SCCM OSD Apply Operating system error - Only when not PXE booted

I have a strange problem when trying to get OSD working from SCCM 2012.

We have a deployment task sequence which works fine from PXE boot to unknown computers (where it asks for computer name) and known computers when added to the relevant SCCM collection.

trying to get the same task sequence working for In-Service workstations so we don't have to use PXE in all locations since it's not working everywhere. That and it makes more sense to use the SCCM 2012 software center in our case since all machines already have the SCCM 2012 client installed on the old SOE.

If I just advertise the task sequence as is to endpoints, it fails to start to run claiming it cannot find content. Trawling through the logs does not reveal which package is missing from the distribution points.

For troubleshooting I cloned the working task sequence, disabled almost all steps apart from the OS WIM and necessary steps to reboot into WinPE etc. Once deployed to endpoints, it now successfully starts and reboots the PC, however it now errors out with a 0x80070002 error on apply operating system step.

My troubleshooting is now pointing towards a certificate based problem, however that doesn't explain why it would work when PXE booting.

!--------------------------------------------------------------------------------------------!  TSManager   11/11/2014 6:11:19 AM   488 (0x01E8)
Successfully completed the action (Partition Disk 0) with the exit win32 code 0 TSManager   11/11/2014 6:11:19 AM   488 (0x01E8)
MP server https://svrCM001.domain.site. Ports 80,443. CRL=false.    TSManager   11/11/2014 6:11:19 AM   488 (0x01E8)
Setting authenticator   TSManager   11/11/2014 6:11:19 AM   488 (0x01E8)
Set authenticator in transport  TSManager   11/11/2014 6:11:19 AM   488 (0x01E8)
Sending StatusMessage   TSManager   11/11/2014 6:11:19 AM   488 (0x01E8)
Setting message signatures. TSManager   11/11/2014 6:11:19 AM   488 (0x01E8)
Setting the authenticator.  TSManager   11/11/2014 6:11:19 AM   488 (0x01E8)
CLibSMSMessageWinHttpTransport::Send: URL: svrCM001.domain.site:443  CCM_POST /ccm_system_AltAuth/request   TSManager   11/11/2014 6:11:19 AM   488 (0x01E8)
In SSL, but with no client cert TSManager   11/11/2014 6:11:19 AM   488 (0x01E8)
In SSL, but with no media cert  TSManager   11/11/2014 6:11:19 AM   488 (0x01E8)
[TSMESSAGING] AsyncCallback(): -----------------------------------------------------------------    TSManager   11/11/2014 6:11:19 AM   488 (0x01E8)
[TSMESSAGING] AsyncCallback(): WINHTTP_CALLBACK_STATUS_SECURE_FAILURE Encountered   TSManager   11/11/2014 6:11:19 AM   488 (0x01E8)
[TSMESSAGING]                : dwStatusInformationLength is 4
    TSManager   11/11/2014 6:11:19 AM   488 (0x01E8)
[TSMESSAGING]                : *lpvStatusInformation is 0x8
    TSManager   11/11/2014 6:11:19 AM   488 (0x01E8)
[TSMESSAGING]            : WINHTTP_CALLBACK_STATUS_FLAG_INVALID_CA is set
    TSManager   11/11/2014 6:11:19 AM   488 (0x01E8)
[TSMESSAGING] AsyncCallback(): -----------------------------------------------------------------    TSManager   11/11/2014 6:11:19 AM   488 (0x01E8)
Error. Received 0x80072f8f from WinHttpSendRequest. TSManager   11/11/2014 6:11:19 AM   488 (0x01E8)
hr, HRESULT=80072f8f (e:\nts_sccm_release\sms\framework\osdmessaging\libsmsmessaging.cpp,8919)  TSManager   11/11/2014 6:11:19 AM   488 (0x01E8)
sending with winhttp failed; 80072f8f   TSManager   11/11/2014 6:11:19 AM   488 (0x01E8)
Will retry in 6 second(s)   TSManager   11/11/2014 6:11:19 AM   488 (0x01E8)
Retrying... TSManager   11/11/2014 6:11:26 AM   488 (0x01E8)
CLibSMSMessageWinHttpTransport::Send: URL: svrCM001.domain.site:443  CCM_POST /ccm_system_AltAuth/request   TSManager   11/11/2014 6:11:26 AM   488 (0x01E8)
In SSL, but with no client cert TSManager   11/11/2014 6:11:26 AM   488 (0x01E8)
