SCCM Account Permission and Ports

SCCM Account Permission and Ports

Software Account Permissions

Below Accounts used for AD discovery purpose

      Active Directory Discovery Account

Your Site server computer Account or User account must have read permission for below AD attributes

Active Directory group discovery account 

Active Directory system discovery account

Active Directory user discovery account

 Active Directory forest account

The Site Server Computer account must have full access required for System Management container and all its child objects

Note: Don’t grant interactive sign-in rights to this account and avoid account lockouts create service account

For extent AD schema, the user account must be either a member of the Schema Admins group or have been delegated sufficient permissions to modify the schema

Ex – SCCMAD@domain.com

      Client Push Installation Account

The Client Push user account must be a member of the local Administrators group on the target client computers. This account doesn't require Domain Admin rights (Using GPO we make our client push account as member of all domain machine local administrator. 

Note: Don’t grant interactive sign-in rights to this account and avoid account lockouts create service account

Ex – SCCMClientpush@domain.com

      Network Access Account

Client computers use the network access account when they can't use their local computer account to access content on distribution points. It mostly applies to workgroup clients and computers from untrusted domains. This account is also used during OS deployment, when the computer that's installing the OS doesn't yet have a computer account on the domain

Its only used for access content in distribution point where computer account unable to access it

This Account mush be in domain user and have access to Distribution point, It doesn’t need any special rights

Note: Don’t grant interactive sign-in rights to this account and avoid account lockouts create service account

Ex - SCCMNAA@domain.com

      Reporting Service Point Account

It’s a normal domain account, Configuration Manager automatically grants the specified user access to the site database. The user is displayed in the Accounts subfolder of the Security node in the Administration workspace with the ConfigMgr Reporting Services Point account name

Note: Don’t grant interactive sign-in rights to this account and avoid account lockouts create service account

Ex – SCCMSQLReporting@domaiin.com

      Task sequence domain join account

Windows Setup uses the Task sequence domain join account to join a newly imaged computer to a domain, the specific user account requires the Domain Join right in the target domain

Note: Don’t grant interactive sign-in rights or domain admin rights to this account and avoid account lockouts create service account

Ex – SCCMdomainjoin@domain.com

For other SCCM task like, site installation and role configuration, create an dedicated domain user account which doesn’t required any special permissions

Ex – SCCMAdmin@domain.com

Create separate account for SQL server service account, we use this for SQL server installation and configuration, this account doesn’t required any special permission.

Ex – SCCMSQL@domain.com

We can also create SCCM Admin group, which will help to troubleshoot SCCM server and clients

This group required local admin permission for all SCCM server and SCCM client computers

Ex – SCCMAdminGroup@domain.com

We can also create another SCCM AD group for having access in AD system container and all SCCM servers

This group required local admin permission for all SCCM server and full permission on System Management container in AD

Ex – SCCMSiteServer@domain.com

SCCM Required Ports

Ports required between clients to site server

From	To	UDP	TCP	Description	Direction
Client	App Catalog Website Point		80/443	http/https	Unidirection
Client	Client (wol)		9/25536	WOL/WUP	Unidirection
Client	NDES		80/443	http/https	Unidirection
Client	Cloud DP		443	https	Unidirection
Client	DP		80/443	http/https	Unidirection
Client	DP with Multi Cast	63000-64000	445	Multi Cast/SMB	Unidirection
Client	DP with PXE	67/68/69/4011		DHCP/TFTP/BINL	Unidirection
Client	FSP		80	http	Unidirection
Client	Domain		3268/3269	LDAP/LDAP SSL	Unidirection
Client	MP		10123/80/443	Client Notification/http/https	Unidirection
Client	SUP		80/8530/443/8531	http/https	Unidirection
Client	SMP		80/443/445	http/https/SMB	Unidirection
Client	PXE DP	67/68/69/4011		PXE Enable DP	Unidirection
Client	DP		445	Windows File Share	Unidirection

Ports Required between SCCM Site Server to Clients

From	To	UDP	TCP	Description	Direction
Console	Client		2701/3389	RC/RDP/RTC	Unidirection
Console	Client		135/445	WMI and Windows File Share	Unidirection
Console	Client		2701/3389	Remote Control	Unidirection
Console	Client			ICMP Echo Request	Unidirection
Console	Client	135		RPC Endpoint Mapper	Unidirection
Console	Client	49152-65535		RPC Ports	Unidirection

Windows Firewall Ports and Inbound / Outbound GPO Rule

It’s recommended to enable windows firewall in on each desktop & server, some certain things we can’t install without enable windows firewall.

