Troubleshooting Imaging Errors: Identifying the Unknown Computer GUID in Configuration Manager

Updated: 27 Mar, 2025 • 0 • min read

Table of Contents

A critical issue can arise in Configuration Manager environments where a client computer undergoing imaging inadvertently acquires the Configuration Manager Unique Identifier (GUID) of an Unknown Computer object. This occurrence disrupts the imaging process and can lead to various operational challenges. This document provides comprehensive guidance to diagnose and resolve this specific problem, ensuring the smooth and efficient deployment of operating systems using Configuration Manager. Understanding the root cause and implementing the recommended solutions are crucial for maintaining a healthy and functional Configuration Manager infrastructure.

Symptoms¶

The introduction of the Previous button in Configuration Manager current branch version 1702, designed to allow retrying failed task sequences within the Task Sequence Wizard in Windows Preinstallation Environment (Windows PE), inadvertently paved the way for a peculiar problem. When utilizing this feature, particularly by selecting the Previous button during a task sequence failure, the client PC being imaged could potentially seize the Configuration Manager Unique Identifier (GUID) belonging to an Unknown Computer object. This object is typically either the x64 Unknown Computer or the x86 Unknown Computer, depending on the system architecture.

Troubleshooting Imaging Errors

This issue, while initially identified and addressed in update rollups for version 1702 and subsequent Configuration Manager current branch releases, can still manifest even after applying the fixes. One common symptom is the failure of unknown computers, booted from media or Preboot Execution Environment (PXE), to locate task sequences specifically targeted for them. In such scenarios, the SMSTS.log file will often record an error message clearly indicating the problem:

There are no task sequences available to this computer. Please ensure you have at least one task sequence advertised to this computer.
Unspecified error (Error: 80004005; Source: Windows)

This error message typically appears if the Previous button on the “Select a task sequence to run” page is engaged on the unknown computer during the imaging process. Even after applying the recommended update rollups or upgrading to newer Configuration Manager versions, the issue might persist, indicating that the initial fix only prevents future occurrences but does not resolve existing instances of GUID theft.

Cause¶

The persistence of this issue, even after applying the corrective updates, stems from the nature of the fix itself. The updates released for Configuration Manager current branch version 1702 and later versions are designed to proactively prevent the GUID theft issue from happening going forward. However, they do not retroactively repair environments where the problem has already occurred. If a client computer has already successfully stolen the GUID of an Unknown Computer object, the update alone will not revert this change.

Therefore, even after applying the update rollup for version 1702 or upgrading to a more recent version, the issue can continue to surface if the environment is not properly remediated. The fix is preventative, not curative for already affected systems. To fully resolve the problem and prevent its recurrence, a series of specific steps must be taken. These steps are essential to ensure that the Configuration Manager environment is cleaned and correctly configured to prevent future GUID conflicts and imaging failures. These critical steps involve updating boot images, recreating media, and thoroughly cleaning the client PC that has acquired the incorrect GUID.

Resolution¶

To effectively resolve the issue of GUID theft and prevent its resurgence within your Configuration Manager environment, a structured approach is required. This involves several key steps, focusing on updating boot images, media, and properly cleaning the affected client computer. Follow these steps meticulously to ensure a complete and lasting resolution:

