HTMD-CM 0️⃣7️⃣🎇SCCM Client Push Installation Method Explained🎇DNS🎇Admin$🎇CCMSetup.log🎇Client.Msi.log

thank you all for joining in today today is our weekend episode SEM episode number seven right and this is season two of our weekend learning this is provided by how to manage devices community and we will come to I will I will explain you about the community in a bit right before that let me let me go through the weekend sessions for for this particular weekend right so III need to change this right so I think this is episode number total if you look at the total episode including SC a mine in tune this is episode number 9 right but if you exclude in tune from a cesium then this is 7 7 this is the seventh episode for SS iam came and tomorrow we will have some interesting sessions so tomorrow joy will be presenting about in tune right getting to know in tune at a deeper level right so will because he will be going through the troubleshooting steps about the in tune some some deep level troubleshooting etc etc right how in tune works in the background from a service I Tech cetera et cetera he will go through right so that would be an interesting session that would be whenever session and after that we will see what does wbd right I don't know how many of you know w VD w VD is basically Windows virtual desktop right this is a Microsoft offering from Azure so this is a cloud it should be probably Microsoft as your VDI solution if you know why does VDI right this is wvd is Microsoft as your VDI solution okay so so we will see that tomorrow right today we are going to see the assessee impart how how do we do the client management right in stir last week we have seen how to configure the discovery how to configure the boundaries and boundary groups and all right now we will see client management probably will install client on Windows 10 mission and one of the servers and probably will find out what is it exactly right how what is experience how to troubleshoot and what are the options to install client etc etcetera right okay so lets me let me go into the other slides right so this is the how to manage device community so we have around 18 core members in this community and we post our and we post over here in this particular web blog right if you want to know about them in detail you can go over here into this particular blog URL right you will come to know what what does their expertise write for members expertise and what they are doing etcetera etcetera right and if you want to connect with us through Facebook or Instagram you can go over here right you you can go over here and connect with us and we have several wot subgroups and telegram groups feel free to join those okay if that is relevant for you okay so other other thing I wanted to highlight is about the forum HTM D forum they write so this is a device management forum exclusively for device management we created this forum and we published this forum I think two months back okay and we have we have a great response from all of you thank you all for the support as as always right if you have any questions related to configuration manager SS iam in tune please login to this particular forum how htm' read forum calm and try to ask questions right you can ask questions from here right so so this is exclusively for device management admins right so probably I also ask questions in this forum because I am NOT super here or something right I I have my own questions right I have my own troubleshooting issues then I normally ask questions here as well right so probably many many others from the community can help with answer answering the questions also right sharing their troubleshooting experience etc etcetera right okay so so that is about the stmd forum so these are the top contributors of the last two last week I didn't get time to update this for this week probably I will update before tomorrow's training session or meeting right so these are the contributors as you can see there is a point system over here and there is a there are I don't know whatever is that called bad just right yeah badges are available over here expert professional admins exit like cetera right and big nerd right and it would be interesting to have this and we will publish this list every week within all our channels right puter Facebook LinkedIn right and all our face watts of iron telegram groups right so I it would be it would be kind of like highlighting your profile I would say right so if you are part of this probably people will come to know you are contributing to the community and do you are expert in this area and you know you you are you you are a somewhat or authority right so so probably that will help you for expert if over here right probably that will help you for your neck interview right so so that that is one of the point I wanted to highlight okay so that's about the SDM D forum okay so apart from that this is the stats of last two last week that's it so you give you and of this initiative right new confit beast we started with and setting up a lab in Azul right I don't know how many of you were part of the initial weeks of this training right so we took a trial version of Azul subscription and we started building servers right and we built resource groups virtual networks and subnets in Azure and way then we built if you are not speaking can you please go on mute okay thank you domain servers SSE amongst equal servers and then now I built a Windows 10 client also right and we are connecting this server infrastructure through something called as your Bastion right so this is a high level very high level architecture of the connectivity and the infrastructure right we we connect from here to Azure portal and Azure portal will connect to as your bastion and then through as your burst and we are connecting to a cesium server domain controller and probably a client server right so this is the overall architecture high level architecture of SCM lab setup we did right so as I mentioned last week we have already created kind of did the risk of discovery part and this week we are going to install some climbs a CCM clients and see how how it is how it goes right let me share my screen so that I can show the lab and connectivity etc okay here you go hope you're all can sorry you can see the screen okay so so this is the SEM lab and we have sequel also sequel ugh also in the same box okay so we have installed to 2002 baseline version in this lab and last week just give you a quick overview right what we did last week we we have enabled system discovery we have been able to use a discovery right and these are the two discoveries we have enabled right last week and we have seen how to configure that and how to troubleshoot it how to look into the log files which are the log files etc right and we have created a boundary a last week for this particular lab and we have created a boundary proof also right so that is this is a boundary group and we have configured the boundary group with the boundary and we talked about the entire concept of boundaries and boundary groups right so this is another thing which we are going to which we explained last week right we created boundaries and we we assume that we will have boundary groups for each office and we those those clients will be connecting to a particular boundary group and those clients will be the boundary group will have a configuration to contact a particular DP MPA exit line that particular office right local office okay so that was a quick overview of last week's topics right okay now today but what I'm trying to show you is basically how to install clients now let's go to assets and complaints as you can see the new last week we have seen stmd domain came into this okay and today if you can see today we have a new device right new device over here that is STM pre Windows 10 so if you look at the time somewhere here if I can see right I don't know whether I would be able to see of the discovery if I go to properties so the agent time 27 right 27 is today over here you can see 27 and this this is this record got created like around 30 minutes before right so I will observe new new Windows 10 client device in this lab and if automatically got discovered now right now now we can you can see over here right there is no client right unless and until via we don't have client we don't we won't be able to manage those devices using a cesium right so you cannot deploy any application now to this device because there is no client and the policies won't get won't get into the client device unless and until we have a client component in the device right so if you can go back go over here and check the client device somewhere this is the client device right so this is the Windows 10 client device which I built right so this is the Windows 10 latest version 2004 and if I go to services right services dot MSE there won't be any line over here or services over there and if I go to control let me go to control control panel and search configuration there is nothing over here also right so there is no configuration manager applet and there is no service let let me check the service also right so there's no service there is no a cesium service there is no client component right so client SCM client or Configuration Manager client is not part of Windows 10 operating system you need to install a separate client then only you would be able to manage right so until now we were seeing the server side of the configurations right now we need to install a client on this device then only we would be able to manage the devices from through SEM okay so that is a basic funder of HCM okay so this is server client architecture right so server if server needs to talk to client then client should have the client components though that is what we are going