Friday, September 14, 2018

SCCM CB 1806 Site server high availability step by step guide

With the release of SCCM CB 1806, High Availability feature is introduced for SCCM site server using active and passive modes.

Requirements:
To use site server high availability feature the design must meet certain requirements as below;
- Site must be running on minimum 1806
- Content library on site server has to be remote and with full control permissions for both servers
- Active and Passive site servers has to be on the same domain
- Connect to the same site database
- Site database must to be remote to each server
- Both the servers must have sysadmin permissions on the database
- Passive mode server should not have any other site system role before installing site server passive mode role
- Must meet all the site server prerequisites

First upgrade the SCCM CB site to 1806. When installing or upgrading the site make sure that Site server high availability is selected (by default it is selected);


For this guide my lab setup is;
LABPRI1 – Primary site server (Active) with SMS provider
LABPRI2 – Primary site server (Will be passive) with SMS provider
LABSQL1– SQL Server 1
LABSQL2 – SQL Server 2
LABAOAGLS – Listener for AlwaysOn group
LABDPMP – DP, MP roles and Remote content library

The setup is using SQL AlwaysOn for database HA and connected with listener.


Make Content folder as a remote folder to both the site servers:
If the content library is local on the primary site server move that to a remote location;
Create a network share on a different server for site server content library and assign full control to both the site servers (active and passive).
 

 Note: Make sure remote content folder is not the root folder. It has to be under another folder as above i,e      \\unc\share1\RemoteContent
If the content library folder is in root then when moving the content, it will fail with 0x800700a1 error.

In Configuration Manager Console, Go to \Administration\Overview\Site Configuration\Sites, then 
Right click on the site then select Manage Content Library or On the ribbon click on Manage Content Library

In the Manage Content Library window, enter a valid network path for the New Location. This path is the location to where the site moves the content library. It must include a folder name that already exists on the share, for example, \\server\share\folder. Click OK

Check the progress of the content move in the Content Library column on the Summary tab of the details panel. While In progress, the Move Progress (%) value displays the percentage completed.

We can also check the progress in distmgr.log;

When the content move is completed successfully, the distmgr.log will show MoveContentLibrary() completed, also the console will show the content location to remote including the remote path.

Install Passive site server role:
Go to \Administration\Overview\Site Configuration\Sites in SCCM console then right click on the sites then click Create site system server.
This will start Site system server wizard, on the general page, enter the server name then click next;

On Specify roles for this server window select Site Server in passive mode then click next;

On site server in passive mode window;
- select appropriate choice for source file location;
- And select the installation folder.
It is a good idea to select similar drive as Active node installation path then click next;

Review the summary then click next;

Click close on the completion window;

Soon after closing the wizard, the installer will start copying the files (SMS_BOOTSTRAP) to the selected installation drive.

Review ConfigMgrSetup.log on the root of C drive on the passive node. Once the setup is completed, the ConfigMgrSetup.log will show “Completed Configuration Manager Site Server setup - Installation”.

To check the nodes of Site servers go to \Administration\Overview\Site Configuration\Sites then switch to Nodes in the bottom.

Now there will be two site servers listed one is in Active Mode and other server is in Passive mode;

At this stage, we have two site servers and one SMS provider. If we tried to promote passive mode to Active it will connect to SCCM provider on the primary site.

By default, when installing the passive site server role it won’t install SMS Provider role. This role need to be installed after installing the Passive mode site server role.


To check the SMS provider location, Select the site from \Administration\Overview\Site Configuration\Sites then right click and open the properties. The General tab will display the SMS provider location; 

Installing SMS Provider:
To Install SMS Provider, run Setup.exe from ConfigMgr installation directory;

Click next on Before you Begin window;

On the Getting started window under Available setup Options, select Perform site maintenance or reset this site then click next;

On Site Maintenance window select Modify SMS Provider Configuration then click next;

On Manage SMS Provider window select Add a new SMS Provider then enter the SMS Provider FQDN name;
- If installed on the Passive node then enter the passive node server name
- If installed on a separate server enter the server FQDN name, then click next;

Monitor the progress of provider installation on Configuration page;

Close the wizard when configuration completes;