In SSL, but with no media cert  TSManager   11/11/2014 6:11:26 AM   488 (0x01E8)
[TSMESSAGING] AsyncCallback(): -----------------------------------------------------------------    TSManager   11/11/2014 6:11:26 AM   488 (0x01E8)
[TSMESSAGING] AsyncCallback(): WINHTTP_CALLBACK_STATUS_SECURE_FAILURE Encountered   TSManager   11/11/2014 6:11:26 AM   488 (0x01E8)
[TSMESSAGING]                : dwStatusInformationLength is 4
    TSManager   11/11/2014 6:11:26 AM   488 (0x01E8)
[TSMESSAGING]                : *lpvStatusInformation is 0x8
    TSManager   11/11/2014 6:11:26 AM   488 (0x01E8)
[TSMESSAGING]            : WINHTTP_CALLBACK_STATUS_FLAG_INVALID_CA is set
    TSManager   11/11/2014 6:11:26 AM   488 (0x01E8)
[TSMESSAGING] AsyncCallback(): -----------------------------------------------------------------    TSManager   11/11/2014 6:11:26 AM   488 (0x01E8)
Error. Received 0x80072f8f from WinHttpSendRequest. TSManager   11/11/2014 6:11:26 AM   488 (0x01E8)
hr, HRESULT=80072f8f (e:\nts_sccm_release\sms\framework\osdmessaging\libsmsmessaging.cpp,8919)  TSManager   11/11/2014 6:11:26 AM   488 (0x01E8)
sending with winhttp failed; 80072f8f   TSManager   11/11/2014 6:11:26 AM   488 (0x01E8)
Will retry in 10 second(s)  TSManager   11/11/2014 6:11:26 AM   488 (0x01E8)
Retrying... TSManager   11/11/2014 6:11:36 AM   488 (0x01E8)
CLibSMSMessageWinHttpTransport::Send: URL: svrCM001.domain.site:443  CCM_POST /ccm_system_AltAuth/request   TSManager   11/11/2014 6:11:36 AM   488 (0x01E8)
In SSL, but with no client cert TSManager   11/11/2014 6:11:36 AM   488 (0x01E8)
In SSL, but with no media cert  TSManager   11/11/2014 6:11:36 AM   488 (0x01E8)
[TSMESSAGING] AsyncCallback(): -----------------------------------------------------------------    TSManager   11/11/2014 6:11:36 AM   488 (0x01E8)
[TSMESSAGING] AsyncCallback(): WINHTTP_CALLBACK_STATUS_SECURE_FAILURE Encountered   TSManager   11/11/2014 6:11:36 AM   488 (0x01E8)
[TSMESSAGING]                : dwStatusInformationLength is 4
    TSManager   11/11/2014 6:11:36 AM   488 (0x01E8)
[TSMESSAGING]                : *lpvStatusInformation is 0x8
    TSManager   11/11/2014 6:11:36 AM   488 (0x01E8)
[TSMESSAGING]            : WINHTTP_CALLBACK_STATUS_FLAG_INVALID_CA is set
    TSManager   11/11/2014 6:11:36 AM   488 (0x01E8)
[TSMESSAGING] AsyncCallback(): -----------------------------------------------------------------    TSManager   11/11/2014 6:11:36 AM   488 (0x01E8)
Error. Received 0x80072f8f from WinHttpSendRequest. TSManager   11/11/2014 6:11:36 AM   488 (0x01E8)
hr, HRESULT=80072f8f (e:\nts_sccm_release\sms\framework\osdmessaging\libsmsmessaging.cpp,8919)  TSManager   11/11/2014 6:11:36 AM   488 (0x01E8)
sending with winhttp failed; 80072f8f   TSManager   11/11/2014 6:11:36 AM   488 (0x01E8)
Will retry in 21 second(s)  TSManager   11/11/2014 6:11:36 AM   488 (0x01E8)
Retrying... TSManager   11/11/2014 6:11:58 AM   488 (0x01E8)
CLibSMSMessageWinHttpTransport::Send: URL: svrCM001.domain.site:443  CCM_POST /ccm_system_AltAuth/request   TSManager   11/11/2014 6:11:58 AM   488 (0x01E8)
In SSL, but with no client cert TSManager   11/11/2014 6:11:58 AM   488 (0x01E8)
In SSL, but with no media cert  TSManager   11/11/2014 6:11:58 AM   488 (0x01E8)
[TSMESSAGING] AsyncCallback(): -----------------------------------------------------------------    TSManager   11/11/2014 6:11:58 AM   488 (0x01E8)
[TSMESSAGING] AsyncCallback(): WINHTTP_CALLBACK_STATUS_SECURE_FAILURE Encountered   TSManager   11/11/2014 6:11:58 AM   488 (0x01E8)
[TSMESSAGING]                : dwStatusInformationLength is 4
    TSManager   11/11/2014 6:11:58 AM   488 (0x01E8)
[TSMESSAGING]                : *lpvStatusInformation is 0x8
    TSManager   11/11/2014 6:11:58 AM   488 (0x01E8)
[TSMESSAGING]            : WINHTTP_CALLBACK_STATUS_FLAG_INVALID_CA is set
    TSManager   11/11/2014 6:11:58 AM   488 (0x01E8)
[TSMESSAGING] AsyncCallback(): -----------------------------------------------------------------    TSManager   11/11/2014 6:11:58 AM   488 (0x01E8)
Error. Received 0x80072f8f from WinHttpSendRequest. TSManager   11/11/2014 6:11:58 AM   488 (0x01E8)
hr, HRESULT=80072f8f (e:\nts_sccm_release\sms\framework\osdmessaging\libsmsmessaging.cpp,8919)  TSManager   11/11/2014 6:11:58 AM   488 (0x01E8)
sending with winhttp failed; 80072f8f   TSManager   11/11/2014 6:11:58 AM   488 (0x01E8)
Will retry in 45 second(s)  TSManager   11/11/2014 6:11:58 AM   488 (0x01E8)
Retrying... TSManager   11/11/2014 6:12:44 AM   488 (0x01E8)
CLibSMSMessageWinHttpTransport::Send: URL: svrCM001.domain.site:443  CCM_POST /ccm_system_AltAuth/request   TSManager   11/11/2014 6:12:44 AM   488 (0x01E8)
In SSL, but with no client cert TSManager   11/11/2014 6:12:44 AM   488 (0x01E8)
In SSL, but with no media cert  TSManager   11/11/2014 6:12:44 AM   488 (0x01E8)
[TSMESSAGING] AsyncCallback(): -----------------------------------------------------------------    TSManager   11/11/2014 6:12:44 AM   488 (0x01E8)
[TSMESSAGING] AsyncCallback(): WINHTTP_CALLBACK_STATUS_SECURE_FAILURE Encountered   TSManager   11/11/2014 6:12:44 AM   488 (0x01E8)
[TSMESSAGING]                : dwStatusInformationLength is 4
    TSManager   11/11/2014 6:12:44 AM   488 (0x01E8)
[TSMESSAGING]                : *lpvStatusInformation is 0x8
    TSManager   11/11/2014 6:12:44 AM   488 (0x01E8)
[TSMESSAGING]            : WINHTTP_CALLBACK_STATUS_FLAG_INVALID_CA is set
    TSManager   11/11/2014 6:12:44 AM   488 (0x01E8)
[TSMESSAGING] AsyncCallback(): -----------------------------------------------------------------    TSManager   11/11/2014 6:12:44 AM   488 (0x01E8)
Error. Received 0x80072f8f from WinHttpSendRequest. TSManager   11/11/2014 6:12:44 AM   488 (0x01E8)
hr, HRESULT=80072f8f (e:\nts_sccm_release\sms\framework\osdmessaging\libsmsmessaging.cpp,8919)  TSManager   11/11/2014 6:12:44 AM   488 (0x01E8)
sending with winhttp failed; 80072f8f   TSManager   11/11/2014 6:12:44 AM   488 (0x01E8)
End of retries  TSManager   11/11/2014 6:12:44 AM   488 (0x01E8)
Send (pReply, nReplySize), HRESULT=80072f8f (e:\nts_sccm_release\sms\framework\osdmessaging\libsmsmessaging.cpp,1950)   TSManager   11/11/2014 6:12:44 AM   488 (0x01E8)
failed to send the request  TSManager   11/11/2014 6:12:44 AM   488 (0x01E8)
DoRequest (sReply, false), HRESULT=80072f8f (e:\nts_sccm_release\sms\framework\osdmessaging\libsmsmessaging.cpp,4048)   TSManager   11/11/2014 6:12:44 AM   488 (0x01E8)
Failed to send status message (80072f8f)    TSManager   11/11/2014 6:12:44 AM   488 (0x01E8)
smStatusMessage.Send(), HRESULT=80072f8f (e:\qfe\nts\sms\framework\tscore\utils.cpp,5975)   TSManager   11/11/2014 6:12:44 AM   488 (0x01E8)
Error calling message lib Send(). Code 0x80072f8f   TSManager   11/11/2014 6:12:44 AM   488 (0x01E8)
Non fatal error 0x80072f8f in sending task sequence execution status message to MP  TSManager   11/11/2014 6:12:44 AM   488 (0x01E8)
Set a global environment variable _SMSTSLastActionRetCode=0 TSManager   11/11/2014 6:12:44 AM   488 (0x01E8)
Set a global environment variable _SMSTSLastActionSucceeded=true    TSManager   11/11/2014 6:12:44 AM   488 (0x01E8)
Expand a string: %_SMSTSMDataPath%\Logs TSManager   11/11/2014 6:12:44 AM   488 (0x01E8)

This issue ended up remaining specifically unresolved. Although the issue clearly pointed to certificate authentication problems, the exact same boot wim worked fine for PXE booting, USB booting and booting when pre-cached.

As a result, the 'solution' for our deployment was to change the delivery of the Task Sequence to 'Download all contents locally before starting task sequence'. This forced end-points to download the boot wim while still in windows, avoiding any authentication issues once in WinPE.

Cheers