to install today okay so I wanted to show you something before I go back to the server okay I forgot what was that okay anyways let me go back to the console and now let's see what are the options to install client okay so let's let's go over here and let's go back into the Microsoft documentation right so there are many options to install client let let me go to a simplest view of it first right so if I go over here we have a blog post in our over blog how to manage devices calm write install SCCM client manually over there so these I have kind of noted down all the possible client installation options right first option is client push ok sses there's something called client push which we can do once the devices are discovered right you know now what does discovery right we did that discovery and that is discovery from administration and this is the discovery methods right we did that discovery system discovery from Active Directory and now associations aware that we have these much these many clients in our organization right in this particular lab in this particular example right so assume knows like these other devices available in this lab environment right now we have discovered these devices through active directory discovery method now once we have discovered these devices now you can use something called client push to install and the clients on the device from a cesium console itself right so this is my favorite method but in a real-world scenario right you might get lot of issues with client push or if you want to enable client push you need to open lot of firewall ports and your security he might not be happy with it right okay so we will see what what are those right and you will see how to how to tackle latex attractions right okay the second option is software update point based installation we can install a cesium clym's sue through something called software update point right so that is another way of installing is cesium climb so this is basically a group policy kind of stuff right and the other one is pure group policy okay so through group policy if the devices are domain join then you can use a group policy create a group policy and that will help you to install the client so this is the easiest way a group policy for the domain join devices okay but there are some caveats like as you know she's tattooing etc right there would be some tattoos and it would be you would be having some problem to remove the those registry entries from the client device when you have some troubleshooting some issues or if you want to reassign the side SEC cetera excetera right yeah okay other - you can use Microsoft Intune to install clients are the winners like if you want to install it through package and package and program you can do that for example if you want to kind of upgrade the clients right mm if you are using 2007 SCCM 2007 and you want to upgrade it to a cesium current branch or 2012 to current branch you can use this method right okay so there are caveats also over there is the task sequence is another method right so if you are using OSD task sequence during those DITA sequence you can install the client so probably you must be aware of this already right I think one of my favorite method in a real world is this one right logon script right so you can have a logon script and you can install the client and Jason Sandy's I think is his Microsoft program manager senior program manager now earlier he was Microsoft MVP he got a great logon script to install climbs right so I would recommend to use that in a real world kind of a scenario him but and I might as I mentioned my favorite is always like client push right because I I have seen I have seen issues with with logon script it's not technical issues right it is political issues right yeah if you are working for a large organization if you have a different ad team right who is managing Active Directory and you don't have access to Active Directory to create policies etc then you you will kind of struggle to make them understand right what we need to do to make this working Excel all right so that is a lot of efforts right either way it's a lot of efforts to be honest right Cline push with security team and opening firewall polls eccentric cetera if you are small organization then probably you can use this right okay I'm inclined push my group Cline so my group clients you need to install it manually there is no other way i internet baselines so that is also kind of a manual way or some other method you need to follow right and the manual installation over here right so these are the high-level options to install clients probably I have made something if please try to command in the chat window right so okay so that is the client installation methods available now let's see what which are so this is great documentation from Microsoft right it says what are the advantages of client each installation client installation methods right Cline push so supported for only for Windows clients not for Linux not for a Mac right this is not supported for Mac OS and upon any other ways apart from Windows right this is only for Windows okay so advantages so these are the advantages right automatically install client on all discovered devices right this can be done pretty easily if the ports are open with with one click oh not literally not one cake okay several clicks right but this one these are to end ages if you use a large large collection to have a client push then probably there would be lot of traffic network traffic right if you are concerned about that then you need to kind of caution about it right and the other one is the devices should be discovered right then only you can use the client push for example if a device is not there in this associate console right kind of configuration manager console then you won't be able to use client push so climb push right this is the client bush install client brush right click and install client push so simple right it is straight straightforward stuff that is why this is my favorite one right but it has its own caveat III as I mentioned over here and it's there in the Microsoft documentation also right so more group clients it is not possible right and client bush installation I account must be specified that has administrative rights to the intended Kline so this could be one of the bigger challenges with the security team right Windows Firewall must be configured right Windows Firewall must be disabled in some scenarios right you cannot cancel that is another thing right it will continue trying for retrying for seven days ok so that is another thing right but probably you can do something you can you can try to cancel it you can try to delete it but it does not recommend that right probably you need to raise it a support ticket or you can refer I will I will show you right there is another method to do that ok software update point installation so this is the second one I listed over here in the other blog post so you can use the existing software updating infrastructure if you have a if you have a W source right then you can use this and that would be easy to do it right if you are already using double users then if you to install a cesium so if you are not using double uses then I don't think this is useful for you and I'm not going to go through all the points over here right but I will provide the link in the description of the video so you can refer it right okay blue policy installation you can see like Oh large number of clients are being installed it can go in cause network issues right so that is one but if you look at the group policy and the disadvantages are list very less right only to it and logon script a real time real world favorite right as I mentioned if you ask me I offer an interface I would say like this is the best option right and the logon script installation it doesn't require computer to be discovered discovered not required any computer you can support using command line properties for CCM setup right so that is why I mentioned Jason Sandy's has a great logon script installation installation script right and normally I recommend using that scrubbed right to install the clients in a real-world scenario okay okay the other one is manual installation so manual installation is very useful I hate where if you want to test and understand try and understand why does happening during the installation and why does that installation process why does the background process right during the installation right etc etc so if you are if you are trying to learn sse 'm then i would recommend you doing manual installation also right that would that will give you some insights why does happening same thing with saying me the same thing with all right everything is every every every method is kind of a new learning right so client push also you will learn right why does client push and how do how can we configure it etc etcetera right so that is about the client installation methods right now other methods also there as I mentioned in tune in tune methods so that is that does not covered it's not relevant over here so I'm not going going to cover that right if you are interested to learn in tune probably uni you can attend the daily training which which we arranged right and I ask you okay okay so in the client push installation method in the last line it was written that you cannot cancel the client push for the next seven days is that right yeah that's correct okay so if if after initiating the client push method after let's say two or three days I kind of feel that no it's not required I have to cancel add so there is no way to cancel it yeah that's correct okay okay fine then yeah that's what my question was okay thank you okay so let's let's go into go into the console right and I will give you a