The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Failed to run task sequence 0x80004005 is a generic Configuration Manager (SCCM) failure, not a diagnosis. The reliable fix is to open the SMSTS.log for the phase that failed, find the first specific error before 0x80004005, and follow the matching branch. A policy-retrieval failure, PXE networking problem, unavailable content, authentication issue, Sysprep defect, and MDT console error can all end with the same code.
Do not start by replacing drivers, recreating an image, or changing PKI settings at random. Capture the log, identify the failing step and protocol, then correct that dependency. The procedure below covers WinPE, PXE, policy retrieval, content distribution, Network Access Account use, image application, Sysprep capture, MDT integration, and controlled debugging.
As an Amazon Associate I earn from qualifying purchases.
What 0x80004005 means in a task sequence
HRESULT 0x80004005 means an unspecified failure. Configuration Manager often displays it after a lower-level operation has already failed, so the code alone cannot tell you whether the problem is certificates, networking, a distribution point, an image, a script, or a WMI registration. The useful evidence is the first meaningful failure in SMSTS.log immediately before the generic code.
Record the task-sequence phase, step name, URL or content ID, HRESULT, and access method. A failure while retrieving policy over HTTPS needs a different remedy from a driver failure while booting WinPE or a package that is absent from the device’s boundary-group distribution point.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Capture the correct SMSTS.log first
The log location changes as the device moves from WinPE to the newly installed operating system and then to the installed Configuration Manager client. Microsoft documents these default locations:
| Task-sequence phase | Default path |
|---|---|
| WinPE, before Format and Partition Disk | X:WindowsTempsmstslogsmsts.log |
| WinPE, after the disk is formatted | X:smstslogsmsts.log, then C:_SMSTaskSequenceLogssmstslogsmsts.log |
| New operating system, before the client is installed | C:_SMSTaskSequenceLogssmstslogsmsts.log |
| After the Configuration Manager client is installed | C:WindowsCCMLogssmstslogsmsts.log |
| After the task sequence has completed | C:WindowsCCMLogssmsts.log |
The read-only task-sequence variable _SMSTSLogPath contains the active log path. In WinPE, press F8 if command support is enabled, open a command prompt, and copy the log to removable storage or a network share before rebooting. If the disk is repartitioned, the earlier X: copy can disappear, so preserve it before continuing.
How to read the failure
- Search upward from the final 0x80004005 entry until you reach the first failed action, HRESULT, WinHTTP code, HTTP status, or content-location message.
- Write down the exact step name, package or application name, content ID, management point or distribution point, and whether the connection used HTTP, HTTPS, SMB, or multicast.
- Note whether the device was in PXE/WinPE, the pre-client operating system, or the post-client operating system.
- Compare the failing operation with the branches below. Apply only the branch that matches the evidence.
Use the failure phase to choose the right branch
| What the log or screen shows | Most likely area to check |
|---|---|
Stuck at “Retrieving policy for this computer”; WinHTTP 0x80072F8F |
HTTPS certificate chain, root CA, or media created at the wrong site |
| PXE starts but WinPE has no address or cannot see storage | NIC or storage drivers, boot-image architecture, PXE distribution-point settings |
| Content-location, download, or package errors | Distribution status, boundary groups, peer cache, or unreachable distribution point |
| Direct distribution-point, multicast, or SMB fallback access fails | Network Access Account configuration and permissions |
| Failure occurs during Sysprep and capture | Capture script and the exact LTIApply.wsf step |
| Failure appears while creating an MDT task sequence in the console | Unregistered BDD_* WMI classes and MDT console integration |
Fix policy retrieval and HTTPS/PKI failures
Microsoft documents a specific pattern in which the wizard remains at Retrieving policy for this computer, SMSTS.log reports WinHTTP secure-connection failure 0x80072F8F, and the site uses PKI with HTTPS management points. The visible 0x80004005 is only the downstream symptom.
Why the documented case occurs
The root certification authority is configured at the primary site but is missing from bootable or prestaged media created at a central administration site. WinPE therefore cannot build a trusted certificate chain to the HTTPS management point and policy retrieval fails.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Remediation
- Confirm in SMSTS.log that
0x80072F8Fappears before 0x80004005 and that policy retrieval, rather than content download, is failing. - Check which site created the bootable or prestaged media. Do not assume that media made at a central administration site contains the same certificate configuration as media made at a primary site.
- Recreate the bootable or prestaged media at the affected primary site so the required root CA information is included.
