the query of why I was installing on the T Drive.The products are turned off at the moment, any changes are permanent, reboot or not.Once I've managed to get the client installed, working, tested things like remote support and software distribution etc, then I'll enable deepfreeze and make a decision on how badly it messes things up :SFurther down the line, things like software updates, deployments, changes to configurations will be performed during a maintenance window when changes are allowed to be permanent.Cheers,SBhttp://www.microsoft.com/technet/security/Bulletin/MS08-067.mspx If you don't ever patch anything, for god sake make sure this patch is on.......

Fair enough, cross that bridge later then =)Next up - DataTransferService.log and ContentTransferManager.log should give you more detail about why the policy transfer may have failed Stan

DataTransferService.log - Server name changed to protect the innocent, but is correct;)Also, I don't seem to have a ContentTransferManager.log.UpdateURLWithTransportSettings(): OLD URL -http://SERVER/SMS_MP/.sms_pol?{ff27c0db-3046-4184-9832-6d162a55fbbf}.1_00DataTransferService13/02/2009 10:18:152848 (0x0B20)UpdateURLWithTransportSettings(): NEW URL -http://SERVER:80/SMS_MP/.sms_pol?{ff27c0db-3046-4184-9832-6d162a55fbbf}.1_00DataTransferService13/02/2009 10:18:152848 (0x0B20)DTSJob {0A4A97EF-7C01-490D-B051-0AEF66A7F0B7} created to download from 'http://SERVER/SMS_MP/.sms_pol?{ff27c0db-3046-4184-9832-6d162a55fbbf}.1_00' to 'T:\SCCM\Temp\{C8D32F94-909E-43FB-BB53-C2C439FC4967}.tmp'.DataTransferService13/02/2009 10:18:152848 (0x0B20)DTSJob {0A4A97EF-7C01-490D-B051-0AEF66A7F0B7} in state 'PendingDownload'.DataTransferService13/02/2009 10:18:151928 (0x0788)DTSJob {459CD859-B115-4549-BD27-B562E8F8E5C0} in state 'Error'.DataTransferService13/02/2009 10:18:151892 (0x0764)DTSJob {459CD859-B115-4549-BD27-B562E8F8E5C0} in state 'NotifiedComplete'.DataTransferService13/02/2009 10:18:151892 (0x0764)DTS job {459CD859-B115-4549-BD27-B562E8F8E5C0} has completed:Status : ERROR (0x80070057)Start time : 02/13/2009 10:18:15Completion time : 02/13/2009 10:18:15Elapsed time : 0 secondsDataTransferService13/02/2009 10:18:151892 (0x0764)DTSJob {0A4A97EF-7C01-490D-B051-0AEF66A7F0B7} in state 'Error'.DataTransferService13/02/2009 10:18:151928 (0x0788)DTSJob {0A4A97EF-7C01-490D-B051-0AEF66A7F0B7} in state 'NotifiedComplete'.DataTransferService13/02/2009 10:18:151928 (0x0788)DTS job {0A4A97EF-7C01-490D-B051-0AEF66A7F0B7} has completed:Status : ERROR (0x80070057)Start time : 02/13/2009 10:18:15Completion time : 02/13/2009 10:18:15Elapsed time : 0 secondsDataTransferService13/02/2009 10:18:151928 (0x0788) http://www.microsoft.com/technet/security/Bulletin/MS08-067.mspx If you don't ever patch anything, for god sake make sure this patch is on.......

The error translates to "The parameter is incorrect" which by itself is not helpful.There are however several references to proxy setting issues such as this one:http://technet.microsoft.com/en-us/library/cc720473.aspxI'm not sure the remediation suggested in that article would be correct for you but you may have to set the system context proxy using netsh:netsh winhttp set proxy...Usage: set proxy [proxy-server=]<server name> [bypass-list=]<hosts list>Parameters: Tag Value proxy-server - proxy server for use for http and/or https protocol bypass-list - a list of sites that should be visited bypassing the proxy (use "<local>" to bypass all short name hosts)Examples: set proxy myproxy set proxy myproxy:80 "<local>;bar" set proxy proxy-server="http=myproxy;https=sproxy:88" bypass-list="*.foo.com" Stan

Hi Stan,Sorry it's taken a while to come back on this one, I've finally managed to squeeze a weeks leave in!!I'm not very clear on the proxy suggestion, am I taking the proxy bit too litterally and thinking about IE proxy settings (as in ISA)?All clients are on the same LAN with direct access to the server.Cheers,SBhttp://www.microsoft.com/technet/security/Bulletin/MS08-067.mspx If you don't ever patch anything, for god sake make sure this patch is on.......

You should check if there's a proxy set for "local system" that might prevent the client communicating with the MP. Use the netsh commands Stan mentioned to start troubleshooting from that point.Make also sure that the permissions for "T:\SCCM\Temp" are not preventing the client from writing stuff into that dir.

Thanks for clarifying that Torsten.I'm running this on an XP SP2 client, not Vista, which from looking at netsh you can only do the proxy config using netsh on Vista.I did however fall back to usingproxycfg.exe which looks like the XP version and it shows the client as having direct access, i.e. no proxy.I've checked the permissions on the folder, and unless it needs more than System> Full Control, Administrators> Full Control, Users> Read then that's ok too.I've successfully used the console to push the install to the client, so I assume if it can install from the console then it has permissions.Any more ideas?Cheers,SBhttp://www.microsoft.com/technet/security/Bulletin/MS08-067.mspx If you don't ever patch anything, for god sake make sure this patch is on.......

This is quite the interesting issue. Since the client appears to be working other than the fact that it can't download policy (which obviously is pretty important!), this may be an issue with BITS which is what we call into to download policy and content.If you download the bitsadmin.exe tool (http://msdn.microsoft.com/en-us/library/aa362813(VS.85).aspx) and run it with the following command line (as an administrator): "bitsadmin.exe /list /allusers /verbose" what do you see?

Hi Adam,Thanks for your reply, I didn't get chance over the weekend to test it, the wife had me doing DIY :(I've just installed the XP SP2 Support tools and run bitsadmin.I get:Listed 0 job(s).I even tried after trying to initiate a Machine Policy Retrieval & Evaluation Cycle but got the same result.I'll go try it on a corporate, working machine in a little while and see what type of output one of those gives.Cheers,SBhttp://www.microsoft.com/technet/security/Bulletin/MS08-067.mspx If you don't ever patch anything, for god sake make sure this patch is on.......

Just tested on a Corporate machine which is a verified working SCCM client.Same result "Listed 0 job(s)." :Shttp://www.microsoft.com/technet/security/Bulletin/MS08-067.mspx If you don't ever patch anything, for god sake make sure this patch is on.......

Hi All,Sorry I've not been back on this topic in a while, I've been caught up in a lot of other projects.I'm afraid I'm still in the same boat on this one, I don't suppose anyones seen anything simliar over these last couple of months or have any fresh ideas?Cheers,SBhttp://www.microsoft.com/technet/security/Bulletin/MS08-067.mspx If you don't ever patch anything, for god sake make sure this patch is on.......

After some further tests....Uninstalled, reinstalled = no goodUninstalled, reinstalled on C:\Windows\System32\CCM = Works fineUninstalled, reinstalled on T:\SCCM = no goodUninstalled (again!)Created an NTFS Junction point (I think that's the right description) using winbolichttp://www.pearlmagik.com/winbolic/Directed C:\Windows\System32\CCM to T:\SCCMWorks fine!!Anyone have any ideas why installing it directly to T:\SCCM using CCMSETUP.EXE CCMINSTALLDIR="T:\SCCM" SMSCACHEDIR="T:\SCCM\Cache" might cause a problem?If no ideas why, then does anyone know of a way to script the NTFS Junction point to redirect C:\Windows\System32\CCM to T:\SCCM so that I don't have to do 120 clients manually?Cheers,SBhttp://www.microsoft.com/technet/security/Bulletin/MS08-067.mspx If you don't ever patch anything, for god sake make sure this patch is on.......

That setup is too specific to give an answer without sitting right in front of that box ...Does http://support.microsoft.com/kb/205524/en-ushelp you?

Yeah it does Torsten, I was looking at it before I posted yesterday, but didn't have time to go digging Linkd.exe out from wherever I've got the Res Kit stashed.I tried mountvol, but that's for assigning folders to the root of vols.I was hoping for a simple command line that was built into XP, but no worries, linkd can soon be stashed on the netlogon share for now :SCheers for everyone's help, I'll post a followupwhen I get it all automated incase anyone else decides to try something similar.http://www.microsoft.com/technet/security/Bulletin/MS08-067.mspx If you don't ever patch anything, for god sake make sure this patch is on.......

Stevyb69,Did you ever get this resolved? I am having the exact same situation using a product from Centurion Tech, which does the same thing as DeepFreeze or SteadState. I had SMS 2003 running in our K-12 school district and was having bad results with Software Metering and duplicate computer names in my collections. I have since upgraded to SCCM 2007 R2 and am in the process of installing the client and still have these same concerns.Thanks!

Did you ever find a better solution? Ross

Got to love thread resurections ;) Hi Guys, I actually posted an answer of sorts on this thread: http://social.technet.microsoft.com/Forums/en-US/configmgrsetup/thread/8a606e6e-12ef-415b-b0b8-a5116adc8d60 Last post copy & paste: We currently have around 300 devices with DeepFreeze and SCCM installed, and it works brilliantly. What we ended up doing was installing the SCCM Client on the C Drive (Drive that is protected by DeepFreeze) but moved the cache to a D Partition so that we could always ensure it didn't get wiped at reboot. We then changed the Inventory and Update schedules to match the DeepFreeze maintentance windows, as well as setting a SCCM Maint window to match it, ensuring that hardware inventory, software deployment and software updates only ever ran while the device was "Thawed". One major thing to point out is that trying to get SCCM to use a "Thaw" drive within DeepFreeze (Usually T: ) for the cache or even an install location wouldn't work. We had to use a physical partition and told DeepFreeze not to protect it. We set the BIOS to wake up just before the DeepFreeze/SCCM Maint windows every night and have a really good working system where it's fully protected during the day and then locked and auto updated/maintained during the night. Hope this helps! Cheers, SB My System Center Blog