tip about that I don't in a bit right so there are some ways we might need to raise etiquette support case or something like that you can do and they can do some registry hacking in the database and that will help you but I don't recommend that okay okay in anyways okay so let's let's go into the into the console again and see what we can do now right so now let's let's try to install a client owner on a sec um server itself right I don't have have climbed over here in this device right in this SEM server okay so let me go to control and let me check config manager right so there is nothing configuration manager applet over here there is no client right there's nothing over here right so let's let's try to install client over here using install client client push method right so this is the client push method which I explained now before that let me let me try to login to my logs favorite folder so logs let's let's short sort this with the date modified and keep it this the side okay now let's cancel it and let's reinitiate it so right-click on the device if you want to if you are a learner right if you want to learn clematis client foosh select one particular device and try to install it right don't do it on a all system collection I don't know whether also some collection will have this okay yeah it's there all right all system collection don't do it okay so that wasn't not interesting but anyways okay so if you are not speaking can you please go on mute and make sure you are on mute when you speak not like if you don't want to ask any questions make sure you're on mute right okay okay so I lost where was I okay anyways okay we were trying to install a client on the SCM server itself right so I I was mentioning don't install don't start testing it on all devices right okay so you can the point is basically you can install the client for entire collection right so for example if I have a collection custom collection which has only to test clients right and I want to install I want to install client I want to install do a client push on those devices probably you can do it with with the client push method right clicking on the collection and click on install client right in this scenario I am going to devices I am going to assume server this is my associate over record right and I'm going to install Cline ok so so here is the client installation wizard it has Lord of details over there side sister side system server condo okay besides this side server account or a client push installation account is a member of local administrate administrator group right on the client computer in this scenario yeah it is already there because this is the same right side system server is the same as a client in this scenario this is a cm server so we don't have any challenge over there and the side system server can resolve computer name of the client right so the ping and the name resolution DNS should be working right so that is one of the item which I kind of explained during the discovery also right and somebody asks me about the flow charts right so if you want to see the flow charts client installation flow charts you would be able to see this right so this is the clock and installation process flowchart which is I am trying to zoom in okay so that you would be able to see okay so this is the client installation process flowchart if you are this is pretty old but it is still relevant to understand the main scenarios of the flowchart I am NOT going to go through the each and every step but it is available in the troubleshooting guide over here which I shared in the in the blog okay I will I will make sure that this this link is also there in the description of the video ok at the bottom of the description right okay so this is the way if you want to understand what is happening when you initiate a client install what is going to happen this is the best way to understand that right okay so so there are lot of resources available if you want to understand learn as the sium right how it works or configuration manager right how it works etcetera etcetera right you need to you need to have proper community connections I would say right if you are connected to how to manage devices community probably you would be able to learn lot of these things right as you can see there are a lot of flow charts available in the in the blog post right SCCM troubleshooting steps blog post right so this would be very interesting for you if you want to learn lot of new stuff right okay so where is it okay anyways okay so this is the client push wizard right side so sir dns you need to you need to have a dns and this is another pain point for for client bush administration team always want to block this right so this is only needed for kline push and at the time of climb Bush probably after that you you can kind of disable it right if you want and if you if your security team is not happy with this admin dollar share and then you can disable it right but for the client push you need admin dollar write a defender firewall you need to either disable it I don't recommend disabling it in real world scenario but in the lab you know I already kind of disabled it right on the client as well as on des let me show you in the Windows 10 client whether I have disabled it or not firewall dot Cpl so firewall top if Cpl I I have disabled it only for something but I am going to disable it for all the other components also right so that will make my life easy and when I try to install something right ok so this is the client client part so I have disabled firewall but I don't recommend to do this in the production scenario in the production scenario there is a documentation available how we can make this work with the firewall rules right you if you have a third party firewall enabled software like Symantec you need to do this for Symantec as well right you need to have those firewall rules open right if you are using semantic firewall ok management point is operational of obviously management point we have installed a management point and we have seen what how we can check the management point in the previous videos also right and previous episodes also right ok so that is the that is kind of the high high level overview what is needed I would say this is kind of a prerequisite right for the installation and it is pretty clear over here right every over 4 up to seven days okay okay it will retry every hour up to seven days if it's fails right so these are the cat this is one of the carry heads and let's let's click next right and now the specified client push option I love client push install on the domain controller right so you need to you need to be very careful when you install client on the domain controller that is why it is a separate separate box by default it won't it won't install client on a domain controller right okay so that is one important note right and this is pretty useful in many scenarios right people might mistakenly if they install a client on a domain controller that can cause lot of impact right okay always install client software this is another interesting option right always install the client software when a computer already has a configuration manager client installed you can repair upgrade or reinstall the client software this is this is interesting in many scenarios double shooting scenarios especially right okay so this is interesting scenario right always install cleaned up the client software ok install client software from a phase specific site okay so this is normally useful right I we have only one particular site but yeah let's enable that right and see what is happening I normally enables these two okay so uninstall the existing line this is for the cleanup installation right if you enable the always always install client software option if you mind if you enable this this is kind of cleaning up the existing client and installing it fresh this is pretty useful in terms of in some scenarios like troubleshooting scenarios as I mentioned before right ok anyways let's enable these two at the moment but America commendation would be tested test this configurations in your environment and select which one its which one is the best for your organization or your lab environment right okay so select next now it will try to it will try to install the line to start the installation of the client probably right so let's let's do this right let's let's go back to the logs and let's find out a log file called cesium okay so this is the log file for line push okay so this is dude now time is three okay this is three minutes before updated three minutes before let's open this up always use log reader right and check okay that's interesting I lost the connectivity let me try to connect back there is my VM sorry about that to connect this is the bastion service if you have not part of if you have not been part of the initial demos sorry video so this is the one okay not reachable username password is incorrect I know I I didn't put the username and password give me a sec I don't remember the username and password let me try to find out that and let me copy the password now let's connect okay so now we are back okay sorry about that now we are back in the cesium and you can see the component which we are working with now right client is SMS client config manager right it's real SMS right it's always be SMS right okay so I don't know how many of you work on SMS right I started with SMS 2003 okay okay in into - I have a network issue okay going back over here and let me open this side by side right probably it would be helpful hmm so this is the first part of the analysis which we need to kind of do okay so first log when you whenever you client which you need to do this analysis right client portion of let's let's click Next right and let's