To check the installed SMS providers, go to \Administration\Overview\Site Configuration\Sites in SCCM console.
The General page of the site properties will display two SMS Providers;

Promoting Passive Mode site server to Active Mode:
To promote Passive mode site server to Active mode go to \Administration\Overview\Site Configuration\Sites, on the summary page switch to nodes tab then select and right click passive mode server then select promote to active;

Click Yes on the warning message to promote passive server to active mode;

The status will change from Passive to Promoting;

In few min. the status will change from Promoting to OK;
 Monitor the FailoverMgr.log from <ConfigMgrInstallDir>\Logs\FailOverMgr.log"
Now LABPRI2 is active node and PABPRI1 is passive node.
To see the HA functionality, turn off the passive node (Primary1 where SMS provider is installed).
Once the server is offline, re-launch the SCCM console.
The console will fail to connect to the LABPRI1 server, where previously it was connected to.

Click on Connect to a new site then enter FQDN of LABPRI2 (New active mode site server);

The console is successfully connected to LABPRI2 using the SMS provider on LABPRI2;

Thursday, August 30, 2018

WSUS Control Manager failed to monitor WSUS Server

SCCM console showing errors;

WSUS Control Manager failed to monitor WSUS Server "SCCB.W2016.LAB.

Possible cause: WSUS Server version 3.0 SP2 or above is not installed or cannot be contacted.
Solution: Verify that the WSUS Server version 3.0 SP2 or greater is installed. Verify that the IIS ports configured in the site are same as those configured on the WSUS IIS website.
Message ID: 7003

Followed by;
WSUS Control Manager failed to configure proxy settings on WSUS Server "SCCB.W2016.LAB".

Possible cause: WSUS Server version 3.0 SP2 or above is not installed or cannot be contacted.
Solution: Verify that the WSUS Server version 3.0 SP2 or greater is installed. Verify that the IIS ports configured in the site are same as those configured on the WSUS IIS website. You can receive failure because proxy is set but proxy name is not specified or proxy server port is invalid.

Messag ID: 7000


WSUSCtrl.log on the SUP;
System.Net.WebException: The request failed with HTTP status 503: Service Unavailable.~~   at Microsoft.UpdateServices.Administration.AdminProxy.CreateUpdateServer(Object[] args)~~   at Microsoft.SystemsManagementServer.WSUS.WSUSServer.ConnectToWSUSServer(String ServerName, Boolean UseSSL, Int32 PortNumber)
 Failures reported during periodic health check by the WSUS Server SCCB.W2016.LAB. 
Will retry check in 1 minutes SMS_WSUS_CONTROL_MANAGER

This check will happen every min so error will appear every min. aswell.

WSUSCtrl.log on the SUP is clearly indicating there is an issue with IIS service availability

The first point to check is the status of WSUS application pool.

Open IIS manager then go to Application pools then check WSUS pool.

In this instance my WSUS pool has stopped.
Once the service is started, the wsusctrl.log file check the connectivity and will successfully validate the connection.

To address the actual WSUSpool issue, consider changing the WSUS pool queue length in IIS from default 1000 to 25000

Follow blog from Microsoft to re-configure the Wsuspool queue length;
https://blogs.msdn.microsoft.com/the_secure_infrastructure_guy/2015/09/02/windows-server-2012-r2-wsus-issue-clients-cause-the-wsus-app-pool-to-become-unresponsive-with-http-503/

Wednesday, August 15, 2018

The software change returned error code 0x87D00664(-2016410012)

You may receive The software change returned error code 0x87D00664(-2016410012) when deploying updates along with below error msg;

