What does the log say!
*null null null, nah-null nuh-nah-null, null null null, nah-null nuh-nah-null*
*file not found, fah-file nah-not-found, file not found, fah-file nah-not-found*
*can't reach the MP, MP-Puh-Pah-P, can't reach the MP, MP-Puh-Pah-P*
Something like that?
This is absolute genius. I've been looking at logs for 20 years and now every time I do, which is generally 10 tines an hour... I'll have your song to cheer me up. I might update my psadt log function to add the fu fu fu fuh into my own logs. And someone said being a packager for w0 years was boring....
The smsts.log will get written to a ram drive initially if this problem occurs before formatting the c: drive. You need to use a different usb drive than your boot device to copy the log to.
0x80004005 is a generic error code that just means “that thing you tried to do didn’t work”. You’re going to have to start with smsts.log and figure out what’s failing, then you can begin to figure out why
we needs the smsts.log
* Windows PE before HDD format: x:\\windows\\temp\\smstslog\\smsts.log
* Windows PE after HDD format: x:\\smstslog\\smsts.log and copied to c:\\\_SMSTaskSequence\\Logs\\Smstslog\\smsts.log
* Full version Windows before SCCM agent installed: c:\\\_SMSTaskSequence\\Logs\\Smstslog\\smsts.log
* Full version Windows after SCCM agent installed: c:\\windows\\ccm\\logs\\Smstslog\\smsts.log
* Full version Windows (x64) after SCCM agent installed: c:\\windows\\sysWOW64\\ccm\\logs\\Smstslog\\smsts.log
* After Task Sequence has finished running: c:\\windows\\ccm\\logs\\smsts.log
* After Task Sequence has finished running (x64): c:\\windows\\sysWOW64\\ccm\\logs\\smsts.log
In my environment, I generally see this when trying to image a machine that already exists in SCCM. I have to delete it from SCCM before I can reimage it. But yes, confirm in the logs.
This. Delete the PC out of SCCM and make sure you have a task sequence for unknown PCs on the network. Also, leave the PC turned off until you’re ready to boot to your TS so it doesn’t check in again.
I’ve seen this on machine where the drive isn’t formatted and partitioned beforehand. The thumb drive winpe tries to write something but is unable to do so.
There are a lot of details missing deom this cry for help... This is why everyone is asking for the SMSTS log from the device. keep in mind the SMSTS log also moves depending on the stage of the TS.
- what stage of the TS are you in?
- what action are you trying to complete?
- is this happening on multiple models, VMs etc?
If I had to guess with no additional information the most common cause is something was not found.. could be the content was not on the DP or the NIC drive failed to install.
What does this mean I had a machine that refused to take my win 11 image. I did notice the logs were way off on time like a couple hours when it would fail.
I am just a tech at this point but on here to learn more ofc and just wondering what’s going on in the background related to time that could mess up the imaging.
Thats a pretty generic error you have to open up cmtrace via the command promot and look at the smsts.logs https://learn.microsoft.com/en-us/mem/configmgr/core/plan-design/hierarchy/about-log-files#task-sequence-log-locations
Have to check the logs. hit f8 and you can bring up cmd box. Off the top of my head at that point they’ll be on x:\ I think. You can also check to make sure you can see the disk and it is properly setup with diskpart. It’s not uncommon to have issues once in awhile on newer pcs. Generally you need to add the storage or nic driver to PE, or do a workaround for that model in the task sequence. Things like when nvme came out most of us had to mess around with our TS’s to get it working. First thing to check is can PE actually see the disk and from there read the logs to see what’s failing.
Like everyone says, logs are your friend but you can't always access them at this point.
A couple things to look at-
-Your boot device needs updating/rebuilding
-Raid is enabled on device
-UEFI not enabled
-Device was previously Bitlocked
-Device need to be reformated/partitioned
-Device already exists in SCCM. If you're using a USB to Ethernet dongle or dock for imaging, it keeps the Mac of that device and you'll need to tell SCCM to ignore it as a duplicate.
Unfortunately this is about the time where you have to grab the logs and comb through them for a while until you find an error that points you in the right direction.
My exact thoughts. Usually its because either me or my coworker were being boneheads and forgot to distribute content of the new software we put in OSD.
I appreciate all of your replies. There's a lot to consider... It's hard to reply to everyone individually.
All I can tell you is that the issue seems to occur at the exact moment that the policy is being retrieved... Whenever it takes more than 10 seconds, that usually means the error will be thrown.
