Comments on: System Center Mobile Device Manager 2008 – Install Guide (No Gateway) – Part 2

By: Jordi

Jordi — Thu, 17 Jun 2010 12:56:23 +0000

Yes, these are the requirements and it’s explicit enough. That happens when you do things in a rush…

http://technet.microsoft.com/en-us/library/dd261866.aspx

By the way… It’s also funny that MDM 2008 does not support windows 2008…

By: Andreas

Andreas — Wed, 16 Jun 2010 18:12:42 +0000

Ah, yes, the Standard Edition will not let you create custom templates which is a bit of a showstopper with SCMDM.
It’s a real easy thing to miss while checking the pre-reqs though so I can’t blame you for running into this error
But at least the fix is “easy” once you locate this as the source (not that the error gives you much clues).

By: Jordi

Jordi — Wed, 16 Jun 2010 16:46:54 +0000

The problem was that the CA was on a W2003 Standard instead of W2003 Enterprise.

Regards,

Jordi

By: Jordi

Jordi — Tue, 15 Jun 2010 09:34:22 +0000

The same error after doing the step:

ADConfig /enableTemplates:instanceName /ca:caserver1.domainName\serverName

from the DC

By: Jordi

Jordi — Tue, 15 Jun 2010 07:29:40 +0000

Yes, I did follow the instructions of that link. The only difference may be that I didn’t do it in the root DC but on a member server. I’ll try to remove the instance following:

http://technet.microsoft.com/en-us/library/dd252819.aspx

“This requires that you run /disablegpsecurity; /disabletemplates; /removetemplates; /disableinstance and finally, /removeinstance”

and I’ll create it again from the root DC. Tell you the result…

Thanks

By: Andreas

Andreas — Mon, 14 Jun 2010 22:40:20 +0000

BPA seems to indicate that you haven’t created an instance. With Service Pack 1 it is an additional step that needs to be performed when preparing AD.
The steps are documented here:
http://mobilitydojo.net/2008/12/30/scmdm-multiple-instance-deployment-part-1/

If you have already been through that it seems that for some reason the BPA isn’t catching it and I’m not sure why that would be.

By: Jordi

Jordi — Mon, 14 Jun 2010 16:43:53 +0000

this is an extended version of the previous message:

Hello, I have the same “Failed to add security on the caserver\caname certification authority using trustee security identifier” error but the BPA don’t give me any clue about the problem…

The error I get is:
ERROR : Failed to add security on the caserver1.domainName\serverName certification authority using trustee security identifier [S-1-5-21-xxxxxxxxx-xxxxxxxxxx-xxxxxxxxxx-23959], and subject security identifier [S-1-5-21-xxxxxxxxx-xxxxxxxxxx-xxxxxxxxxx-23960]. Error: This function is not supported on this system.
ERROR : Errors occurred while configuring security on caserver1.domainName\serverName certification authority for MDM instance instanceName.

The 23959 account is SCMDMEnrollmentServers and the 23960 is SCMDMEnrolledDevices

This is the result of BPA.
Pre-deploy tests were all OK but this other test failed
http://img243.imageshack.us/img243/6949/mdmcaerror.jpg

I have searched but I don’t find this error to happen to other people… Any help is welcome

By: Jordi

Jordi — Mon, 14 Jun 2010 16:28:38 +0000

Hello, I have the same “Failed to add security on the caserver\caname certification authority using trustee security identifier” error but the BPA don’t give me any clue about the problem…

This is the result of BPA.
Pre-deploy tests were all OK but this other test failed
http://img243.imageshack.us/img243/6949/mdmcaerror.jpg

I have searched but I don’t find this error to happen to other people… Any help is wellcome

By: Michael B. Abbott

Michael B. Abbott — Thu, 26 Nov 2009 00:52:02 +0000

You Sir, are amazing! Appreciate the quick response and all your effort into documenting these setups. I’ll drink a beer in your honor tonight!

By: Andreas

Andreas — Wed, 25 Nov 2009 07:36:53 +0000

If you are installing SCMDM Service Pack 1 (and there really is no reason you shouldn’t be going for SP1) you should follow the ADConfig steps listed in the following article:
http://mobilitydojo.net/2008/12/30/scmdm-multiple-instance-deployment-part-1/

Also, if I remember correctly, you might see strange behaviour if you are running ADConfig from a read-only location, (like a cd or mounted iso), so to be sure you should copy the directory to a writable folder.