Evaluating status of the updates for the job ({482120C8-5E79-4668-ADD1-845946FFA2B7}) UpdatesHandler
CDeploymentJob::InstallUpdatesInBatch - Batch or non-batch install is not in progress for the job ({482120C8-5E79-4668-ADD1-845946FFA2B7}). So allowing install.. UpdatesHandler
CDeploymentJob::InstallUpdatesInBatch - Resetting install flag to false as method is complete UpdatesHandler
Job {482120C8-5E79-4668-ADD1-845946FFA2B7} is cancelling execution UpdatesHandler
CancelProcessing for job ({482120C8-5E79-4668-ADD1-845946FFA2B7}) - Finishing the updates processing.
Update (8fb8e6db-2eee-494c-a06a-9664d9df8493) processing cancelled by job.
Execution completed for the job ({482120C8-5E79-4668-ADD1-845946FFA2B7}).
Successfully sent job ({482120C8-5E79-4668-ADD1-845946FFA2B7}) success completion to the SdmAgent
CompleteJob received from SDM. UpdatesHandler
Complete - Job ({482120C8-5E79-4668-ADD1-845946FFA2B7}) Cleanup.
CompleteJob - Job ({482120C8-5E79-4668-ADD1-845946FFA2B7}) removed from job manager list.

This error has occurred only on few servers where they running slow.
The update starts installing and after sometime it will fail to install. The reason for the update failed to install is, run time exceeded. By default the updates will have 60 min or 30 based on update type, however the machine taking longer then expected time to install.

To resolve the issue, go to update and right click, then go to the properties. 
Go to Maximum run time tab on the properties then increase the Maximum run time as needed.

Friday, August 3, 2018

Step by Step SCCM 1806 Upgrade Guide

Microsoft has released new branch update (1806) for System Center Configuration Manager.

ConfigMgr Current Branch 1806 loaded with valuable new features like Primary site HA, CMPivot, added ConfigMgr tools and much more...

For complete list of features visit Enterprise Mobility and Security blog

Before proceeding with SCCM branch upgrade, it is very important to review SCCM Current Branch servicing (upgrade) checklist

This step by step SCCM 1806 upgrade guide will guide you through  upgrading SCCM Current branch from all supported previous versions to SCCM Current Branch 1806.

Downloading the SCCM CB 1806 update:
1. Use FastRingScript_1806.exe to upgrade the site to 1806 without waiting for global release.
2. Download FastRingScript_1806.exe from TechNet gallery
3. Extract the downloaded FastRingScript_1806.exe
4. Launch PowerShell as Administrator
5. Change the current directory to the FastRingScript_1806 script path
6. Run the script from elevated PowerShell window (ex: EnableFastUpdateRing1806.ps1 SCCB )
         Note: Just use server name without FQDN

7. You will get the command(s) completed successfully

8. Now go to \Administration\Overview\Updates and Servicing node in SCCM console then click           Check for updates on the ribbon;

9. Review the dmpdownloader.log file
    The log should have - Found a new available update 

Then downloading large file with bits;

 10. Refresh the Updates and servicing node in SCCM console, you can see the 1806 update in
      downloading state.

 The dmpdownloader.log will show package finished downloading;

11. Wait until the 1806 update status changes from Downloading to Ready to Install in the console

Installing SCCM CB 1806 update:
1. Like any other previous updates, first run the Run Prerequisite check or run the Install update Pack directly;

 2. The installer will start the Configuration Manager Updates wizard. Click Next on the General tab;

 3.  Select required features to be installed then click Next;

4.  Select required client update options then click Next;

 5. Accept the license terms then click Next;

6. Review and confirm the selected options then click Next;

7. Close the completion window;

8. Now the 1806 update state will change from Available to Installing;

9. We can view the detailed progress of the update installation from \Monitoring\Overview\Updates 
    and Servicing Status\Configuration Manager 1806 node From the ribbon click on Show status.

The show status will provide detailed progress of the upgrade process;

The update status also can be checked by reviewing hman.log
It will take 20-30 min (based on the server performance) to complete the upgrade.

Once the update is installed, Configuration Manager 1806 update status will be changed from Available to Installed.

Console Upgrade:
 After upgrading the site server to SCCM Current Branch 1806, If we re-launch or check the console version, we will get a popup message saying A new version of the console is available (5.1806.1074.1200).


When prompted, Click OK to upgrade the console and follow on screen prompts to complete the upgrade process.

Once the update is installed the version number of SCCM will be;
          System Center Configuration Manager Version: 1806
          Console Version: 5.1806.1074.1200
          Site Version: 5.0.8692.1000

That's it. The site been upgraded to 1806 successfully.

Click here for complete SCCM Current Branch step by step guides, step by step migration guide, step by step monitoring and health check guide and step by step SCCM Current Branch servicing guide.