SCCM Secondary Server Installation Failed Error | ConfigMgr | Fix

0
SCCM Secondary Server Installation Failed Error| ConfigMgr | Fix

I got the following error “Unable to complete secondary site server installation” during the installation of a new Configuration Manager secondary server. Let’s try to fix SCCM Secondary Server Installation Failed Error.

Another error that I could see in the ConfigMgr console is related to SQL DB permissions. Either the user account running Configuration Manager Setup or NT AUTHORITY\SYSTEM does not have sysadmin SQL Server role permissions on the SQL Server instance.

NOTE! – More details 👉 New SCCM Secondary Server Installation Guide | Step by Step | ConfigMgr.

SCCM Secondary Server Installation Failed Error| ConfigMgr | Fix
SCCM Secondary Server Installation Failed Error| ConfigMgr | Fix

Secondary Site Server Logs

Before starting the troubleshooting of the SCCM Secondary server installation failed issue, let’s understand the related log files.

  • Check the ConfigMgrPreReq.log on the primary server.
  • Once the prerequisite is completed successfully, Refer the following logs on the new secondary server.
    • smstvc.log for secondary server installation-related log on secondary server C:\.
    • SMS_BootStrap.log on secondary server C:\.
    • ConfigMgrSetupWizard.log is not useful for secondary server installation.
    • ConfigMgrSetup.log to validate the installation of the secondary server.
  • Event Viewer Logs on the secondary site server.

Show Install Status – Secondary Server

Let’s find more details about secondary server installation failure from ConfigMgr console.

  • Navigate to \Administration\Overview\Site Configuration\Sites.
  • Click on the new secondary server.
  • Click on Show install status (secondary server installation).
[Failed]:Either the user account running Configuration Manager Setup or NT AUTHORITY\SYSTEM does not have sysadmin SQL Server role permissions on the SQL Server instance selected for site database installation, or the SQL Server instance could not be contacted to verify permissions. Setup cannot continue.
[Failed]:Prerequisite checks complete with failure - check ConfigMgrPrereq.log in the root of the primary site server system drive
[Failed]:Unable to complete secondary site server installation - check ConfigMgrSetup.log in the root of the secondary site server system drive
SCCM Secondary Server Installation Failed Error| ConfigMgr | Fix
SCCM Secondary Server Installation Failed Error| ConfigMgr | Fix

ConfigMgrPreReq.log

You have to refer the ConfigMgrPreReq.log on the primary server to understand the initial details of secondary server installation failure.

*** [28000][18456][Microsoft][SQL Server Native Client 11.0][SQL Server]Login failed for user 'MEMCM\CMMEMCM$'
*** [28000][18456][Microsoft][SQL Server Native Client 11.0][SQL Server]Login failed for user 'MEMCM\CMMEMCM$'
*** Failed to connect to the SQL Server, connection type: SMS Master
ERROR: Failed to connect to SQL Server database
MEMCMSecondary.memcm.com; Dedicated SQL Server instance; Error; Configuration Manager requires a dedicated SQL Server instance to host its site database.
*** [28000][18456][Microsoft][SQL Server Native Client 11.0][SQL Server]Login failed for user 'MEMCM\CMMEMCM$'
*** [28000][18456][Microsoft][SQL Server Native Client 11.0][SQL Server]Login failed for user 'MEMCM\CMMEMCM$'
*** Failed to connect to the SQL Server, connection type: SMS Master
INFO: Checking sql index create memory
ERROR: Failed to connect to SQL Server database.
MEMCMSecondary.memcm.com; SQL Index Create Memory option; Warning; SQL Index create memory is not configured as default value of 0 and might hit issue
ERROR: Failed to connect to SQL Server database.
SCCM Secondary Server Installation Failed Error| ConfigMgr | Fix
SCCM Secondary Server Installation Failed Error| ConfigMgr | Fix
  • More details about the issue in the details of ConfigMgrPreReq.log. It’s all pointing towards SQL DB permission related issues.
MEMCMSecondary.memcm.com; SQL Server sysadmin rights; Error; Either the user account running Configuration Manager Setup or NT AUTHORITY\SYSTEM does not have sysadmin SQL Server role permissions on the SQL Server instance selected for site database installation, or the SQL Server instance could not be contacted to verify permissions. Setup cannot continue.
ERROR: The current user does not have administrative rights on computer: MEMCMSecondary.memcm.com.
ERROR: Prerequisite checking stopped on this machine.

