We came across the below issue recently in Service manager , we were using the self service portal which was set up so that users were able to request software and get it installed on there machine.

The System Center configuration manager had been set up and was syncing every day, however when users requested software the software request would come through but would fail and never get installed on the users machine.

The first thing i did was check the ‘Software Deployment workflow’ status, so i could see the reason of the failure. I viewed the log of the failed deployment and expanded the failure details and the following error was given. “System.UnauthorizedAccessException: Access is denied. (Exception from HRESULT: 0×80070005 (E_ACCESSDENIED))”

We managed to get this resolved by giving the correct permissions to the Service manager accounts, please see below.

On the SCCM Server

1. Add the Service Manager Services and Service Manager Workflow accounts to the SMS Admins group
2. Grant the SMS Admin group the appropriate DCOM perms to SCCM console connections
3. Add appropriate permissions to the Service Manager services and workflow accounts in configuration manager
4. Reboot SCCM Server

Step 1 – Add Service Manager Accounts into the SMS Admins

1. Open Local Users and Groups
2. Navigate to Groups and SMS Admins
3. Add the Service Manager Services and Service Manager Workflow accounts

Step 2 – How to Configure DCOM Permissions

1. Open Component Services on the SCCM Server
2. Expand Component Services > Computers
3. Right Click on My Computer and go to properties
4. Navigate to the COM Security Tab and Edit Limits under Launch and Activate Permissions
5. Add SMS Admins and give it the Local Launch and Remote Activation Permission

Step 3 – Permissions for the Service Manager Accounts

Grant the following rights to the “Service Manager services account” within SCCM

Site – Read

Configuration Items – Read, Modify, Administer, Create and Network Access

Collections – Read

Advertisements – Read , Administer, Manage Folders

Packages – Read

Grant the following rights to the “service manager workflow account” within SCCM

Site – Read

Configuration Items – Read, Modify, Administer, Create and Network Access

Collections – Read, Modify, Delete, Advertise, Modify Resource, Administer, Delete Resource, Create, Read Resource, Modify Collection String and View Management Controllers

Advertisement – Read, Modify, Delete, Administer, Create and Managed Folders

Packages – Read, Modify and Administer

Step 4 – Reboot Server

Rebooted the SCCM Server , tested requesting software and all Service Manager software deployments worked

Just a quick PowerShell script which will tell you if any active case in Service Manager has not been updated in 2 days. Obviously by changing the values for the time span ($LastModifiedBreached = New-Object Timespan 2,0,0,0,0)  you can alter how many days it is before your alerted.

CMDLets from “http://smlets.codeplex.com/”

Import-Module SMLets
$LastModifiedBreached = New-Object Timespan 2,0,0,0,0
$incident = Get-SCSMIncident -Status active |?{$_.LastModified -lt (Get-Date).Subtract($LastModifiedBreached)}
$incident

If you want to change the status of the case if it’s not been updated then run the following ( Note you must create the new status before running the script)

Import-Module SMLets
$LastModifiedBreached = New-Object Timespan 2,0,0,0,0
$incident = Get-SCSMIncident -Status active |?{$_.LastModified -lt (Get-Date).Subtract($LastModifiedBreached)}
$incident | Set-SCSMIncident -Status “Customs status name you created”

Just a quick PowerShell script which will close any case that have been Inactive for 2 days and are currently in a resolved state in Service Manager.

CMDLets from “http://smlets.codeplex.com/”

Import-Module SMLets
Get-SCSMIncident -Status resolved -InactiveFor 2.00:00:00 | Set-SCSMIncident -Status Closed -Comment “Comment Here”