"SMS Client Configuration Manager cannot connect to the machine "COMPUTERNAME". The operating system reported error 5: Access is denied.

Possible cause: The client is not accessible.
Solution: Verify that the client is connected to the network and that the SMS Service account or (if specified) the SMS Client Remote Installation account have the required privileges, as specified in the SMS documentation."

^ This is the error when trying to connect to any computers to push the client. 

Almost all of the PC's are turned on.  Almost of them are set as "assigned status".  The install account that is set has full domain admin privs as well as enterprise admin. 
It can also access admin$ or c$ on any PC's on the domain.

We have close to 2000 PC's on the domain.

The only 3 Windows NT 4.0 machines that are on the network successfully received the client.
99% of our PC's are Windows XP or 2000.

I set up the client msi as a group policy to push out the advanced client to see that would help.  But I don't think it will.  AD discovery and network discovery are enabled.

 It is SMS 2003 SP2 R2.

Any help would be much appreciated.  Thanks in advance.

 

In the Client Push settings, make sure you have specified an account that has admin access to the computers. Also make sure you have setup the same account in Client Network Access account. Run the push again and you ahould not see error 5 in the ccm.log file on the SMS server. Two thinks need to happen, first, SMS needs access to the remote system. Second, the machine needs to access the location with the client.msi to pull it down. You can get access denied in either location...

The same account is set up under Connection Accounts under Client. 

 It is still having the issue.  It has admin rights everywhere.

Make sure you have a admin account for the workstations setup in the following 3 locations. If you typed in a bad password in any of them, you will get denied from the client.

1. In Client Push... set the account on the account tab.

2. Client Network Access Account.

3. Client account...

If these 3 are setup, you should not get access denied. However, do you have a firewall running on any of the machines? Either disable or open needed ports...

Where is the Client Network Access Account?

Oh I see where it is, yes it was already set in the Software Distribution.

It was already there, so the issue still remains.  Not sure what it can be.

Try to type the password again in the Client Psuh Installation properties, You may have input a wrong password the first time.

Also under connection accounts - clients make sure that the account specified in there is the same account that you are using for your Client Installation Methods.

Make sure that the account is members of the Domain Admin account.

Make sure to look at the ccmsetup.log and see what account the sms installation using to verify what the issue is.

It tells you in there what account sms uses to install the client.

Also make sure that sms service account has full access to the share where the installation files are located. It should already have access.

I have noticed that this usually happens when a computer is offline, or the computer isnt even on the network anymore.

If you take a look at the site status message and try to connect to those pc's with error, you will end getting a lot of computers that are not online. Personal Experience.

Another thing is that those computers maybe detected by sms but they are not on the domain, or the account listed with the local admin group are not any of the domain aswell.

Also those computers maybe within the DMZ. The sms server detect them because of the subnet that they are in but sms cannot communicate with the machines.

Most of them do exist.

The password was typed carefully, it is an enterprise admin, domain admin.

I checked all of those steps very carefully.

 

Its not getting as many of those access denied errors anymore, but its not pushing the client out at all.  I don't know what wrong with this.

To further help you troubleshoot this issue, you may want to check the ccm.log file on the site server.

This log helps you identify the following.

Scenarios where the site cannot connect to the computers because of permission or name resolution. Make sure that the site server can connect to the Admin$ share on the client computer.