Analyzing SMSPXE.log and other methods to troubleshoot SCCM 2012 OS deployments

• Author
• Recent Posts

Joseph Moody

Joseph Moody is a network admin for a public school system and helps manage 5,500 PCs. He is a Microsoft Most Valuable Professional (MVP) in Cloud and Datacenter Management and blogs at DeployHappiness.com.

Latest posts by Joseph Moody (see all)

• SmartDeploy: Rethinking software deployment to remote workers in times of a pandemic - Thu, Jul 30 2020
• Outlook attachments now blocked in Office 365 - Tue, Nov 19 2019
• PolicyPak MDM Edition: Group Policy and more for BYOD - Tue, Oct 29 2019

In my previous post, I explained how to deploy unknown computers with SCCM 2012. Unfortunately, things don’t always go as planned. Various ways exist to find the cause of a failed OS deployment. The SMSPXE.log in SCCM 2012 is the first place where you should start your investigation.

Using the SMSPXE.log in SCCM 2012

When any device attempts a network boot off of a SCCM distribution point, that process is recorded in the SMSPXE log. This log location varies depending on the SCCM version, whether multicasting is enabled, and the setup of your environment. To troubleshoot unknown computer deployments, your first step is to locate this log file. Check the following locations:

• \\Distribution Point\SMS_DP$\SMS\Logs
• \\Site Server\SMS_SITENAME\Logs

The SMSPXE.log file can occasionally go missing (especially if you reconfigure your distribution point or change multicast settings). Check C:\Program Files\SMS_CCM\Logs on your site server if you can’t find it in the two locations above.

Reading the log is cumbersome without the Configuration Manager Trace Log tool (which you can download from here). This tool was previously called trace32. Open the SMSPXE.log file, and let’s explore the deployment process for an unknown computer for a bit.

Our first scenario involves a brand new computer, straight out of the box. After we ensure that PXE is enabled on the NIC, we can attempt a network boot. We will see the following in our SMSPXE log:

SMSPXE log showing an unknown computer

SCCM will look up two identification items: the MAC and the SMBIOS GUID. These determine if the device is treated as an unknown (new) computer. You can see that process on line 2 in the screenshot above. SCCM will see if any task sequence is deployed to the All Unknown Computers collection. Line 5 shows that an optional advertisement was found. The client will continue the network boot. Settings, such as computer name, can be specified before the task sequence actions begin.

Our second scenario will involve a known computer. In the screenshot below, a client is attempting a network boot. Line 1 shows that the device is found in the database, making it a known device.

SMSPXE log showing a known computer

Any task sequences deployed to the All Unknown Computers collection will not apply to this device. No task sequences are deployed to this client through any other collections. The client then stops the network boot process (abortpxe.com) and attempts to boot from another device.

Searching SCCM for MAC addresses and SMBIOS GUIDs

OS deployments to known computers are normally handled with a task sequence deployment to a dedicated device collection. The known computer is added to the collection and can begin the deployment process.

You may want to take a known device and image it like an unknown computer. In this case, you could delete the client record from SCCM. Occasionally, you might not know the computer name and cannot delete it from SCCM. Even rarer, you may have duplicate MAC or SMBIOS GUID entries in your database. This can make a new computer appear as a known device. SMSPXE.log does not contain the computer name. To find the computer name, you must query SCCM by using the MAC address or SMBIOS GUID.

Queries to find MAC addresses and SMBIOS GUIDs in our SCCM database

Launch the Configuration Manager console and navigate to Monitoring/Queries. Create a new query and name it Query Machine Name from MAC Address. Select Edit Query Statement – Show Query Language. Paste in the following and then close your query:

select distinct SMS_R_System.Name, SMS_R_System.MACAddresses from SMS_R_System where SMS_R_System.MACAddresses = ##PRM:SMS_R_System.MACAddresses## order by SMS_R_System.MACAddresses

Double-click the query. You will be prompted for a MAC address. If you have an address listed in your SMSPXE log, copy it and paste it into your query. The query returns any matching computer names. You can then navigate to Assets and Compliance and delete the record (if needed).

The MAC address query prompting for a value

Now, we need to create a query that searches the SMBIOS GUID property. Create a new query, name it, and paste in the following statement:

select distinct SMS_R_System.Name, SMS_R_System.SMBIOSGUID from SMS_R_System where SMS_R_System.SMBIOSGUID = ##PRM:SMS_R_System.SMBIOSGUID## order by SMS_R_System.SMBIOSGUID

By understanding the SMSPXE log and using the two queries above, you can successfully troubleshoot any unknown computer deployment issues that you will face in SCCM 2012.