OSD TS: Failed to download policy - TS does not start in WinPE
Here is a "slight little" problem I havecome over. We have an existing SCCM 2007 R2 infrastructure, with a Central Primary and several Primary's, all running in mixed mode. Server OSon all servers are Win2k3 R2 SP2. One of the Primary's is a PXE service point, with WDS installed. I have distributed the boot images to the smspxeimages$ on this primary. I can boot a server on pxe and WinPE loads as it should. After about 45 seconds the server reboots by itself. I have checked the smsts.log file on the bootimage and it gives me the following (I have only copied out the last section):Retrieving Policy Assignments:TSPxe25.08.2009 11:45:561460 (0x05B4) Processing Policy Assignment {b39c04fb-993d-4211-8a4b-71e7eccc7817}.TSPxe25.08.2009 11:45:561460 (0x05B4) Processing Policy Assignment {26606ba2-d58e-488f-9fd5-1b71f9c5ed62}.TSPxe25.08.2009 11:45:561460 (0x05B4) Processing Policy Assignment {defd640e-9b77-43ec-927e-16707020682b}.TSPxe25.08.2009 11:45:561460 (0x05B4) Processing Policy Assignment {464584d6-9bbb-4267-95c9-2914d7f3e8a5}.TSPxe25.08.2009 11:45:561460 (0x05B4) Processing Policy Assignment {10b03597-302d-4666-a338-521299ee8bcc}.TSPxe25.08.2009 11:45:561460 (0x05B4) Processing Policy Assignment {b213a05f-24aa-45b7-9a32-da3b778977da}.TSPxe25.08.2009 11:45:561460 (0x05B4) Processing Policy Assignment {bcf77b02-56d8-443c-a2b7-1d998dc4605b}.TSPxe25.08.2009 11:45:561460 (0x05B4) Processing Policy Assignment {d8127c94-cb47-43ee-81ed-cda5349d8005}.TSPxe25.08.2009 11:45:561460 (0x05B4) Processing Policy Assignment {52dc65fa-3226-4c9c-88e4-c0216f92d5ce}.TSPxe25.08.2009 11:45:561460 (0x05B4) Processing Policy Assignment {7b5e02ac-8675-4c46-88d2-c1c344a9ed49}.TSPxe25.08.2009 11:45:561460 (0x05B4) Processing Policy Assignment {7a45e7df-9201-4d18-953c-a3bc56ea5f91}.TSPxe25.08.2009 11:45:561460 (0x05B4) Processing Policy Assignment {8248c950-30f3-442c-a402-e3f8ed2ed0df}.TSPxe25.08.2009 11:45:561460 (0x05B4) Processing Policy Assignment {1c988638-0233-4ce4-9104-a28b9d09103b}.TSPxe25.08.2009 11:45:561460 (0x05B4) Processing Policy Assignment {13c18763-be3c-47d4-8c41-8e6f6d7d4599}.TSPxe25.08.2009 11:45:561460 (0x05B4) Processing Policy Assignment {323d2e4d-3a14-410a-b8cb-070ef849dd3e}.TSPxe25.08.2009 11:45:561460 (0x05B4) Processing Policy Assignment {452698a2-938e-418f-ad7c-ef87dd829bf0}.TSPxe25.08.2009 11:45:561460 (0x05B4) Processing Policy Assignment {c573f20c-3b7b-499f-b675-86c9ac7e5e3b}.TSPxe25.08.2009 11:45:561460 (0x05B4) Processing Policy Assignment {ddc87355-1b6c-469f-8ef8-a2542bed99fd}.TSPxe25.08.2009 11:45:561460 (0x05B4) Processing Policy Assignment {6914305f-9677-46d5-8f2b-96842054cd22}.TSPxe25.08.2009 11:45:561460 (0x05B4) Processing Policy Assignment {b2fd38c4-baa5-4444-abda-c69ccd6342e8}.TSPxe25.08.2009 11:45:561460 (0x05B4) Processing Policy Assignment {2db6fd57-5e1e-4cce-913f-51ec0c25c7d7}.TSPxe25.08.2009 11:45:561460 (0x05B4) Processing Policy Assignment {4334faec-8c48-431e-b8db-fb98700cf934}.TSPxe25.08.2009 11:45:561460 (0x05B4) Processing Policy Assignment {55277a95-1004-4c26-8f13-dc9609570da8}.TSPxe25.08.2009 11:45:561460 (0x05B4) Processing Policy Assignment {54491327-ae01-4528-9dcd-cf7a56bda813}.TSPxe25.08.2009 11:45:561460 (0x05B4) Processing Policy Assignment PNO20000-CPS006E5-DBBBC9D6.TSPxe25.08.2009 11:45:561460 (0x05B4) Processing Policy Assignment DEP-PNO20000-CPS006D7-DBBBC9D6.TSPxe25.08.2009 11:45:561460 (0x05B4) Processing Policy Assignment DEP-PNO20000-CPS006DB-DBBBC9D6.TSPxe25.08.2009 11:45:561460 (0x05B4) Processing Policy Assignment DEP-PNO20000-CPS006DD-DBBBC9D6.TSPxe25.08.2009 11:45:561460 (0x05B4) Processing Policy Assignment DEP-PNO20000-CPS006ED-E2DCFA3B.TSPxe25.08.2009 11:45:561460 (0x05B4) Processing Policy Assignment DEP-PNO20000-CPS006EE-DBBBC9D6.TSPxe25.08.2009 11:45:561460 (0x05B4) Processing Policy Assignment DEP-PNO20000-CPS006EF-DBBBC9D6.TSPxe25.08.2009 11:45:561460 (0x05B4) Processing Policy Assignment DEP-PNO20000-CPS006F0-DBBBC9D6.TSPxe25.08.2009 11:45:561460 (0x05B4) Processing Policy Assignment DEP-PNO20000-CPS006F1-DBBBC9D6.TSPxe25.08.2009 11:45:561460 (0x05B4)Successfully read 33 policy assignments.TSPxe25.08.2009 11:45:561460 (0x05B4)Downloading policy body PNO20000-CPS006E5-DBBBC9D6.TSPxe25.08.2009 11:45:561460 (0x05B4)Preparing Policy Body Request.TSPxe25.08.2009 11:45:561460 (0x05B4) Setting transport.TSPxe25.08.2009 11:45:561460 (0x05B4) Setting policy location = http://<mp>/SMS_MP/.sms_pol?PNO20000-CPS006E5-DBBBC9D6.3_00.TSPxe25.08.2009 11:45:561460 (0x05B4)Executing Policy Body Request.TSPxe25.08.2009 11:45:561460 (0x05B4)Using Authenticator for policyTSPxe25.08.2009 11:45:561460 (0x05B4)CLibSMSMessageWinHttpTransport::Send: URL: servername.fqdn.local:888 GET /SMS_MP/.sms_pol?PNO20000-CPS006E5-DBBBC9D6.3_00TSPxe25.08.2009 11:45:561460 (0x05B4)The request has succeeded. 