Troubleshooting SCCM Client Installation Error 0x80041002

In trying to install the SCCM 2012 client on a Windows 7 workstation  it terminated with error 0x80041002.  Here’s the log snippet from CCMSETUP.LOG:

[LOG[Failed to open to WMI namespace ‘\\.\root\cimv2’ (80041002)]LOG]! [LOG[CcmGetOSVersion failed with 0x80041002]LOG]! [LOG[Failed to open to WMI namespace ‘\\.\root\ccm’ (80041002)]LOG]! [LOG[Failed to get client version for sending messages to FSP. Error 0x80041002]LOG]! [LOG[Params to send FSP message ‘5.0.7958.1000 Deployment Error 0x80041002 : ‘]LOG]! [LOG[Failed to open to WMI namespace ‘\\.\root\ccm’ (80041002)]LOG]! [LOG[State message with TopicType 800 and TopicId {A1967584-10FA-45E0-8790-1559DEF627B5} has been sent to the FSP]LOG]! [LOG[CcmSetup failed with error code 0x80041002]LOG]!

It turned out that WMI on this workstation was completely unusable.  When using the WBEMTEST application you couldn’t even connect to the WMI at all.

With the help of the WMI: Rebuilding the WMI Repository article I was able to rebuild WMI on this workstation using the following commands:

Winmgmt /verifyrepository

Winmgmt /salvagerepository

Once WBEMTEST connected successfully the SCCM Client correctly installed.

Cisco ASA Firewall Presents Only “ASA Temporary Self Signed Certificate”

Recently we started to get reports of untrusted certificates for AnyConnect and when accessing the ASDM web page. When you browse to the web site it was presenting the default “ASA Temporary Self Signed Certificate” rather than our public SSL certificate.

After opening a case with Cisco TAC about this they pointed us to the release notes issue in ASA 9.4(x):

Elliptic curve cryptography for SSL/TLS—When an elliptic curve-capable SSL VPN client connects to the ASA, the elliptic curve cipher suite will be negotiated, and the ASA will present the SSL VPN client with an elliptic curve certificate, even when the corresponding interface has been configured with an RSA-based trustpoint. To avoid having the ASA present a self-signed SSL certificate, the administrator needs to remove the corresponding cipher suites using the ssl cipher command. For example, for an interface configured with an RSA trustpoint, the administrator can execute the following command so that only RSA based ciphers are negotiated:

ssl cipher tlsv1.2 custom

As soon as I added the command into our ASA it started working again. It sounds like this should be a default entry going forward for all ASA firewalls.

Want to learn more about elliptic curve cryptography  or look at this for a primer.

Microsoft Intune and Conditional Access to Exchange On-Premise Configuration Problems

I’m trying to setup the Microsoft Intune MDM solution with the Conditional Access policies to our Exchange On-Premise server.  The idea behind this is that users must enroll their device with Intune via the Company Portal app on their mobile device and then once they meet the requirements, they will be granted access to Exchange ActiveSync.

The basic setup is straightforward and easy to setup following this Technet article.  However we have run into two issues:

I received emails previously (last week) from the Intune Exchange Connector that looked like the following:

To access your organization’s email, you must enroll your device and make sure that it complies with your organization’s security policies. Follow the steps below for the relevant device.

Instructions for your Android with ID androidxxxxxxxxxxxxx
1. If you haven’t enrolled your device yet, enroll it now
2. After a couple of minutes activate your email
3. Check to see if your device is compliant

But after upgrading the latest version of the Microsoft Intune On-Premises Connect for On-Premises Exchange, I’m no longer receiving these emails but other users are.

The other issue is that the “activate your email” link doesn’t work.  The URL points to the following web site:, but also includes options to POST the following:


And the response to this URL and POST commands just looks like the following:

{“Message”:”No API matching request was found, verify URL and parameters are correct”,”TraceId”:”90baac77-3ac9-43e6-bb67-3b47a6c3726f”,”Time”:”04-28-2015 11:37:57Z”}

And the TraceId above has nothing to do with the obfuscated TraceId above.

I have opened a case with Microsoft Online Support about this and will update once I get more information.