- Replace the old media, boot the device again, and verify that policy retrieval progresses past the point where it previously stopped.
For media intended to work across sites, Microsoft says dynamic media can be created at any site. Use that option when it fits the deployment design, then retest with the same management-point and certificate conditions shown in the log. Do not apply this remedy when the log shows a missing package, a driver error, or a PXE address problem; those are separate branches.
Repair PXE and WinPE initialization
Microsoft calls SMSTS.log the most useful resource for PXE troubleshooting. A device can successfully contact the PXE service yet still fail in WinPE because the boot image lacks the network or storage driver required by that hardware.
Verify WinPE networking
- At the WinPE screen, press
F8to open a command prompt if command support is enabled. - Run
IPCONFIG. Confirm that the intended NIC has a valid address, subnet mask, gateway, and (where required) DNS information. - If the adapter is absent or shows no usable address, identify the exact hardware model and NIC hardware ID. A wireless adapter is generally not a substitute for the wired or firmware-supported interface expected by PXE.
- Review SMSTS.log for DHCP, network initialization, management-point discovery, and certificate errors before changing the task-sequence steps.
Update the boot image correctly
- Import only the required NIC and storage drivers into the boot image. A smaller, targeted driver set is easier to test than an uncontrolled collection.
- Ensure both x86 and x64 boot images exist when the environment still supports both architectures and that the architecture required by the device is available.
- Distribute the updated boot image to the PXE-enabled distribution point.
- Verify the deployment setting that makes the boot image available through PXE, then force a fresh network boot so the device does not reuse an older image.
If WinPE has an address and can reach the management point but fails later, stop treating the incident as a NIC problem. The next specific log entry may point to policy, content, authentication, or an image step.
Recommended Free Tools
Resolve content and distribution-point failures
When a task sequence references an operating-system image, boot image, driver package, application, or other package, every item must be distributed and reachable from the device’s location. A generic 0x80004005 can appear after the content-location request or after the download has already failed.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Understand the content search order
Configuration Manager attempts content acquisition in this order, subject to deployment settings:
- Peer cache.
- Distribution points in the device’s current boundary group.
- Distribution points in a neighbor boundary group.
- The site-default boundary group.
That order explains why one device can complete a sequence while another fails: the devices may resolve different content sources or have different boundary-group relationships.
Content checklist
- In the task-sequence editor, list every referenced package, OS image, boot image, driver package, and application.
- For each item, confirm that distribution has completed successfully and that the content is available on at least one distribution point eligible for the device.
- In SMSTS.log, note the requested content ID and the location source returned. Compare it with the device’s IP range and boundary-group membership.
- Check that the distribution point is reachable over the protocol selected by the deployment. A source that is available over HTTP is not automatically available over SMB or HTTPS.
- Redistribute or update the specific content that is missing or stale, then wait for distribution to complete before retrying.
Do not redistribute every package as a first response. The content ID and location-source lines usually identify the single object that needs correction.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteCheck the Network Access Account only where it is required
The Network Access Account (NAA) supplies credentials for particular network-resource operations; it is not the security context used to run task-sequence programs. Microsoft states that the NAA is still required for multicast, direct distribution-point access requested by the task sequence, direct OS-image access, some Request State Store scenarios, and SMB fallback when HTTP or HTTPS download fails.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
When to investigate NAA credentials
- SMSTS.log shows that the task sequence is attempting one of those operations and authentication fails.
- The same content works over HTTP or HTTPS but fails when the client falls back to SMB.
- A state-store or image-access step fails before the operating system has a usable domain or local service identity.
What to verify
- Confirm that the account configured for NAA is enabled, has not expired, and is permitted to read the required share or distribution-point resource.
- Check that the task sequence is actually using an access method that needs NAA; do not change NAA to fix an unrelated certificate or driver error.
- Review the exact authentication and share-access error in SMSTS.log, then test the same path from the relevant deployment network.
Because NAA is for network access, granting it extra rights does not fix a program that fails under the task-sequence execution context.
Investigate Sysprep-and-capture failures
A 0x80004005 during Sysprep and capture has a documented, narrowly scoped cause involving the MDT script LTIApply.wsf. Microsoft describes a failure in which the script does not check whether the boot folder exists before invoking takeown.exe.
- Open SMSTS.log and confirm that the failing step is the Sysprep-and-capture sequence, not image application or content acquisition.
- Record the exact
LTIApply.wsfversion and the command line shown in the log. - Compare the script and boot-folder condition with the documented issue. Do not apply this remedy solely because the final HRESULT is 0x80004005.
- Correct the script or task-sequence implementation only after that comparison, then run a controlled capture on a clean test device.
If the log instead identifies a pending reboot, an application, a package, or a different script, troubleshoot that first. A narrowly targeted Sysprep fix will not repair a generic capture environment problem.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsFix MDT task-sequence creation errors in the console
There is a separate failure mode in which the error appears while creating an MDT task sequence in the Configuration Manager console, before any device executes it. Microsoft attributes this case to unregistered BDD_* WMI classes.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
- Close all Configuration Manager and related administrative consoles.
- Open the MDT integration configuration through Configure ConfigMgr Integration.
- Remove the MDT console extensions.
- Run the integration process again so the extensions and their WMI registrations are installed.
- Reopen the console and retry the task-sequence creation wizard.
This branch does not apply to a task sequence that already booted a device and then failed. For execution failures, return to the SMSTS.log from the affected device.
Use the task-sequence debugger for controlled isolation
The Configuration Manager task-sequence debugger is a troubleshooting tool for debug deployments to small collections. It can step through actions, set breakpoints, inspect variables, open a command prompt in WinPE, and open SMSTS.log at the failing point.
Prepare a safe debug deployment
- Update the Configuration Manager client and the associated boot image before debugging so the test does not reproduce a problem already fixed in newer components.
- Deploy the debug task sequence only to a small test collection containing non-production devices.
- Enable
TSDebugOnErrorwhen you want the debugger to start after a step returns an error. - At the failure, inspect variables, the selected content source, and the command environment, then open SMSTS.log directly from the debugger.
Use Set Current carefully
The debugger can set the current step, but skipping steps can omit variables or preparation required later. Use that control only when you understand the dependencies of the skipped actions. A sequence that appears to continue in debug mode may still fail in a normal run because a prerequisite was never created.
Free tools Windows power users keep installed
One-click scans. No signup required.
Capture evidence automatically after a failed step
For a sequence that includes error handling, the read-only variable _SMSTSLastActionSucceeded is false after a failed action. An error-handler group can use that condition to copy SMSTS.log to a protected share for later analysis. Include the device name, task-sequence ID, time, and phase in the destination naming scheme so logs from parallel deployments do not overwrite one another.
Make sure the error-handler copy itself has network access and does not mask the original failure. If the handler cannot reach the share, preserve the local log before rebooting and record that the secondary collection failed.
Compare incidents systematically
When several devices report 0x80004005, compare them on the same axes instead of treating the code as a common root cause:
- Execution phase: PXE/WinPE, pre-client operating system, or post-client operating system.
- Failing step: policy retrieval, partitioning, content download, OS application, Sysprep, state store, or custom command.
- Network and protocol: HTTP, HTTPS, SMB, multicast, DHCP, and DNS conditions.
- Content source: peer cache, current boundary group, neighbor boundary group, or site-default group.
- Authentication: whether NAA or another deployment identity was required.
- Sequence design: MDT-integrated versus custom steps and scripts.
- Hardware scope: one model, one NIC/storage controller, or all devices.
A failure affecting only one hardware model points toward WinPE drivers or firmware. A failure affecting devices in one network range points toward boundaries, routing, DHCP, or a local distribution point. A failure beginning immediately after a media rebuild points toward media content, certificates, or boot-image changes.
Quick Recap
Final recovery checklist
- Preserve the SMSTS.log from the correct phase using the path listed above or the
_SMSTSLogPathvariable. - Find the first specific error before 0x80004005 and record the step, HRESULT, content ID, URL, and protocol.
- Apply one matching branch: PKI media, PXE/WinPE drivers, content distribution, NAA, Sysprep, or MDT integration.
- Retest on a non-production device with the same hardware, boundary group, and media type.
- If the result changes, compare the new log with the preserved failure rather than relying on the final generic code.
- Only after the sequence succeeds on the controlled test should you expand the deployment collection.
If you also need a convenience utility for general Windows cleanup and crash diagnostics outside Configuration Manager, Outbyte PC Repair is an optional shortcut. It can address more than 100 common Windows issues where possible, review crash logs, clean temporary and cache files, and check selected Windows settings and updates; it runs on Windows 11, 10, 8, and 7. Its free trial is category-based and lasts at least two days before a subscription, results vary, and it does not replace antivirus protection or guarantee that every crash will be repaired.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
