SMS/SCCM Error Messages. Might come handy.

Message ID 576, 578, & 579:  Possible reasons for this message:

The Windows Server that SCCM was installed on was promoted to a Domain Controller after the installation or installation occurred on a Domain Controller that was demoted to a Member server.  This process interferes with the SCCM accounts created at setup.




The messages are related to registry access permissions. Verify that proper permissions are set for SCCM to update the registry keys. Use ACLRESET.EXE to reset registry key permissions.

Message ID 600:  In an SCCM 2007 environment of any size, slow processing of client data files may occur – specifically those from hardware inventory, software inventory, and discovery data records (MIF, NHM, SID, SIC, DDR).

The slow processing can lead to backlogs of data in their respective inboxes.  This behavior is usually seen at a central site, but could potentially occur anywhere. Work from any errors reported in the component log files on the site server: sinvproc.log, dataldr.log, ddm.log  sinvproc.log, dataldr.log, ddm.log

One potential cause for this type of error is an inventory resynchronization.  A Full inventory file will nearly always take longer to process than a Delta.  Another common cause for slow Client data processing is Duplicate GUIDs.  Refer to DuplicateGUID.xls for a list of these machines.  Also check for Max Timeout, Max number of connection values in SQL configurations.

Message ID 620: This issue can occur when repeated message ID 620 errors are generated by the Collection Evaluator thread of the SCCM_Executive service. You may experience excessive disk thrashing, delays in processing advertisement status  messages, and overall site server degradation when repeated message ID 620 errors are generated by the Collection Evaluator thread of the SCCM_Executive service. All errors related to SQL Server Access and Message ID 620 should be investigated and solved. Typically message ID 620 and 2511 is generated by SQL server when it encounters invalid objects. Please check the status message descriptions for more information and possible solutions.

Message ID 669: This message is caused when SCCM component raised an exception but failed to handle it. We should further investigate this problem.

Message ID 679: This message is caused as SCCM component failed to retrieve the list of SCCM sites from the site database. Please follow the status message description to fix the problem.

Message ID 1016: This message is caused when the Site Component Manager fails to install an SCCM component on site system. Please review previous messages in status viewer to identify the root cause of the problem.

Message ID 1028, 1037, and 1048:  These messages are almost always indicative of missing or incorrect Sender addresses between sites.

Message ID 1080, 1081, 1084 & 1090: This message is caused because SCCM Site Component Manager does not have sufficient access rights to administer the site system. Please Verify Site System Connection accounts are properly configured to allow SCCM to administer the site system.

Message ID 1098 & 1020: Sites where these messages occurr are having problems with its SCCM Component Service and/or Executive services failing to restart or reinstall.

Message ID 1104: This message is caused when an SCCM Component crashes unexpectedly. Please verify the crash log to identify the root cause of the failure.

Message ID 1215: This is in the “Warning” messages column so much it has triggered a “Critical” notification. It reads, SCCM Status Manager received a status message reported by component “Software Distribution” running on computer “ComputerName”, and the time stamp on the message is more recent than the current system time on the site server.

Message ID 2302:  This is due to the inability of a Site to send and update packages to a Distribution Point.

Possible causes:

·         The path defined for the package being incorrect.  Within the Package properties – Data Source tab, change the Source Directory to the correct location.

Please follow to fix this error. This message could also be a result of distribution manager trying to access an invalid DP Share.

·         Always refer to the DistMgr.log file for more information.

Messages ID 2303, 2344, & 2345: These are generated when Distribution Manager is unable to create/remove the Virtual Directory from a DP. Please verify if IIS components are installed and configured correctly.

Message ID 2328: These messages are generated if the package source files are inaccessible due to permissions issue or server/share unavailability. See the DistMgr.log for the package information and distribution point causing the errors.

Message ID 2402:  This message is most likely being caused by synchronization errors.  A symptom could be a backlog in the CollEval box directory shown in the Site Server Health.xls.

Message ID 2349: This message is generated only by Windows Server 2007-based SCCM sites, and it is designed to notify an administrator when the WebDAV extensions are not installed on a Windows Server 2007 BITS enabled Distribution Point.

Message ID 2509, 2511, 2542, & 2543: This message may be due to an improper configuration of collections. Please verify the collection ID which is causing this error and fix it. Also please refer to Microsoft Knowledge Base article 886136 for a possible hotfix.

Message ID 2528: This message is caused when the collection table is queried for a subcollection that does not exist in the child site database or the parent site. To solve this please identify *.psd files that contain references to the subcollections reporting the warning and delete it.

Message ID 2530:  These messages may be logged due to Site Systems having lost the ability to communicate with their SQL database.  This may be resolved by replacing the deleted file msvcr70.dll and reregistering said file.

