Configuration Manager Client fails to assign to site

Installing Configuration Manager 2012 clients on all my servers was fairly easy and straight forward. With one exception – My TMG2010 server running Server 2008R2.
For some reason, the client would install, but would never assign itself to my site, or download policies. The firewall rules allowed it to talk to the ConfigMgr server, and monitoring the traffic showed nothing was being blocked at all.
Much digging in TechNet etc and I found various mentions relating to certificates. This put me on the right track and got me 80% of the way there, but not quite.

There was not a lot of indication of what was going wrong. Most of the logs just weren’t reporting anything, let alone an error. The one log that was showing something is the “ClientIDManagerStartuplog” with repeating entries of

RegTask: Failed to get certificate. Error: 0x80004005

This was the only place I could find an indication of what was wrong.

Various articles say to delete all the files in the MachineKeys certificates folder. That is VERY BAD, DO NOT DO THAT!

While they are misguided, they do point to the correct resolution. Some suggest deleting one specific file which is the SMS certificate. At first, permissions blocked me doing this, but even after deleting it, the problem would repeat.

TMG 2010 Firewall Service Crashing. Event ID Pointing to Malware Updates

After *yet another* disk crash, my TMG service wouldn’t start. Databases were all fine and no disk errors to be found. I was just about to repair\reinstall when I noticed the following blog post which sorted the problem out much more easily!

http://social.technet.microsoft.com/wiki/contents/articles/16488.tmg-2010-firewall-service-crashing-event-id-pointing-to-malware-updates-resolution.aspx

Must be fate considering that post was only made a few short weeks ago. Almost like they *knew* it was about to happen to me… Maybe they caused it just to drive traffic to their site… hmm…

 

It pays to be paranoid in the security world.

Disaster Recovery – SQL Express databases

The continuing journey in the very slow quest to restore everything.

This post is the recovery of the SQL Express database used by the Threat Management Gateway (TMG 2010) firewall. The SQL Server (ISARS) and (MSFW) instances were failing to start with an eventid:9003 message saying “The log scan number passed to log scan in database ‘master’ is not valid”

Essentially it would appear the MASTER database was corrupted, and as per the other servers the backup was also messed up. :sigh: