When KB977203 is installed on the ConfigMgr 2007 site server, besides the site server being patched, the following client related activities also take place:
- A utility called CCMCertFix.exe, along with its documentation, is placed in the directory:
<ConfigMgr_2007_Install_Directory>\Logs\KB977203
- A ConfigMgr 2007 client patch is placed in the directory:
<ConfigMgr_2007_Install_Directory>\Client\i386\hotfix\KB977203
- A package for the KB977203 ConfigMgr 2007 client patch is created in the ConfigMgr 2007 administrator console under "Computer Management" --> "Software Distribution" --> "Packages" for . The package is called:
KB977203 - Advanced Client Hotfix
When the KB977203 ConfigMgr 2007 client patch is installed on a client PC, it allows the ConfigMgr 2007 client to properly generate the self-signed certificates without an embedded NULL character in the friendly name. However, if the certificates have already been generated, installing the KB977203 ConfigMgr 2007 client patch will NOT resolve the issue. The KB977203 ConfigMgr 2007 client patch will only resolve any certificates that may be generated again in the future. It does NOT fix the current ConfigMgr 2007 client certificates on the PC nor does it regenerate them.
To fix the current ConfigMgr 2007 client certificates on the PC, run the CCMCertFix.exe utility from KB977203 on the client PC. Running the CCMCertFix.exe utility on a client PC fixes the currently installed self-signed certificates that were originally auto generated by the ConfigMgr 2007 client.
To resolve the problem during the Task Sequence, the CCMCertFix.exe utility from KB977203 needs to be run on the client PC BEFORE the Task Sequence is started. Running CCMCertFix.exe utility on the client PC will fix the ConfigMgr 2007 client certificates and will allow the certificates to migrate over to the new Windows OS successfully.
To resolve the problem:
- Using normal Software Distribution, deploy the Package and Program KB977203 - Advanced Client Hotfix created by the KB977203 installation on the site server to all client PCs in the environment. This will ensure that if the ConfigMgr 2007 client certificate is ever regenerated, it will be generated correctly without an embedded NULL character in the friendly name. For detailed instructions, please read the file ACReadme.txt which is located in the same directory as the CCMCertfix.exe utility.
- Using normal Software Distribution, create a Package and Program with the CCMCertFix.exe utility from KB977203. Once the package is created, run the Package and Program that runs CCMCertFix.exe on all client PCs in the environment. For detailed instructions, please read the file readme_ccmcertfix.txt which is located in the same directory as the CCMCertfix.exe utility.
- If distribution of the CCMCertFix.exe utility is not possibly using normal Software Distribution, run the CCMCertFix.exe utility BEFORE starting the Task Sequence. It cannot be run as part of the Task Sequence as this will NOT resolve the problem. Running of the CCMCertFix.exe utility before starting the Task Sequence can be performed either manually or by setting the Task Sequence to automatically run another program before it begins. To set the Task Sequence to automatically run another program before it begins:
- Using normal Software Distribution, create a Package and Program with the CCMCertFix.exe utility from KB977203.
- Right click on the Task Sequence and choose "Properties".
- Click on the "Advanced" tab.
- Click on the option "Run another program first:", and then select the Package and Program from Step 1.
This method will automatically run the CCMCertFix.exe utility outside of the Task Sequence and before the Task Sequence begins.
If the Package and Program "KB977203 - Advanced Client Hotfix" created by the KB977203 installation on the site server cannot be run using normal Software Distribution, it is advisable to install the KB977203 ConfigMgr 2007 client patch during the Task Sequence using the method described in the KB977203 article. However, it is not necessary to install the KB977203 ConfigMgr 2007 client patch during the Task Sequence to actually fix the problem described in this article. The main reason for doing so is to prevent issues from occurring in the future.