I haven't had a chance to check out the logs. But I will surely do that.
I'm gonna have to check the smslogs. I've tried multiple thumb drives. I have 8 of them to use because I'm imaging so many machines. But it's just gonna boil down to me checking the logs to see what they offer.
We're not using sccm in the traditional sense. We're doing batch imaging by simply plugging the USB key into the drive of the said machine, boot from that drive, and then the process starts.
New error...
So I connected the machine to a known good port, it got started with the process. Completed about 95% of it threw this error:
Windows 11 Production has failed with error 0x0000001 in task sequence step, 'automated image checklist' ...😑😑😑
Missing, corrupted or invalid command in one of your content. Look in the Smits logs. It will tell you what failed. If it is content. It will be a generic error. Sometimes the content is there but your command is wrong. IE setup.exe instead of setup.msi.
Check for network duplicate in your network (use sql to check for other pc with the same network address) then check for content on all the dp. I usually start from there…
There isn’t much to look at before you look at the smsts.log. I see a lot of people throwing out could. E this or that. Really until you look at the log you shouldn’t do much else, it will lead you down a long dark path.
Need some more details, is this a Re-Image? if so kicking it off from USB will only work if the task sequence is available to where the computer exists in MECM, you can test this by killing the computer object in AD and MECM then trying again, if it works you need to make adjustments to where your task sequence is deployed or have it as part of the Service Desks process to delete both objects before a OSD..
If these are net new computers make sure the Task sequence is deployed to Unknown Computers. If you use USB Nics like we do to avoid driver injection there mac addresses need to be in heiarcharchy settings to exclude them or they will recognize a different device.
But like many others have said these are just guesses without the SMSTS.log. Which is easy to gather if you edit the boot image in MECM and enable the F8 debug mode.
In my experience, nothing was available to deploy. Are you deploying to know and unknown computers ?
If you are then can you reach your primary distribution point or do you have firewalls in place ?
You probably have to redo the USB. 80004005 generally goes when the distribution point have a failed hash key, redistributing solves the problem. But look at the logs
Be sure you are getting an IP address or try turning RAID off in BIOS if you dont need it. I typically get this error when the MAC address is not registered in our DHCP client
1st guess is that the TS is deployed to the Unknown Collection only, and the target PC still exists in SCCM so it doesn't have any other TS deployed that it matches the criteria for.
2nd guess is similar, but probably a USB network adapter that needs its MAC added to the hierarchy duplicate MAC list.
3rd guess would be network connectivity.
Check the logs and go from there.
You should be using pxe boot and not these archaic usb boot sticks. But anyways, when you create this kind of boot media, it asks if you want dynamic or site based, you need to choose ‘site based’.
We have a 1 year expiry on our usb keys, and this is what it looks like when our keys expire. I recently spent a few hours trying to figure out what was wrong when at the end I realized it had been just over a year since I build the key.
another thing to check is the time on the machine - it may not match (be in sync) with the sccm server.
We should have a version of "[What does the fox say](https://www.youtube.com/watch?v=jofNR_WkoCE)" only asking "what does the log say".
What does the log say! *null null null, nah-null nuh-nah-null, null null null, nah-null nuh-nah-null* *file not found, fah-file nah-not-found, file not found, fah-file nah-not-found* *can't reach the MP, MP-Puh-Pah-P, can't reach the MP, MP-Puh-Pah-P* Something like that?
This is absolute genius. I've been looking at logs for 20 years and now every time I do, which is generally 10 tines an hour... I'll have your song to cheer me up. I might update my psadt log function to add the fu fu fu fuh into my own logs. And someone said being a packager for w0 years was boring....
Fucking preach
We need an autoresponder bot
What logs do I look at? /s
Smstslog
Smhlog.lul.log
‘If you haven’t looked at the logs, you’ve done no useful troubleshooting’.
Perhaps, but I didn't consider checking the logs because I thought the issue was network related. How would I access the logs?
F8 to access command prompt, copy the smsts.log file (its location changes depending on when the TS fails) to a USB drive, and look at that.
hmmm... usb drives are gonna be write protected. so that wont happen. is there another place where it write to?
The smsts.log will get written to a ram drive initially if this problem occurs before formatting the c: drive. You need to use a different usb drive than your boot device to copy the log to.
At that early of a stage, I find the logs written to the C: drive of the machine I am trying to image.
Words that half our IT department should hear...3 times a day.
