SCCM 使用者狀態遷移 - 此使用者的數據消失了嗎?
長話短說(ish),我們正處於從 XP 到 Windows 7 遷移項目的最後階段,最終獲得了一些要遷移的 VIP 機器。由於這台機器幾乎和上面的作業系統一樣舊,所以除了新的作業系統之外,這個特定的使用者還“有幸”擁有了新的硬體。
問題是我們讓實習生做了這個特殊的遷移,他有點搞砸了。嚴重地。簡而言之,使用者狀態遷移的一般過程是在 SCCM 中創建新舊電腦之間的關聯,在舊電腦上執行擷取任務序列,然後在新電腦上執行恢復序列。在這種情況下,擷取任務序列是在電腦關聯之前執行的,因此 SCCM 拒絕執行還原,並且舊機器被重新格式化……由於某種原因……在這被發現之前。
現在,當我們嘗試通過“恢復”
USMT.mig
擷取並上傳到 SCCM 伺服器來遷移使用者時,我們會在操作之後收到以下錯誤Request State Store
。Task Sequence: USMT - Restore State has failed with the error code (0x00004005). For more information, contact your system administrator or helpdesk operator.
來自的相關日誌條目
smsts[date-time].log
似乎是:<![LOG[Requesting SMP Root share config information from http://[Our SCCM server]:0]LOG]!><time="15:45:28.823+240" date="06-13-2014" component="OSDSMPClient" context="" type="1" thread="5136" file="smpclient.cpp:2348"> <![LOG[Received 4027 byte response.]LOG]!><time="15:45:28.892+240" date="06-13-2014" component="OSDSMPClient" context="" type="0" thread="5136" file="smpclient.cpp:2363"> <![LOG[Adding \\[Our SCCM server]\SMPSTORED_378B856C$ to list ]LOG]!><time="15:45:28.912+240" date="06-13-2014" component="OSDSMPClient" context="" type="1" thread="5136" file="smpclient.cpp:2403"> <![LOG[Successfully connected to "\\[Our SCCM server]\SMPSTORED_378B856C$"]LOG]!><time="15:45:28.919+240" date="06-13-2014" component="OSDSMPClient" context="" type="1" thread="5136" file="tsconnection.cpp:287"> <![LOG[Sending SMP request to http://[Our SCCM server]:0.]LOG]!><time="15:45:28.950+240" date="06-13-2014" component="OSDSMPClient" context="" type="1" thread="5136" file="smpclient.cpp:1854"> <![LOG[Received 4899 byte response.]LOG]!><time="15:45:29.045+240" date="06-13-2014" component="OSDSMPClient" context="" type="0" thread="5136" file="smpclient.cpp:1861"> <![LOG[SMP request to "http://[Our SCCM server]" failed with error: E_SMPERROR_MIGRATIONID_NOT_FOUND (204)]LOG]!><time="15:45:29.065+240" date="06-13-2014" component="OSDSMPClient" context="" type="2" thread="5136" file="smpclient.cpp:135"> <![LOG[Request to SMP 'http://[Our SCCM server]' failed with error (Code 0x80004005). Trying next SMP.]LOG]!><time="15:45:29.065+240" date="06-13-2014" component="OSDSMPClient" context="" type="2" thread="5136" file="smpclient.cpp:1601"> <![LOG[Failed to find an SMP that can serve request after trying 4 attempts.]LOG]!><time="15:45:29.065+240" date="06-13-2014" component="OSDSMPClient" context="" type="3" thread="5136" file="smpclient.cpp:1644"> <![LOG[ExecuteRestoreRequestToSMP failed (0x80004005).]LOG]!><time="15:45:29.065+240" date="06-13-2014" component="OSDSMPClient" context="" type="3" thread="5136" file="smpclient.cpp:2862"> <![LOG[ExecuteRestoreRequest failed (0x80004005).]LOG]!><time="15:45:29.065+240" date="06-13-2014" component="OSDSMPClient" context="" type="3" thread="5136" file="smpclient.cpp:2926"> <![LOG[OSDSMPClient finished: 0x00004005]LOG]!><time="15:45:29.065+240" date="06-13-2014" component="OSDSMPClient" context="" type="1" thread="5136" file="main.cpp:124"> <![LOG[Process completed with exit code 16389]LOG]!