|Welcome to my blogs. Today's blog is about a forum question that we received. Since we seem to get a lot of SCCM questions I thought it would be good to blog about it.|
A software package/wrapper script was created that would execute the ACUConfig.exe command line executable to provision a machine using SCCM 2007. The local SYSTEM account (which SCCM uses to execute packages on machines) was given access to the WMI namepsace yet errors were occurring on machines when provisioning them using this package. If the same script is run manually (using individual account), it works fine. Here are some of the errors coming from the ACUConfig log file:
2013-06-06 18:36:41: Thread:6000(ERROR) : ACU Configurator , Category: ConnectServer Source: Src\WMIAccess.cpp : ConnectToNamespace Line: 118: A call to this function has failed - (0xc000278b) (Access is denied. -2147024891)
2013-06-06 18:36:41: Thread:6000(ERROR) : ACU.dll, Category: Remote Configure Source: Src\ActivatorDll.cpp : RemoteConfiguration Line: 3581: Failed to complete remote configuration of this Intel(R) AMT device.
2013-06-06 18:36:41: Thread:6000(ERROR) : ACU Configurator, Category: Exit Source: Src\ActivatorMain.cpp : wmain Line: 1096: ***********Exit with code 75. Details: Failed to complete remote configuration of this Intel(R) AMT device. Failed to authenticate with the RCS. A call to this function has failed - Access is denied.
The solution is covered in the Intel SCS 8 Deployment Guide on pg 55-56 (although it doesn't specifically call it out). As SCCM uses the local system account to deploy software to doman machines, by adding <DOMAIN>\Domain Computers to the WMI security settings for Intel SCS components, it will then allow localsystem to run the ACUConfig.exe on domain machines. Make sure to add it to DCOM group too as per instructions on those pages.