Client installation checklist (ccmsetup.log)

Symptoms to confirm

• Devices stay at Client: No in Assets and Compliance › Devices long after client push or the Install Client wizard ran.
• C:\Windows\ccmsetup exists but C:\Windows\CCM doesn't, or the ccmsetup service is still there hours later.
• ccmsetup.log ends with CcmSetup failed with error code 0x80070643 or another non-zero result.
• The client installs, but its control panel applet shows only the two policy retrieval actions and the device never becomes active.

Likely causes

Every installation method ends up running ccmsetup.exe, which always does the same work: find a management point (MP), download the client files (from a distribution point in the device's boundary group, the MP, or a /source folder), install prerequisites, run client.msi, then register with the MP and get assigned to a site.

• Can't get in (push only): non-admin push account, admin$ unreachable, SMB or WMI blocked, Kerberos failing.
• Can't download: no HTTP/HTTPS route to the MP (TCP 80/443 by default), proxy or DNS problems, or an HTTPS-only MP without a client certificate on the device.
• Can't install: failed prerequisite, pending restart, another MSI running, damaged WMI, or remains of an old client.
• Can't register: no boundary group for site assignment, wrong site code, or an unhealthy MP.

Checklist

1. 1

   Client push: read ccm.log on the site server

   Each push attempt is a request block. Search for the device name:

   ======>Begin Processing request: "2097152017", machine name: "PC042"
       ---> Attempting to connect to administrative share '\\PC042.contoso.com\admin$' using account 'CONTOSO\svc-cmpush'
       ---> ERROR: Unable to access target machine for request: "2097152017", machine name: "PC042", access denied or invalid network path.

   Error	Meaning	Fix
   5	Access denied	Add the push account to local Administrators (by Group Policy); check it isn't locked out
   53, 67	Network path or name not found	Device offline, stale DNS record, or File and Printer Sharing blocked
   0x800706BA	RPC server unavailable	Allow the WMI inbound firewall rules (RPC: TCP 135 plus dynamic ports)
   1396	Target account name is incorrect	Kerberos found the wrong computer: fix duplicate or stale DNS records

2. 2

   Read ccmsetup.log from the bottom up

   Open C:\Windows\ccmsetup\Logs\ccmsetup.log, read the outcome at the end, then search upwards for the first real error. The return code gives the category:

   Code	Meaning	Next step
   0	Success	Check assignment (step 5)
   6	Error	Find the first error; MSI failures go to step 3
   7	Reboot required	Often a prerequisite such as .NET Framework; restart
   8	Setup already running	Two install methods collided
   9	Prerequisite evaluation failure	Check the OS and prerequisite lines
   10	Setup manifest hash validation failure	Files don't match the site; retry from a known-good source

   Test from the device:

   powershell

   Test-NetConnection cm01.contoso.com -Port 80
   Invoke-WebRequest 'http://cm01.contoso.com/sms_mp/.sms_aut?mplist' -UseBasicParsing | Select-Object StatusCode

3. 3

   If client.msi failed, read client.msi.log

   0x80070643 is Windows Installer's generic fatal error (1603). Open C:\Windows\ccmsetup\Logs\client.msi.log and search for Return value 3; the lines above it name the failing action.

   • Error 1618: another installation is running. Let it finish or restart.
   • WMI errors: run winmgmt /verifyrepository, and only if it reports an inconsistent repository, winmgmt /salvagerepository. Don't reset the repository as a first step.
   • Old client remains: run C:\Windows\ccmsetup\ccmsetup.exe /uninstall, wait for ccmsetup.log to finish, restart, reinstall.
   • Pending restart: restart first.
4. 4

   Reinstall with explicit parameters

   Take automatic MP lookup out of the equation:

   cmd

   \\cm01.contoso.com\SMS_PS1\Client\ccmsetup.exe /mp:cm01.contoso.com SMSSITECODE=PS1

5. 5

   Check site assignment and registration

   In C:\Windows\CCM\Logs, ClientLocation.log records site assignment: if auto-assignment fails, the device's subnet, IP range or AD site isn't in a boundary group with Use this boundary group for site assignment selected. LocationServices.log shows the MPs and distribution points found, and ClientIDManagerStartup.log records registration.

Verify

A good install ends with CcmSetup is exiting with return code 0, and the ccmsetup service removes itself.

Get-Service CcmExec
Get-CimInstance -Namespace root\ccm -ClassName SMS_Authority | Select-Object Name, CurrentManagingPoint

• CcmExec (SMS Agent Host) is running.
• Name reads SMS:PS1 (your site code) and CurrentManagingPoint is an MP you expect.
• The control panel applet soon lists the full set of actions.
• The console shows Client: Yes, and Client Activity turns Active once the device reports.

Prevent it next time

• Use one dedicated push account with local admin rights granted by Group Policy, never a domain admin.
• Deploy the push firewall rules (File and Printer Sharing, WMI) and outbound HTTP/HTTPS to MPs by Group Policy.
• Update boundary groups whenever you add subnets, VPN ranges or AD sites.
• Installed isn't healthy: watch inactive and unhealthy clients.