When unknown computers stop imaging in SCCM 2012, knowing where to look first will save hours of effort. This guide covers the SMSPXE.log file and two custom queries for the SCCM database.

In my previous post, I explained how to deploy unknown computers with SCCM 2012. Unfortunately, things don’t always go as planned. Various ways exist to find the cause of a failed OS deployment. The SMSPXE.log in SCCM 2012 is the first place where you should start your investigation.

Using the SMSPXE.log in SCCM 2012

When any device attempts a network boot off of a SCCM distribution point, that process is recorded in the SMSPXE log. This log location varies depending on the SCCM version, whether multicasting is enabled, and the setup of your environment. To troubleshoot unknown computer deployments, your first step is to locate this log file. Check the following locations:

The SMSPXE.log file can occasionally go missing (especially if you reconfigure your distribution point or change multicast settings). Check C:\Program Files\SMS_CCM\Logs on your site server if you can’t find it in the two locations above.

Reading the log is cumbersome without the Configuration Manager Trace Log tool (which you can download from here). This tool was previously called trace32. Open the SMSPXE.log file, and let’s explore the deployment process for an unknown computer for a bit.

Our first scenario involves a brand new computer, straight out of the box. After we ensure that PXE is enabled on the NIC, we can attempt a network boot. We will see the following in our SMSPXE log:

SMSPXE log showing an unknown computer

SMSPXE log showing an unknown computer

SCCM will look up two identification items: the MAC and the SMBIOS GUID. These determine if the device is treated as an unknown (new) computer. You can see that process on line 2 in the screenshot above. SCCM will see if any task sequence is deployed to the All Unknown Computers collection. Line 5 shows that an optional advertisement was found. The client will continue the network boot. Settings, such as computer name, can be specified before the task sequence actions begin.

Our second scenario will involve a known computer. In the screenshot below, a client is attempting a network boot. Line 1 shows that the device is found in the database, making it a known device.

SMSPXE log showing a known computer

SMSPXE log showing a known computer

Any task sequences deployed to the All Unknown Computers collection will not apply to this device. No task sequences are deployed to this client through any other collections. The client then stops the network boot process (abortpxe.com) and attempts to boot from another device.

Searching SCCM for MAC addresses and SMBIOS GUIDs

OS deployments to known computers are normally handled with a task sequence deployment to a dedicated device collection. The known computer is added to the collection and can begin the deployment process.

You may want to take a known device and image it like an unknown computer. In this case, you could delete the client record from SCCM. Occasionally, you might not know the computer name and cannot delete it from SCCM. Even rarer, you may have duplicate MAC or SMBIOS GUID entries in your database. This can make a new computer appear as a known device. SMSPXE.log does not contain the computer name. To find the computer name, you must query SCCM by using the MAC address or SMBIOS GUID.

Queries allow us to find MAC Addresses and SMBIOS GUIDs in our SCCM database.

Queries to find MAC addresses and SMBIOS GUIDs in our SCCM database

Launch the Configuration Manager console and navigate to Monitoring/Queries. Create a new query and name it Query Machine Name from MAC Address. Select Edit Query Statement – Show Query Language. Paste in the following and then close your query:

select distinct SMS_R_System.Name, SMS_R_System.MACAddresses from SMS_R_System where SMS_R_System.MACAddresses = ##PRM:SMS_R_System.MACAddresses## order by SMS_R_System.MACAddresses

Double-click the query. You will be prompted for a MAC address. If you have an address listed in your SMSPXE log, copy it and paste it into your query. The query returns any matching computer names. You can then navigate to Assets and Compliance and delete the record (if needed).

The MAC address query prompting for a value.

The MAC address query prompting for a value

Now, we need to create a query that searches the SMBIOS GUID property. Create a new query, name it, and paste in the following statement:

select distinct SMS_R_System.Name, SMS_R_System.SMBIOSGUID from SMS_R_System where SMS_R_System.SMBIOSGUID = ##PRM:SMS_R_System.SMBIOSGUID## order by SMS_R_System.SMBIOSGUID

By understanding the SMSPXE log and using the two queries above, you can successfully troubleshoot any unknown computer deployment issues that you will face in SCCM 2012.

  1. jaime 7 years ago

    Very cool.  Great post.

  2. olivier dsm 7 years ago

    Thanks for sharing. very cool

  3. Mike 3 years ago

    I was trying to reimage a VM with Windows 10 but when i run the machine it shows error 

    "No more network devices

    Fatal: could not read from he boot medium! system halted"

    will you help please

    Thank you

    • Author
      Joseph Moody (Rank 3) 3 years ago

      Will it image if you remove the NIC from the VM and add another one? If so, you might need to clear the PXE flag on the device going forward or change your deployment from mandatory. 

Leave a reply

Your email address will not be published. Required fields are marked *


© 4sysops 2006 - 2023


Please ask IT administration questions in the forums. Any other messages are welcome.


Log in with your credentials


Forgot your details?

Create Account