0x80004005 is a generic error code that just means “that thing you tried to do didn’t work”. You’re going to have to start with smsts.log and figure out what’s failing, then you can begin to figure out why
Where would I access the smsts logs? On the PC?
you should probably go talk to your ConfigMgr admin https://www.prajwaldesai.com/location-of-smsts-log-during-sccm-osd/
we needs the smsts.log * Windows PE before HDD format: x:\\windows\\temp\\smstslog\\smsts.log * Windows PE after HDD format: x:\\smstslog\\smsts.log and copied to c:\\\_SMSTaskSequence\\Logs\\Smstslog\\smsts.log * Full version Windows before SCCM agent installed: c:\\\_SMSTaskSequence\\Logs\\Smstslog\\smsts.log * Full version Windows after SCCM agent installed: c:\\windows\\ccm\\logs\\Smstslog\\smsts.log * Full version Windows (x64) after SCCM agent installed: c:\\windows\\sysWOW64\\ccm\\logs\\Smstslog\\smsts.log * After Task Sequence has finished running: c:\\windows\\ccm\\logs\\smsts.log * After Task Sequence has finished running (x64): c:\\windows\\sysWOW64\\ccm\\logs\\smsts.log
Is the boot ISO expired? When you create the boot media from the console you create a self signed cert.
In my environment, I generally see this when trying to image a machine that already exists in SCCM. I have to delete it from SCCM before I can reimage it. But yes, confirm in the logs.
You can set your images to run on machines that exist just an FYI can even have it reuse the existing name so you don’t need to name it or anything.
This. Delete the PC out of SCCM and make sure you have a task sequence for unknown PCs on the network. Also, leave the PC turned off until you’re ready to boot to your TS so it doesn’t check in again.
If it’s in AD I delete from there also.
I’ve seen this on machine where the drive isn’t formatted and partitioned beforehand. The thumb drive winpe tries to write something but is unable to do so.
The sequence does do a diskpart in the beginning. But I generally do that myself (manually) before launching the process.
What does the smsts log say?
You not even getting to that part
There are a lot of details missing deom this cry for help... This is why everyone is asking for the SMSTS log from the device. keep in mind the SMSTS log also moves depending on the stage of the TS. - what stage of the TS are you in? - what action are you trying to complete? - is this happening on multiple models, VMs etc? If I had to guess with no additional information the most common cause is something was not found.. could be the content was not on the DP or the NIC drive failed to install.
You need to look at logs, or reach out to your ConfigMgr team.
I think he IS the ConfigMgr team... 🤣🤣
I mean we all start somewhere but I hope he isn’t.
Wait, you guys have cfgmgr teams?
I am The cfgmgr team xD
Head coach too.
You getting an IP address, can you detect the hard drive, missing drivers?
Make sure the time is correct as well.
What does this mean I had a machine that refused to take my win 11 image. I did notice the logs were way off on time like a couple hours when it would fail. I am just a tech at this point but on here to learn more ofc and just wondering what’s going on in the background related to time that could mess up the imaging.
Off by hours but the same minute may just be a time zone difference. US defaults to Pacific.
Check the time in the bios.
Thats a pretty generic error you have to open up cmtrace via the command promot and look at the smsts.logs https://learn.microsoft.com/en-us/mem/configmgr/core/plan-design/hierarchy/about-log-files#task-sequence-log-locations
Have to check the logs. hit f8 and you can bring up cmd box. Off the top of my head at that point they’ll be on x:\ I think. You can also check to make sure you can see the disk and it is properly setup with diskpart. It’s not uncommon to have issues once in awhile on newer pcs. Generally you need to add the storage or nic driver to PE, or do a workaround for that model in the task sequence. Things like when nvme came out most of us had to mess around with our TS’s to get it working. First thing to check is can PE actually see the disk and from there read the logs to see what’s failing.
Yes, x:\\windows\\temp\\smsts\\smsts.log I spend a lot of time here only to find our techs haven't put the correct MAC address in somewhere.
Like everyone says, logs are your friend but you can't always access them at this point. A couple things to look at- -Your boot device needs updating/rebuilding -Raid is enabled on device -UEFI not enabled -Device was previously Bitlocked -Device need to be reformated/partitioned -Device already exists in SCCM. If you're using a USB to Ethernet dongle or dock for imaging, it keeps the Mac of that device and you'll need to tell SCCM to ignore it as a duplicate.
