AdminService no longer support NTLM Authentication

[jdm5000]

Invoke-CMApplyDriverPackage.ps1 fails to run during the WinPE stage because the AdminService now rejects NTLM Authentication. How can we get around this?

[bakegreg]

I saw this issue too with our OS deployment task sequences in SCCM after the upgrade to SCCM 2509. I was able to fix it by changing the format of credentials in the MDMUserName task sequence variable. I now have to specify the fqdn like this:

domain.com\username

Up until the SCCM 2509 upgrade it worked with just the username in the variable, so something changed.

[systxix]

https://msendpointmgr.com/modern-driver-management/#minimum-required-task-sequence-variables

I had the same problem when I upgraded to 2509. It started working again when I deleted the variables from the task sequence and added them back. I used the same username format svc-cm-as@domain.com as in the instructions. At least that's how it worked before 2509 and it still works now.

[MrMrRubic]

How did you discover it was NTLM? I am troubleshooting our MDM after noticing it failing during task sequence with the following error in smsts.log:

Executing command line: Run PowerShell Script with options (0, 4)								
C:\_SMSTaskSequence\Packages\SMS00203\Invoke-CMApplyDriverPackage.ps1 : 						
InnerTerminatingFailure																			
At line:1 char:1																				
+ & 'C:\_SMSTaskSequence\Packages\SMS00203\Invoke-CMApplyDriverPackage. ...						
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~							
    + CategoryInfo          : NotImplemented: (:String) [Invoke-CMApplyDriverPackage.ps1], Ru 	
   ntimeException																				
    + FullyQualifiedErrorId : Invoke-CMApplyDriverPackage.ps1									
																								
Process completed with exit code 1																
PowerShell command line returned code 1															
ReleaseSource() for C:\_SMSTaskSequence\Packages\SMS00203.										
reference count 1 for the source C:\_SMSTaskSequence\Packages\SMS00203 before releasing			
Released the resolved source C:\_SMSTaskSequence\Packages\SMS00203								
Process completed with exit code 1																
!--------------------------------------------------------------------------------------------!	
Failed to run the action: Dynamically Apply Drivers. Error 1									

ApplyDriverPackage.log shows the following:

 - Failed to retrieve available package items from AdminService endpoint. Error message: The underlying connection was closed: An unexpected error occurred on a send.
 - An error occurred while calling AdminService for a list of available driver packages. Error message: InnerTerminatingFailure

Would these be an indication of NTLM failing, or is it something else? We are currently running 2503 so that's one thing different you your environments.
Invoke-CMApplyDriverPackage.ps1 v4.2.6, but got the same on v4.2.5.

Edit:
I tried the fix above using domain.com\username for the MDMUserName Variable, but it didn't help.

[jdm5000]

In the adminservice.log file, I found: Rejecting NTLM authentication Every time the task sequence step to discover the right driver package to download ran.

[bakegreg]

I was seeing a similar error in ApplyDriverPackage.log as MrMrRubic's, with the only difference being the error message was "(401) Unauthorized" rather than the connection being closed. I also saw the same "Rejecting NTLM authentication" message in adminservice.log as jdm5000. This started with the 2509 upgrade, and re-entering the credentials as I described fixed it. It seems like MrMrRubic's problem is similar but not exactly the same.

[MrMrRubic]

Gonna make a new issue then, thanks for verifying :)

[JPC-IT]

I can confirm the same issue since 2509 and I can confirm the same resolution as @bakegreg . Updating the username variable to include the domain.com \ . Prior to this, just the username without the domain.com\ prefix was working.

[curtv2]

We upgraded to 2509 yesterday and found this issue, we have tried domain.com\username, domain\username and username@domain. Deleting the details in the task sequence and adding it back, deleting the whole step and recreating, changing the password in AD and nothing works. We are just presented with "The remote server returned an error: (401) Unauthorized."

Have we missed anything? Any suggestions would be gratefully received.

[jdm5000]

What administrative role does the account you're using have? I may be going overboard, but the service account I'm using is a Full Administrator. I'm using the UPN as the username.

[curtv2]

I did try that as I did wondered if it could be a permission issue but the same fault occurred. Thank you though.

[ctowens]

Has this issue been resolved? Wondering that if we are on SCCM 2509, I believe NTLM support has been removed for AdminService and so I believe we are gonna face the same issues, even if we have the FQDN on the MDMVariables

[curtv2]

Not for me it hasn't no. I've tried so many things and I just can't get it to work. This could of course be down to the fact we have two domains, the sccm server being on one and the devices being on another. We have verified that kerberos is working but still no joy.

[curtv2]

I have an update on this, my amazing colleague had a hunch that it might be that our password was too complex. We had a long password full of special characters, but most crucially it contained two & symbols. We removed all the symbols for a belts and braces approach and low and behold it started to work! We are using the username format of our.company.co.uk\sccm_driver_admin and our new much more simple password and we're all good.

Hopefully this will help someone.

[Alledger]

This also worked for me using same username format our.company.co.uk\sccm_driver_admin