Message ID 2636:  The SCCM Discovery Data Manager failed to process a discovery data recorded because it cannot update the data source.  This can be caused by a workstation sending up corrupted data to the SCCM Site Server.  Possible scenarios are an incorrect year that is contained in the DDR record in question. For example, the date stamp in the DDR record is “01/01/1601″ instead of “01/01/2006″.  In this scenario, SQL reports a syntax error in the DDM.log file on the SCCM site server computer.  See the following information to troubleshoot the issue.  How to troubleshoot problems with software inventory in SCCM 2.0 and SCCM

Message ID 2700: This problem occurs because inventory data loader has encountered an error while processing MIF files. Please verify bad .mif files and investigate which property is causing this error also check for value “unsupported” as described in article

Message ID 2702, 2703, 3701, & 3707: This message may be generated when Inventory data loader tries to update information for a machine whose discovery record does not exist. This message could indicate inconsistent client GUIDs in the SCCM database preventing SCCM from processing discovery and inventory information for clients. Execute the following query in SQL Query Analyzer:

SELECT * FROM System_Disc Sys JOIN MachineIdGroupXRef XRef ON Sys.ItemKey=XRef.MachineID WHERE IsNULL(SCCM_Unique_Identifier0,”) !=IsNULL(GUID,”)

If this query returns rows, this indicates inconsistent GUIDs, execute the following to resolve:

DELETE Sys FROM System_Disc Sys JOIN MachineIdGroupXRef XRef ON Sys.ItemKey=XRef.MachineID WHERE IsNULL(SCCM_Unique_Identifier0,”) !=IsNULL(GUID,”)

Message ID 3015 and 3011: SCCM client installation is failing. SCCM will place the failed installations into a “retry” status. These messages are indicating that SCCM is unable to install the client on targeted machines. Please reference CCRRetryReport-AllSites.xls for a list of machines that are failing. The following information may be helpful

Error (53).

Error 53: Network resource not found.  It occurs when the server is not able to resolve the target computer by name or the target computer is offline.  To troubleshoot this error, make sure you can ping the target from the site server by name.

Error (5) and Error 1326.

Error 5: Access denied.   Error 1326: Logon failure: unknown user name

or bad password.  This occurs when the account (listed in the log file) can not

connect to the Admin$ share.  To troubleshoot this, make sure you can connect from the site server to the target machine’s Admin$ share under the context of the account.  For example:    NET USE * \\SERVER1\ADMIN$ /U:domain1\SCCMacct1  If you get a message that says “Credentials conflict…” then you already have an existing connection.  To see what connections you have just type NET USE at a cmd prompt.  To delete a connection, type NET USE \\server1\ipc$ (or whatever share or drive letter) /d.

Error (3) .

Error 3:  Cannot find the path specified.  This occurs when the path is not

valid on the target computer.  To troubleshoot this, make sure the Admin$ share and the C$ share exist.  The TEMP variable must also be valid (you can see this by typing SET at a command prompt).  If that still does not work, check to see if there is any part of the SCCM client installed on the target.  If there is, remove it.


Note: All of the errors above are WIN32 errors, which means they are error codes used by the WIN32 APIs.  You can lookup any WIN32 error by using the ERROR32 tool on the SCCM CD.  They syntax is: ERROR32 <error#>.  This works for all Back Office products.

Message ID 3400: These messages are occurred because scheduler is trying to send job to child site server whose address is not configured or the child site server does not exist anymore in the hierarchy. When you remove a secondary site, Hierarchy Manager attempts to delete all jobs for the deleted site. While Hierarchy Manager is deleting all jobs for the child site, Replication Manager, Distribution Manager, or Offer Manager may still be creating jobs for the deleted site as a result all jobs which are target to the deleted sites many not be cleaned successfully. To solve this problem please check the schedule. log file and identify the jobs targeted to deleted site. Stop scheduler and manually delete the jobs and start the scheduler component.

Message ID 3401: Sender is closed during backup time.

Message ID 3500:  This is typical in environments where links between sites are slow and/or possibly saturated.  SCCM recovers from these events by placing the files in a retry state until the data is delivered.

Message ID 3512: The Management Point may be prevented from connecting to the server that is running Microsoft SQL Server. Review KB832109 to resolve this problem.

Message ID 3517: These messages are occurred if the sender account does not need administrative privileges on the site or any SCCM share. It needs to be added to the SitetoSiteConnection_XXX group on the destination site.

Message ID 3530: This is a Lan Sender error. These are common in environments where the link between sites may be unavailable at times. These messages may occur if the site server is offline or cannot be accessed using FQDN. Please verify if you could access the destination server using local system account credentials.

