SCCM 2012 R2 Upgrade 0x87D00267

Hi everyone, Had some issues after upgrading from SCCM 2012 SP1 to SCCM 2012 R2.  In short, the symptom was our applications were not installing during the task sequence after the upgrade to R2.  We use an “Install Application” action in the task sequence with a dynamic variable list to install apps.

Reviewing the smsts.log file on a machine, we see a Policy Evaluation failed, hr=0x87D00267 message for every application in the list. Moving from the SMSTS.log to the DCMAgent.log, there’s nothing very interesting, so we look next to the CIAgent.log

 So we continue following the logs and look next to the CIAgent.log, then , CIDownloader.log, and finally DataTransferService.log where the event is logged for downloading the policy data from the server.

Here we see ErrorCodes 0x80190194 and 0x80070002 which if you do some internet searches there starts to me a lot more information and suggestions.

The general meaning of these is File or Document not found, so just to double check, I try the path in a web browser.

Normally doing the above in a browser will get you a bunch of encrypted xml data.  Having seen something similar in the past, I double check the “Allow this application to be installed from the Install Application task sequence action without being deployed”

In my case, it was already checked as expected, but to force a recompile of the application policy for task sequences, I made a  small change to any of the fields, such as the comments or description.  This essentially creates a new version of the application in SCCM which also causes the management points to create new policies for all computers that the application is targeted to, and the standalone policy file for task sequences.  After testing the task sequence again, boom, application installed.

The Big Fix

Since all the applications in the environment, roughly 3000, had this issue after the upgrade to SCCM R2, and automated fix had to be found.  I also didn’t want to change the description or comments on all the apps, so through some trial and error, I also found that simply assigning a category to an application also triggers a policy update.  The advantage here is that multiple applications can be selected in the SCCM console, and all assigned a category at one time.  This is probably good enough for most people, and the category can just as easily be removed the same way if desired at a later time.  However, this is still quite slow in the SCCM console if you have a large number of apps selected, and there’s a limit somewhere around 300 that can be done at once before console errors out.

Let’s automate it! 

Below is some VB.NET code to loop through every application instance on the server and add a category if it doesn’t already exist.  This leverages WMI through the Configuration Manager SDK libraries.  Could easily be done in VBscript, Powershell, or anything else that talks to WMI, but this is my current interface of choice.