see what is going to happen now Frank and now it started working on this right okay so something happened right now let's let's analyse unable to okay that is fine Leighton lace so don't don't get worried about those red marks right so that is normal okay so this is where it started executing curry s PCP there is some clue over here right which is the stored procedure it is which is in which is being used over here right stored procedure is being used SP get a new client push machine right and set client push request machine status the Lord of S sees SP I'm away M said why I was saying SP it this is CP right client pushed all right okay I'm always I always get confused between s and C okay I don't know why okay anyways CPE is client push this is the stored procedure SP is stored procedure and CP is client push so this is something to do with something to do with sequel database right so oh okay oh okay let me go back to sequel database over here and let me try to check where is my database stored procedures right if I go to stored procedures over here in this sequel database I don't recommend you doing anything on the sequel database right but this is kind of an eye tip probably it might help you okay I didn't filter it properly I just think I need to filter this one it's filter it with CP right so that we can see all the client climb push related stored procedures why it is not showing anything this is let me remove this remove the filter okay anyways it it doesn't show filtering option says something wrong with the filter okay then okay this one probably I will remove this also now let's see what is there okay anyways it is not it is not throwing anything but probably you can see something over here CPC PCP just remove the filter right and let me expand this and if you can show if you can see something called SPC P then let me know this is Spain Hind that filter should work actually okay so basically what I'm trying to say is all these stored procedures are somewhere here in the sequel database okay so we will find out this in a bit I'm not able to find it over here I am probably I am looking into wrong wrong thing wrong location or something okay anyways so so basically I the idea was to look into the look into the sequel and check why does that stored procedure right and so basically you you can understand all these are related to a stored procedure and it is doing something in the sequel database right so that is from where from that place it is kind of getting reinitiated every every cell every over seven days for seven days right or retry is being initiated using that kind of a scenario okay another thing which I can show you in the sequel is basically this one right if you if you run this command this query we underscore CP this is again client push right machine and check right ah okay now we can see right so this is the client push record right available in database now right so it can see push side code assign side code and initial request right number of processes atoms and how many atoms already completed right what does the status etc right so this is very useful in terms of troubleshooting right but don't do not change anything in the database so that is not recommended at all right this is only for the advanced kind of troubleshooting if you have a trouble with its CSS iam client installation or client push installation right so let's go back to the CCM log this is the log ID from the cly saury server side right so so this is saying processing processing started CC are processing thread and if you can go through this and the flowchart which I mentioned right before which I showed you before this one right that would help you to understand better right so warning no remote client installation account found we have not created any account right remote client installation account we have not created right so we need to create that if we want to use that so now I mentioned this is site system and site system should have access to the site system itself right so it is trying to connect to see where admin sheer so this is why admin share is required right blind push is trying to connect to admin share so if the client push if the admin share is disabled if this will fail the installation won't work okay now let's analyze and same Oh what is this what is this happening here what is happening here right so this is unable to get s summers under school some object right so this is this is taking the WMI of the device of the client device which we push the client and obviously if the client is not installed then obviously the this particular WMI class won't be available okay so you can easily or you can ignore this right you don't worry about this error error is this one right you don't worry about this right you can just ignore it right now what is happening next creating verifying copying existing existence of destination directory CCM setup is being copied to admin dollar right so admin dollar in admin dollar it is kind of creating a cesium setup let's check what is happening in CCM got mean dollar I don't know whether I will have access from here or not this is with the system account or not okay this is the admin dollar share it I don't know if you if you have not seen this before alright this is the admin dollar right you know which is this folder hey see this is system 32 you can see system 32 over here you can see system apps now you know which folder is this right any guesses probably you can chat mention this in the chat okay so CCM setup this is basically Windows folder right okay so CCM setup you can see CCM setup bit code copied it got created right so creating verifying copying right that is done copying the fly files to CCM setup creating that client copying the clients deleting the install lookup file this is again the luca file is being created and deleting executing this query it the the why it is red mark it there is error in that stored procedure client pushed showed procedure write the name of the stored procedure is set last error code that is why it shows error so ignore all the rates are not wrong right okay so very important it very important thing these two these two are very important if my missed one over here I these two are very important these two lines always search if you have lot of if you deployed client push to say ten missions and you want to check them check that do the troubleshooting then keep in use this particular search key bow keyword right so every log will have search keywords right in the previous videos I have mentioned several search keywords right to search in the log files right if you during the MSI installation it is always returned value three right you need to search that you will find the exact error three lines or four lines below or a bow I forgot about that line that error right return value 3 okay so for client boots CCM log this is the key search so what what is happening over here this server is handing over the SS iam installation server has done everything which it needs to its needs to be done right or it has to do with the installation with the client push feature right so it it's it handover it did handover the activity to the client now so how to do how it is doing it it is to by creating a service right and it is asking that service to install the client right so start started service CCM setup on the client right so CCM setup service has been started on the claim right now after that it is removing the log file right these are the two important log file entries which you need to remember when you troubleshoot the client push right now rest others are like ok you can understand you will you if if you have any problem at the server side with the connectivity then you won't be able to see this these two is two services right these two log entries you won't be able to see if you have any problem with DNS or you have any problem with this particular share or you have any problem with admin share right then then you don't have access to do client push right you have not configured the client installation and a client installation account you have not configured you your site server doesn't have access to the client then you won't see these two lines right these two lines if you see these two when you see these two lines it means a server side is fine now you need to check the client side if there is any issue in on the client side or not right now let's again I don't know what is happening over here mmm let's reconnect Bastion is not stable today okay so now let's see the client side right client side of things now go to go to the client now if you are not used if you are not installing client push or client on us SCM server then you need to go to now you need to go to the client device and check the logs over there but in our scenario we are installing this on a SCCM server itself right so you can check the clients from here right I'm going to use this admin dollar itself right that is where we can see this CCM setup over here right CCM setup over here and it might say no you don't have access ok that's fine and then I need to go to all C : so that is where the log file would be if I'm not wrong probably it might be in somewhere else also right so CCM setup right CCM set up this is a log file folder right where you can find the remaining part of the SEM installation log so this these are the components or files which got copied and got created during the client push installation so this folder got created during our client push so you need to remember this folder path right it's always CCM setup and to check the log files so these are the sorry before going into log files right this is this is the main file CCM set of always use this file right don't use the client client Cline MSI right that is not recommended always use the CCM setup dot exe