How to install SCCM Client on Workgroup Computers

Jonathan LefebvreSCCM6 Comments

Recently, at a client site, I was asked to install the SCCM client to manage workgroup servers in the DMZ with SCCM.

Following our a recent post on how to install a DP/MP/SUP in untrusted domain, I thought that documenting the process could be helpful.

In this post, we will detail how to install the SCCM client on workgroup computers.


  • The client must be able to resolve the FQDN of the management point.
    • Depending on network security, it might not actually ping. The important is that it can associate the FQDN to the IP of the management point.
    • Adding an entry to the Host file might be required.
  • Port
    • Client -> Management point : TCP 80 or 443
    • Client -> Software Update Point : TCP 8530 or 8531
    • More details on SCCM ports requirement, here
  • Manual installation of the SCCM client
    • There is no way to use the Client Push Installation for workgroup computers
    • Management Point must be provided in the install command line, as the client will not be able to find it in Active Directory
    • Site code must be provided in the install command line

SCCM Client Install Workgroup Computers

  • Copy the source of SCCM client locally on the computer

SCCM Client Install Workgroup Computers

  • Open a command prompt as Administrator

SCCM Client Install Workgroup Computers

  • Set the working directory and run the CCMsetup command line
    • ccmsetup.exe /mp:<Management Point FQDN> SMSSITECODE=001 SMSMP=<Management Point FQDN> DNSSUFFIX=<domain suffix>

SCCM Client Install Workgroup Computers

  • Validate Management Point configuration and communication
    • When a client can’t resolve the FQDN of the management point, it might show up empty

SCCM Client Install Workgroup Computers

  • Action are limited as the client is not yet approved to connect to the SCCM server.

  • Important logs at this point are
    • C:\Windows\CCM\Logs\ClientLocation.log
    • C:\Windows\CCM\Logs\LocationServices.log
    • Those logs provide details to the connection to the management point
    • If you see any error at this point, you are missing connection prerequisites of some sort.
  • Client show up in the SCCM console

SCCM Client Install Workgroup Computers

Approve Workgroup Computer Client in SCCM

In most environment, SCCM client approval method is set to Automatically approve computers in trusted domains.

This settings can be found under Administration / Site Configuration / Sites / Hierarchy Settings

When using this settings, workgroup computers will not be automatically approved for this SCCM site.

With this said, we need to approve clients once they show up in the SCCM console.

  • The ease management, we first create a Collection for Not Approved clients.
    • Be sure to set the limiting collection to All System, as the not approved clients don’t have much information to based query on.
[su_box title=”Collection Unapproved clients” style=”glass” title_color=”#F0F0F0″]


SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_CM_RES_COLL_SMS00001 on SMS_CM_RES_COLL_SMS00001.ResourceId = SMS_R_System.ResourceId where SMS_CM_RES_COLL_SMS00001.IsApproved= ‘0’

  • To validate the Not Approved status, simply add the column Approved

  • To approve a client, right-click on the client and select Approve

  • Confirmation of approval

  • The approved column will change to Approved

  • After a couple minutes, SCCM agent will have all is action available

  • Client will show online and will eventually start reporting inventory

For more details about the approval methods, click here 


6 Comments on “How to install SCCM Client on Workgroup Computers”

  1. This worked well for me. Thank you. I installed using the command cmsetup / SMSSITECODE=RAN

  2. Nice job here.

    I would change the command:
    ccmsetup.exe /mp: SMSSITECODE=001 SMSMP= DNSSUFFIX=

    ccmsetup.exe /source:”C:\Temp\SCCMClient” SMSSITECODE=001 SMSMP= DNSSUFFIX=

    The /mp option tells the ccmsetup.exe to query the MP from a DP to download the client.msi and prereqs. Since you have all the installation and prereqs in your PC, you do not have to download it again.


  3. I have done the same but unable to push any software to the workgroup computer. Is there any steps that i need to take that might be missing ? What logs do i look at to see the issue.

    1. Hi Matthew – i am facing the same issue – did you manage to push out the software updates to workgroup clients?

  4. Hello Jonathan,

    Good tutorial, thank you.

    What aboyt updating LMHOSTS file on each client first in order to allow for name resolution, isn’t this needed anymore ?

    Siteserver #PRE
    “SMS_SLP \0x1A” #PRE
    “SMS_MP \0x1A” #PRE
    “SMS_NLB \0x1A” #PRE (Only needed if the MP is load balanced)

    Also there must be 20 characters between the quotation marks for each entry.

Leave a Reply

Your email address will not be published. Required fields are marked *