Reading smsts.log: troubleshooting Configuration Manager task sequence failures

When a task sequence fails, the device shows an error code and a countdown, then restarts. The code alone rarely tells you much: the reason is in smsts.log, which moves as the deployment progresses. In this post I'll show where to find the log in each phase, how to keep the device on the error, and how to fix the usual failure areas: drivers, network access, content and domain join.

Symptoms#

• A Task Sequence … has failed with the error code dialog, often with 0x80004005 or 0x80070002, then a restart.
• Failed to Run Task Sequence before any step runs, saying files for a package can't be located on a distribution point.
• WinPE loads and restarts within seconds, or disk steps fail on new hardware.
• Windows finishes, but the device is in a workgroup instead of the domain.

Why it happens#

The task sequence engine runs steps in order. A step that returns anything other than a success code fails, and unless Continue on error is set on the step or its group, the sequence stops. The code on screen is usually the last link in the chain, such as 0x80004004 (operation aborted); the real cause sits higher in the log. The log itself moves as the disk is formatted and the client installs:

Drive letters can differ in WinPE, and a full log rolls over to smsts-<date>-<time>.log, so search each drive: dir /s /b C:\smsts*.log.

How to fix it#

1. Keep the device on the error#

Turn on Enable command support (testing only) on the Customization tab of the boot image properties, then update its distribution points. In WinPE, press F8 for a command prompt; the device won't restart while that window is open. For more time on the error dialog, set the variable SMSTSErrorDialogTimeout (seconds; default 900) on the collection. First checks:

ipconfig /all
nslookup cm01.contoso.com
diskpart
list disk

No IPv4 address points to a missing network driver; an empty list disk points to a missing storage driver. Turn command support off again in production boot images, because an open F8 prompt is a security risk.

2. Read the log from the failure upwards#

Open the log in CMTrace if your boot image includes it, otherwise Notepad. Search for Failed to run the action, which names the failed step, then read upwards to the first error:

Failed to run the action: Apply Driver Package.
The system cannot find the file specified. (Error: 80070002; Source: Windows)
The execution of the group (Drivers) has failed and the execution has been aborted. An action failed.
Operation aborted (Error: 80004004; Source: Windows)

Some lines show codes in decimal: in PowerShell, '{0:X}' -f 2147942402 returns 80070002. CMTrace's Tools › Error Lookup gives the description.

3. Drivers and storage#

If WinPE has no IP address or no disk, add the network or storage driver (newer devices often need one for Intel VMD) on the Drivers tab of the boot image properties and update its distribution points. Keep boot images lean: network and storage drivers only. If Apply Driver Package fails, check that the package is distributed and that the step's condition, such as SELECT * FROM Win32_ComputerSystem WHERE Model LIKE '%Latitude 7450%', matches the model the firmware reports.

4. Content and network access#

Failed to resolve selected task sequence dependencies with 0x80040104, logged before the first step, means referenced content has no location the device may use. The lines above it name the package ID; match it on the task sequence's References tab, check its content status and distribute it, or run Distribute Content on the task sequence itself.

If the content exists only outside the device's boundary group, distribute it locally or allow fallback on the deployment's Distribution Points page: When no local distribution point is available, use a remote distribution point and Allow clients to use distribution points from the default site boundary group. A task sequence doesn't wait for fallback times; it uses them only to order neighbor groups.

For hash errors, redistribute the content to that distribution point. For access-denied errors, check the account in use: with Enhanced HTTP or HTTPS most task sequence downloads don't need a network access account, but an expired one still breaks the scenarios that use it.

5. Domain join#

Apply Network Settings only writes the join details into the unattend file; Windows Setup joins later, so the sequence can succeed while the device stays in a workgroup. Read C:\Windows\debug\NetSetup.LOG and C:\Windows\Panther\UnattendGC\setupact.log:

6. Capture logs automatically#

Put the main steps in a group with Continue on error. Add a second group with the condition _SMSTSLastActionSucceeded equals false: a Connect to Network Folder step mapping Z:, a Run Command Line step with the command below, and a final cmd.exe /c exit 1 so the deployment still reports failure.

cmd.exe /c xcopy "%_SMSTSLogPath%" "Z:\%_SMSTSMachineName%\" /E /I /Y /C

Verify the fix#

• Rerun the sequence on a test device: the final C:\Windows\CCM\Logs\smsts.log has no Failed to run the action lines, and the device shows Success in Monitoring › Deployments.
• For domain join, Test-ComputerSecureChannel returns True and the computer object is in the expected OU.
• Device Manager shows no unknown devices.

Prevent it next time#

• Check references and distribute everything to distribution point groups before deploying; pilot new hardware models first.
• Apps used in Install Application steps must allow installation from a task sequence without being deployed; their failures are in AppEnforce.log (see application deployment failures).
• After a site upgrade or new Windows ADK, update and redistribute boot images (see upgrading current branch).

References#

• Log file reference - Configuration Manager (Microsoft Learn)
• Boundary groups and distribution points, including task sequence support (Microsoft Learn)