okay to ensure all the clients to pull down all the required prerequisites exes etc etcetera right okay so let's go into the logs right so there are two important logs over here I don't know what happened hi so two important logs over here one is CCM setup right caesium setup will give you an high-level overview of what is happening on the client side or client installation right as you can see there are a lot of red red marks over here right successfully deleted fold-back what happened I don't know right we need to check that right so installation failed or installation succeeded right we don't know we need to check that ok so we will check that right so this is a overview of the client installation right so this is this folder this for a log file will give you the client-side installation overview if you want to do a deep level troubleshooting of client installation then always open Cline dot MSI log file right so this is the MSI log file this will give you into end details what as what has happened and what what are the processes happened during the client installation on the client end right so this is taking long time to open up so you can you can and you can understand Lord of log entries will be here and it might take lot of time to understand this log file right and probably it will be it will be once you understand this it will be easy to it easy for you right to troubleshoot on the issues right windows windows installer installed product install the product product name Configuration Manager client protect version right product language this is the language ID for Loki I forgot the name actually look a righty or something right for English right and manufacture installation success or error it seems okay to me at this point of time right and let lets let's analyze this particular log file right so this is the this is again shows in red right you know my it throws in red this is because even error is there right so you will see this a red because you are using CM phrase right so if you use notepad probably that you will get more confused you will get more confused right now let's see all msi installations right always you can use return value 3 as your keyword right so return value 3 if I go up there is nothing that is also a positive same sign for me at least right I can see there is no errors right in the MSI installation I think MSI installation is kind of succeeded right so let's go up on this particular log file and see what is happening over here I'm not going to go through each line of this but if you have time and if you are interested to learn what is what has happened and what is happening during the installation you can see that right over here what is happening Cline it is calling client MSI right and it is disabling etc etcetera and lot of things are going on over here right so if you have if you are very interested to know probably this is the best log file to understand and you check I to understand what is happening how many WMA entries it is getting created how many well what are all other things it is doing in the in the system right registry entries exit right sir you will see lot of those stuff right so as you can see this is very very very long or heavy log file I would say okay see the registry entries over here I think this is registry entry right so yeah lot of lot of things happening over here okay so my end our end goal should be to understand whether the process God's completed successfully or not right so that is one thing which you need to check and you can see more files are getting comfy right lot of WMI classes are being created during this process right related to SEM client right you would be able to see all those things over here in the log file so this is pretty important log file right and to understand the client installation in trend components if you want to do a deep level kind of a troubleshooting okay so so that is msi client msi dot log right client dot msi dot log right okay so CCM setup these two are the servers so decline side logs okay so msi client installation succeeded Windows installer has requested a reboot this is another another interesting thing right sometimes this is this is kind of interesting message probably we might need to restart to get this working as expected right the client working as expected right now let's let's see what what happened in the control panel now right now we have we had of we have opened the control panel and now let's search with this again right config and see whether you can you are able to see something over here right it says no nothing there why why it is not showing right let's understand that I'd probably we mean we may need we may need to restart I don't know right services stored MSE services dot MSC okay now let's check what is here in this agent host SMS agent host is running right that can be running before also this is the one thing which is used for MP also right so that is another important thing so EMP management point and client client are kind of sharing some of the components when you install a management point and a client on a particular server then you need to be pretty careful about that right okay so I'm not going to restart this this client now right the server now now we have seen this what has happened over here now let's try to refresh and you can see oh the client is up and running right so it has a green checkmark I don't know how many of you know what is this green checkmark I have a blog post about this online version online this is online status right so if you if you enable one over here right new column over here somewhere you would be able to see let me go down and if you can help me to find out otherwise I am going to leave this ok last activity to do just a bit up the Vice on wine stylist where is it ok bit up ok thank you for that online status thank you okay so this is the online status right and you can see online status over here and you can see like Kline sorry management point it is connecting to right so this is the management point it is connecting to it is pretty useful that is why configuration manager is or some product and it has lost of legacy right 20 25 years of legacy and code in it so so it is pretty difficult to develop these features also but it is it is pretty heavy loaded product with lot of features right so so this is this is useful now you can see the client is installed on the server now let's I don't know why I am NOT able to see the component in the control panel now let me start the control panel again and control Who I am searching controller okay here we go configuration manager right so this is a client applet Configuration Manager client applet right and you can see over here Co management capabilities no we have not enabled that co-management there you can see that right and you can see the components over here right enabled installed actions you can see actions over here right this is good sign you can see lot of actions if you only see like two options then you have some problem with the client right or the proper the client didn't get the policies yet right okay so that is one thing which I wanted to show you can see all these things over here alright this is a applet thing and you can see the site code etc over there right so this is one verification step you can do now let's go to the logs no not this one now I will I'm going to struggle to find out log file right see for the client right this is the this is only for the setup right but actual log file will be somewhere else because this is not straight forward because we have a MP also on this particular so right so I'm going to open another window okay over here and I'm going to see F Drive and this is the associate installation drive right and configuration manager let me so search over here log file so what is this log file okay so this is the log file for the client if I'm not wrong Museum let's check up okay let's check policy valuator right so okay so this is the log file for sorry log file folder for the for the client right it's for the line why why it is bit different on the server because we have as I mentioned installed s management point also on the same server that is why the log file folder the client log file folder is different right otherwise it should be there in Windows itself okay so we will see that in Windows 10 device in a bit okay but this is the log file folder and you need to be where you need to this is very important for you you need to remember this difference if you if you are checking secm client logs on iymp remote management point well then you need to look into this particular location right okay rather than the default location this is one of the tip I wanted to share with you okay so so that is one thing now let's understand where the tools folder trace I don't know whether MP will have CM trace okay so cm prays folder so sorry if not folder right cm traced log file should be there in the client folder and in all devices right so we will we will see this in Windows 10 also once we install that okay now we have seen almost all all the things about the what you call the client right now let's let's go back and check the log file so one log file probably will check client ID manager or something right this is one of the client ID manager startup this is one of the important log file if you have any trouble trouble in digit string with the client registering the client if you have any duplicate records if you by mistakenly used something like image right no.not sysprep image or something like that which has a client entry then probably you will see lot of things over here so this is one of the important logs which you need to kind of look into right and there are lot of other logs which is very important which I am NOT going to go through it now right one of