Hi All, Need query or script to findout the machines which are having the not access of Admin$ in SCCM.its make many pbms while Pushing client. please help me on this to get the machines which are having the Admin$ not accessing the machines.

Here is the problem. That thread talks about using DCM on existing clients. How can the DCM baseline be evaluated and reported for non-clients? Perhaps I'm missing something, but I don't know of a way to assign a baseline to a collection of non-client machines. John DeVito

Here is the problem. That thread talks about using DCM on existing clients. How can the DCM baseline be evaluated and reported for non-clients? Perhaps I'm missing something, but I don't know of a way to assign a baseline to a collection of non-client machines. John DeVito Yes there is an assumption that the Client is installed for you to use DCM. ConfigMgr does not run agentless. I would suggest you visit Directory Services, obtain a list of all the machines you are interested in, then remotely query the each machines registry to see if Admin shares are disabled: http://support.microsoft.com/kb/816524 That is one way to do it.

Just because you can't access the admin$ share, do not make the assumption that the admin$ share is not present. There are many things that can cause the admin$ share to be inaccessible. Don't look at it from the macro point-of-view... instead, pick a couple of machines and do some in-depth debugging to figure out what the story is. In order of likeliness, if you can't access admin$ (and thus SCCM can't access admin$ to install the client), the cause may be: 1. The machine is turned off 2. The machine has a firewall up 3. "File and Printer sharing for Microsoft networks" is not enabled. I have seen Lenovo ThinkCenter software disable this setting. I have also seen administrators disable this setting thinking it's a poor-man's attempt at a firewall or virus scanner 4. Network port blocking 5. The admin$ share, in fact, does not exist (I've seen it, but rarely) 6. Other issues... name resolution issues come to mind. Nick.

I'm not sure if I am misunderstanding your need here. Please let me know that I am restating your concern properly. You have machines that do not have the admin$ share present on them, and this is causing the ConfigMgr client push installation to fail. You want to find the machines that are having this issue through ConfigMgr. Since the machines are not ConfigMgr clients there is not record in inventory that would help you identify the issue with the shares. There are two things that I can think of that might help you. A fallback status point might help you to identify issues with the admin$ share that are causing client installation failures. I haven't actually tried this, but it might help. The other thing I can think of is to script something that would identify the machines from the CCM.LOG file. The admin$ share issue you are having will be logged there. I poked around and found this article, which explains this quite well. http://support.microsoft.com/kb/925282 I hope this is helpful.John DeVito

look at this post discussed about admin$ machines http://social.technet.microsoft.com/Forums/en-US/configmgrgeneral/thread/0cc59177-c6a2-43f0-96db-35c92bf9d31c/#084f8984-6c4c-407c-83b0-6ad8bf285208Please click on "vote as Helpful" if you feel this post helpful to you. Eswar Koneti | My Tech blog: www.eskonr.com | Linkedin: Eswar Koneti

Just because you can't access the admin$ share, do not make the assumption that the admin$ share is not present. There are many things that can cause the admin$ share to be inaccessible. Don't look at it from the macro point-of-view... instead, pick a couple of machines and do some in-depth debugging to figure out what the story is. In order of likeliness, if you can't access admin$ (and thus SCCM can't access admin$ to install the client), the cause may be: 1. The machine is turned off 2. The machine has a firewall up 3. "File and Printer sharing for Microsoft networks" is not enabled. I have seen Lenovo ThinkCenter software disable this setting. I have also seen administrators disable this setting thinking it's a poor-man's attempt at a firewall or virus scanner 4. Network port blocking 5. The admin$ share, in fact, does not exist (I've seen it, but rarely) 6. Other issues... name resolution issues come to mind. Nick. Very helpful, I still believe he should sample a few machines to see if the key is setup right: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\AutoShareServer to see if it is set to 0 (disabled). A solution will be easy once he figures out if this is an intentional disablement, or, if it is due to the list of good reasons you provided :-)

Just because you can't access the admin$ share, do not make the assumption that the admin$ share is not present. There are many things that can cause the admin$ share to be inaccessible. Don't look at it from the macro point-of-view... instead, pick a couple of machines and do some in-depth debugging to figure out what the story is. In order of likeliness, if you can't access admin$ (and thus SCCM can't access admin$ to install the client), the cause may be: 1. The machine is turned off 2. The machine has a firewall up 3. "File and Printer sharing for Microsoft networks" is not enabled. I have seen Lenovo ThinkCenter software disable this setting. I have also seen administrators disable this setting thinking it's a poor-man's attempt at a firewall or virus scanner 4. Network port blocking 5. The admin$ share, in fact, does not exist (I've seen it, but rarely) 6. Other issues... name resolution issues come to mind. Nick. Very helpful, I still believe he should sample a few machines to see if the key is setup right: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\AutoShareServer to see if it is set to 0 (disabled). A solution will be easy once he figures out if this is an intentional disablement, or, if it is due to the list of good reasons you provided :-)

I still like to see what you are getting in the ccm.log file when you attempt to push a client. My original impression was that the machines in question were verified as not having the admin$ share. If you are being asked for creds when mapping a drive or making a remote connection (which is what it looks like you are doing) then the share is present and you just don't have rights to it. Two questions. What does ccm.log on the server (\Program FIles (x86)\Microsoft Configuration Manager\Logs) show you? And do you have a client installation account (as an admin on the target machines) defined in the client push installation properties item in the Site Configuration node of the ConfigMgr console?John DeVito

Hi Torsten, This is in regards with Client Push Installation only. If i understood it right, the above error snapshot says that Client machine's local admins group does not have the IT-admin group (my id is member IT-admin). In that case can i refer to the below post for report. Please advice. http://myitforum.com/cs2/blogs/skissinger/archive/2008/06/08/report-on-local-administrators-group-membership-updated.aspx Correct me, but your saying your in an AD group and that AD group is in local administrator group on the target machine and yet you get a prompt? Is this correct?

When you access the C$, d$, etc. the user ID (which is used to login on the source computer from where you are accessing the share path) has to be a member of local admin group on the Client Computer. or else give a credential that is member of local admin group on client computer in the prompt shown in above screenshot.Regards Rushikesh..

Hi all, I have a big basic doubt now. Please help as i m a newbie to SCCM. Its regarding the ADMIN$ and LOCAL ADMIN rights requirement in the client. I've pasted the error that i'm getting when i try to connect C$ of a client machine. Please clarify me whether the above error is an Admin$ error or related to Local Admin group permisisions, which is stated with snapshot in the below link, so that i can proceed the correct step on query. http://social.technet.microsoft.com/Forums/en-US/configmgrreporting/thread/8bbe8c9a-eca3-4b4b-9bd0-32f0330964f7/#c593f959-7f2d-45a4-a4de-6276aff82c63 Also pls give me tips on the Admin$ issue, or a Local admin group issue.

ConfigMgr does not use administrative shares at all - exception: cllient push installation. You have to be member of the local admins group (directly or via group membership) in order to access c$/admin$ (given that you did not change any defaults).Torsten Meringer | http://www.mssccmfaq.de

Hi Torsten, This is in regards with Client Push Installation only. If i understood it right, the above error snapshot says that Client machine's local admins group does not have the IT-admin group (my id is member IT-admin). In that case can i refer to the below post for report. Please advice. http://myitforum.com/cs2/blogs/skissinger/archive/2008/06/08/report-on-local-administrators-group-membership-updated.aspx