Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
The code in the title, 0X080004005, appears to contain a typo. The Configuration Manager task-sequence failure documented by Microsoft is 0x80004005. That value is a generic result, not a diagnosis. In the best-known scenario, WinPE cannot retrieve policy because HTTPS management-point communication fails certificate-authority validation; the useful evidence is in smsts.log, often alongside WinHTTP 0x80072f8f and WINHTTP_CALLBACK_STATUS_FLAG_INVALID_CA. Preserve the log, identify the first actionable error, then correct the PKI/media-site mismatch or the network, time, certificate, identity, boundary, content, or permission problem the log actually shows.
What does 0x80004005 mean in SCCM?
0x80004005 means that the task sequence ended with an unspecified failure after an earlier operation failed. When the Task Sequence Wizard is retrieving policy, the displayed code does not tell you whether the failure is caused by a certificate, an unreachable management point, an invalid client identity, missing content, or another prerequisite.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsIn Microsoft’s documented case, the visible result appears after WinPE cannot establish trusted HTTPS communication with a management point. The surrounding smsts.log contains 0x80072f8f, WINHTTP_CALLBACK_STATUS_FLAG_INVALID_CA, and messages about failing to query or select a management point. Those lines identify a certificate-authority trust problem; the generic 0x80004005 alone does not.
Do not treat the code as proof of a bad hard drive, a broken USB stick, or malware. Treat it as a pointer to the log and the deployment topology.
Popular on Amazon
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
What should I record before rebooting the failed computer?
Rebooting can remove the most useful diagnostic context. Photograph or transcribe the Task Sequence Wizard screen and preserve the log before trying another deployment.
- The exact hexadecimal value, including capitalization and any leading characters.
- The complete message shown with the code, the task-sequence name, and the action that was running.
- Whether the deployment used PXE, bootable media, standalone media, or prestaged media.
- The management-point host name, URL, and whether it uses HTTP or HTTPS.
- The site where the media was created: a central administration site or a primary site.
- The computer’s date and time, deployment time, and whether the failure is repeatable on another device.
- Any visible network, certificate, identity, or content messages.
In early WinPE, Microsoft documents the log at X:WindowsTempSMSTSLogsmsts.log. Other deployment phases use different locations, so use the path appropriate to the stage shown in the log. Copy the file to another USB drive or network location before restarting if possible.
How do I find the real cause in smsts.log?
Search from the beginning of the failure and work forward to the first error that explains why the next operation could not run. Later lines often repeat the consequence as 0x80004005.
Look for certificate and management-point failures
In the Microsoft scenario, search for these exact strings:
WINHTTP_CALLBACK_STATUS_FLAG_INVALID_CA80072f8fFailed to get client identityFailed to query Management Point locatorFailed to select MP
An invalid-CA message means the WinPE environment does not trust the certificate chain presented by the HTTPS management point. The identity and management-point messages show the effect of that trust failure during policy retrieval.
Separate a policy problem from a transport problem
If those certificate strings are absent, inspect the lines immediately before the generic code for a failed name lookup, connection timeout, authentication failure, content-location error, boundary decision, or task-sequence permission error. The same result code can follow very different failures, so changing PKI settings without matching log evidence can make a working deployment worse.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Also popular on Amazon
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Why does HTTPS media created at a central administration site fail?
When a hierarchy uses PKI and HTTPS management points, task-sequence media must contain the root certificate-authority information needed to validate the management point. Microsoft documents a topology in which bootable or prestaged media created at the central administration site lacks that required root-CA information. WinPE then rejects the HTTPS certificate and the wizard reports the generic 0x80004005.
This is a media-creation issue, not evidence that the management point’s certificate is automatically invalid. The same certificate can work for clients that already have the correct trust chain while failing for newly booted media that does not.
What is Microsoft’s correction?
- Confirm in
smsts.logthat the invalid-CA and management-point errors match the documented pattern. - In Configuration Manager, create new bootable or prestaged media at a primary site rather than at the central administration site.
- Recreate the media after selecting the intended task sequence, distribution points, and certificate settings.
- Boot the target computer from the newly created media and verify that policy retrieval proceeds past the previous failure.