Update all boot images: This is a crucial first step. Within the Configuration Manager console, locate your boot images. Typically found in the Software Library under Operating Systems, Boot Images. Right-click on each boot image (both x86 and x64) and select Update Distribution Points. This action injects the updated Configuration Manager binaries, which contain the fix for the GUID theft issue, directly into the boot images. This ensures that any new deployments using these boot images will benefit from the fix. Refer to the Microsoft documentation for detailed instructions on how to Update distribution points with the boot image.
Recreate all media: If your environment utilizes bootable media (USB drives, DVDs, ISO files) for operating system deployment, it is imperative to recreate all media after updating the boot images. This guarantees that the media you are using contains the updated boot images with the necessary fix. Using older media with outdated boot images will not prevent the issue. To further safeguard against accidental use of old media, consider blocking the certificates associated with the old boot images within the Configuration Manager console. This can be done under Administration > Security > Certificates. Locate the certificates related to media creation (identified by their Start Date, which reflects the media creation date) and block those created before you updated the boot images in step 1. For comprehensive guidance on media creation, consult the documentation on how to Create task sequence media.
Clean the client computer that stole the GUID: This is a critical step to rectify the immediate problem. The client computer that has acquired the incorrect GUID needs to be thoroughly cleaned of the Configuration Manager client components. This process is more involved than a simple client uninstall and requires careful execution of the following sub-steps:
1. Identify the offending computer: Begin by identifying the client computer that has stolen the GUID. Examine the properties of the Unknown Computer object, typically named x64 Unknown Computer or x86 Unknown Computer. Note the Configuration Manager Unique Identifier value. Then, within the Configuration Manager console, perform a query to locate the computer object that possesses this same GUID. This identification process can be entirely conducted within the console without requiring direct SQL database access.
2. Remotely connect and initiate client cleanup: Once the offending computer is identified, establish a remote connection to it. The cleanup process needs to be performed directly on this machine.
3. Uninstall the Configuration Manager client: On the client computer, open an elevated command prompt (run as administrator). Navigate to the C:\Windows\CCMSetup directory and execute the command CCMSetup.exe /uninstall. This initiates the client uninstallation process.
4. Monitor uninstallation: Open Task Manager and monitor the processes to ensure that CCMSetup.exe runs to completion. Additionally, review the ccmsetup.log file located in the C:\Windows\CCMSetup\Logs\ directory to confirm a successful client uninstallation.
5. Delete directories: After successful uninstallation, delete the following directories from the client computer. You might need to restart the computer to fully delete these directories if files are in use.
  - C:\Windows\CCM
  - C:\Windows\CCMSetup
6. Delete registry keys: Remove the following registry keys from the client computer. Use Registry Editor (regedit.exe) to navigate to these keys and delete them if they exist:
  - HKEY_LOCAL_MACHINE\Software\Microsoft\CCM
  - HKEY_LOCAL_MACHINE\Software\Microsoft\CCMSetup
  - HKEY_LOCAL_MACHINE\Software\Microsoft\SMS
7. Delete SMSCFG.ini: Delete the C:\Windows\SMSCFG.ini file from the client computer.
8. Delete SMS certificates: Remove all certificates located under the SMS > Certificates node in the Certificates console for the Computer account. Follow these steps:
  1. Run MMC.exe from an elevated command prompt to open the Microsoft Management Console.
  2. Go to File > Add/Remove Snap-in.
  3. Select Certificates from the list and click Add.
  4. Choose Computer account and click Next.
  5. Select Local computer and click Finish.
  6. Click OK to close the Add/Remove Snap-in window.
  7. Navigate to Certificates (Local Computer) > SMS > Certificates.
  8. In the right pane, right-click on each certificate listed under SMS > Certificates and select Delete. Repeat this for all certificates in this location.
  9. Close the Certificates console.
9. Delete computer record from Configuration Manager: Remove the record of the offending computer from the Configuration Manager console. This should be done after completing steps 1-8 to prevent the record from being immediately recreated if client reports are processed before the cleanup is complete. Locate the identified computer object in the Configuration Manager console and delete it. Again, this action is performed within the console and does not require direct SQL database manipulation.
10. Reinstall Configuration Manager client: Finally, reinstall the Configuration Manager client on the cleaned computer. This can be done using your standard client installation methods, such as client push installation or manual installation.

Remove duplicate Unknown Computer objects¶

In scenarios where attempts to resolve the GUID theft issue have inadvertently resulted in the recreation of duplicate Unknown Computer objects within the Configuration Manager site, these extra objects must be removed. This clean-up process is essential to maintain the integrity of the Configuration Manager database and prevent potential conflicts. The removal of duplicate Unknown Computer objects requires direct interaction with the SQL Server database and cannot be performed solely through the Configuration Manager console.

