Not a issue with the actual upgrade process itself, but caused by upgrading the site, and hence the roles, to release 1511. After upgrading I noticed that the Endpoint Protection Control Manager reporting as critical.
In Component Status the following errors were reported:
‘Site Component Manager failed to install component SMS_ENDPOINT_PROTECTION_CONTROL_MANAGER on server <siteserver> SCEPInstall.exe returns error 0x80070006.’
‘Site Component Manager failed to reinstall this component on this site system. Solution: Review the previous status messages to determine the exact reason for the failure. Site Component Manager will automatically retry the reinstallation in 60 minutes. To force Site Component Manager to immediately retry the reinstallation, stop and restart Site Component Manager using the Configuration Manager Service Manager.’
Checking the EPSetup.log file I noticed that SCEP was failing to be detected:
‘File D:\Microsoft Configuration Manager\Client\SCEPInstall.exe version is 22.214.171.124.
Failed to detect whether SCEP client is installed with error = 0x80070006
SMSEP could not be installed. The return code was -2147024890′
ConfigMgr needs to be able to access the registry key ‘HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Security Client’ to be able to perform this check.
I checked the permissions to that registry key and no access was granted to the ConfigMgr site server. So fix the problem I added in local administrators to have full access to the key. Why didn’t the ConfigMgr site server have access? Quite simple a GPO had been set to allow access to a particular AD group.
After adding I removed the Endpoint Role from the site server. Allowed it to uninstall and then added back in.
‘ ======== Completed Installation of Pre Reqs for Role SMSEP ========
Installing the SMSEP
Passed OS version check.
File D:\Microsoft Configuration Manager\Client\SCEPInstall.exe version is 126.96.36.199.
EP version 188.8.131.52 is already installed.
EP 184.108.40.206 is installed, version is lower than expected installer version 220.127.116.11.
Invoking process “D:\Microsoft Configuration Manager\Client\SCEPInstall.exe” /s /q /noreplace /policy “D:\Microsoft Configuration Manager\Client\EP_DefaultPolicy.xml”
CreateProcess: D:\Microsoft Configuration Manager, “D:\Microsoft Configuration Manager\Client\SCEPInstall.exe” /s /q /noreplace /policy “D:\Microsoft Configuration Manager\Client\EP_DefaultPolicy.xml”
Installation was successful.