Message ID 3600: Please use KB889429 and verify that you are not having the same symptoms. That is article is related to SCCM 2.0 SP5.

Message ID 3812: This problem typically occurs when the .ofr advertisement file on a Client Access Point (CAP) is missing, corrupted, or missing required data. When this problem occurs, the advertisement does not run and is not displayed. Review KB886108 to resolve this problem.

Message ID 4406: These messages occur due to public key corruption or package corruption over the network. Please verify despooler.log to fix the problem.

Message ID 4908: These messages occur when the Management Point could not add machine accounts to the SQL Server authentication. As a workaround please add the machine account to the administrators group on the SQL server.

Message ID 4912 & 4913: This status message indicates that the site was unable to create and/or write information to the Systems Management container in Active Directory. Verify that this site server and all SCCM site servers with a MP and/or SLP have permissions to this container.

Message ID 4915: These messages are occurred if there are duplicate entries of Management Point in the domain. If so, please delete one entry from AD using ADSIEdit.

Message ID 4918: Please verify that the schema has been extended for SCCM Service Pack 2.

Message ID 4950, 4951, 4960 and 4963: These messages are occurred if SCCM component manager fails to install Management Point.

Message ID 5000, 5002, 5004, 5008, 5025, 5026, 5027, 5032, 5033, or 5043: These status messages indicate that the Backup task has not been completed successfully. This backup cannot be used to repair the site in case of failure.

Message ID 5203, 5303, & 5503: Verify that the LDAP query specified in any SCCM AD discovery methods contain a valid path and/or the Site Server’s ability to read all objects.

Message ID 5204: This may be generated due to an inability of the SCCM Active Directory System Discovery agent to bind to Active Directory objects. A reboot of the site server where you are experiencing the issue may provide a resolution.

Message ID 5400: This is caused because account used to connect the MP to the site server may be locked out or may not have needed permissions. Verify that the account is not locked out and that it has needed permissions

Message ID 5412: The possible cause for this error is XML parser might not be registered correctly. Please register the XML parser with the following command “regsrv32 msxml3.dll” at command prompt.

Message ID 5413: The possible cause for this error is if client’s DDR reported site code does not match the assigned site code. This can be verified from SCCM_ccm\logs\mp_ddr.log. To resolve the issue reassign the client to appropriate site.

Message ID 5414 & 5415: It is possible that the System Certificates are Incorrect. Verify if site system accounts are in SCCM_SitesystemtoSQLConnection_XXX group. To resolve System Certificate issue

o Stop SCCM Executive Service

o Backup HKLM\Software\Microsoft\SystemCertificates\SCCM registry key

o Delete HKLM\Software\Microsoft\SystemCertificates\SCCM registry key

o Start SCCM Executive Service

o Restart SCCM Agent Host Service

o The registry should rebuild after a short time.

Message ID 5420: It might be due to network problems, SQL server Service Principal Names (SPNs) are not registered correctly in Active Directory, insufficient access rights and SQL Server might be down.

To resolve SQL SPN issue please follow article 829868. Please verify that the Management Points machine accounts are members of the SCCM_SiteSystemToSQLConnection_<primary site code> group on the primary site.

Message ID 4963, 5436 & 5420: These are indicative of Management Point failures. Verify the Authentication and access control of Default Web site properties and Stop and Start “SCCM Agent Host Services”. Also please refer to Microsoft Knowledge Base article 838891.

Message ID 5430 & 5431: The problem is caused because the site server could not register/unregister Management Point information in WINS.

Message ID 5432 & 5433: This problem is most likely related to Management Point installation failures. Please check the MPControl.log and MPSetup.log files for errors and a possible reinstall of the Management Point at the affected site.

Message ID 5441: Add appropriate site systems machine account to Systems Management Container with full control permissions.

Message ID 5504: I believe this error is begin caused by the fact that this Primary Site has Active Directory System Group Discovery configured to run every 15 minutes and the load on the Domain Controller is too high. This setting needs to be reduced to daily. Refer to Discovery Settings section of this report for more information.

Message ID 5600: These messages are occurred if SCCM Software Metering Processor failed to read and configure the registry. SCCM Software Metering Processor is waiting for the information to become available and will retry obtaining the registry information at its next interval.

Message ID 5613, 5614 and 5615: This indicates that the Software Metering Processor is failing to process .MUX files from clients. Review the SWMProc.log for details. A look at these files in the inboxes\\corrupt directory usually shows that the processing StartTime and EndTime are out of sync. Actually showing an EndTime prior to the StartTime. Verify that the time on the clients sending up these files is correct.

Leave a Reply