Comments on: System Center Mobile Device Manager 2008 – Install Guide (No Gateway) – Part 2

By: Michael B. Abbott

Michael B. Abbott — Thu, 26 Nov 2009 00:52:02 +0000

You Sir, are amazing! Appreciate the quick response and all your effort into documenting these setups. I’ll drink a beer in your honor tonight!

By: Andreas

Andreas — Wed, 25 Nov 2009 07:36:53 +0000

If you are installing SCMDM Service Pack 1 (and there really is no reason you shouldn’t be going for SP1) you should follow the ADConfig steps listed in the following article:
http://mobilitydojo.net/2008/12/30/scmdm-multiple-instance-deployment-part-1/

Also, if I remember correctly, you might see strange behaviour if you are running ADConfig from a read-only location, (like a cd or mounted iso), so to be sure you should copy the directory to a writable folder.

By: Michael B. Abbott

Michael B. Abbott — Wed, 25 Nov 2009 04:05:55 +0000

In your first screenshot of ADConfig you have:

adconfig /domain:mobilitydojo.net

When I execute that same command-line using my Domain, I don’t have happen when you’re showing — the setting up of AD and the OU’s, etc.

The ADConfig menu of options comes back up but does not progress any further. Should I be putting /createinstance: in there?

::: Confused::

By: Philip

Philip — Mon, 08 Jun 2009 06:26:56 +0000

I downloaded the Best Practice Tools for MDM and ran the pre-deployment scan. I was able to figure out what was wrong from the scan results. I got my window mobile phone successfully enrolled. Sweet.

By: Andreas

Andreas — Sat, 06 Jun 2009 15:13:05 +0000

The “/enabletemplates” requires enterprise admin, so make sure your domain admin is also a member of that group as a double-check. And you’ve already ran the other required parameters? (Createinstance, enableinstance, createtemplates, in that order.) If you have multiple domains enabletemplates must be run on the root domain controller. Although not recommended for production it should work fine to have the CA running on the DC.

Have you tried running adconfig /validateinstance to make sure AD is ok for SCMDM?

By: Philip

Philip — Fri, 05 Jun 2009 00:08:02 +0000

my CA is on my domain controller running window 2008. I login as Domain Administrator with all the necessary permission. Here is the log.

[06/04/2009-14:34:26] DEBUG : Executing assembly directory C:\Temp\adconfig
[06/04/2009-14:34:26] DEBUG : Invoking RunDll with arguments “C:\Temp\adconfig\CertificateAuthorityPermissions_x64.dll”,IsCASecurityEnabled TIETON.lychee.comlychee-TIETON-CAS-1-5-21-1119451185-429848030-2992905492-1219
[06/04/2009-14:34:26] DEBUG : Rundll invocation was successful. Process returned with exit code 0
[06/04/2009-14:34:26] DEBUG : Call to exported native method IsCASecurityEnabled in DLL CertificateAuthorityPermissions_x64.dll was successful
[06/04/2009-14:34:26] DEBUG : Calling exported native method IsCARestrictionEnabled in DLL CertificateAuthorityPermissions_x64.dll with args TIETON.lychee.comlychee-TIETON-CAS-1-5-21-1119451185-429848030-2992905492-1219S-1-5-21-1119451185-429848030-2992905492-1220
[06/04/2009-14:34:26] DEBUG : Executing assembly directory C:\Temp\adconfig
[06/04/2009-14:34:26] DEBUG : Invoking RunDll with arguments “C:\Temp\adconfig\CertificateAuthorityPermissions_x64.dll”,IsCARestrictionEnabled TIETON.lychee.comlychee-TIETON-CAS-1-5-21-1119451185-429848030-2992905492-1219S-1-5-21-1119451185-429848030-2992905492-1220
[06/04/2009-14:34:27] DEBUG : Rundll exited with error code -2147024776
[06/04/2009-14:34:27] DEBUG : Failed to verify CA security restrictions on TIETON.lychee.com\lychee-TIETON-CA with trusteeSid S-1-5-21-1119451185-429848030-2992905492-1219, subjectSid S-1-5-21-1119451185-429848030-2992905492-1220. Error: System.ComponentModel.Win32Exception: This function is not supported on this system

By: Andreas

Andreas — Thu, 04 Jun 2009 22:06:49 +0000

And this is against a Windows Server 2003 or Windows Server 2008 Enterprise CA?
Have you checked that the user you are logged on with have the proper credentials? Domain Admin rights are probably not sufficient as it usually requires Enterprise Admin to do things related to a CA.

By: Philip

Philip — Thu, 04 Jun 2009 22:00:41 +0000

I’m getting this error when running /enabletemplates /ca:\

Error: Failed to add security on the caserver\caname certification authority using trustee security identifier ….
. Error: This function is not supported on this system.

Help!

By: Andreas

Andreas — Thu, 27 Nov 2008 10:49:25 +0000

Good thing that it was a simple syntax error.
SCMDM is not very forgiving with incorrect syntax – you need it to be correct down to the letter

By: Francob

Francob — Thu, 27 Nov 2008 10:05:02 +0000

Just figured out my syntax was incorrect

I was omitting the ca instance at the end

/enabletemplates /ca:\

Francob