ConfigMgr Clients not receiving any advertisements – unapproved / blocked?

On a freshly upgraded ConfigMGr 2012 SP1 environment, a customer noticed that machines did not get any advertisements anymore.ย  I was called in to investigate what happened.

I noticed the following:

– The machines were listed as members of the All Systems Collection.

– An OSD Task Sequence had been deployed to the All Systems Collections, making it available to only Media and PXE (not to configmgr clients).

Still, the machines they mentioned did not pick up any advertisements when booted through PXE.

However, other machines that were part of the All Systems collection, DID get the advertisement.

It turned out that the systems that did not get the advertisements, had not been added to the domain properly. Therefore, they had not automatically been approved in ConfigMgr, and were not allowed to access the ConfigMgr Site.

The analysis

I have reconstructed this in my lab environment, to show you what this looks like.

First, i installed a Windows 7 machine, adding it to a workgroup instead of to the domain. Then installed the ConfigMgr client, using the parameters /SMSMP=<my MP name> and /SMSSITECODE=<name of my ConfigMgr site>.

After this, the machine showed up in ConfigMGr in the All Systems Collection as Windowsclient-3:


Now when you would just look at this, you would think it is a member of the All Systems collection, and therefore would get all the advertisements (or deployments) that are targeted to this collection, right?

Well, no.

Let’s add some more columns to this view; rightclick the title bar, and you get a list of columns you can add to the view:


Let’s add the Approved and Domain columns;

unapproved-3Now we can clearly see that windowsclient-3 is not a member of the domain, and therefore also not approved.

Well, not automatically anyway. This is something we configure in the Site Hierarchie Settings:

unapproved-4As you can see, by default only computers that are member of the same domain, or a trusted domain are automatically approved.

Since the windowsclient-3 machine is not in any domain, but in a workgroup, it is not approved.

With it being “Not approved”, it is also denied access to Site content, like policy and Files.

So, although the system is listed in the All Systems collection, it will not get any Deployments advertised.

If i PXE boot the client:

unapproved-5Sorry, no OSD for you ๐Ÿ™‚

On the machine itself, we see the following in the ConfigMgr Client:



On the “Actions”, we can see by the limited number of cycles available, that only the core client is installed, and no policy has been retrieved yet.

If we look through the client log files we see that it can contact the MP (since we specified this during client installation), but it will get no policy from it.

Also, it cannot contact find information about available MPs from Active Directory, since it is not a domain member.

So, the only thing it can do now, is to keep contacting its MP, and hope for Approval ๐Ÿ™‚

Now, let’s Approve the client in the ConfigMgr Console, and see what happens.

Rightclick the machine and select “Approve”


Are we sure? :p


Now, a reboot of the client to speed things up, and a Machine Policy Retrieval later, the clients starts working, and then:

unapproved-10Well this looks better ๐Ÿ™‚

And there we get the policy assigned to the collections:

unapproved-11See the “Software changes are required” balloon pop up in the corner?

Yes, this is one happy client now ๐Ÿ™‚



One Response to “ConfigMgr Clients not receiving any advertisements – unapproved / blocked?”

  1. Lewis Says:

    Here’s a useful article I wrote a while back for troubleshooting this stuff:

    Hope it’s useful ๐Ÿ™‚

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

%d bloggers like this: