Thanks so much for the update @spalladino, great to hear you finally were able to get it resolved!
So the AgentType field of the record representing the ISV certificate in ClientKeyData needs to be set to a '4', while the AgentType of devices will be set to an '8' or ISV Client since this is a value controlled by the SCCM messaging SDK.
@drhoten Hello
just started to now have a issue where the plugin wont let some systems update but everything that has updated seems to be ok I am looking at the cert in the DB again it still shows agent type 4 so that looks ok but whats should the key type be it now looks to be set at 1 should it be 2? below is what i see on certain systems but on systems that are already in sccm they continue to work...
2020-08-17 12:43:51,749 [ 7] DEBUG Jamf.ProxyService.Plugins.SCCM.SccmReports - Raw ConfigMgrRegistrationReply '<ClientRegistrationResponse ResponseType="Registration" TimeStamp="2020-08-17T16:43:51Z" Status="3" ApprovalStatus="-1"/> '.
2020-08-17 12:43:51,749 [ 7] ERROR Jamf.ProxyService.Plugins.SCCM.SccmReports - There was an unexpected error sending the device to SCCM.
System.InvalidOperationException: Invalid registration state: Error. Cannot continue.
at Microsoft.ConfigurationManagement.Messaging.Messages.ConfigMgrRegistrationRequestBase.RegisterClient(ConfigMgrRegistrationRequestBase baseRequestMessage, IMessageSender sender, TimeSpan timeout)
at Microsoft.ConfigurationManagement.Messaging.Messages.ConfigMgrRegistrationRequestBase.RegisterClient(IMessageSender sender, TimeSpan timeout)
at Jamf.ProxyService.Plugins.SCCM.SccmDevice.RegisterDevice(MessageCertificateX509 certificate, HttpSender sender)
at Jamf.ProxyService.Plugins.SCCM.SccmDevice.SendToSccm()
at Jamf.ProxyService.Plugins.SCCM.SccmDevice.Send()
2020-08-17 12:43:51,751 [ 7] ERROR Jamf.ProxyService.Plugins.SCCM.SccmReports - Sending to SCCM failed!
Hi @spalladino
Have you been able to capture both plug-in and SCCM logs for any of the devices that are not updating? It would be great to see what's happening on the SCCM side too.
For the KeyType based on information we received directly from the developer at Microsoft working on the Messaging SDK, 1 is for Self-Signed certificates and 2 is for a PKI certificate (one issued from a certificate authority). From what I recall, you are using PKI so it should be a 2.
Let me know if you want us to re-open your previous case so we can help you dig into this some more.
@drhoten Hello
Might as well reopen the ticket not sure why all of a sudden certain systems wont update this is the error i see in the mp registration log.... to me it kind of seems the cert changed possibly... happy to do a webex with someone to look at it further
Morning @spalladino
I'll let the folks in support know, and you can also reply to any email from that case and it will automatically re-open it.
Thinking about your case a bit more yesterday afternoon, assuming your configuration has not changed then other things I wonder about are:
1. Are there any Group Policy Object (GPO) that could be modifying certificates on the server where the proxy service is installed?
2. Have there been any Windows, SQL, or SCCM updates and/or hotfixes applied to either the SCCM server or proxy server? How soon after patch Tuesday did this behavior start up again?
3. Could there be any SCCM maintenance tasks that ran and triggered this behavior?