Microsoft also states that dynamic media can be created at any site for use across multiple sites when the hierarchy’s root-CA requirements are satisfied. Use that option only when the environment has been configured to provide the required root certificate information; the log and site configuration should confirm that it is appropriate.
What should I check if the log does not show an invalid CA?
Do not recreate media blindly. Work through the following checks in the order that matches the first actionable log line.
Recommended Free Tools
Verify network reachability
Confirm that WinPE has the correct network adapter driver and an IP address, gateway, and DNS configuration. Check that the management-point host name resolves from the deployment network and that firewalls allow the required management-point traffic. A device that boots successfully can still lose connectivity when it changes network ports or VLANs during deployment.
Check system time
Compare the computer’s clock with the time source used by the Configuration Manager infrastructure. A substantially incorrect clock can make an otherwise valid certificate appear not yet valid or expired and can break authenticated communication. Correct the time, reboot WinPE if necessary, and capture a fresh log.
Also popular on Amazon
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Validate the certificate chain
For HTTPS management points, verify the certificate subject or subject-alternative name matches the management-point name used by the media. Check the validity dates, the issuing chain, and whether the root and intermediate authorities are trusted in the WinPE context. A certificate can be valid on an administrator’s workstation while its root CA is absent from the boot media.
Confirm client identity and certificates
If the log reports Failed to get client identity, verify that the media contains the intended client certificate information and that the certificate is usable for Configuration Manager authentication. Check for an expired certificate, a missing private key, or a certificate issued by a CA that the deployment environment does not trust.
Free tools Windows power users keep installed
One-click scans. No signup required.
Review site assignment and boundaries
Ensure that the network from which the computer is deploying is represented by the correct boundary and boundary group. A device can reach a server yet receive no suitable management-point or distribution-point location when its boundary configuration is incomplete.
Check content and permissions
Verify that the task sequence, boot image, operating-system image, drivers, and packages are distributed to an available distribution point. Confirm that the deployment is available to the account or collection used by the device and that the task sequence has not been disabled or expired. Content-location errors usually appear earlier in the log than the final generic code.
Which SCCM media type should I use?
The right media depends on network availability, PKI topology, whether the computer can boot WinPE, and whether deployment content must travel with the device.
| Media or method | Network and content behavior | When it fits | Important diagnostic focus |
|---|---|---|---|
| PXE or online deployment | Starts WinPE from the network and retrieves policy and content from Configuration Manager infrastructure. | The device can reach the PXE responder, management point, and distribution point during deployment. | Network adapter drivers, DHCP or PXE reachability, boundaries, management-point protocol, and the first smsts.log error. |
| Bootable media | Starts WinPE from USB or another supported boot device, then normally retrieves the task sequence and content over the network. | The computer cannot use PXE or you need a repeatable physical boot method. | Media creation site, root-CA information, HTTPS trust, and network access after WinPE starts. |
| Standalone media | Carries the task sequence and required content locally instead of retrieving all deployment content from the network. | Network availability is limited or the deployment must run with locally carried content. | Media capacity, content freshness, task-sequence version, and any remaining management-point or authentication requirement shown in the log. |
| Prestaged media | Places an operating-system image on the disk before the normal provisioning sequence runs. | You want to stage the image ahead of time and finish provisioning later. | Creation site and PKI trust, image applicability, disk state, and the point at which the provisioning sequence fails. |
| Dynamic media | Can be created at any site for multi-site use when the hierarchy’s root-CA conditions are met. | A single media set must work across sites with a correctly configured common root CA. | Root-CA requirements and the management point selected for the device’s boundary. |
USB flash drives are supported task-sequence media. Microsoft describes media as a way to capture an operating-system image from a reference computer or deploy an operating system to a destination computer. Media is especially useful when the installed operating system is missing or unusable and the computer cannot start the normal client.
Also popular on Amazon
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
How do I recreate bootable or prestaged media safely?
Recreation should follow the confirmed cause, not replace diagnosis. Use a change record so you can compare the new run with the preserved failure.
- Correct the identified issue first: create the media at a primary site for the documented central-administration-site PKI case, or repair the network, time, certificate, boundary, content, or permission problem indicated by the log.
- Open the Configuration Manager console at the site that should own the media and start the appropriate task-sequence media wizard.
