IUSR account and SCCM 2007 R3 agent

I recently started working with SCCM and rolling the agent out with machine having IIS 7.x installed.  I ran into issues where the SCCM agent wouldn’t install.  The errors mostly were 0x80004005 and 1603, another key one I found was Return Value 3 in the SCCM setup log.  During the troubleshooting, I found a cool utility called WMI Diag  WMI diag is a VBS script that reads the local WMI store and helps diagnose issue.  Anyone working with SMS or SCCM should keep this handy tool around.  The good thing my particular case WMI was healthy. 


The issue turned out I changed the Anonymous Authentication module from using the IUSR account to inherit Application Pool identity.  Once we temporarily switched back to IUSR, installed the agent, then switched the setting back to inherit application pool identity, the SCCM agent installed with no issues. I’m not sure why switching back to the IUSR account solved my issue, if I find out I’ll update the post. 


More information on IIS 7 builtin accounts


http://learn.iis.net/page.aspx/140/understanding-built-in-user-and-group-accounts-in-iis-7


Specify an application pool identity 


http://technet.microsoft.com/en-us/library/cc771170(WS.10).aspx


SCCM resources (Config Mgr Setup  / Deployment forums)


http://social.technet.microsoft.com/Forums/en-US/configmgrsetup/threads


http://www.myitforum.com (the best independent SCCM community resource)


Hope this helps.


Steve Schofield
Microsoft MVP – IIS

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s