“GetDPLocations failed with error 0x80072efe” usually means the Configuration Manager client could not complete an HTTP or HTTPS request to its management point while asking for distribution-point locations. The code is WININET_E_CONNECTION_ABORTED: the connection ended unexpectedly. It does not, by itself, prove that a distribution point is missing, content is undistributed, the boundary group is wrong, or that the client must be reinstalled.
Start with the management-point hostname, protocol, port, firewall path, IIS/management-point health, proxy, TLS and certificate configuration. Validate boundaries and distribution-point content after basic management-point communication works.
What the error means
During client bootstrap, ccmsetup.exe identifies a management point, sends a location request, and receives distribution-point information based on the client’s site and boundary groups. The client then obtains the installation package. If the management-point request is interrupted, setup records GetDPLocations failed.
Microsoft documents 0x80072EFE as an abnormally terminated connection; proxy, TLS, cipher-suite and other transport conditions can cause it. See Microsoft’s explanation of 0x80072EFE. In Configuration Manager, the error commonly appears during management-point communication, not necessarily during a direct distribution-point transfer.
Recommended Free Tools
#1 Best Overall
- Get NVMe solid state performance with up to 1050MB/s read and 1000MB/s write speeds in a portable, high-capacity drive(1) (Based on internal testing; performance may be lower depending on host device & other factors. 1MB=1,000,000 bytes.)
- Up to 3-meter drop protection and IP65 water and dust resistance mean this tough drive can take a beating(3) (Previously rated for 2-meter drop protection and IP55 rating. Now qualified for the higher, stated specs.)
- Use the handy carabiner loop to secure it to your belt loop or backpack for extra peace of mind.
- Help keep private content private with the included password protection featuring 256‐bit AES hardware encryption.(3)
- Easily manage files and automatically free up space with the SanDisk Memory Zone app.(5). Non-Operating Temperature -20°C to 85°C
A boundary-group error can produce an empty or unsuitable location response, but it does not explain every occurrence of this code. Treat communication and resource selection as separate diagnostic branches.
Read the right logs first
Client logs
C:WindowsccmsetupLogsccmsetup.log— primary log for a new installation.C:WindowsCCMLogsLocationServices.log— location and management-point requests.C:WindowsCCMLogsCcmMessaging.log— communication with the management point.C:WindowsCCMLogsClientIDManagerStartup.log— identity and registration.C:WindowsCCMLogsClientLocation.log— site and boundary evaluation.C:WindowsCCMLogsCCMHTTP.log, when present — HTTP transport details.C:WindowsCCMLogsCAS.log,ContentTransferManager.logandDataTransferService.log— content acquisition after location succeeds.
For a fresh install, begin with ccmsetup.log. Once a client is partially installed, correlate LocationServices.log and CcmMessaging.log.
Management-point evidence
- IIS access logs, commonly under
C:inetpublogsLogFilesW3SVC*. - Configuration Manager site-system and management-point logs under the site installation’s
SMSLogsdirectory. - Management-point and site-component status in the Configuration Manager console.
Search for combinations such as GetDPLocations failed with error 0x80072efe, Failed in WinHttpReceiveResponse API, receiving response with winhttp failed; 80072efe, and requests to /ccm_system/request. Record the MP FQDN, HTTP or HTTPS, port, proxy mode, secondary WinHTTP code and timestamp. A timeout (0x80072ee2), name-resolution failure (0x80072ee7), certificate error, HTTP 401/403, and HTTP 500/503 require different fixes.
Run transport tests from the affected client
Replace the example name with the exact management-point hostname shown in the logs. Test the same protocol and port that Configuration Manager uses.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsRank #2
- Solid state performance with up to 800MB/s read speeds in a portable drive. (Based on internal testing; performance may be lower depending on host device, interface, usage conditions and other factors. 1MB=1,000,000 bytes.)
- Back up your content and memories on a storage solution that fits seamlessly into your mobile lifestyle.
- Take it with you on your adventures—up to two-meter drop protection means this durable drive can take a beating. (Based on internal testing.)
- Secure it to your belt loop or backpack for extra peace of mind thanks to the tough rubber hook.
- From Sandisk, a brand professional photographers trust to take on assignments.
Resolve-DnsName MP01.contoso.comandnslookup MP01.contoso.com— verify DNS and suffix handling.Test-NetConnection MP01.contoso.com -Port 80andTest-NetConnection MP01.contoso.com -Port 443— verify TCP reachability. Do not infer success from a different port.curl.exe -Iv http://MP01.contoso.com/orcurl.exe -Iv https://MP01.contoso.com/— inspect HTTP status, certificate and TLS negotiation.netsh winhttp show proxy— identify the machine/service proxy path.
- DNS failure points to name resolution, suffix or an incorrect MP name.
- TCP failure points to routing, firewall, listener, VPN or load-balancer reachability.
- TCP success with TLS failure points to certificates, trust, cipher suites or inspection.
- Successful curl with Configuration Manager failure leaves client proxy context, authentication, certificate selection and request-specific behavior to investigate.
A browser test is not conclusive: the interactive user may use a different proxy, certificate store and authentication context than the Configuration Manager service.
Fix firewall, routing and inspection failures
Check Windows Firewall on both endpoints, network firewalls, load balancers, reverse proxies, TLS inspection, WAN optimization, VPN split tunneling, NAT and asymmetric routing. Compare a working and failing client in the same boundary, then compare another subnet.
Correlate the failing client’s source IP and timestamp in IIS. No IIS entry means traffic did not reach that server or the client used another endpoint. If a controlled firewall test makes the error disappear, re-enable protection and create the narrow rule required for the documented management-point traffic; disabling a firewall is not a permanent remediation.