them is policy agent log right policy agent dot log is as it is is a is very important to understand whether the client is getting receiving any policies or not right and you will get some clues about the WMI connectivity's and the policies it is raising it receiving from the management boy index attract cetera right client always talks to management point you get the policies right okay so that is the client way of doing client communication so if the management point is down client is not going to get any policies etc etc right okay so these are the important log files and client paulius policy evaluator is also an important log file evaluate for like how the policy is being evaluated and during during that and are you are we getting some error etc etcetera right all the policies everything is policy in SEM right even if you enable kind of a component or like hardware inventory or software inventory in a cesium through the client client policies then those those all are policy and those all will be kind of recorded in these log files right so it is very important to understand this and and like troubleshooting from a troubleshooting perspective right it is very important to understand each log files and components we have some blog posts available about the log files also you can look into that and Microsoft all has also lost a lot more details right so remember you won't see all these log files in normal client right this is specifically for management point right and this is also very important right if you have a problem with client registration there is already a clue which which log file you need to look into right this is a log file this is it's all already saying client registration right see something called the client registration will name itself right MP Klein registration so so you would be able to see the record details and everything over here if you have if you have some errors etc right and all these are very important right and hardware inventory policy all these are like very important log files in in in client world client communication right so if a client is not getting registered then you can analyze all these logs and you you would be able to get some clue what is happening in during the installation process or registration process etc etcetera right so you need to remember underscore MP underscore files are for management point related to the client activities right so this is another tip which I wanted to give you okay so this is again see SMS underscore cesium and log file okay so that is a client side of things and some part we I covered MP also write suicide also write okay mmm now now let's let's go to the other other thing right other other clients so this is my Windows 10 client now first time what I need to do is let me try to ping this Klein right so let me try to ping ping to HTM d win 10 right so this is a Klein so is it able to ping okay good that's good news it is able to ping it is able to resolve right that is able to resolve the DNS in the resolution is there yep okay so that is good news one one one part is working right we don't have any problem with that now I don't know what what and with this know my system got stuck okay so now let's let's try to do some other stuff right let's try to do admin dollar stuff okay so I'm going to access the admin dollar of the client okay let's see what is happening over there okay admin dollar is fine on the client okay so that is also positive nah now what what else right these are the two things which we can kind of check to understand whether it is going to work or not but anyways I don't know it is good it is it is going to work or not because we still have not configured them a client push account right so where to configure the client push account let me show it to you I don't know I don't remember exactly let's see whether I remember it or not okay client settings it so sides if you go to administration overview site configuration sides right sides and if you try to go to client installation settings and align push you would be able to see option client push over here right so this is the site way decline push configuration which we have not seen yet okay so now over here the default configurations are there Allah when TM fall back to ntlm this is a security issue we can disable it if you want your security team is not happy and the other important option you if you want to enable automatic site-wide decline push this would be a drastic step in if you are doing it for a big organization right with I don't know maybe and thousand clients right don't do this right that is going to create lot of issues right so this one enable auto automatic side site-wide client push ok so anyways I love Cline I love connection fall back 20 L and this is this is important you need to understand this ok and accounts this is what we are going to we are talking about here right so we have not created the client installation account and our windows then client if I can go back to the Windows 10 client you know over here which we're on which we are going to install the computer manage and hopefully this I don't know why my Windows 10 device is pretty slow normally as your is better 45 14 percent H CPU and school it's good ok ok local users users and groups right administrators we have only to write that the local user this is the local user and this is domain admin so we don't have our site system added to administrator so anyways the client push is going to fail most probably right we are not going to configure these two things right one is ok if I can find one is client client push account we are not configuring at that if you want to configure you can use that you can use an existing account I don't have any existing account otherwise you can use this account you can browse and you can select any account right probably I will if I say I know it will check my Active Directory and it will try to add this account right then I need to probate the you password also right if I say HTM D user for example you would you would see an interesting error over there because SDM D user is a normal user in my Active Directory and client push require administrative access on the server okay so that is why I am kind of launching the Active Directory and trying to find out what is the axis at HTM D user is having HTM D user and if I go to HD MP user and go to properties and where it is member of right it is part of administrators okay so let me compare this with a new user account a noob and I don't know why that N and the door does there okay I'm still not liking it anyways domain admin it's not domain admin right administrator is there but administrator doesn't help us because domain only domain admin is part of that local ad local administrators group in the client side right okay you have already seen that so if at all we provide this user as a SDM vertical client push account user right it is not going to work anyways I'm not going to use that account just to show you how what would be the error and the log files how it will what would be the things which which will be shown in the log files okay so site code this is the default one if you want to add something you can add over here for the entire client push right whenever you initiate the client push all these properties will take automatically right into the consideration right okay so this is the client push installation method which you want to look into this is configuration which you want to look in okay so let's close this let's minimize let's close this also now I'm going to initiate the client push on that device before that I want to open the log file CCM log file server end okay now I'm going back to assets and devices sorry assets and complaints and I'm clicking on the record discovered record I'm going to install it right the same same wizard I'm going to select the same options right so the site specified specified site etc and let me confirm this and summary let me let me low enable the log file outside and it's already started okay okay and you can see some interesting errors also right okay let's analyze now process titled MP is available yes MP is available it's check the service service stored procedure I don't know why I am look going into service principle and all right that's it's cloud impact probably okay so attempting to connect okay using using machine account which machine account side server machine account and no it is not a loving but you so my account has access because I'm a domain admin right my account has access to this if you see if I try to access this URL not URL SMB path right over here no it's not giving me access earlier it when when we try to use this it had given me the axes okay this is oh come on again question I think you are doing some nasty stuff over there okay so that that is because of the I think the quotation I don't know what is that called code right now with my user account I can able to I am able to access admin dollar but this because first thing no remote client installation account we have not gone figured that account and as I mentioned site server doesn't have access it got failed because admin dollar is required to copy the files from site server to the client admin dollar CCM setup so it didn't happen failed to connect Fae error failed connecting connect to the share share share using machine account so whenever it says machine account it's a site server account okay and try each entry to true warning nor igano okay failed fail again machine account it is trying with mission account again trying it again right now every one hour every hour it will try and this error will continue okay and now let's check that sequel right now let's run the sequel query and understand what is happening over here right so this is the cease its PMD CCM sorry s SEM