- Select bootable or prestaged media as required by the deployment design. If using USB, verify that the drive is large enough for the selected boot image and any content the wizard will copy; the required capacity depends on those selections.
- Choose the task sequence and distribution points deliberately. Confirm that the boot image, operating-system image, drivers, and packages are current and distributed.
- Apply the certificate and trust settings required by the HTTPS management points. For the documented PKI topology, ensure the media is created at a primary site so the necessary root-CA information is included.
- Label the new media with its creation date, site, task-sequence version, and intended environment. Keep the failed media separate so it cannot be mistaken for the corrected set.
- Boot a test computer, record the management point selected, and preserve the new
smsts.logif the run fails. - Compare the first actionable error in the new log with the old one. A successful correction should show policy retrieval and allow the sequence to advance beyond the original failing action.
Can a bootable USB fix an SCCM policy-retrieval failure?
A USB drive can solve a boot-path problem, such as a computer that cannot PXE boot, but it does not automatically solve HTTPS trust or management-point access. Bootable media still needs the certificate-authority information and network path required by the selected deployment design. If the log shows WINHTTP_CALLBACK_STATUS_FLAG_INVALID_CA, create corrected media rather than simply copying the same files to another USB drive.
Use standalone media when carrying the task sequence and required content locally is more important than retrieving everything over the network. Use bootable media when you need a lightweight WinPE launcher and the deployment network can provide policy and content.
What if the task sequence still fails after the media is corrected?
Preserve the new log and identify whether the failure moved to a different action. If policy retrieval now succeeds, the original PKI issue is likely resolved and the remaining problem is downstream, such as unavailable content, an image mismatch, a driver issue, a boundary assignment, or a task-sequence permission. If the same invalid-CA lines remain, confirm that the test actually used the newly created media and that the selected management point presents the expected certificate chain.
Test with a second device or network segment only after recording the first result. A comparison can distinguish a media-wide problem from a boundary, switch, adapter, or device-specific condition without losing the original evidence.
What does Microsoft say about task-sequence media?
“You can use media to capture an OS image from a reference computer or to deploy an OS to a destination computer in your Configuration Manager environment.”
Also popular on Amazon
Sale
Anker USB C Hub, 5-in-1 USBC to HDMI Splitter with 4K Display | 85W Max PD, 1 Powered USB-C 5Gbps & 2 Powered USB-A 3.0 5Gbps Data Ports, for MacBook Pro, MacBook Air, Dell and More (Black)
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Microsoft’s documented remediation for the central-administration-site PKI scenario is: “To fix the issue, create the bootable media or prestaged media at a primary site instead of at the central administration site.” These statements describe the role of media and the site-location correction; they do not make 0x80004005 a standalone diagnosis for every deployment.
For unrelated local Windows problems discovered during troubleshooting, Outbyte PC Repair is an optional shortcut that can address more than 100 common Windows issues, clean temporary and cache files, check selected Windows settings and missing updates, and provide an app-crash log. It complements antivirus software rather than replacing it, results vary, and it cannot repair every Configuration Manager, certificate, or task-sequence failure; a free trial is available by category for at least two days before a subscription is required.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Frequently Asked Questions
Is 0x80004005 in SCCM a hardware failure?
Not by itself. The value is a generic task-sequence result, and Microsoft’s documented example is an HTTPS certificate-authority trust failure; consider hardware only when the log contains device, storage, or driver errors that precede the code.
Can I repair the problem without rebuilding the media?
Sometimes. Network reachability, time, boundary, content, and permission errors may be corrected in the environment, but the documented PKI mismatch requires new bootable or prestaged media created at a primary site.
Where is smsts.log after the computer restarts?
The location changes with the deployment phase. In early WinPE it is commonly X:WindowsTempSMSTSLogsmsts.log; capture it before rebooting because the temporary WinPE volume and its log may not persist.
Why does dynamic media work across multiple sites?
Dynamic media is designed for multi-site use when the hierarchy’s root-CA requirements are satisfied. It still depends on correct boundary selection, certificate trust, and management-point availability at the site where the device deploys.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Should I choose standalone media instead of bootable media?
Choose standalone media when carrying the task sequence and required content locally is necessary or network access is constrained. Choose bootable media when the device can reach Configuration Manager infrastructure and you want policy and content retrieved from the network.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
