Unable to logon to domain workstation after inter-forest migration with "The security database on the server does not have a computer account for this workstation trust relationship"

I was involved in a inter-forest Active Directory migration recently using the ADMT 3.2 and PES 3.1 tools and came across a wierd issue which really puzzled me for a few days.

Everything was setup correctly, the trust, the migration account, the permission, the DNS, the firewall is off.  Looking at the migration agent log file, it said it was successful.  Everything seems to be working except when I tried to logon to the workstation in the new forest root domain after the workstation migration using ADMT 3.2.  I got the message "The Security database on the server does not have a computer account for this workstation trust relationship"  I was like... "What the ..."

After some investigation, I realized that the Service Principal Name (SPN) was not set correctly after the migration.  You can look at the workstation SPNs in "Advance View" of the Active Directory Users and Computers.  Looking at the "servicePrincipalName" attribute, the property was empty.   That's wierd.  To temporarily resolve this issue, you can insert the following entries in the SPN and you will be able to logon to domain on the workstation  (Reference:  http://virtualcurtis.wordpress.com/2011/03/02/fix-the-security-database-on-the-server-does-not-have-a-computer-account-for-this-workstation-trust-relationship/)

HOST/ComputerNetBIOSName
HOST/ComputerFQDN

However, that's not what we want..  we need to find out the root cause of this problem.  After some thorough investigation, I think I found the culprit.  Well, I at least when I corrected this problem, the problem went away.

In the source domain, one of the GPOs has the "Primary Domain Suffix" defined in Computer Configuration\Administrative Templates\Network\Dns Client.  It was pointing to the source domain.  Luckily this blog points me to the right direction.  During the migration, the agent was not able to update the workstations or their A records in the DNS and therefore the SPN property was empty and not allowing logon to the domain.  I removed the GPO entry and everything started to work perfectly.

SCCM 2012 & Application Virtualization 5.0

Application Virtualization (App-V) has came a long way in my opinion.  I look into App-V 5.0 the other day and  ran into so much problem trying to sequence an application for SCCM 2012 and App-V client.  Completely my fault...  I didn't do much reading on it and was trying to use the Q drive like I used to do in App-V 4.6 sp1.  Big mistake! With App-V 5.0, the Q: drive is gone...   So, what has changed since 4.6 sp1, this is a good read.

Even the installation of App-V client is so simple and the fact that you can use group policy to control the settings makes App-V 5.0 so user friendly now.

Complete App-V 5.0 document resources HERE

This guide provide a step by step instruction for sequencing applications with App-V 5.0 for SCCM 2012.
Windows-Noob:  How can I sequence applications using App-V version 5 for Configuration Manager 2012 Sp1.


The following articles can be used as a reference for sequencing application with App-V 5.0
How to sequence a new application with App-V 5.0
What I do:  App-V 5 and the "Primary Virtual application Directory"

The following shows you how to install App-V 5.0 client with SCCM 2012
http://social.technet.microsoft.com/Forums/en-US/configmanagergeneral/thread/b136865c-8aa0-4a96-9fb4-476fb9081a98/

Issues with SCCM 2012 Reporting Service Point on SQL 2012

I ran into some issues with getting the Reporting Service Point in SCCM 2012 to work with SQL 2012. According to this post, SCCM 2012 Reporting Service Point is indeed supported on SQL 2012 SP1.  This is exactly what I had...

Why in the world it is not working for me?  I am not getting a Reporting Services Server Instances on the drop down box...  It was empty.

After some research, I came to realize that the issue was due to the configuration of SSRS which was not properly done.  Most likely the virtual directory was not created etc.

Following this article or this article actually resolve the problem.  Phew!!!!

System Center Configuration Manager 2012 in Secure Mode (PKI)

There are a lot of articles available on the internet which provide a step by step guide in providing certificates to your SCCM 2012 infrastructure to run in secure mode (HTTPS)

Here are some of the articles which I find useful. Kudos to the authors.

James Bannan IT - Certificate Requirement for SCCM 2012  (Gotchas with SQL)
Step by Step Guide from TechNet
Another Step by Step Guide Here
Sandbu Blogg

There are very straight forward and they work!!!

MDT 2010/2012 CustomSettings.ini - Control Application Installs

Controlling Application Installs in customsettings.ini can be very useful.  I come across multiple posts and this is one of them.

http://social.technet.microsoft.com/Forums/en-US/mdt/thread/564b6afd-bc1f-4cf9-8706-1f8f13319ee1/

Essentially, the following will execute the [ByType] section which has 2 SubSections.  %IsLaptop% is determined by the ZTIGather script. So, if found to be laptop,  the variable %IsLaptop% would be "True" and it goes to the [Laptop-True] section.

In the [Laptop-True] section, it has another SubSection called %make%.  Again, this variable is deteremined by ZTIGather script.  You can use the %model% if you need to.

[Settings]
Priority=ByType,Default
Properties=MyCustomProperty

[ByType]
SubSection=Laptop-%IsLaptop%
SubSection=Desktop-%IsDesktop%

[Desktop-True]
MachineObjectOU=OU=Workstations,OU=Non-Thins,OU=Computers,OU=_Corp,DC= ***** ,DC=com

[Laptop-True]
MachineObjectOU=OU=Laptops,OU=Non-Thins,OU=Computers,OU=_Corp,DC= ***** ,DC=com
SubSection=%make%

[Hewlett-Packard]
MandatoryApplications001={cdf5444c-abce-4de2-8375-fc5b9c8ff523}
MandatoryApplications002={82747e6b-da40-4cd0-9d91-41b2b39f3a17}

[Default]
DeployRoot=*****

OSInstall=YES

SkipBDDWelcome=YES
SkipComputerName=No
SkipComputerBackup=YES
SkipAppsOnUpgrade=YES
SkipCapture=NO
SkipAdminPassword=YES
SkipProductKey=YES

SkipDomainMembership=YES
JoinDomain=*****
DomainAdmin=*****
DomainAdminDomain=*****
DomainAdminPassword=*****

SkipLocaleSelection=YES
KeyboardLocale=en-US
UserLocale=en-US
UILanguage=en-US

SkipUserData=Yes
SkipBitLocker=YES

XResolution=1366

SkipTimeZone=Yes
TimeZone=020
TimeZoneName=Central Standard Time