To remove these duplicate objects, follow these detailed steps:

Backup Configuration Manager Site: Before making any modifications to the SQL Server database, ensure you have a current and valid backup of your Configuration Manager site. Utilize the built-in Backup maintenance task within Configuration Manager to create a reliable backup. This is a critical safety measure in case of any unforeseen issues during the database modification process.
Open Configuration Manager Console (Central Administration Site recommended): Launch the Configuration Manager console. If your environment includes multiple primary sites, it is strongly recommended to connect to a Configuration Manager console that is connected to the central administration site. This provides a consolidated view of your environment.
Navigate to Device Collections: Within the Configuration Manager console, navigate to Assets and Compliance > Overview > Device Collections.
Open All Unknown Computers Collection: Double-click the All Unknown Computers collection to view its members.
Sort by Site Code: In the results pane displaying the members of the All Unknown Computers collection, sort the objects by the Site Code column. This will group Unknown Computer objects by their respective sites.
Identify Duplicate Objects: Carefully examine the sorted list to identify if there are multiple x64 Unknown Computer objects or x86 Unknown Computer objects listed for any individual site. Ideally, there should be only one of each type (x64 and x86) per site.
Add Resource ID Column (if duplicates exist): If you find duplicate Unknown Computer objects for any site, right-click on the column headers in the results pane and add Resource ID to the list of displayed columns. The Resource ID is a unique numerical identifier for each object in the Configuration Manager database.
Determine Resource IDs: Note down the Resource ID value for each x64 Unknown Computer object and each x86 Unknown Computer object for any site that has duplicates. Record the Resource IDs for all Unknown Computer objects for the site, even if only one appears to be duplicated.
Prepare for SQL Database Modification: With the Resource IDs of the Unknown Computer objects identified, you are now ready to proceed with modifying the SQL Server database to remove the duplicates.
Open SQL Server Management Studio: Launch SQL Server Management Studio and connect to the SQL Server instance that hosts the database for the Configuration Manager site containing the duplicate Unknown Computer objects.
Select Configuration Manager Database: In SQL Server Management Studio, expand the Databases node and select your Configuration Manager database. The database name usually follows the pattern CM_Site_Code.
Open New Query Window: On the toolbar in SQL Server Management Studio, click New Query to open a new query window.
Verify Database Context: Ensure that the correct Configuration Manager database is selected in the database dropdown menu located to the left of the Execute button on the toolbar.
Query Collection Membership (Optional but Recommended): In the query pane, execute the following SQL query. This query will identify all collections that the Unknown Computer objects are currently members of. This information is useful for re-adding the newly created Unknown Computer objects to the correct collections later.
```
SELECT C.CollectionID, C.SiteID, C.CollectionName, CM.MachineID, CM.Name
FROM Collections C
JOIN CollectionMembers CM ON C.SiteID = CM.SiteID
JOIN UnknownSystem_DISC USD ON USD.ItemKey = CM.MachineID
```
Examine the results of this query and note the collection memberships for the Unknown Computer objects. The Resource ID is listed in the MachineID column.
Query UnknownSystem_DISC Table: Execute the following SQL query to retrieve the specific records from the UnknownSystem_DISC table that correspond to the duplicate Unknown Computer objects. Replace 'Resource_ID_1','Resource_ID_2', 'Resource_ID_3' with the actual Resource IDs you noted down in step 8, enclosed in single quotes and separated by commas.
```
SELECT * FROM UnknownSystem_DISC WHERE ItemKey IN ('Resource_ID_1','Resource_ID_2', 'Resource_ID_3')
```
For example, if the Resource IDs are 2046820354 and 2046820355, the query would be:
```
SELECT * FROM UnknownSystem_DISC WHERE ItemKey IN ('2046820354','2046820355')
```
Verify Query Results: Carefully review the records returned by the query in step 15. Confirm that these records are indeed the duplicate Unknown Computer objects you intend to delete. Double-check the Resource IDs and other identifying information to prevent accidental deletion of incorrect records.
Delete Records from UnknownSystem_DISC Table: If you have verified that the query results are correct, execute the following SQL query to delete the records from the UnknownSystem_DISC table. Again, replace 'Resource_ID_1','Resource_ID_2', 'Resource_ID_3' with the Resource IDs of the Unknown Computer objects you want to remove.
```
DELETE FROM UnknownSystem_DISC WHERE ItemKey IN ('Resource_ID_1','Resource_ID_2', 'Resource_ID_3')
```
For example, using the same Resource IDs as before:
```
DELETE FROM UnknownSystem_DISC WHERE ItemKey IN ('2046820354', '2046820355')
```
Important Note: Remember to delete all Unknown Computer objects (both x64 and x86) for the affected site, even if only one type appeared to be duplicated. This ensures a clean and consistent state.
Recreate Unknown Computer Objects: Follow the steps outlined in the section “Recreate Unknown Computer objects in case of accidental deletion” to create a brand new set of Unknown Computer objects for the affected site.
Return to Configuration Manager Console: Go back to the Configuration Manager console and navigate to Assets and Compliance > Overview > Device Collections.
Update All Unknown Computers Collection Membership: Right-click the All Unknown Computers collection and select Update Membership. This will refresh the collection membership and reflect the changes made in the database.
Refresh and Verify: Wait for a few minutes to allow the collection membership update to complete. Then, click Refresh in the Configuration Manager console. Verify that only one x64 Unknown Computer object and one x86 Unknown Computer object now exist for each site. If the objects are not immediately visible, wait a few more minutes and try refreshing again.
Re-add to Collections (if applicable): Once the new Unknown Computer objects appear, re-add them to any collections they were previously members of, as determined in step 14.
Repeat for Additional Primary Sites (if needed): If you have duplicate Unknown Computer objects in other primary sites, repeat steps 10-22 for each of those sites as necessary.