this is the site server and we got installed our client got installed on this site server and you can see status over here status is important right status over here and it is for so status forest okay it is successful and status - right last year okay last error code and how many time times it tried it says okay only one time and retry description previously it was complete now retry the previous record it shows street complete now it shows retry now the status is two so that means something is having some issues there right so this is another way of troubleshooting but I don't recommend this just for your information I have shared this okay so now let's let's go back to the console right let's go back to console and go back to monitoring and see do you do you see something over here or blind status if I say client status right and if I see something nothing over here it flying check nothing over here yet right that is probably going to take some time hmm production client deployment nose nose no complaints chatters okay that's fine everything is kind of nothing populated yet right Cline dashboard is also kind of no nothing there right so so that is the overview of client monitoring stuff right so we will come to that probably next sessions right so don't worry about that now just wanted to show what would be the the data over there right when we you initially set up this SCM ok so now now what is next what you can do is basically either you can add account right if you want to see an account and you can do that otherwise what you can do is you can take hostname oh here host name and this is the best method right rather than adding account if you have if you if you add pressed mission account than a user account then probably you can you can make your security team happy right so what I did is I copied that host name sorry yeah server name and now I am going to Windows 10 client no I'm going to do a manual task you don't need to do this right you can add this through group policy or you can do scripting or you can do otherwise it's better option is to use the client push account itself right with a domain admin access right or it should be part of this administrator not domain admin access sorry that was a mistake right you should you don't need domain admin access to install the client push right to enable the client push you just need a local administrative access on the client device right that user should be part of this particular group administrators group local administrators group on that device client device right now I'm going to add the site server and if I check sage click on check name it is going to give me an error probably okay see because I have not selected object types if you have seen the previous videos you might know this right computers select the computers right and then ok then check name you will see it got it is it is able to find from the directory now click OK now click OK now let's confirm this right ok so it's there now now let's go to see now let's go to this one right now Ben C folder C Drive and check what is going to happen here whether there is any cesium holder here no there is no cesium folder here yet right because the I it couldn't create any services it couldn't copy the copy the content right the content now we have added the site server account into the into the local administrators of the client now let's rerun it how to rerun and probably this is not the best way but client push let's initiate it again right crying push ok next and close and analyze the log file right where is our favorite log file right let's see what is going to happen now okay so it is says it is far more less read write read alerts here right so using machine account again warning no remote client installation account why why you are not using it okay I don't want to use it right so using machine account machine account connected yes CCR everything is ok I think and WMI root CCM obviously it won't be there because obviously there's no nothing over there right and there's no client installation over there that is why you are not able to see that that is fine and this is a different one and you can see started service CCM setup that is good news right this as I mentioned if you see this that is good news right the the server handed over the installation activity to the client now its clients responsibility Windows 10 operate systems responsibility to install decline that is why I normally say like a configuration manager oil secm is a delivery boy or a courier boy right it just delivers with instructions with content everything it will get just delivers to the operating system and then or else to the client or else to MSI or as or else to software update agent for patching right and those components at the client and should contact or you should execute the other activities right relevant activities okay so Windows 10 over here and you can see a lot of things are happening over here CCM setup came up ok and cesium came out ok Hey cesium cache came up going created so these these three folders got creating now again so that's a good news right so let's go to cesium setup okay I need admin that's fine now same folder structure nothing change right and we have already seen this now let's go to logs now one thing is different one thing different here is if you open up CCM setup it will open up in them notepad okay so notepad is not bad right but for me it is not easy to read like this logs log reading with notepad is not easy for me I need CC MCM praise or some other log file reader right but if you want to see this you can see and you can use it what does it go what is happening over here but I don't prefer that and you can you can quickly see what is happening here return value 3 right return value 3 is not there that good news okay that is good news and you need to be very careful when you search right it is basics but I normally forget to select up and down right CCM setup always gives down the bottom view of the the last line it will true right CCM sorry not CCM setup CM trace right but if you open up in notepad it will always give you the first line right why does the first line and then you need to traverse back to the last line and you need to go down drag down and understand it right like that okay I'm not going to use this anyways return value three is not there that is good stuff now I'm going to go back to Windows folder and go to CCM right I need CM trace right so cesium is a folder client folder the core client folder for is SEM client or a Configuration Manager client all the stuffs is here all the DLL all the discharge right all are here all the core components of the client all are here even my favorite log files right so let's log files over here right now let me let me find out the CM price my friend over here cm trace so cm trace is here I'm going to click open I am going to say this is my default thing and I'm going to close this now I'm going to go back and see CM setup now check log files over here and let's try to use this and let's see always open with CM trace now this as you know this is going to launch and let me check the CPU have how is the performance of my as your VM so by while opening that I think this installation got successful and it should but let's check what is the status in the console right let's go back and see okay so it says yes but it doesn't see online or offline or something like that right probably we need to give some more time okay you get that online status working etcetera etcetera right so it says it's the it says on offline probably the status is not there but right so but it says good news is that it says client is is the client installation got succeeded now after our trick of adding that site server a thorned to the administrate local administrative administrators group okay so then okay after after loading that msie log file it went back to nine person aged that's good so MSI log file is pretty heavy okay so installation product name okay succeeded probably okay and as you can see it's lot of things you can see over here in the client logs and sorry MSI log and same thing can be seen in CCM setup also so I don't want to repeat everything over here MDM sitting configuration sitting that is fine came face losing status okay that this something which is came reboot success MSI installation succeeded it's okay let me search with reboot right what is this reboot okay so suppress reboot that is fine this is for suppress reboot that is the command line we just used let's go and check this is search down reboot GCM reboot successful mission reboot suppressants okay that is also sir suppress reboot move files deleted ok fine that is also fine moves ok that's also fine I don't worry about those reboots ok I think that is fine from from us CCM setup a perspective now let's let's see what is happening over here in the log file actual client log fell as you can see when we initially opened the client log file was until this level now you can see lot more log file so it is getting populated the components are getting enabled right and it will show the law online status soon right on the console and you would be able to install application deploy a configuration item policies etc etc now into the windows line right on this climb no I don't like this configuration man this control panel right I understand until we close this and it is not showing me the thing see I need to close this and open it then only it will shows so that is not a good thing probably it is Windows 7 or Windows XP thing probably that is why now it shows configuration manager so I chose ok components let's see components a enable the installed actions ok you can see actions ok good side you can see side ok I think this is this is fine the installation went well and the log files are increasing