200 OKTSPxe25.08.2009 11:45:561460 (0x05B4)found a secure policyTSPxe25.08.2009 11:45:561460 (0x05B4)decoding policyTSPxe25.08.2009 11:45:561460 (0x05B4)hCertStore != NULL, HRESULT=80004005 (e:\nts_sms_fre\sms\framework\osdmessaging\libsmsmessaging.cpp,4331)TSPxe25.08.2009 11:45:561460 (0x05B4)no cert available for policy decodingTSPxe25.08.2009 11:45:561460 (0x05B4)oPolicy.RequestPolicy((GetPolicyFlags() & POLICY_SECURE) != 0), HRESULT=80004005 (e:\nts_sms_fre\sms\framework\tscore\tspolicy.cpp,1841)TSPxe25.08.2009 11:45:561460 (0x05B4)Failed to download policy PNO20000-CPS006E5-DBBBC9D6 (Code 0x80004005).TSPxe25.08.2009 11:45:561460 (0x05B4)(*iTSPolicyAssignment)->GetObjects(pszClassName, aTSPolicyObjectArray ), HRESULT=80004005 (e:\nts_sms_fre\sms\framework\tscore\tspolicy.cpp,1111)TSPxe25.08.2009 11:45:561460 (0x05B4)m_pPolicyManager->GetObjects( TS::Policy::TaskSequence::GetClassNameW(), TS::Policy::TaskSequence::GetPolicyCategory(), TS::Policy::TSPolicyAssignment::POLICY_TS_FOR_CD_AND_PXE, aTSPolicyObjectArray ), HRESULT=80004005 (e:\nts_sms_fre\sms\client\tasksequence\tsmbootstrap\tsmediawizardcontrol.cpp,947)TSPxe25.08.2009 11:45:561460 (0x05B4)Exiting TSMediaWizardControl::GetPolicy.TSPxe25.08.2009 11:45:561460 (0x05B4)GetPolicy(), HRESULT=80004005 (e:\nts_sms_fre\sms\client\tasksequence\tsmbootstrap\tsmediawizardcontrol.cpp,2058)TSPxe25.08.2009 11:45:561460 (0x05B4)RunWizardForPXE(), HRESULT=80004005 (e:\nts_sms_fre\sms\client\tasksequence\tsmbootstrap\tsmediawizardcontrol.cpp,2383)TSPxe25.08.2009 11:45:561460 (0x05B4)oTSMediaWizardControl.Run( sMediaRoot, true, true ), HRESULT=80004005 (e:\nts_sms_fre\sms\client\tasksequence\tsmbootstrap\tsmbootstrap.cpp,936)TSPxe25.08.2009 11:45:561460 (0x05B4)Execute( eExecutionEnv, sConfigPath, sTSXMLFile, uBootCount, &uExitCode ), HRESULT=80004005 (e:\nts_sms_fre\sms\client\tasksequence\tsmbootstrap\tsmbootstrap.cpp,1105)TSPxe25.08.2009 11:45:561460 (0x05B4)Exiting with return code 0x80004005TSPxe25.08.2009 11:45:561460 (0x05B4)Execution complete.TSBootShell25.08.2009 11:45:56916 (0x0394)Finalizing logging from process 896TSBootShell25.08.2009 11:45:56916 (0x0394)Finalizing logs to root of first available driveTSBootShell25.08.2009 11:45:56916 (0x0394)LOGGING: Setting log directory to "C:\SMSTSLog".TSBootShell25.08.2009 11:45:56916 (0x0394)Now comes the tricky part. When I imported the boot images into SCCM, I imported them using the SCCM consolethat is conneted to the Central Primary (CPS). I then distributed both bootimages to the Primary (PNO) that is also the pxe service point. I havecreateda TS to install a bare metal server. This TS is created on the CPS and advertised it to a collection. I then created a computer association for this specific bare metal server on CPS. When I tried to pxe boot the server, I always ended up getting abortpxe.com until I deleted the advertisement and computer association on CPS and recreated them directly on PNO. When I did this the server booted on pxe right away and started to load WinPE. But now I'm stuck with the error thatis "attached" above.I have a bad feeling something is not correct in the access rights within the enterprise setup of SCCM. In short terms this an existing SCCM environment where OSD has not been used before. The SCCMenvironment contains one Central Primary, 5 Primarys and about 100 Secondary SCCM servers locatedall overthe globe. My bad feeling is caused by the thought that it just can't be right that I'm supposed to create new advertisements on each site that is supposed to have the OSD feature. Any guidance on getting my head wrapped around this problem will be greatly appreciated ! /Tom Erik
August 25th, 2009 10:05am

