I’ve been working on a customer site for the last few days in my old stomping ground: System Center Configuration Manager (SCCM) 2007. It’s a new deployment in a mature Windows XP network. Today started out as a nightmare. I had all the prereqs done but the install of the primary site server was not going well. The management point just would not install. The SMS_MP_CONTROL_MANAGER was reporting that:
“MP Control Manager detected MPsetup has failed to create the CCM_Incoming Virtual Directory.
Possible cause: The IIS IWAM account has expired, been disabled, or has invalid or too restrictive logon hours. You may verify this information by running the net user command line for the IWAM account. (i.e.: "net user IWAMMachineName)
Solution: Use the output to verify that the account is enabled, and logon is possible during the time of installation. Note: You can use "net user" to modify the account properties.
Possible cause: The IIS IUSR account has expired, been disabled, or has invalid or too restrictive logon hours. You may verify this information by running the net user command line for the IUSR account. (i.e.: "net user IWAMMachineName)
Solution: Use the output to verify that the account is enabled, and logon is possible during the time of installation. Note: You can use "net user" to modify the account properties.
Possible cause: The designated Web Site is disabled in IIS.
Solution: Verify that the designated Web Site is enabled, and functioning properly”.
I knew that all IIS components were installed and configured correctly: I use my Zero Touch chapter from Mastering Windows 7 Deployment as my ConfigMgr prereqs check list! Using that, I can normally get an all green install. But something here was wrong. I suspected a security issue … who knows what’ll impact you in a mature network. I googled and a number of people reported corrupt IIS metabases caused issues. A reinstall of IIS and ConfigMgr ensued but no result.
Now I was sure an external factor was at fault. I’d heard that some security feature had screwed up the XP machines in the past. Something to do with Conficker. I had GPO, antivirus, and a 3rd party management product in my sights. We started deploying a new VM that would be dropped into an OU with blocked inheritance to prevent anything from screwing with the clean OS. Meanwhile, I returned to the already deployed (and new) VM and Google.
Then I found this thread on MS TechNet Forums. The user, tymque, had found that a hack to prevent Conficker had changed some permissions to the SVCHOST registry key and the WindowsTasks folder and this broke the management point installation. I found the default permissions on MS Support (on a Conficker subject page). I compared the default permissions with what was in place. They were different! I made the required changes manually and then the management point installation (manually running mp.msi) worked. To be safe, I ended up doing a clean reinstall of the entire site server … and got an all green as expected.
I never did find out what hacked those permissions: a bit of time pressure on this project.
