SCCM 2007 Client troubleshooting – Part 5: Native Mode

Most sites I’ve seen and heard of are using Native Mode. If you ask many administrators what that means, you get some pretty interesting responses. Basically, Native Mode means that the communications channel is encrypted via SSL between the Client device and the Management Point (MP), and other site system servers, except for communicating with Server Locator Point (SLP), and Fallback Status Point (FSP) servers.

Author
Recent Posts

David Stein

David is an author and consultant, working for Endurance IT Services in Virginia Beach, Virginia, specializing in Microsoft enterprise systems and Business Process Automation.

Symptoms

Client applet (General tab) does not show “Site Mode” as “Native Mode”
Client fails to communicate with Management Point
Client is not Approved (when Automatic approval has been enabled)
Client fails to report inventory

Potential causes

Corrupted, missing or expired client certificate
PKI environment issues
Missing or Unavailable CRL in perimeter network (Internet clients)
Client device does not meet minimum requirements for Native mode
DNS or WINS name resolution issues
Firewall settings (on routers, servers, and clients)
Network Connectivity issues
Trying to use NLB Management Points with AD publishing

Suggestions

Check the Windows System Event Log
Verify Network Connectivity
Verify Name Resolution (DNS, WINS)
If using Windows Server 2008, do not use Version 3 PKI certificate templates
Verify client certificate is installed and valid
Verify PKI environment is working properly
Run the SCCMNativeModeReadiness.exe utility from the CCM folder (right-click and select "Run as Administrator". Append " /?" to view available options as well)
Verify local services are running properly
Verify firewall settings (client, routers, switches, servers)

If the client computer issues are related to domain account issues, such as losing trust or delegation rights, or password synchronization failures, you may also see Windows Event log entries indicating failures to locate or communicate with a domain controller, or failures downloading or applying Group Policy. I don’t mean individual GPO settings or GPO’s, but errors indicating Group Policy is unable to update at all.

"Potential Causes" items 1 through 4 are the most common I’ve seen, but that's only in the context of the environments I've dealt with, so that's anecdotal. Checking on the status of the certificate never hurts, and since Native Mode depends so heavily on PKI it makes sense to rule that out first.

DNS and WINS name resolution issues can be easy to overlook, so be sure to verify that the clients can resolve the Name of each DNS server relevant to the client's connection and authentication scheme. If WINS is used (more often than expected actually), make sure you verify name resolution to the WINS server as well.

When everything else appears fine I ask the user (or field technician) to verify there is “activity” on the network port of the device and they reply “I don’t see any lights blinking”, I usually suggest checking the cable or swapping it out, or trying a different jack or verifying wireless connectivity (if applicable).