Re: SMS 2.0 Client on Domain controller fails error 1069

From: Michael Poling [MSFT] (michpol_at_online.microsoft.com)
Date: 07/22/04


Date: Thu, 22 Jul 2004 16:47:28 -0700

Does SMSInternalCliGrp have Logon as a service permissions? I have done
some research and after SP5 it appears most issues like this have been
resolved by giving logon as a service permissions to the SMSInternalCliGrp.

If this group already has this permission, then please tell me what OS you
are using on these domain controllers, and tell me where SMS is installed.
Are both DC's in the same domain?

This posting is provided "AS IS" with no warranties, and confers no rights.

"John Graham" <anonymous@discussions.microsoft.com> wrote in message
news:23c401c47011$8fb8e2b0$a301280a@phx.gbl...
> Opened Default Domain Controller Security Policy tab under
> Administrative Tools.
> Log On as a Service is marked as "Not Defined"
>
> AD Users & Computers - Domain COntrollers tab indicates
> that I am using Default Domain Controllers Group Policy.
>
> Also Note: Both Northglenn and Southglenn have the same
> policy settings. Northglenn installed, Southflenn did not!
> What would cause one domain controller to install the
> client but prohibit the other.
>
> Both machines are on the same subnet, same domain.
>
> Another question: During the installation, the account
> SMS#_Southglenn is created. The CCMBoot service is
> created, errors out, but then the account and the service
> are both deleted. Is there any way to prevent the deletion
> so that the permissions issue could be troubleshot?
>
>>-----Original Message-----
>>The error 1069 is "The service did not start due to a
> logon failure."
>>
>>I have seen issues where the Default Domain Controller
> Security Policy has
>>been disabled and replaced by a custom policy, or
> modified where SMS is not
>>able to modify it.
>>
>>If this is the case try adding SMSInternalCliGrp to
> the "Logon as a Service"
>>permission in your Domain Controller Security Policy or
> enable the Default
>>Domain Controller Security Policy.
>>
>>This posting is provided "AS IS" with no warranties, and
> confers no rights.
>>
>>"John Graham" <anonymous@discussions.microsoft.com> wrote
> in message
>>news:16dd01c46f45$84ea7140$a601280a@phx.gbl...
>>> Running SMS V2.0 sp5.
>>> Trying to install SMS client using NT Remote Client
>>> Installation method on a pair of AD Domain controllers.
>>> The first server installation succeeded without any
>>> problems. The second server fails with the following
> error
>>> in ccm.log
>>> ------
>>> $$<SMS_CLIENT_CONFIG_MANAGER><Wed Jul 21 08:16:55.725
> 2004
>>> Alaskan Daylight Time><thread=2808 (0xAF8)>
>>> ---> Sync part #1: Account is in the local
> administrators
>>> group (still need account properties sync locally)...
>>> $$<SMS_CLIENT_CONFIG_MANAGER><Wed Jul 21 08:17:54.864
> 2004
>>> Alaskan Daylight Time><thread=3456 (0xD80)>
>>> ---> Synced! User comment set to "SMS#_SOUTHGLENN
>>> PDC:\\NORTHGLENN Svr=SOUTHGLENN @ 07-21-2004, 08:16.54"
>>> locally $$<SMS_CLIENT_CONFIG_MANAGER><Wed Jul 21
>>> 08:17:54.880 2004 Alaskan Daylight Time><thread=3456
>>> (0xD80)>
>>> ---> Created service "CCMBoot" on machine "SOUTHGLENN".
>>> $$<SMS_CLIENT_CONFIG_MANAGER><Wed Jul 21 08:17:54.927
> 2004
>>> Alaskan Daylight Time><thread=3456 (0xD80)>
>>> ---> ERROR: Unable to start service "CCMBoot" on
>>> machine "SOUTHGLENN", error = 1069.
>>> $$<SMS_CLIENT_CONFIG_MANAGER><Wed Jul 21 08:17:54.943
> 2004
>>> Alaskan Daylight Time><thread=3456 (0xD80)>
>>> ---> Waiting for service to stop
>>> $$<SMS_CLIENT_CONFIG_MANAGER><Wed Jul 21 08:17:54.943
> 2004
>>> Alaskan Daylight Time><thread=3456 (0xD80)>
>>> ---> Service stopped $$<SMS_CLIENT_CONFIG_MANAGER><Wed
>>> Jul 21 08:17:59.942 2004 Alaskan Daylight
>>> Time><thread=3456 (0xD80)>
>>> ---> Failed to start the CCM Client Bootstrap service on
>>> SOUTHGLENN (1069) $$<SMS_CLIENT_CONFIG_MANAGER><Wed Jul
>>> 21 08:17:59.942 2004 Alaskan Daylight Time><thread=3456
>>> (0xD80)>
>>> ---> Service "CCMBoot" on machine "SOUTHGLENN"
>>> successfully deleted. $$<SMS_CLIENT_CONFIG_MANAGER><Wed
>>> Jul 21 08:17:59.989 2004 Alaskan Daylight
>>> Time><thread=3456 (0xD80)>
>>> ---> Failed to install CCM Client Bootstrap component on
>>> client (1069) $$<SMS_CLIENT_CONFIG_MANAGER><Wed Jul 21
>>> 08:18:00.005 2004 Alaskan Daylight Time><thread=3456
>>> (0xD80)>
>>>
>>> -----
>>> Please note that these servers (Northglenn and
> Southglenn)
>>> are set up identically!
>>
>>
>>.
>>



Relevant Pages

  • RE: Active Directory user enumeration
    ... Domain Controller installation. ... "Permissions compatible with pre-Windows 2000 servers" ... or "Permissions compatible only with WIndows 2000 servers."/ ... allow anonymous LDAP operations other than reading the RootDSE ...
    (Pen-Test)
  • Re: How to use a Group Distribution list inorder to send and received messages
    ... In the Permissions list, locate Send As, and then click to select the ... permission of the user account that is a member of one of administrative ... groups will be reset to match the ACL of the AdminSDHolder thread. ... Directory domain controller that holds the primary domain controller ...
    (microsoft.public.exchange.admin)
  • Re: How to use a Group Distribution list inorder to send and received messages
    ... In the Permissions list, locate Send As, and then click to select the ... permission of the user account that is a member of one of administrative ... groups will be reset to match the ACL of the AdminSDHolder thread. ... Directory domain controller that holds the primary domain controller ...
    (microsoft.public.exchange.admin)
  • Re: AD and WinXP
    ... the "Everyone" group permissions to specific objects in the tree. ... on a user object, so passwords cannot be changed over the null session ... Once you have verified propogation of the ACE, a default Domain Controller ... restricting Anonymous Access in Windows 2000. ...
    (microsoft.public.win2000.security)
  • Re: SMS 2.0 Client on Domain controller fails error 1069
    ... Opened Default Domain Controller Security Policy tab under ... >> Installation method on a pair of AD Domain controllers. ...
    (microsoft.public.sms.setup)