Recreate Unknown Computer objects in case of accidental deletion¶

In the event that all Unknown Computer objects for a site are accidentally deleted, they can be recreated by following these steps. These steps should only be used if no Unknown Computer objects exist for a site. If only one of the two objects (x86 or x64) remains, first delete the remaining object using the steps in the “Remove duplicate Unknown Computer objects” section, and then proceed with these recreation steps:

Sign in to Primary Site Server: Log in to the primary site server from which the Unknown Computer objects are missing.
Modify Registry Key: Open an elevated command prompt (run as administrator) on the primary site server and execute the following command. This command modifies a registry value that triggers the recreation of Unknown Computer objects.
```
REG.exe ADD "HKLM\SOFTWARE\Microsoft\SMS\COMPONENTS\SMS_DISCOVERY_DATA_MANAGER" /v CreatedUnknownDDR /t REG_DWORD /d 0 /f
```

After this registry key value is updated, the Unknown Computer objects should be automatically recreated shortly. You can monitor the progress of this recreation process by examining the DDM.log file located on the primary site server (typically in C:\Program Files\Microsoft Configuration Manager\Logs).

To expedite the recreation process, you can restart the SMS_DISCOVERY_DATA_MANAGER thread using the following steps:

Open Configuration Manager Console (Primary Site): Launch the Configuration Manager console and connect to the primary site from which the Unknown Computer objects are missing. Navigate to Monitoring > Overview > System Status > Component Status.
Open Configuration Manager Service Manager: On the toolbar, click Start > Configuration Manager Service Manager.
Select Components: In Configuration Manager Service Manager, expand the node representing your site code and then select Components.
Query SMS_DISCOVERY_DATA_MANAGER: In the results pane, right-click SMS_DISCOVERY_DATA_MANAGER and select Query. The thread status should display as Running.
Stop SMS_DISCOVERY_DATA_MANAGER: Right-click SMS_DISCOVERY_DATA_MANAGER again and select Stop.
Verify Stop Status: Right-click SMS_DISCOVERY_DATA_MANAGER and select Query again. The thread status should now display as Stopped.
Start SMS_DISCOVERY_DATA_MANAGER: Right-click SMS_DISCOVERY_DATA_MANAGER and select Start.
Verify Start Status: Right-click SMS_DISCOVERY_DATA_MANAGER and select Query one last time. The thread status should now be Running again.
Close Service Manager: Close the Configuration Manager Service Manager window.

The Unknown Computer objects should now be recreated automatically. Continue to monitor the DDM.log file on the primary site server to track the progress of this process.

If you have any questions or require further assistance with troubleshooting imaging errors and Unknown Computer objects in Configuration Manager, please feel free to leave a comment below!

Computacionvinchi