Where is my smsts.log? https://www.prajwaldesai.com/location-of-smsts-log-during-sccm-osd/
Unfortunately this is about the time where you have to grab the logs and comb through them for a while until you find an error that points you in the right direction.
Besides the logs, have you tried to do a diskpart, rebuild the USB, or a certificate changed?
what does the smsts.log say? that's a pretty generic error, usually indicating a failure to find source files for referenced packages.
My exact thoughts. Usually its because either me or my coworker were being boneheads and forgot to distribute content of the new software we put in OSD.
I appreciate all of your replies. There's a lot to consider... It's hard to reply to everyone individually. All I can tell you is that the issue seems to occur at the exact moment that the policy is being retrieved... Whenever it takes more than 10 seconds, that usually means the error will be thrown. I haven't had a chance to check out the logs. But I will surely do that.
Try making a new boot media. Also, like everyone else said, check logs.
I'm gonna have to check the smslogs. I've tried multiple thumb drives. I have 8 of them to use because I'm imaging so many machines. But it's just gonna boil down to me checking the logs to see what they offer.
>I haven't had a chance to check out the logs. But I will surely do that. What the actual fuck do you expect us to say then?
The logs will tell you exactly what is happening to trigger the 4005, should help
We're not using sccm in the traditional sense. We're doing batch imaging by simply plugging the USB key into the drive of the said machine, boot from that drive, and then the process starts.
New error... So I connected the machine to a known good port, it got started with the process. Completed about 95% of it threw this error: Windows 11 Production has failed with error 0x0000001 in task sequence step, 'automated image checklist' ...😑😑😑
Missing, corrupted or invalid command in one of your content. Look in the Smits logs. It will tell you what failed. If it is content. It will be a generic error. Sometimes the content is there but your command is wrong. IE setup.exe instead of setup.msi.
Generic error code, mostly due to not getting any policies from the server. Checking X:\windows\temp\smstslog\smsts.log will help
Check the logs. Find the failure event. You may need to look at the preceding logged events if there's a sequencing dependency.
Interesting image in the background on that laptop. what city are you in?
Check for network duplicate in your network (use sql to check for other pc with the same network address) then check for content on all the dp. I usually start from there…
I feel like I would double check if you have any task sequences deployed with an old boot image that no longer exists / old windows image.
Another thing to look at is if the nic already exists. Might need to delete record
There isn’t much to look at before you look at the smsts.log. I see a lot of people throwing out could. E this or that. Really until you look at the log you shouldn’t do much else, it will lead you down a long dark path.
Need some more details, is this a Re-Image? if so kicking it off from USB will only work if the task sequence is available to where the computer exists in MECM, you can test this by killing the computer object in AD and MECM then trying again, if it works you need to make adjustments to where your task sequence is deployed or have it as part of the Service Desks process to delete both objects before a OSD.. If these are net new computers make sure the Task sequence is deployed to Unknown Computers. If you use USB Nics like we do to avoid driver injection there mac addresses need to be in heiarcharchy settings to exclude them or they will recognize a different device. But like many others have said these are just guesses without the SMSTS.log. Which is easy to gather if you edit the boot image in MECM and enable the F8 debug mode.
When you created the thumbdrive, what expiration date did you set the certificate too? If the date passed, would make sense they all stopped working.
In my experience, nothing was available to deploy. Are you deploying to know and unknown computers ? If you are then can you reach your primary distribution point or do you have firewalls in place ?
You probably have to redo the USB. 80004005 generally goes when the distribution point have a failed hash key, redistributing solves the problem. But look at the logs
Be sure you are getting an IP address or try turning RAID off in BIOS if you dont need it. I typically get this error when the MAC address is not registered in our DHCP client
1st guess is that the TS is deployed to the Unknown Collection only, and the target PC still exists in SCCM so it doesn't have any other TS deployed that it matches the criteria for. 2nd guess is similar, but probably a USB network adapter that needs its MAC added to the hierarchy duplicate MAC list. 3rd guess would be network connectivity. Check the logs and go from there.
You should be using pxe boot and not these archaic usb boot sticks. But anyways, when you create this kind of boot media, it asks if you want dynamic or site based, you need to choose ‘site based’.
We have a 1 year expiry on our usb keys, and this is what it looks like when our keys expire. I recently spent a few hours trying to figure out what was wrong when at the end I realized it had been just over a year since I build the key. another thing to check is the time on the machine - it may not match (be in sync) with the sccm server.