Validation Checks

  • I have given sysadmin & security admin permission to the user account which I’m using to install the secondary site server.
  • I have already given sysadmin & security admin permission to the primary server computer account.

Event Logs on the Secondary Site Servers

I have checked the event logs from secondary to get more details about the installation error. It seems that there is no issue with the primary computer account permissions.

  • ConfigMgrPreReq.log file above indicates a user account?
  • Logged into the secondary server.
  • Launched event viewer logs (eventvwr).
  • Checked Security Logs.

Event ID 4624 from security-related event logs indicates that An account was successfully logged on with MEMCM\CMMEMCM$.

  • All I can see is Event ID 4624
    • Logon success with primary server computer account – MEMCM\CMMEMCM$
SCCM Secondary Server Installation Failed Error| ConfigMgr | Fix
SCCM Secondary Server Installation Failed Error| ConfigMgr | Fix
Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 8/2/2020 4:59:34 AM
Event ID: 4624
Task Category: Logon
Level: Information
Keywords: Audit Success
User: N/A
Computer: MEMCMSecondary.memcm.com
Description:An account was successfully logged on.
Subject:
Security ID: NULL SID
Account Name: -
Account Domain: -
Logon ID: 0x0
Logon Information:
Logon Type: 3
Restricted Admin Mode: -
Virtual Account: No
Elevated Token: Yes
Impersonation Level: Impersonation
New Logon:
Security ID: MEMCM\CMMEMCM$
Account Name: CMMEMCM$
Account Domain: MEMCM.COM
Logon ID: 0x144846
Linked Logon ID: 0x0
Network Account Name: -
Network Account Domain: -
Logon GUID: {1ea1a268-7b4d-acaa-935c-395cf806a0ea}
Process Information:
Process ID: 0x0
Process Name: -
Network Information:
Workstation Name: -
Source Network Address: 10.1.0.6
Source Port: 58674
Detailed Authentication Information:
Logon Process: Kerberos
Authentication Package: Kerberos
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
This event is generated when a logon session is created. It is generated on the computer that was accessed.
The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).
The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.
The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
The impersonation level field indicates the extent to which a process in the logon session can impersonate.
The authentication information fields provide detailed information about this specific logon request.
- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Event Xml:
4624
2
0
12544
0
0x8020000000000000
3337
Security
MEMCMSecondary.memcm.com
S-1-0-0 - - 0x0 S-1-5-21-2901188661-3025291148-348095268-1107 CMMEMCM$ MEMCM.COM 0x144846 3 Kerberos Kerberos - {1ea1a268-7b4d-acaa-935c-395cf806a0ea} - - 0 0x0 - 10.1.0.6 58674 %%1833 - - - %%1843 0x0 %%1842

Validation Checks to Fix

I continued validation of the security logs from the event viewer. It seems the NT Authority (system account) defined in the SQL server is also trying to log in as per the following event log.

Even ID 4672 -Special privileges assigned to new logon.
Subject:
Security ID: SYSTEM
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon ID: 0x3E7
SCCM Secondary Server Installation Failed Error| ConfigMgr | Fix
SCCM Secondary Server Installation Failed Error| ConfigMgr | Fix

Fix Secondary Server Installation Failed Error

  • It seems the permissions of the primary server computer account and NT Authority\System account.
  • NT Authority\System account didn’t have the following permissions.
    • Security Admin
    • SysAdmin
  • Given those permissions as per the following guide.
SCCM Secondary Server Installation Failed Error| ConfigMgr | Fix
SCCM Secondary Server Installation Failed Error| ConfigMgr | Fix
  • Navigate to \Administration\Overview\Site Configuration\Sites.
  • Right-Click on the new secondary server.
  • Click on the Retry secondary Site option.
  • Complete the Secondary Server Installation wizard.
SCCM Secondary Server Installation Failed Error| ConfigMgr | Fix
SCCM Secondary Server Installation Failed Error| ConfigMgr | Fix

Results

The secondary server installation got completed successfully. And the site server status shows as Site Active.

Secondary Server Installation
SCCM Secondary Server Installation Failed Error| ConfigMgr | Fix

Resources

LEAVE A REPLY

Please enter your comment!
Please enter your name here

This site uses Akismet to reduce spam. Learn how your comment data is processed.