Configuration Manager client won't install: reading ccmsetup.log and fixing common causes

When the Configuration Manager client (still widely called the SCCM or MECM client) won't install, the console just keeps showing Client: No. The reason is nearly always written down: in ccm.log on the site server for client push, and in ccmsetup.log and client.msi.log on the device. In this post I'll walk through what a client install actually does, where each stage breaks, and what a clean install looks like.

Symptoms#

• Devices stay at Client: No in Assets and Compliance › Devices long after client push or the Install Client wizard ran.
• C:\Windows\ccmsetup exists but C:\Windows\CCM doesn't, or the ccmsetup service is still there hours later.
• ccmsetup.log ends with CcmSetup failed with error code 0x80070643 or another non-zero result.
• The client installs, but its control panel applet shows only the two policy retrieval actions and the device never becomes active.

Why it happens#

Every installation method ends up running ccmsetup.exe, which always does the same work: find a management point (MP), download the client files (from a distribution point in the device's boundary group, the MP, or a /source folder), install prerequisites, run client.msi, then register with the MP and get assigned to a site. Only the start differs:

Failures fall into four groups:

• Can't get in (push only): non-admin push account, admin$ unreachable, SMB or WMI blocked, Kerberos failing.
• Can't download: no HTTP/HTTPS route to the MP (TCP 80/443 by default), proxy or DNS problems, or an HTTPS-only MP without a client certificate on the device.
• Can't install: failed prerequisite, pending restart, another MSI running, damaged WMI, or remains of an old client.
• Can't register: no boundary group for site assignment, wrong site code, or an unhealthy MP.

How to fix it#

1. Client push: read ccm.log on the site server#

Each push attempt is a request block. Search for the device name:

======>Begin Processing request: "2097152017", machine name: "PC042"
    ---> Attempting to connect to administrative share '\\PC042.contoso.com\admin$' using account 'CONTOSO\svc-cmpush'
    ---> ERROR: Unable to access target machine for request: "2097152017", machine name: "PC042", access denied or invalid network path.

Reproduce it from the site server with net use \\PC042.contoso.com\admin$ /user:CONTOSO\svc-cmpush. Starting in version 2207, Allow connection fallback to NTLM (Administration › Site Configuration › Sites › Client Installation Settings › Client Push Installation) is off by default on new sites, so push needs Kerberos and a trusted forest. Fix name resolution rather than re-enabling NTLM. Failed requests are retried automatically.

2. Read ccmsetup.log from the bottom up#

Open C:\Windows\ccmsetup\Logs\ccmsetup.log, read the outcome at the end, then search upwards for the first real error. The return code gives the category:

A Failed to get client version ... Error 0x8004100e line is normal on a first install: the client's WMI namespace doesn't exist yet. Download problems appear as 0x80072EE7 (name not resolved), 0x80072EFD (can't connect) or 0x80072EE2 (timeout). Test from the device:

Test-NetConnection cm01.contoso.com -Port 80
Invoke-WebRequest 'http://cm01.contoso.com/sms_mp/.sms_aut?mplist' -UseBasicParsing | Select-Object StatusCode

A 200 means the MP is reachable and answering. For an HTTPS-only MP, test with https://; the device also needs a valid client authentication certificate.

3. If client.msi failed, read client.msi.log#

0x80070643 is Windows Installer's generic fatal error (1603). Open C:\Windows\ccmsetup\Logs\client.msi.log and search for Return value 3; the lines above it name the failing action. Usual culprits:

• Error 1618: another installation is running. Let it finish or restart.
• WMI errors: run winmgmt /verifyrepository, and only if it reports an inconsistent repository, winmgmt /salvagerepository. Don't reset the repository as a first step.
• Old client remains: run C:\Windows\ccmsetup\ccmsetup.exe /uninstall, wait for ccmsetup.log to finish, restart, reinstall.
• Pending restart: restart first.

4. Reinstall with explicit parameters#

Take automatic MP lookup out of the equation:

\\cm01.contoso.com\SMS_PS1\Client\ccmsetup.exe /mp:cm01.contoso.com SMSSITECODE=PS1

/mp: sets where ccmsetup gets its files; SMSSITECODE sets the site (use AUTO only when boundary groups are right). Add /forceinstall to replace an existing client, or /source: to install from a local folder.

5. Check site assignment and registration#

In C:\Windows\CCM\Logs, ClientLocation.log records site assignment: if auto-assignment fails, the device's subnet, IP range or AD site isn't in a boundary group with Use this boundary group for site assignment selected. LocationServices.log shows the MPs and distribution points found, and ClientIDManagerStartup.log records registration. If registration keeps retrying, suspect the MP: see troubleshooting an unhealthy management point.

Verify the fix#

A good install ends with CcmSetup is exiting with return code 0, and the ccmsetup service removes itself. Then check:

Get-Service CcmExec
Get-CimInstance -Namespace root\ccm -ClassName SMS_Authority | Select-Object Name, CurrentManagingPoint

1. CcmExec (SMS Agent Host) is running.
2. Name reads SMS:PS1 (your site code) and CurrentManagingPoint is an MP you expect.
3. The control panel applet soon lists the full set of actions.
4. The console shows Client: Yes, and Client Activity turns Active once the device reports.

Prevent it next time#

• Use one dedicated push account with local admin rights granted by Group Policy, never a domain admin.
• Deploy the push firewall rules (File and Printer Sharing, WMI) and outbound HTTP/HTTPS to MPs by Group Policy.
• Update boundary groups whenever you add subnets, VPN ranges or AD sites.
• Installed isn't healthy: watch inactive and unhealthy clients.

References#

• About client installation parameters and properties in Configuration Manager
• How to deploy clients to Windows computers in Configuration Manager
• Windows Firewall and port settings for clients in Configuration Manager