Debugging 80070002 and 80190191 errors during ConfigMgr (SCCM) OSD

Last week I was debugging a task sequence that failed with errors 80070002 and 80190191 when it was trying to download the first package used by the task sequence. The first package the task sequence tried do download was the MDT 2013 package, use by the "Use Toolkit Package" action in the task sequence. There are typically three reasons for these errors to happen:

• Network Access Account not configured properly
• Crappy (or just slow) Network
• Missing IIS components on the DP
• Incorrect authentication settings in IIS for the DP

Network Access Account not configured properly

Most times the 80070002 and 80190191 errors happens because the network access account is not configured correctly. When it's not you see the following in the log:

First a few 401 errors, which are IIS (web) errors meaning authentication errors.

Second, a line where you clearly see the text: "Network access account credentials not supplied"

Obvious fix when this happens: Configure the network access account, use the "Test Connection" feature to verify you typed the password correct. Verify that you can do a net use to a share with that account, and in rare cases after upgrading to R2, remove the network access account from software distribution, delete the account from Security / Accounts, and then add it back again.

Task Sequence failing because of network access account not configured in software distribution settings.

Slow network causing issues

When the network is slow, like when having poor bandwidth and/or high latency issues, that can cause 80070002 errors as well.

Fixing this issue: Simply give the task sequence more time to find packages by adding these two task sequence variables in the beginning of the task sequence:

• SMSTSDownloadRetryCount = 5
• SMSTSDownloadRetryDelay = 15

Adding task sequence variables to allow for more time getting packages.

 

Missing IIS components on the DP

The final, and fortunately quite rare reason for 80070002 and 80190191 errors are that you are missing the "Windows Authentication" component on the DP.

If that's the case you get the following in the smsts.log:

401 – Unsuccessful with anonymous access. Retrying with context credentials.   
401 – Unsuccessful with context credentials. Retrying with supplied credentials.   
401 – Unsuccessful with supplied credentials.   
401 – Unsuccessful on all retries.
SendResourceRequest() failed. 80190191   
Download() failed. 80190191.   
DownloadContentAndVerifyHash() failed. 80070002.   

if you open the IIS logs on the Management Point you see the following "401" errors:

192.168.1.214 PROPFIND /SMS_DP_SMSPKG$/P010000D – 80 – 192.168.1.100 SMS+CCM+5.0+TS – 401 2 5 1433 2
192.168.1.214 PROPFIND /SMS_DP_SMSPKG$/P010000D – 80 – 192.168.1.100 SMS+CCM+5.0+TS – 401 2 5 1452 0
192.168.1.214 PROPFIND /SMS_DP_SMSPKG$/P010000D – 80 – 192.168.1.100 SMS+CCM+5.0+TS – 401 2 5 1433 0

Obvious fix: Add the missing Windows Authentication" component on the site server.

Windows Authentication IIS feature added.

IIS logs showing the error.

Incorrect authentication settings in IIS for the DP

Having Anonymous Authentication disabled on the default website can also generate these errors. Thanks to Jason Orth for sharing that tip with me.