If windows firewall is enable, we need to create few inbound and outbound rule in GPO to allow SCCM traffic. Below are the details

Name	Group	Profile	Enabled	Action
ICMP Wake-up proxy communication		All	Yes	Allow
RPC End Point Mapper		All	Yes	Allow
Configuration Manager remote control		All	Yes	Allow
Windows Management Instrumentation (ASync-In)	Windows Management Instrumentation (WMI)	Private, Public	Yes	Allow
Windows Management Instrumentation (WMI-In)	Windows Management Instrumentation (WMI)	Private, Public	Yes	Allow
Windows Management Instrumentation (DCOM-In)	Windows Management Instrumentation (WMI)	Private, Public	Yes	Allow
Windows Management Instrumentation (ASync-In)	Windows Management Instrumentation (WMI)	Domain	Yes	Allow
Windows Management Instrumentation (WMI-In)	Windows Management Instrumentation (WMI)	Domain	Yes	Allow
Windows Management Instrumentation (DCOM-In)	Windows Management Instrumentation (WMI)	Domain	Yes	Allow
File and Printer Sharing (LLMNR-UDP-In)	File and Printer Sharing	All	Yes	Allow
File and Printer Sharing (Echo Request – ICMPv6-In)	File and Printer Sharing	Private, Public	Yes	Allow
File and Printer Sharing (Echo Request – ICMPv4-In)	File and Printer Sharing	Private, Public	Yes	Allow
File and Printer Sharing (Spooler Service – RPC-EPMAP)	File and Printer Sharing	Private, Public	Yes	Allow
File and Printer Sharing (Spooler Service – RPC)	File and Printer Sharing	Private, Public	Yes	Allow
File and Printer Sharing (NB-Datagram-In)	File and Printer Sharing	Private, Public	Yes	Allow
File and Printer Sharing (NB-Name-In)	File and Printer Sharing	Private, Public	Yes	Allow
File and Printer Sharing (SMB-In)	File and Printer Sharing	Private, Public	Yes	Allow
File and Printer Sharing (NB-Session-In)	File and Printer Sharing	Private, Public	Yes	Allow
File and Printer Sharing (Echo Request – ICMPv6-In)	File and Printer Sharing	Domain	Yes	Allow
File and Printer Sharing (Echo Request – ICMPv4-In)	File and Printer Sharing	Domain	Yes	Allow
File and Printer Sharing (Spooler Service – RPC-EPMAP)	File and Printer Sharing	Domain	Yes	Allow
File and Printer Sharing (Spooler Service – RPC)	File and Printer Sharing	Domain	Yes	Allow
File and Printer Sharing (NB-Datagram-In)	File and Printer Sharing	Domain	Yes	Allow
File and Printer Sharing (NB-Name-In)	File and Printer Sharing	Domain	Yes	Allow
File and Printer Sharing (SMB-In)	File and Printer Sharing	Domain	Yes	Allow
File and Printer Sharing (NB-Session-In)	File and Printer Sharing	Domain	Yes	Allow
SQL Ports for SCCM	TCP 1433	Domain,Private, Public	Yes	Allow
SQL Ports for SCCM	TCP 4022	Domain,Private, Public	Yes	Allow

SCCM - SQL Query Server Hardware Inventory With MAC and IP Address

SCCM - SQL Query Server Hardware Inventory With MAC and IP Address

SELECT
A.Name0,
B.SerialNumber0 ,
A.Manufacturer0,
A.Model0,
 C.Name0 ,
D.TotalPhysicalMemory0 ,

MAX (J.MACAddress0) as MAC ,
MAX (F.IPAddress0) As IPAddress ,
G.AD_Site_Name0 ,
MAX (A.UserName0) as Username ,
H.Caption0 ,
H.CSDVersion0,
G.Creation_Date0 ,
I.LastHWScan


FROM
v_GS_COMPUTER_SYSTEM A,
v_GS_PC_BIOS B,
v_GS_PROCESSOR C,
v_GS_X86_PC_MEMORY D,
v_GS_DISK E,
v_GS_NETWORK_ADAPTER_CONFIGUR F,
v_GS_NETWORK_ADAPTER J ,
v_GS_OPERATING_SYSTEM H,
v_GS_WORKSTATION_STATUS I
 INNER JOIN
v_R_System G on G.ResourceID=I.ResourceID


