SCCM Management Point outbox backlog after hardening site server

My SCCM management point has a growing backlog in the outboxes folder. The problem started when I applied a GPO to my SCCM 2007 site server to harden it per my government agency’s security guidelines. I removed the GPO and rebooted the site server, but the outboxes backlog on my MP is still growing. Both servers are running Windows Server 2008 non-R2 x64 and SCCM 2007 R3 with SP2. Our local AD domain is at Windows Server 2008 level.

When I pull up "All Status Messages for a Specific System" for the MP, I see no new real messages after the hardening GPO was applied to the site server and I rebooted it. I see that the d:\sms\logs\outboxmon.log on the MP is reporting that all the outboxes are getting backlogged there. The mpfdm.log on the MP shows this error every 30 secs:

Cannot connect to the inbox source

This is still happening even after I removed the GPO and rebooted the site server and for good measure disabled McAfee HIPS on all SCCM servers. The status message files are supposed to automatically copy files from the MP "d:\SMS\MP\OUTBOXES\statemsg.box\" folder to \\site server \SMS_xxx\inboxes\auth\statesys.box\incoming\". The permissions on the folders and shares look fine, and the MP is in the local admin and SMS_SiteServerToSiteSystemConnection_xxx local groups on the site server. Also, the site server computer account is still in the MP's local admin group.

Other than the backlog, SCCM is partially operational. I can image a machine using OSD, I can access Reports, I can uninstall a critical update from a workstation and then SUP reinstalls it.  From the site server SQL console I see active SQL connections from the MP. If I grant db_owner privileges to the sms_xxx database for the MP computer account there is no difference.

I thought maybe the MP computer account can't get into the share \\site_server\SMS_xxx as part of its status message processing cycle. To confirm that it can, I did a remote desktop to the MP , opened up a command prompt running as the System account by using "psexec -i -s cmd.exe", from there I was able to copy a file to \\site_server\SMS_xxx\inboxes\auth\statesys.box\incoming folder. I can't figure out where the blockage may be. On the MP all automatic services and all SCCM components (subthreads) are running, nothing is stopped as far as I can see.

Can someone tell me how to further troubleshoot this outbox backlog?
DscpTechAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

DscpTechAuthor Commented:
The senior tech lead on our team came up with the resolution. The MP must access the site server HKLM\software\wow6432node\microsoft\sms to gather all the site settings of many things. This includes the "inbox source" which holds all the locations for the status files, instruction files, etc which is how site systems all communicate back to the site server. When you install SCCM this registry path gets added automatically. Our GPO removed it, and it did not get re-added back when we unlinked the GPO. We manually added it. So we will add the registry key to the GPO and try hardening the site server again.
0
EE_AutoDeleterCommented:
Because you have presented a solution to your own problem which may be helpful to future searches, this question is now PAQed and your points have been refunded.

EE_AutoDeleter
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Microsoft Server Apps

From novice to tech pro — start learning today.