Hi we are facing the following issue in our environment: A number of the new SCCM client machines are apparently failing to authenticate with their Management Point. Logs On the server: The error in the MP status logs read like: MP has rejected a policy request from GUID:A2062E3F-655F-4F4A-97C9-2E6D41B31D72 because it was not approved. The operating system reported error 2147942405: Access is denied. Logs On the client: When we then look at the Policy Agent log on the client we see the following entries: Failed to decrypt policy which is not encrypted properly for this client. 2 such decryption failures have been encountered. Decryption of authz-required policy file 'C:\WINDOWS\system32\CCM\Temp\{32A94CCA-24FD-4075-8C68-092A89C28440}.tmp' failed (0x8009310b). Location Services Log shows: Failed to process security mode transition. (0x80070002) (every 40 mins) Certificate Maintenance Log shows: Certificate (0x26aef40) is Exportable CCMValidateEncryptionCert failed. (0x80090005) Creating Encryption Certificate... Successfully created certificate Raising event: instance of CCM_ServiceHost_CertRetrieval_Status { ClientID = "GUID:889C5AC7-F1DE-4AC0-BF9D-B74E8F94ED00"; DateTime = "20080129190357.492000+000"; HRESULT = "0x00000000"; ProcessID = 2248; ThreadID = 768; }; Successfully submitted event to the Status Agent. New Cert generated - generate new SMS ID Force Generation of New SMSID This is every hour. ClientIDManagerStartup Log shows: Failed to get the current version of the client. In our environment we have automatic approval enabled and we are using mixed mode. And the client machines and the server are on the same domain. The client machines on which this issue is coming are showing their approval status as N/A on the server console. Also if we try to manually approve it the issue remains the same. Would appreciate any help on this issue. Thanks, Rajat Raghav.

Does the ClientIDManagerStartup.log indicate that the client has been registered? That's the first step. If not, no policies can be downloaded. If it is registered, then any policies can be downloaded except the policy with the Network Access account.

If the client has not been registered how to register it

The client will automatically retry the registation process. You will see that happen in the ClientIDManagerStartup.log. There's nothing you have to do to attempt the re-registration process. If I recall, it tries every 10 minutes.

Wally, i see this in my clientlogs after deploying an osd image. Howlong does it take till the client registers after an os deployment? thx Oliver

In my labs on OSD (I have two different ones), the client registers immediately after the Configuration Manager client install (well, in a normal timeframe, I've never bothered to check the log to see exactly how long it takes, but it seems normal to me). Normal is usually within a few minutes after the client is installed.

I resolve this issue using following method, Log on to SQL Server Management Studio and run this query against SCCM database select * from dbo.system_data where smsid0 = 'GUID here' If it finds the PC, then locate PC in SCCM collections, uninstall SCCM client then reinstall the client. If it does not find the PC, then the PC may been deleted directly from site database. Also check AD System Discovery configuration and make sure that ADSYSDIS discovers the container where the client whose GUID matches the error resides.

This response is not an answer. How can this be marked as an answer??