Cisco ASA Firewall ASDM Incompatibility with Java 7 Update 51

The latest version of Java 7 Update 51 that was deployed this week breaks access to Cisco ASA firewalls running ASDM.  When you connect with the ASDM you get the following error message: “Unable to launch device manager from X.X.X.X”

Unable to Launch Device Manager
“Unable to launch device manager from”

The symptoms are that the web page for the firewall will show up and display normally, but you can’t connect to the server with the ASDM launcher.  The log on the firewall shows

%ASA-6-302013: Built inbound TCP connection 112 for outside:X.X.X.X/64508 (X.X.X.X/64508) to identity:Y.Y.Y.Y/443 (Y.Y.Y.Y/443)
%ASA-6-725001: Starting SSL handshake with client outside:X.X.X.X/64508 for TLSv1 session.
%ASA-7-725010: Device supports the following 6 cipher(s).
%ASA-7-725011: Cipher[1] : RC4-SHA
%ASA-7-725011: Cipher[2] : DHE-RSA-AES128-SHA
%ASA-7-725011: Cipher[3] : DHE-RSA-AES256-SHA
%ASA-7-725011: Cipher[4] : AES128-SHA
%ASA-7-725011: Cipher[5] : AES256-SHA
%ASA-7-725011: Cipher[6] : DES-CBC3-SHA
%ASA-7-725008: SSL client outside:X.X.X.X/64508 proposes the following 8 cipher(s).
%ASA-7-725011: Cipher[1] : AES128-SHA
%ASA-7-725011: Cipher[2] : DHE-RSA-AES128-SHA
%ASA-7-725011: Cipher[3] : DHE-DSS-AES128-SHA
%ASA-7-725011: Cipher[4] : RC4-SHA
%ASA-7-725011: Cipher[5] : DES-CBC3-SHA
%ASA-7-725011: Cipher[6] : EDH-RSA-DES-CBC3-SHA
%ASA-7-725011: Cipher[7] : EDH-DSS-DES-CBC3-SHA
%ASA-7-725011: Cipher[8] : RC4-MD5
%ASA-7-725012: Device chooses cipher : RC4-SHA for the SSL session with client outside:X.X.X.X/64508
%ASA-7-725014: SSL lib error. Function: SSL3_READ_BYTES Reason: sslv3 alert certificate unknown
%ASA-6-725006: Device failed SSL handshake with client outside:X.X.X.X/64508
%ASA-6-302014: Teardown TCP connection 112 for outside:X.X.X.X/64508 to identity:Y.Y.Y.Y/443 duration 0:00:00 bytes 580 TCP Reset by appliance

Cisco has included this information in their latest release notes:

If you use Java 7 Update 51, you must upgrade ASDM to Version 7.1(5.100) or later, and you can only use the Java web start. The ASDM Launcher is not supported.

So the alternatives are to downgrade your Java on your workstation or upgrade to the latest ASDM version at this point to get the ASDM working again.

Pork Scratchings


Pork ScratchingsWhile the United States celebrates Thanksgiving today (I do miss my brother’s Buffalo Fried Turkey) I picked up a couple bags of Pork Scratchings from the Saint Nicholas Fayre going on in York.  What are pork scratchings?  They are the UK equivalent of pork rinds in the US.  But while most of the pork rind products I’ve had in the US have been the equivalent of pork flavored puffs, the pork rinds from this particular vendor are MUCH better.

First, they are sold in paper bags.  The scratchings quickly soak through the bag turning it slightly translucent.   All fatty products should be sold this way, as putting them into plastic or mylar defeats the purpose.  Next a bite.  Hard and crunchy on the outside (some of the big ones can be almost teeth damaging), but rich and fatty on the inside.  The salty flavor isn’t over powering and almost has a slight season salt taste as well, just makes this pork scratching perfection.

Thankfully, for my health at least, the vendor is only in York on special market days, but it is the new tradition to pick up a bag (or three) when they are in town.

So while we aren’t celebrating Thanksgiving today in the UK I’m trying to keep up the tradition of over indulgence.   Happy Thanksgiving everyone!

Slow TFTP Transfers to Cisco 3850 Switch

I recently upgraded a couple of Cisco 3850 switches and noticed that the TFTP transfer rate to get the Cisco IOS files to the switch were horrible (approximately 200Kbps) which took a LONG time to transfer the 250MB file required for these switches.  After trying a couple different TFTP clients, and finding nothing that worked, I dug into the settings on my preferred TFTPD32 software and found that changing the TFTP setting for “Use anticipation window of” to 4092 gave me about a 4x to 5x improvement in transfer speed.  Still slower than I would have liked but definitely tolerable now.

TFTPD32 Settings showing

Sending Email from WordPress Hosted by GoDaddy

If you have just signed up for a newer GoDaddy hosting account (using either cPanel (Linux) or Plesk (Windows)) for a domain that hosts email externally from GoDaddy account you may have problems sending email.

I noticed this problem when trying to send email to new WordPress users (installed via GoDaddy) that I just created and they never got the introductory email from the server.