><time="15:45:29.077+240" date="06-13-2014" component="TSManager" context="" type="1" thread="5744" file="commandline.cpp:1123"> <![LOG[!--------------------------------------------------------------------------------------------!]LOG]!><time="15:45:29.078+240" date="06-13-2014" component="TSManager" context="" type="1" thread="5744" file="instruction.cxx:804"> <![LOG[Failed to run the action: Request State Store. Unknown error (Error: 00004005; Source: Unknown)]LOG]!><time="15:45:29.082+240" date="06-13-2014" component="TSManager" context="" type="3" thread="5744" file="instruction.cxx:895"> <![LOG[Set authenticator in transport]LOG]!><time="15:45:29.088+240" date="06-13-2014" component="TSManager" context="" type="0" thread="5744" file="libsmsmessaging.cpp:7734"> <![LOG[Set a global environment variable _SMSTSLastActionRetCode=16389]LOG]!><time="15:45:29.350+240" date="06-13-2014" component="TSManager" context="" type="0" thread="5744" file="executionenv.cxx:668"> <![LOG[Set a global environment variable _SMSTSLastActionSucceeded=false]LOG]!><time="15:45:29.352+240" date="06-13-2014" component="TSManager" context="" type="0" thread="5744" file="executionenv.cxx:668"> <![LOG[Clear local default environment]LOG]!><time="15:45:29.353+240" date="06-13-2014" component="TSManager" context="" type="0" thread="5744" file="executionenv.cxx:807"> <![LOG[Failed to run the action: Request State Store. Execution has been aborted]LOG]!><time="15:45:29.365+240" date="06-13-2014" component="TSManager" context="" type="3" thread="5744" file="instruction.cxx:983"> <![LOG[Set authenticator in transport]LOG]!><time="15:45:29.373+240" date="06-13-2014" component="TSManager" context="" type="0" thread="5744" file="libsmsmessaging.cpp:7734"> <![LOG[Failed to run the last action: Request State Store. Execution of task sequence failed. Unknown error (Error: 00004005; Source: Unknown)]LOG]!><time="15:45:29.700+240" date="06-13-2014" component="TSManager" context="" type="3" thread="5744" file="engine.cxx:213"> <![LOG[Set authenticator in transport]LOG]!><time="15:45:29.708+240" date="06-13-2014" component="TSManager" context="" type="0" thread="5744" file="libsmsmessaging.cpp:7734"> <![LOG[Task Sequence Engine failed! Code: enExecutionFail]LOG]!><time="15:45:33.323+240" date="06-13-2014" component="TSManager" context="" type="3" thread="5744" file="tsmanager.cpp:923">
嘗試使用->
USMT.mig
中找到的恢復密鑰解密文件顯然不起作用,並且在重新格式化原始電腦後,我很快感覺到解密此文件所需的任何密鑰痕跡都可能消失了。Computer Association``Recovery Information
所以現在我們
USMT.mig
的 SCCM 伺服器上有一個可愛的文件,沒有辦法恢復它,或者手動解密它(至少據我所知)。既然它出現了,這是通過 GUI 完成的,所以我們不能返回查看 CLI 命令以從那裡恢復,我很確定這個
.mig
文件是加密的 - MigViewer警告它已加密,並嘗試無論如何提取文件會導致 0 字節文件(corrupt)
附加到文件名。我們運氣不好,還是有人知道讓我們擺脫束縛的方法?
使用者的數據已經死了,是的。
Microsoft 支持確認原始的、自動生成的加密密鑰不可檢索,而且太長而無法破解。
嘗試使用在電腦協會 -> 恢復資訊中找到的恢復密鑰解密 USMT.mig 文件顯然不起作用,並且在重新格式化原始電腦後,我很快感覺到任何密鑰的痕跡都需要解密這個文件可能已經消失了。
由於掃描是在創建此並行電腦關聯之前完成的,因此 SCCM 應該已自動創建就地電腦關聯。如果該關聯仍然存在,您應該能夠使用以下命令使用 USMTUtils.exe 程序破解打開 .MIG 文件(參考:如何從壓縮的 USMT 遷移儲存中提取文件):
usmtutils /extract <Path to .MIG file> /decrypt /key:<Recovery key from SCCM console> <Path to Extract to>