Thank you so much for the information...it sounds like we have very similar setups. I have one additional question: How do you get an accurate software usage report or power report by only redirecting the cache? The files I need are in the following location: %systemroot%\system32\ccm\inventory\temp\. Or doesIf you would like to contact me directly, let me know. We may have some information to trade for similar enviroments! Thanks, Ross

We then changed the Inventory and Update schedules to match the DeepFreeze maintentance windows, as well as setting a SCCM Maint window to match it, ensuring that hardware inventory, software deployment and software updates only ever ran while the device was "Thawed" ConfigMgr's maintenance windows only apply to software distribution / updates. HINV and SINV are not affected!

To be more specific.... I changed the Hardware Inventory Client Agent Properties to a custom inventory schedule, running only when the PC's are thawed (every 3 days at 1am). Same with the Software Updates Client Agent schedule. Sorry if I made it seem that only setting a maintenance window affected this. As for power usage and software metering Ross, I only installed R3 the other day and haven't enabled it on our "Public Network" and neither do we use software metering on that network either. Sorry. Cheers, SBMy System Center Blog

Can anyone give a good reason on why it doesn't work with a virtual partition but it does work with a physically created partition? Thanks, Ross

I believe I have a solution. It is not the cleanest but you will get accurate power reports and I believe software metering reports with Deep Freeze enabled. I used Microsoft's junction.exe program (http://technet.microsoft.com/en-us/sysinternals/bb896768.aspx) and Unlocker (http://ccollomb.free.fr/unlocker/). I execute them remotely by using a vb.net program built around psexec. Keep in my I believe that the client needs to be installed as System or it doesn't install correctly....I don't remember though. The first bat file uninstalls the current client and creates folders on the thaw partition...in my case Z:. It also installs unlocker and uses it to delete both the repository folder and Windows\Temp folders. I had to stop my AV service first because it tied into WMI. It must do this to make the junction to the Thaw partition. It then must restart the computer because the WMI repository needs to be rebuilt. You may be able to just restart the winmgmt service, but I was unable to because of the way VMware ties into it. The second bat file then deletes the C:\Windows\System32\CCM folder and creates a Z:\SCCM folder. It then makes the junction and installs the client and then the R3 update for power management. Lastly it refreezes the machine. Here is the code: Redirect.bat REM Redirects the WMI repository and Windows\Temp folders start /WAIT \\wausccm1\share\ccmsetup.exe /uninstall START /WAIT \\server\unlocker1.8.8.exe /S mkdir z:\repository "c:\program files\unlocker\unlocker.exe" c:\windows\system32\wbem\repository /S /D \\server\junction.exe -accepteula c:\windows\system32\wbem\repository z:\repository mkdir z:\temp "c:\program files\unlocker\unlocker.exe" c:\windows\temp /S /D \\server\junction.exe -accepteula c:\windows\temp z:\temp "c:\program files\unlocker\uninst.exe" /S shutdown -r -t 2 SCCMInstall.bat rmdir /s /q "C:\Windows\System32\CCM" mkdir "z:\SCCM" \\server\junction.exe -accepteula C:\windows\system32\ccm Z:\SCCM start /WAIT \\server\share\CCMSetup.exe /noservice SMSSITECODE=AUTO \\server\share\sccm2007ac-sp2-kb977384-x86-enu.msp /quiet DFC password /BOOTFROZEN Let me know what you think. Thanks, Ross

Wow! I'll get one of my staff to try this today as I'm tied up with Service Manager atm. If this works Ross, you're a star! Cheers, SBMy System Center Blog

Let me know what you think. I am just curious about WMI. What does Deepfreeze do with the repository? The ConfigMgr client relies heavily on it and there might be unpredictable result if WMI gets reset at each reboot.

At the moment, we let DeepFreeze reset the WMI repository at each reboot and rely on it sending it's information up when it's thawed, which appears to have worked fine for the last year or so. However... with the advent of Power Mgt in R3, it's likely to cause problems due to it recording power up times etc constantly. This is why the solution Ross is proposing above might be ideal due to it moving WMI across to a "Thawed" area where it won't get reset every reboot. We're going to try this today and I'll post back with our results. Cheers, SBMy System Center Blog

Deep Freeze will revert all changes to the hard drive everytime the computer is rebooted. That includes the WMI repository. This is why I had to redirect the repository to a Thaw partition. This is a virtual partition that is not reverted on reboot. This way my hardware inventory (for Power Reports) and Software Metering are correct, since they are based on WMI. I also had to redirect the Windows\Temp folder as it seems to be tied into the way SCCM uses the repository. If the Temp folder was wiped on reboot then WMI would be messed up for the SCCM client. Hope that makes sense....I've learned a ton about how the client works! Thanks, Ross