SCCMF12TWICE: Potential USMT Errors & Resolution

Check the "SMSTS.LOG" "C:\Windows\CCM\Logs"

In the screenshot below look for a line like "Unable to find a volume that is suitable for staging the boot image" in the log file

This is typically for 2 different reasons.

1. The drive is locked by bitlocker encryption and you need to first disable bitlocker in the task sequence. once this is done then the task sequence engine can identify the drive to stage the boot image locally

2. This can also be because the drive is still undergoing the encryption process. You must wait until the drive is fully encrypted before you can execute this task sequence from windows.

To verify the drive is finished encrypting launch powershell as an admin and type "Get-BitlockerVolume" and do not attempt to run the installation until the "Encryption KeyProtector Percentage" is are 100%

NOTE: it is possible you receive this error when you are trying to stage the boot image onto the disk and the disk cannot be read b/c of a different encryption software locks the disk. For example if you are running Dell Credant you must be logged into the system then the TS Engine will be able to read the disk.

To identify Dell Credant systems via SQL...this is a hybrid of one my queries that I use in my production environment but you can modify it to abosrb only bitlocker information by commenting out not needed parts

SELECT Distinct

v_R_System.Name0 AS System,

Computer_System_DATA.Model00 AS [System Model],

___System_INSTALLED_SOFTWARE0.ARPDisplayName00,

V_R_System.AD_Site_Name0 AS [AD Site],

CASE V_R_System.Build01

When '6.1.7601' THEN 'Windows 7'

WHEN '10.0.14393' THEN 'Win 10 v1607'

WHEN '10.0.15063' THEN 'Win 10 v1703'

END AS [Operating System],

CASE V_R_System.Client0

When '0' THEN 'No Client'

WHEN '1' THEN 'Client Installed'

END AS [Client],

v_GS_ENCRYPTABLE_VOLUME.DriveLetter0 AS [Drive Letter],

--v_GS_ENCRYPTABLE_VOLUME.ProtectionStatus0 AS [Protection Status],

CASE v_GS_ENCRYPTABLE_VOLUME.ProtectionStatus0

WHEN '0' THEN 'not encrypted'

WHEN '1' THEN 'encrypted'

WHEN '2' THEN 'Encrypted Requires Pin'

END AS [Bitlocker Status]

FROM

v_GS_ENCRYPTABLE_VOLUME

INNER JOIN v_R_System ON v_GS_ENCRYPTABLE_VOLUME.ResourceID = v_R_System.ResourceID

INNER JOIN Computer_System_Data ON V_R_System.Name0 = Computer_System_Data.Name00

INNER JOIN INSTALLED_SOFTWARE_DATA AS ___System_INSTALLED_SOFTWARE0 ON ___System_INSTALLED_SOFTWARE0.MachineID = V_R_System.ResourceID

Where

v_GS_ENCRYPTABLE_VOLUME.DriveLetter0 = 'C:'

AND Computer_System_DATA.Model00!= 'VMware Virtual Platform'

AND Computer_System_DATA.Model00!= 'Virtual Machine'

--AND v_GS_ENCRYPTABLE_VOLUME.ProtectionStatus0 = '0' --for not bitlocker encrypted systems--

--AND V_R_System.Name0 = 'P620268'

AND ___System_INSTALLED_SOFTWARE0.ARPDisplayName00 like N'Credant_WindowsShield%'

Failure when trying to connect to SMP Share

This failure is more often seen when trying to rerun on a failed system (can be seen during backup or restore part of the process)

For this we corrected the issue is to open PowerShell and running the following.

Remove-Item -Path ‘HKLM:\SOFTWARE\Microsoft\SystemCertificates\SMS\Certificates*’ -force; restart-service ccmexec

I would also recommend opening registry location to verify this has successfully been deleted.

Once this runs successfully you should then be able to re-run the task sequence successfully.

File Not Found:

of course there is the standard make sure your commands are typed correctly. In the example below we see a file not found error. Make sure you type out your file names correctly etc.

NOTE: I have seen cases where a variable is set for Packages, but it does not always translate, so I tend to just hard code the package ID when I set restore/capture options into a variable see the example below

Connection to SMP Refused:

Make sure when you being your deployment strategy that you plan for an adequate number of connections to the SMP. The default for this I believe is 100 connections, but that does not mean concurrent connections. The criteria that goes into the count is any established connection (completed or in progress) within the your deletion policy time period. If you have a problem where the connection is actively refused by the SMP you should increase the max allowed connections you have configured.

I tried to create as many USMT problems as I could think of to help out the community. If I encounter anymore or can think of new ones I will add them to this blogpost.