Mail sent from your web hosting account will be blackholed and never sent out to the external account.  You can confirm this problem by going into cPanel (sorry I don’t know what this looks like in Plesk) and use the Email Trace feature.  Just click Run Report (you don’t need any email address in the list) and look for recently sent email.  The message will show up as “Message Accepted”

GoDaddy Email Trace with Message Accepted

But click on the magnifying glass and the Delivery Event Details will show that this message is delivered to the :blackhole: address.GoDaddy Delivery Event Details showing

After an almost two hour phone call with GoDaddy support, their support person was able to contact a back end engineer who “changed something” on our account so that GoDaddy was no longer authoritative for email for our hosting domain and mail correctly started to flow out to the Internet.  I wasn’t able to get GoDaddy Support to clarify exactly what was changed on the back end but it is apparently a new “feature” of the newer hosting platform that hasn’t been reported previously.  There is currently no way to change this through the existing cPanel interface.

So please give your GoDaddy Support a call if you are running into this problem and push for them to escalate to the back end support as soon as possible.

From Rag & Bone to Boney M

As I’m continuing my British education (and hopefully yours too) after my previous posting about Rag & Bone Men, I only just found out about the musical group Boney M., a huge disco hit from the 1970’s and onwards, but apparently not a big hit in the United States.  Go ahead and click play below on the Rasputin song and read on…..

I originally heard a song from them while listening to BBC York during my workday.  When my wife came home that evening I asked if she had ever heard of Boney M. and couldn’t believe I had never heard of them.  Even my mother-in-law knew the name and remembered the band and music.

I spent most of the day listening to the various Boney M offerings on YouTube, so catch up on your 1970’s Euro disco music and get educated.




The Rag & Bone Men

Horse Drawn Rag & Bone Man
Rather than the typical van that drove by we had a horse drawn Rag & Bone Man that came by

Since moving to York in the United Kingdom (since I used to live in the New York area I like to call this York the “original flavored York”) there have been several days when a large van would drive slowly by with a man shouting out the window.  From what I could make out he could have been yelling any of the following phrases:

“Fresh Corn!”
“Fresh Manure!” (the van had horse stickers on it and people do like to garden here)

When I asked our neighbour what he was yelling, he didn’t know either.

But yesterday there were several different versions of these guys drove by that I could actually understand what they were saying.  The phrase actually was:

“Rag and Bone!”

Turns out that these are Rag-and-Bone men, the scrap collectors of the UK, that drive by to pick up old unwanted items that they can sell for scrap.  Typically they are more interested in metal as it has a higher resale value, but will pretty much take anything.

Lync 2010 to Lync 2013 Migration: Issue with Dial-in Conferencing and SIP Trunk with REFER

We are in the middle of a migration from Lync 2010 to Lync 2013.  The migration has been very smooth and we moved several users over to the Lync 2013 environment for pilot.  Shortly after migrating the users, we identified issues with our Dial-In Conferencing.  Anyone on Lync 2013 that created a conference could not dial into the conference.  Users would call in, be prompted to input the meeting number and then would receive a busy signal. If the user moved back to the Lync 2010 pool, Dial-In Conferencing would work again.

During this process, we didn’t move our SIP trunk from the Lync 2010 Mediation Server at all, so I wasn’t sure why there should be any difference in this case.  After running a trace on our Lync 2010 Mediation Server we found the following Messages during a Dial-In Conferencing test hosted by a Lync 2013 user:

SIP/2.0 405 Method Not Allowed
Trace from Lync 2010 Mediation Server

The REFER method error indicated that it wanted to transfer the call from the Lync 2010 Mediation server to itself, which didn’t seem to implicate the new Lync 2013 environment.  After checking in with tech support at our SIP trunk provider they reminded us that the REFER method must be turned off for their SIP trunks.  In looking at the Lync 2010 Control Panel, the REFER method support is just a check box for “Enable refer support”:

Lync 2010 Control Panel
Lync 2010 Control Panel “Enable Refer Support”

But in Lync 2013 Control Panel this has been moved to a drop down list and this feature hasn’t been duplicated to match the Lync 2010 environment:

Lync 2013 Refer Support
Lync 2013 Refer Support

So the default setting in Lync 2013 turns REFER method support back on and sets it to “Enable sending refer to the gateway”.

Just set the Lync 2013 REFER method support to “None” and save the settings to match the Lync 2010 environment.  Once the change was made, the Dial-In Conferencing started working again for our Lync 2013 users and the migration could continue.


What interests me now on the Internet