This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(6.4, 68%, 10%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Hi guys! I have one primary site last build SCCM CB, that contains one server with mp, dp fall status roles, db server and one server with mp role. We use PKI and deploy certificate to all workstations and sccm servers. In all mp i have error in mpcontrol.log:
Blockquote
STATMSG: ID=5465 SEV=I LEV=M SOURCE="SMS Server" COMP="SMS_MP_CONTROL_MANAGER" SYS=DC01-SCCM-01 SITE=SBC PID=3252 TID=7112 GMTDATE=.... ...... 14 08:25:51.665 2021 ISTR0="" ISTR1="" ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=0 LE=0X0 SMS_MP_CONTROL_MANAGER 14.07.2021 11:25:51 7112 (0x1BC8)
Successfully performed User Service availability check against local computer for /CMUserService_WindowsAuth/applicationviewservice.asmx. SMS_MP_CONTROL_MANAGER 14.07.2021 11:25:51 7112 (0x1BC8)
Applied D:P(A;CIOI;GA;;;SY)(A;CIOI;GA;;;BA)(A;CIOI;GR;;;LS)(A;CIOI;GR;;;S-1-5-17) to folder C:\Program Files\Microsoft Configuration Manager\Client SMS_MP_CONTROL_MANAGER 14.07.2021 11:30:51 7112 (0x1BC8)
SSL is enabled. SMS_MP_CONTROL_MANAGER 14.07.2021 11:30:51 7112 (0x1BC8)
Client authentication is also enabled. SMS_MP_CONTROL_MANAGER 14.07.2021 11:30:51 7112 (0x1BC8)
CRL Checking is also enabled. SMS_MP_CONTROL_MANAGER 14.07.2021 11:30:51 7112 (0x1BC8)
Failed to retrieve client certificate. Error -2147467259 SMS_MP_CONTROL_MANAGER 14.07.2021 11:30:51 7112 (0x1BC8)
Call to HttpSendRequestSync failed for port 443 with -2147467259 error code. SMS_MP_CONTROL_MANAGER 14.07.2021 11:30:51 7112 (0x1BC8)
Inbox source is local on DC01-SCCM-01 SMS_MP_CONTROL_MANAGER 14.07.2021 11:30:51 7112 (0x1BC8)
Sent summary record of SMS Management Point on ["Display=\DC01-SCCM-01\"]MSWNET:["SMS_SITE=SBC"]\DC01-SCCM-01\ to \dc01-sccm-01\SMS_SBC\inboxes\sitestat.box\8k8f5n1o.SUM, Availability 1, 167207932 KB total disk space , 113917628 KB free disk space, installation state 0. SMS_MP_CONTROL_MANAGER 14.07.2021 11:30:51 7112 (0x1BC8)
Http test request failed, error code is -2147467259. SMS_MP_CONTROL_MANAGER 14.07.2021 11:30:51 7112 (0x1BC8)
Successfully performed Management Point availability check against local computer. SMS_MP_CONTROL_MANAGER 14.07.2021 11:30:51 7112 (0x1BC8)
SSL is enabled. SMS_MP_CONTROL_MANAGER 14.07.2021 11:30:51 7112 (0x1BC8)
CRL Checking is also enabled. SMS_MP_CONTROL_MANAGER 14.07.2021 11:30:51 7112 (0x1BC8)
Using thread token for request SMS_MP_CONTROL_MANAGER 14.07.2021 11:30:51 7112 (0x1BC8)
Call to HttpSendRequestSync succeeded for port 443 with status code 200, text: OK SMS_MP_CONTROL_MANAGER 14.07.2021 11:30:51 7112 (0x1BC8)
Http test request succeeded. SMS_MP_CONTROL_MANAGER 14.07.2021 11:30:51 7112 (0x1BC8)
STATMSG: ID=5465 SEV=I LEV=M SOURCE="SMS Server" COMP="SMS_MP_CONTROL_MANAGER" SYS=DC01-SCCM-01 SITE=SBC PID=3252 TID=7112 GMTDATE=.... ...... 14 08:30:51.692 2021 ISTR0="" ISTR1="" ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=0 LE=0X0 SMS_MP_CONTROL_MANAGER 14.07.2021 11:30:51 7112 (0x1BC8)
Successfully performed User Service availability check against local computer for /CMUserService_WindowsAuth/applicationviewservice.asmx. SMS_MP_CONTROL_MANAGER 14.07.2021 11:30:51 7112 (0x1BC8)
In component status, i see next error:
MP Control Manager detected MP is not responding to HTTP requests. The http error is 2147500037.
Does the system hosting the MP have a valid client authentication certificate issued to it?
yes, this certificate erolled two days ago)
Based on the log though, the MP_Control thread cannot retrieve this certificate so you need to validate that the cert is accessible to this thread (it runs in the local System context) and that it in fact meets the requirements for a client auth cert in ConfigMgr. See the first row or the table at https://video2.skills-academy.com/en-us/mem/configmgr/core/plan-design/network/pki-certificate-requirements#BKMK_PKIcertificates_for_clients for client cert requirements.
but when i see don't work workstation, right? but i checked some workstations and they works fine.
The client auth cert on the MP is used for a self-check only. Lack of this certificate won't cause the MP to not function, it just causes the self-check to fail.
You mean that error with mp certificate, right?
I mean what I said. Not having a proper client auth cert on the MP will cause the self-check to fail which is what that error is saying.
Hi,
Thanks for posting in Microsoft Q&A forum.
May we know if you are using HTTPS only model in the Communication Security tab on your Primary site properties? Or HTTPs or HTTP model?
1.Please try to restart SMS Agent Service.
2.Please also try to restart IIS Service.
Best regards,
Simon
If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Yes, we use only https. i restarted iis and server, but it's not help
Hi,
Thanks for your information.
Please help make sure that the client certificate is working well and not expired. We can renew the certificate to have a try.
For more information about PKI certificate, please refer to:
PKI certificate requirements for Configuration Manager
Deploy PKI Certificates for SCCM 2012 R2 Step by Step Guide
Best regards,
Simon
I check my template for sccm client and he's right (i compare with docs microsoft)
Just because you have a valid template doesn't mean a cert based on that template was issued to the MP. Thus, you need to examine the actual on the MP itself to validate.