SCCM Console – Item referred to by this shortcut cannot be accessed.

Issue:

I just performed a new install of SCCM.

When I went to open the shortcut on the desktop for the SCCM Console, I received the following error:

The item referred to by this shortcut cannot be access. You may not have the appropriate permissions.

Figure 1 – SCCM Console Error

I then proceeded to the executable location –
“D:\Program Files\Microsoft Configuration Manager\AdminConsole\bin\Microsoft.ConfigurationManagement.exe”,
and received the following error:

Access is denied.

Figure 2 – SCCM Console Error – Access Denied

Solution:

The issue was that I had changed the Group Policy for this server.

Ensure that the following Objects have the following permissions:

Bypass Traverse Checking = Everyone, LOCAL SERVICE, NETWORK SERVICE, Administrators

Create Global Objects = SERVICE, NETWORK SERVICE, LOCAL SERVICE

Replace a process level token = LOCAL SERVICE, NETWORK SERVICE

SCCM – Inventory Data Load Failed to Process the delta MIF file

Background:

Installed a new SCCM Primary Site in a new environment. Used SCCM 1702 media. WSUS, SCCM and SQL Server all sitting on the same server.

Got the client installed successfully on all the new devices and left SCCM to do its thing overnight.

Noticed that the devices were not being added to the new Device Collections i created. Double checked that the filters were correct and proceeded to do a Healthcheck of SCCM.

While looking at the SCCM Console and check out the Component Status page, noticed the following errors:

Error:

---

Inventory Data Loader failed to process the delta MIF file……

Solution:

---

The issue as it turns out was a permission issue.

Running ProcMon (SysInternals Tool) and filtering by Access Denied I was able to see Access Denied errors on the D:\Program Files\Microsoft Configuration Manager\CCM…..

Click Share on the folder (right click > Properties > Sharing tab) and add the relevant service account that is captured in ProcMon.

 

Using CMTrace to find Error Message

Recently had an issue where the SCCM Clients were not sending their hardware inventory to SCCM. Once upon a time it was.

The best way to view the logs is using the SCCM Tool – CMTrace.
More information can be found here:

Microsoft CMTrace

CMTrace is found on the SCCM server under:
<SCCM Server>\SMS_<SITENAME>\Tools\cmtrace.exe

On the client double click on CMTrace and set as default log viewer.

NP – in version 1806 CMTrace is installed on the client and can be found under %WinDir%\CCM\CMTrace.exe.
Open the log file.

Click CTRL + L on CMTrace.

Enter the error code, in this case its 8004100E, and click Lookup.

In this case, the error is to do with the WMI > Invalid Namespace. That helps narrow down the issue.

 

OnSearchComplete – Failed to end search job

Currently patching an environment that has not been receiving patches regularly. 30 servers. Not a big deal, but some Windows Server 2008 R2 ones, which are always fun due to the update process.

Noticed that updates were not going out to a bunch of Windows Server 2008 R2 servers that were configured (Deployment Package) after the rest.

Thought it was my Deployment Package, so redeployed the Deployment Package with more certainty and confidence.
Still no luck. Decided to check the SCCM logs.
Checked the WUAHandler.log under C:\Windows\CCM\Logs and found that the below error:

OnSearchComplete – Failed to end search job. Error = 0x80072efe
Scan failed with error = 0x80072efe

This error indicates an issue talking to the WSUS server. For my particular case the WSUS App Pool was stopped, meaning it couldn’t communicate with it.

Start the App Pool and it fixes the problem. If the application pool is running for you then check you can connect to the WSUS URL, eg. http://:8530 remotely from the client and troubleshoot that way.

You can confirm this by checking C:\Windows\CCMCache and looking at the timestamp for the updates coming in.