so now you have sort of locked well see okay cool so now let's go back to the console and see what is going to happen I need some what I need water No Oh see now you need to be patient right note patient patients you need to have some patience right okay so now now we have I think we I I was speaking for I don't know almost two hours only 10 minutes left I will open up for the questions if you have any questions please feel free to ask now okay that's easy for me then if you don't have any questions so Dean here I have a thought yeah yeah sure you know what external domain server which is not in our domain external kind of internet-based kind second so though the missions are not coming into the devices you know and unless you install the client so when you install the client and machines are coming over there and the machines are getting discord that's that's that's a troubleshooting thing which we need to do from a discovery perspective right so if I can open up this one night and I don't know where whether I will ha I have the discovery flow chart somewhere here or not it came but the process is if if you don't have those if you are not kind of how I can explain this okay so for example right you you mean to say it is DN as or DM so DMC's on device okay so DM C so DM Z so I don't know that DM zone okay thank you for that okay DM zone because I'm I never I never been a server guy right I never kind of install the server I in a corporate world so I'm always a desktop and workplace man right so anyways that's that's a bad bad excuse DM zone okay so if you have a DM zone device then probably you might have issues with DNS right probably you might not be able to ping the servers probably the firewall is coming in between right so so those are the scenarios where at the record won't get created even though that discovery is enabled and even though you have given the axis in the discovery methods right to to have to discover the devices from that domain domain controller right Active Directory so the day a ping ping should be available you would be able you should be able to ping that particular server you should be able to have a replay back from that server so these are the requirement for the discovery I have somewhere here I don't know so that if if you can resolve that issue right ping related issue DNS I don't know whether you already tried and it is kind of maybe I don't know rest rest is not an issue I think because I already I already have many experience without with without rest scenarios right untrusted forest so so in my organization I use we have different domains and we have management domain where we install all the all the sec 'm or server components right but we have a client domain where we don't have a QA trust between server domain and client domain ok so so but we are able to discover the devices and because we open up all the ports required poles and the server is able to contact that particular kind of device from the from this side server so so this should happen from the side server right if you have installed the client sorry if you have installed the console in owner on a terminal server right or somewhere if the from the terminal server you are able to ping that one that might not work or that might not help you write but he yeah so if you if you try to troubleshoot from a primary server then that might help you to understand the problem right very basic on what are the thanks for this what are the ports we need to openly you know this client pushing so to be worked we haven't opened any port in our Windows 10 machines right yeah yeah yeah you you missed something and that is my mistake not your mistake right because I I kind of disabled the entire thing so as you can see firewall is the firewall see I have opened the firewall in between here and I've disabled the firewall entirely okay that is why it is it is it is kind of happened magic magic happened right automatically otherwise yeah I need to go into the firewall configuration and I need to enable all those communication port 80 and the ping the SMB port four four five exit exit exit all right so because this is SMB traffic right client push uses SMB traffic using that admin dollar right that is why security team is not very pleased with these client push installation methods when if we we are going to explain them we are not going to explain them then they are they should be fine okay and the very last one I will stop here so here you have added one mission at the our primary server as a local administrator why in the real world scenario we never add that we will be adding in like you know particular of cold over the right let's see how it related actually so what kind of permission will be giving in that account administrator net administrator work yeah okay it would be full nexus 30 yeah on that particular client device okay so when you when you speak to security like we will see I already mentioned somewhere like domain admin a access needed right now that is not correct right only local administrative account or local administrative access is required administrator access is required a new product cross forest also this service account or this SACM agent account we need to give them a permission if it is not fully trusted or there is no trust between this forest oh if you don't if you don't have rest right so for example this is your client device and if you don't have trust with with the management forest for example right well where we you hosted or create build the service right then if you try to add that management server racism server it won't be able to see right or it you won't be able to add that management server into this right so that is where we call we don't have trust between these these domains right so so what do you need to do in that scenario is you use the client account client push account from administration and if you go to sites right if you go to client install settings client push installation account right what you can do over here is over here either either you can use a dummy account or something right it will it will directly try to you to do something I don't know I never tried this recently I don't know whether this will work or not right now let's say this is this is my domain right sees let's say HT HT is my domain and this I don't have any trust between my current domain that is HTM D and this domain and I'm going to provide password transfer is it also trouble okay I don't know okay anyways let's see one two three four five one two three four five okay and let's see okay so now we have configured and trusted the account over here right and thirsted forest account now when you when you initiate the client push it will use this particular account right over here over here you would be able to see okay a remote client installation account found and I'll be attempting to connect to this particular share with the remote client account right so in that the untwisted forest scenario first of all most probably not interested for a scenario your security team won't I love you too Duke align push because you are opening up 4:45 and all the high risk items right admin dollar it won't they won't allow you to do it but if they if you are lucky then you need to use this this kind of account probably that would help you does that make sense okay the problem would be the client push we cannot use it and that's a limitation or entre stretch I did need to be done manually the installation of agents no why do you need to do it manually right so client push can be used there is no limitation from client push right if the limitation is from your security side right if your security is happy to enable all the ports right then then we are we can do it through client there is no limitation from a CCM side at all okay how about the admin so this is admin account you are adding so this is untrusted for us admin account right okay for example for example as I mentioned HT is your untrusted forest where your Windows 10 clients are right okay and I am adding a user user not that so that account have the permissions to install the agent on that interest rate forest yeah this account this account should be part of your local administrators of on on your Windows 10 device kada yeah then it will work so there's no limitation from a cesium side client push will work okay and in that scenario also but and you need to convince the security for understand correctly right yeah that makes sense okay companies think who sees up people that was that was horrible I don't know what was that are you are you guys able to hear me somebody's trying to somebody is trying to speed sujin I think you you are vodeo is having some trouble right your mic or system is having some trouble ok any other questions apart from soutine so did sorry no that's not means I always get confused between - any other any other questions otherwise I'm going to finish this call today for today I will talk to you I'll talk to you next week if you are only interested in SEM I'll talk to you next week same time same place Saturday 6 p.m. India time and that's it thank you all for joining have a great rest of your evening right and 3 you bye bye thanks and thank you

Channel: Anoop C Nair

Views: 1,246

Keywords: ConfigMgr SCCM Client installation Options, Client push installation (From SCCM Console, Software update point-based installation, Group policy installation, Advantages and Disadvantages of Client Installation Method, Real-world favorite client installation method logon script, Configuration Client Installation using Client Push method, Initiate the client push from collection or from device record, Configure client push account from SCCM site setting node, Review CCM.log

Id: cRKJtvAiW6A

Length: 119min 56sec (7196 seconds)

Published: Sun Jun 28 2020