An exact case involving this error reported a central firewall as the cause, but that is an example rather than proof for every environment. See the reported Configuration Manager case.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallRank #3
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Resolve proxy, TLS and certificate problems
Confirm whether internal MP names should bypass the proxy. A proxy may be unable to reach the MP, terminate and re-encrypt TLS, close the session, or apply different policy to different subnets. Do not change WinHTTP globally without first establishing the intended design.
In HTTPS or certificate-based deployments, open certlm.msc and inspect Local Computer → Personal → Certificates, along with trusted root and intermediate stores. Verify the selected certificate is current, has the required EKU and private key, chains to a trusted CA, and matches the MP name through its subject or SAN. Check IIS bindings and whether an inspection appliance is replacing the server certificate. Do not delete certificates based on forum advice alone.
Compare client and server TLS versions and cipher suites. Microsoft’s 0x80072EFE guidance documents restrictive cipher-suite policy as a possible secure-channel cause; in Configuration Manager this is a transport diagnosis, not proof of a product defect.
Check management-point and IIS health
Review MP role status, site-component status, IIS application pools, server-side MP logs, bindings and recent certificate or TLS changes. Interpret IIS results carefully:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #4
- NEARLY 2X FASTER THAN OUR PREVIOUS GENERATION(8) – move 1,000 high-res photos in under 60 seconds(6) with up to 2000MB/s transfer speeds(2).
- IP65 RATING AND UP TO 3M DROP PROTECTION(3) – protects against spills and drops.
- POCKET-SIZED – fits easily in pockets and small bags.
- SPACE TO OWN YOUR AI CONTENT – speed and capacity to download your high-res clips and photo edits.
- 256-BIT AES ENCRYPTION(4) – helps keep private files secure with password protection.
| Observation | Likely area | Next check |
|---|---|---|
| No IIS request | Network path or wrong endpoint | Verify FQDN, routing, VIP and firewall logs. |
| 401 or 403 | Authentication or IIS configuration | Check client identity, permissions and MP authentication. |
| 404 | Missing or incorrect MP endpoint | Validate MP role and IIS virtual directories. |
| 500 or 503 | MP, IIS or application-pool failure | Repair server-side health and review component logs. |
| 200 but client reports an abort | Truncated response, proxy, TLS or wrong backend | Correlate source IP, URL, timestamp and response completion. |
An HTTP 200 in IIS does not guarantee that the client received and accepted the complete Configuration Manager response. One documented example shows 200 responses alongside client communication errors; see the IIS and client-log case.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Validate site assignment and boundary groups
Use ClientLocation.log and LocationServices.log to confirm the assigned site code, selected MP, intranet or internet state, current IP address, active adapter and boundary. VPN adapters and multiple NICs can change the apparent subnet. A valid site code does not prove that the client can register with its MP.
In the console, verify that:
- the client’s current boundary is defined correctly;
- the boundary belongs to the expected boundary group;
- a usable DP is associated with that group or an intentional fallback group;
- the Configuration Manager client package is distributed successfully to that DP;
- the DP supports the client’s HTTP, HTTPS or Enhanced HTTP configuration.
Clients use current network location and boundary-group configuration to select site resources. See Microsoft’s documentation on management-point boundary groups, distribution-point boundary groups, site assignment and resource discovery.
An empty location response generally indicates boundary, fallback or content-distribution configuration. It is different from a request that is aborted before a location response can be processed.
Best Value
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Use explicit installation parameters as controlled tests
Specify a known-good MP to bypass ambiguous discovery:
ccmsetup.exe /mp:MP01.contoso.com SMSSITECODE=ABCTo bypass DP download for the setup files, use a valid local source and permissions:
CM01
elevant?SMS_ABC?Client
elevant?ccmsetup.exe /source:"CM01
elevant?SMS_ABC?Client" SMSSITECODE=ABCUse the actual UNC path; the illustrative command above should be entered with normal backslashes, for example:
\CM01SMS_ABCClientccmsetup.exe /source:"\CM01SMS_ABCClient" SMSSITECODE=ABC/mp selects the management point used for bootstrap; /source supplies installation files. A local source can avoid a DP download during setup, but the installed client still needs management-point communication. Microsoft describes these behaviors in its client installation and boundary-group documentation.
Free tools Windows power users keep installed
One-click scans. No signup required.
When client repair or reinstallation is justified
Repair only after DNS, TCP, TLS, proxy, MP health and boundary configuration are sound. Reinstallation is reasonable when client binaries are damaged, WMI corruption under rootccm is independently confirmed, installation remains incomplete after connectivity is fixed, or stale identity and certificate state have a supported remediation plan.
Reinstallation will not fix a blocked port, broken DNS, an unhealthy MP, failed TLS negotiation, an incorrect site assignment or a DP absent from the client’s boundary group.
Quick Recap
Decision table
| Observation | Most likely area | Action |
|---|---|---|
| MP name does not resolve | DNS or wrong MP | Correct DNS, suffix or MP configuration. |
| TCP 80/443 fails | Firewall, routing, listener or VPN | Trace the path and policy. |
| TCP succeeds, TLS fails | Certificate, TLS, cipher suite or inspection | Compare working client and server policy. |
| Only one subnet fails | Boundary, firewall, routing or VPN | Compare with a working subnet. |
| All clients fail | MP, hierarchy or common security policy | Check MP health and recent global changes. |
| Location response is empty | Boundary group or content distribution | Associate a DP and distribute the client package. |
| Local source works, normal install fails | DP location or distribution path | Fix MP discovery, boundaries or DP content. |
| Install completes but client remains unregistered | MP communication, certificate, identity or assignment | Review CcmMessaging.log, ClientIDManagerStartup.log and MP logs. |
References
- Microsoft Configuration Manager deployment and download log reference
- Install and configure distribution points
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