WHERE
A.ResourceID = B.ResourceID AND
A.ResourceID = C.ResourceID AND
A.ResourceID = D.ResourceID AND
A.ResourceID = E.ResourceID AND
A.ResourceID = F.ResourceID AND
A.ResourceID = G.ResourceID AND
A.ResourceID = H.ResourceID AND
A.ResourceID = I.ResourceID AND
A.ResourceID = J.ResourceID AND
H.Caption0 like '%server%'


GROUP BY A.Name0,b.SerialNumber0, A.Manufacturer0, A.Model0, C.Name0, D.TotalPhysicalMemory0, G.AD_Site_Name0, A.UserName0, H.Caption0, H.CSDVersion0, G.Creation_Date0, I.LastHWScan

SCCM - Secondary Site Unable to Contact MP or DP

SCCM - Secondary Site Unable to Contact MP or DP

Recently we deployed few secondary site , Management point and Distribution point are working fine, but clients unable to receive policy from MP.

No error on mpcontrol.log 

And found some kerberos error on event logs

Log Name:      System
Source:        Microsoft-Windows-Security-Kerberos
Event ID:      4
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      SCSMDW.wsdemo.com
Description:
The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server smsvc. The target name used was MSOMSdkSvc/SCSMDW. This indicates that the target server failed to decrypt the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Ensure that the target SPN is only registered on the account used by the server

After investigating, it turned out to be the Service Principal Name (SPN) that caused the issue. And I quickly saw why. The issue was that the SPN’s was created on the wrong Domain Service Account. If you are running the SQL Service (MSSQLSvc) with local computers system account, the SPN’s are registered automatically and you should not see these types of errors. But if you are running the SQL Service (MSSQLSvc) account with a domain account, then you have to do this manually

So you need to run the below command to register SPN manually

To delete existing SPNs from wrong service account:

setspn -D MSSQLSvc/<SQL Server computer name>:1433 <Domain\Account>
setspn -D MSSQLSvc/<SQL Server FQDN>:1433 <Domain\Account>

 To add new SPNs the correct service account:

setspn -A MSSQLSvc/<SQL Server computer name>:1433 <Domain\Account>
setspn -A MSSQLSvc/<SQL Server FQDN>:1433 <Domain\Account>  

SCCM - SQL Query to get Software Update Deployment Status - Pivot View

SCCM - SQL Query to get Software Update Deployment Status - Pivot View

Select  Deploymentname, Available, Deadline,

cast(cast(((cast([Compliant] as float) / (ISNULL([Compliant], 0) + ISNULL([Successfully installed update(s)], 0) + ISNULL([Pending system restart], 0) + ISNULL([Waiting for restart], 0) + ISNULL([Installing update(s)], 0) + ISNULL([Downloaded update(s)], 0) + ISNULL([Downloading update(s)], 0) + ISNULL([Waiting for another installation to complete], 0) + ISNULL([Waiting for maintenance window before installing], 0) + ISNULL([Enforcement state unknown], 0) + ISNULL([Failed to download update(s)], 0) + ISNULL([Failed to install update(s)], 0) ))*100) as Numeric(10,2)) as varchar(256)) + '%' AS '% Compliant',

[Compliant],
[Successfully installed update(s)],
[Pending system restart],
[Waiting for restart],
[Installing update(s)],
[Downloaded update(s)],
[Downloading update(s)],
[Waiting for another installation to complete],
[Waiting for maintenance window before installing],
[Enforcement state unknown],
[Failed to download update(s)],
[Failed to install update(s)]

From

(select
a.Assignment_UniqueID as DeploymentID,
a.AssignmentName as DeploymentName,
a.StartTime as Available,
a.EnforcementDeadline as Deadline,
sn.StateName as LastEnforcementState,
count(*) as NumberOfComputers
from v_CIAssignment a
join v_AssignmentState_Combined assc
on a.AssignmentID=assc.AssignmentID
join v_StateNames sn
on assc.StateType = sn.TopicType and sn.StateID=isnull(assc.StateID,0)

group by a.Assignment_UniqueID, a.AssignmentName, a.StartTime, a.EnforcementDeadline,
sn.StateName) as PivotData

PIVOT

(

SUM (NumberOfComputers)
FOR LastEnforcementState IN

( [Compliant],
[Successfully installed update(s)],
[Pending system restart],
[Waiting for restart],
[Installing update(s)],
[Downloaded update(s)],
[Downloading update(s)],
[Waiting for another installation to complete],
[Waiting for maintenance window before installing],
[Enforcement state unknown],
[Failed to download update(s)],
[Failed to install update(s)])
) AS pvt

where DeploymentName in ('Deployment Name')

ORDER BY Deploymentname