have you tried restarting the windows deployment service on that server ? my SCCM step by step Guides > http://www.windows-noob.com/forums/index.php?showtopic=1064
Free Windows Admin Tool Kit Click here and download it now
August 25th, 2009 10:18am

Soit starts WinPE, but not your Task Sequence? Could be a problem with your networkdrivers in the bootimage to...My Blog: http://www.petervanderwoude.nl/
August 25th, 2009 10:24am

Niall,I have tried to restart the WDS service on that server. I can see that the WinPE image receives an IP, but I did however notice one slightly odd thing. The lease of the IP is obtained on Saturday, July 19, 1873, but the lease expire date makes sense. I can ping the server from WinPE, with netbios and fqdn name also./Tom Erik
Free Windows Admin Tool Kit Click here and download it now
August 25th, 2009 10:27am

Hi Peter,I have checked that out to. I have used the same drivers in the test environment and they work as I can load the TS there. Using only common HP Scripting Tools (latest version) drivers that are for WinPE./Tom Erik
August 25th, 2009 10:29am

have you tried restarting the DHCP service as well ? is that server also hosting DHCP my SCCM step by step Guides > http://www.windows-noob.com/forums/index.php?showtopic=1064
Free Windows Admin Tool Kit Click here and download it now
August 25th, 2009 11:58am

The server is hosting DHCP as well. I have also restarted the service and verified that everything is OK with it./Tom Erik
August 25th, 2009 1:38pm

I finally found the solution. It was my user id's lack of access rights within SCCM that caused the error. The PXE SP installed OK without any warnings and the pxesetup.log file did not report anything wrong. However the real problem was that the certificate never reached "Site Management - Site Name - Site settings - Certificates - PXE. You could see that the certificate was in place on the PXE SP role itself, but since I had uninstalled the PXE SP and installed it over again, I missed the exact date expiry date time. It looked very much to be the same, but it was some hours off and the old one had not been blocked, so due to this together with to little attention to a minor detail it pretty much had me pretty far off the where the solution was. So when I gave my self access rights enough to perform this task I had the correct certificate in place and things where back on track again (except I had already removed WDS, DHCP settings and the PXE SP together with boot images from the DP). So I started off from scratch againand now things are back on track.A big, Thank You, to Lothar Zeitler in MS Services - Switzerland whogave me a great big hint that something was wrong with the certificate (hence all the 0x80004005 access denied log entries)./Tom Erik
Free Windows Admin Tool Kit Click here and download it now
August 28th, 2009 4:58am

I ran across this on a server that had been working for some time (but not used often). turns out the pxe self cert had expired. In the configmgr console -> site mgmt -> SITE -> site systems -> SERVER -> pxe server role, I was able to give the cert a new expiration date. still no dice until I restarted the wdsserver service on the local pxe server. once I did that, we were away. Thanks for the pointer.-cornasdf http://cornasdf.blogspot.com
July 5th, 2012 2:24pm

Tom I'm also facing the same issue. Could u please tell me what sort of permissions u provided to your user id?Esakz
Free Windows Admin Tool Kit Click here and download it now
August 5th, 2012 6:04am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics