What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
For Cloud Management Gateway (CMG) deployment problems, start with CloudMgr.log and CMGSetup.log. For a provisioned CMG that is not serving client traffic, start with CMGService.log and SMS_Cloud_ProxyConnector.log, then correlate them with the affected client’s LocationServices.log and CcmMessaging.log.
“SCCM” is the common legacy name; Microsoft’s current product name is Configuration Manager. The log names and paths below apply primarily to Configuration Manager current branch, although exact UI labels and authentication behavior can vary by release and configuration.
As an Amazon Associate I earn from qualifying purchases.
Understand the CMG troubleshooting path
A CMG request can fail at several different components. A green CMG status in the Configuration Manager console proves only that the service reports healthy; it does not prove that a particular client can discover the CMG, authenticate, reach the connection point, contact a management point, or download content.
Free tools Windows power users keep installed
One-click scans. No signup required.
Configuration Manager client
↓
CMG public endpoint
↓
CMG service
↓
CMG connection point
↓
Management point
↓
Site server and site databaseFor application, package, or update content, the path can also involve the optional CMG content service and Azure storage.
#1 Best Overall
- Get NVMe solid state performance with up to 1050MB/s read and 1000MB/s write speeds in a portable, high-capacity drive(1) (Based on internal testing; performance may be lower depending on host device & other factors. 1MB=1,000,000 bytes.)
- Up to 3-meter drop protection and IP65 water and dust resistance mean this tough drive can take a beating(3) (Previously rated for 2-meter drop protection and IP55 rating. Now qualified for the higher, stated specs.)
- Use the handy carabiner loop to secure it to your belt loop or backpack for extra peace of mind.
- Help keep private content private with the included password protection featuring 256‐bit AES hardware encryption.(3)
- Easily manage files and automatically free up space with the SanDisk Memory Zone app.(5). Non-Operating Temperature -20°C to 85°C
| Failure point | What it usually looks like | Primary evidence | Likely owner of the fix |
|---|---|---|---|
| Client discovery and location | The client has no internet-based management-point candidate or chooses an on-premises MP | LocationServices.log, ClientLocation.log, LocationCache.log |
Client policy, site assignment, boundaries, or CMG association |
| Client authentication | Certificate, token, TLS, or authorization errors | ClientAuth.log, CcmAad.log, CcmMessaging.log |
Certificate infrastructure, Microsoft Entra configuration, proxy, or client identity |
| CMG service | The endpoint responds poorly or service-side request processing fails | CMGService.log |
CMG configuration, service certificate, or Azure service state |
| Connection point | The CMG is reachable, but requests do not reach the site or management point | SMS_Cloud_ProxyConnector.log |
Connection-point server, firewall, proxy, certificates, or MP reachability |
| Management point | Forwarding succeeds, but the MP rejects or mishandles the request | MP_Framework.log, CcmIsapi.log, CCM_STS.log |
Management-point authentication, IIS, registration, or site configuration |
| Content delivery | Policy works, but an application, package, or update will not download | CMGContentService.log, CloudDP-<guid>.log, client content logs |
Content distribution, Azure storage, boundary policy, BITS, or proxy |
Microsoft’s Configuration Manager log reference is the authoritative reference for log ownership and descriptions.
CMG log files: quick reference
| Log | Location | Use it for | Pair it with |
|---|---|---|---|
CloudMgr.log |
Primary site server or CAS | CMG creation, provisioning, configuration changes, service state, storage, content provisioning, and administrator start/stop actions | CMGSetup.log |
CMGSetup.log |
Synchronized CMG log on the site system | Second-stage service setup, initialization, certificates, storage, role instances, and startup errors | CloudMgr.log, CMGService.log |
CMGService.log |
Synchronized CMG service log | CMG health, incoming client traffic, request processing, and service-side authentication failures | SMS_Cloud_ProxyConnector.log, client logs |
SMS_Cloud_ProxyConnector.log |
Server hosting the CMG connection point | CMG-to-connection-point communication, forwarding, certificates, proxy behavior, and returned HTTP status codes | CMGService.log, MP logs |
CMGContentService.log |
Synchronized CMG service log | CMG content-service startup, Azure storage access, content requests, and content availability | CloudDP-<guid>.log, client download logs |
LocationServices.log |
Client | Management-point, software-update-point, and distribution-point location activity; CMG discovery and selection | ClientLocation.log, CcmMessaging.log |
ClientLocation.log |
Client | Site assignment and client location state | LocationCache.log |
LocationCache.log |
Client | Cached location information and stale or missing location data | LocationServices.log |
CcmMessaging.log |
Client | Client-to-management-point communication, HTTP responses, policy communication, TLS, proxy, and transport symptoms | LocationServices.log, CMG logs |
ClientAuth.log |
Client | Client certificate selection and authentication | CcmMessaging.log, CCM_STS.log |
CcmAad.log |
Client | Microsoft Entra authentication and token-related activity | ClientAuth.log |
ccmsetup.log |
Client during installation | Internet-based client installation, CMG hostname, TLS, certificate-chain validation, and registration | CcmMessaging.log, CMG logs |
CAS.log |
Client | Content access and cache decisions | ContentTransferManager.log |
ContentTransferManager.log |
Client | Content-location selection and transfer requests | DataTransferService.log |
DataTransferService.log |
Client | BITS and data-transfer activity | CMBITSManager.log |
MP_Framework.log |
Management point | Management-point framework and request processing | CcmIsapi.log |
CcmIsapi.log |
Management point | IIS and client request handling | MP_Framework.log |
CCM_STS.log |
Management point | Authentication and security-token service activity | ClientAuth.log, MP_GetAuth.log |
Where CMG logs are located
Client logs
The default client location is:
C:WindowsCCMLogsStart here when one or more clients cannot discover the CMG, request policy, authenticate, or download content.
Site-server logs
The default site-server and CAS location is:
C:Program FilesMicrosoft Configuration ManagerLogsUse the actual Configuration Manager installation directory if the site was installed elsewhere. CloudMgr.log is the main deployment and service-management log.
Connection-point and management-point logs
The CMG connection point hosts SMS_Cloud_ProxyConnector.log. A management point commonly stores logs under:
C:SMS_CCMLogsManagement-point log locations can also differ by installation.
Synchronized CMG service logs
Do not treat direct RDP access to the CMG as the normal log-retrieval method. Configuration Manager synchronizes CMG service logs from Azure storage to the local site-system SMSLogs folder. The important synchronized logs are CMGSetup.log, CMGService.log, and, when content is enabled, CMGContentService.log.
Rank #2
- Solid state performance with up to 800MB/s read speeds in a portable drive. (Based on internal testing; performance may be lower depending on host device, interface, usage conditions and other factors. 1MB=1,000,000 bytes.)
- Back up your content and memories on a storage solution that fits seamlessly into your mobile lifestyle.
- Take it with you on your adventures—up to two-meter drop protection means this durable drive can take a beating. (Based on internal testing.)
- Secure it to your belt loop or backpack for extra peace of mind thanks to the tough rubber hook.
- From Sandisk, a brand professional photographers trust to take on assignments.
Each synchronization stage is approximately five minutes apart, and Microsoft documents a maximum expected delay of about 10 minutes. Filenames can include the CMG service name and role-instance identifier, for example:
CMG-ServiceName-RoleInstanceID-CMGSetup.logWait for this delay before concluding that a newly reproduced event is absent. If the CMG has multiple role instances, make sure you correlate the correct instance and timestamp.
The fastest repeatable troubleshooting workflow
- Define the symptom. Decide whether the failure is deployment, discovery, authentication, management communication, forwarding, or content delivery.
- Record the reproduction time. Note the client name, CMG name, role-instance identifier if available, exact time, time zone, HTTP status, and error code.
- Run Connection Analyzer. In the Configuration Manager console, open Administration, expand Cloud Services, select Cloud Management Gateway, select the CMG, and choose Connection analyzer from the ribbon. Authenticate using one of the available options and review each test stage.
- Check the client’s location state. Open
LocationServices.log,ClientLocation.log, andLocationCache.log. Confirm that the client received CMG policy and selected an internet-based management point. - Check the client request. Use
CcmMessaging.logand, for authentication issues,ClientAuth.logorCcmAad.log. - Check the connection point. At the server hosting the connection point, correlate the same time in
SMS_Cloud_ProxyConnector.log. - Check the CMG service. After allowing for synchronization delay, inspect
CMGService.logand compare the request, status, and identifiers with the connection-point entry. - Check the management point. If forwarding reached the MP, inspect
MP_Framework.log,CcmIsapi.log,CCM_STS.log, or the relevant authentication/registration log. - Separate content problems. If policy succeeds but downloads fail, switch to
CAS.log,ContentTransferManager.log,DataTransferService.log,CMBITSManager.log,CMGContentService.log, andCloudDP-<guid>.log. - Retest after the fix. Run Connection Analyzer again and reproduce the original client operation. Confirm that the same request now completes through every hop.
Use CMTrace, OneTrace, or another Configuration Manager-aware viewer. Open the active .log first, but inspect rotated .lo_ files if the event has rolled out of the active file. Search for error, failed, 0x, 401, 403, timeout, certificate, proxy, token, revocation, and the CMG FQDN. Preserve the preceding successful request: it often shows the exact point at which behavior changed.
Verify that the client has CMG policy
Configuration Manager treats the CMG as an internet-based management point. To display internet-based candidates known to the client, run:
Get-WmiObject -Namespace RootCcmLocationServices `
-Class SMS_ActiveMPCandidate |
Where-Object {$_.Type -eq "Internet"}If the query returns no candidate:
- Confirm that the client received the policy enabling CMG use.
- Review
LocationServices.log,PolicyAgent.log, andPolicyEvaluator.log. - Verify site assignment.
- Confirm that the CMG is associated with the site and that the relevant management point allows CMG traffic.
- Restart the SMS Agent Host service when appropriate to force a location request instead of waiting for the normal 24-hour location polling cycle.
- Run the query again and inspect the new log entries.
A client that can reach a domain controller or on-premises management point may classify itself as intranet and not use the CMG. For controlled testing, Microsoft documents this registry value:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Path: HKLMSOFTWAREMicrosoftCCMSecurity
Value: ClientAlwaysOnInternet
Type: REG_DWORD
Data: 1This changes normal resource-selection behavior. Use it only as a deliberate diagnostic or for clients intentionally configured to remain internet-based; it is not a universal repair.
Rank #3
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Fix CMG deployment and provisioning failures
When the console shows provisioning, updating, or failed status, begin on the primary site server or CAS with CloudMgr.log. It records Azure provisioning, service-state changes, configuration updates, storage and content provisioning, and administrative actions. Then correlate the deployment stage in CMGSetup.log.
Investigate:
- Expired, incorrectly configured, or incomplete service certificates.
- Invalid certificate chains or unavailable private keys.
- Azure resource, role-instance, or storage configuration errors.
- Permissions or connectivity problems during provisioning.
- An unassociated or incorrectly configured CMG connection point.
- A configuration change that is still within the provisioning or log-synchronization window.
CMGService.log is not the primary log for an individual client’s failed policy request when the CMG itself is still being provisioned. First establish that the service is deployed and initialized.
Fix client communication failures
If the CMG is provisioned but a client cannot communicate, follow the request from the client outward:
- In
LocationServices.log, confirm that the client discovered and selected the CMG. - In
CcmMessaging.log, identify the requested endpoint, HTTP response, TLS/proxy symptom, and error code. - In
ClientAuth.logorCcmAad.log, verify certificate or Microsoft Entra authentication behavior. - In
SMS_Cloud_ProxyConnector.log, determine whether the CMG forwarded the request internally. - In
CMGService.log, confirm that the CMG received and processed the request. - If forwarding succeeded, inspect management-point logs for authentication, registration, IIS, or framework rejection.
Check DNS resolution of the CMG FQDN, HTTPS/TLS negotiation, proxy configuration and authentication, certificate validity and private-key access, site assignment, client registration, management-point availability, and the management point’s CMG-traffic configuration. An internet connection alone is not sufficient: the client must trust the endpoint, authenticate, and reach a correctly configured management point.
Interpret 403, 401, timeout, and certificate errors
| Symptom | Likely area | Logs to correlate |
|---|---|---|
403 CMGConnector_Clientcertificaterequired |
Client-certificate authentication or certificate selection/trust | LocationServices.log, ClientAuth.log, SMS_Cloud_ProxyConnector.log, CMGService.log |
401 Unauthorized |
Authentication, token, certificate, or management-point authorization | Client authentication logs, CMGService.log, CCM_STS.log, and relevant MP logs |
| Timeout | DNS, firewall, proxy, TLS, or service reachability | CcmMessaging.log, SMS_Cloud_ProxyConnector.log, CMGService.log |
| CMG metadata unavailable | Location, policy, or endpoint discovery | LocationServices.log, CcmMessaging.log, policy logs |
| Policy succeeds but content fails | Content distribution, Azure storage, content location, BITS, or proxy | CMGContentService.log, CloudDP-<guid>.log, CAS.log, DataTransferService.log |
An HTTP status is a symptom, not a complete diagnosis. The same status can be generated at different hops, so always identify which component logged it and read the accompanying text.
Investigate the 403 certificate-required scenario
Microsoft documents the message:
StatusCode=403
StatusText=CMGConnector_ClientcertificaterequiredThis points toward a client-certificate authentication requirement rather than simply an offline CMG. Check that the client certificate is valid, has the expected EKU and private key, is not expired or revoked, and chains to a trusted CA. Confirm that certificate revocation checking works from the relevant internet paths. Where client authentication certificates are used, verify the required certificate is also available and usable on the CMG connection point.
Rank #4
- NEARLY 2X FASTER THAN OUR PREVIOUS GENERATION(8) – move 1,000 high-res photos in under 60 seconds(6) with up to 2000MB/s transfer speeds(2).
- IP65 RATING AND UP TO 3M DROP PROTECTION(3) – protects against spills and drops.
- POCKET-SIZED – fits easily in pockets and small bags.
- SPACE TO OWN YOUR AI CONTENT – speed and capacity to download your high-res clips and photo edits.
- 256-BIT AES ENCRYPTION(4) – helps keep private files secure with password protection.
Authentication requirements differ between client certificates, Microsoft Entra authentication, and site-issued tokens. Use the environment’s actual authentication model when interpreting ClientAuth.log, CcmAad.log, and CCM_STS.log. See Microsoft’s guidance on CMG communication errors.
Recommended Free Tools
Fix CMG content-download failures
Management traffic and content traffic are separate troubleshooting tracks. A client can successfully retrieve policy through a CMG while content delivery remains disabled, undistributed, unavailable in Azure storage, or blocked by the client’s BITS/proxy path.
Check the client’s CAS.log, ContentTransferManager.log, DataTransferService.log, and CMBITSManager.log. On the CMG side, inspect CMGContentService.log and the relevant CloudDP-<guid>.log.
Verify that:
- The CMG is configured to serve content.
- The package, application, or update content was distributed to the CMG.
- The deployment’s content is available from that CMG.
- Boundary-group and content-location policy select the intended source.
- Azure storage access and content-service initialization are healthy.
- The client’s BITS and proxy path permits the transfer.
Internet client installation failures
For an internet-based installation or repair, start with ccmsetup.log. Look for the CMG hostname and path, HTTPS attempts, certificate-chain validation, Microsoft Entra information retrieval, failed downloads, and registration steps. Correlate with CcmMessaging.log, ClientAuth.log, CMGService.log, and SMS_Cloud_ProxyConnector.log.
The client must trust the CMG server-authentication certificate chain. If the root CA is private and is not already available on the device, install it through the organization’s approved device-management process. Certificate revocation checking must also work from the installation path unless the design explicitly handles it after security review. Microsoft describes this workflow in its documentation for Microsoft Entra authentication and CMG-assisted client installation.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteIncrease logging safely
Increase detail only for a controlled reproduction window. Verbose or trace logging adds component-specific detail; debug logging is lower-level and can generate a large volume of data.
Best Value
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
For client and management-point components, Microsoft documents global settings under:
HKLMSOFTWAREMicrosoftCCMLogging@Global| Value | Meaning |
|---|---|
LogLevel |
0 = Verbose; 1 = Default; 2 = warnings and errors; 3 = errors only |
LogMaxHistory |
Number of previous log versions to retain |
LogMaxSize |
Maximum log size in bytes; Microsoft’s documented default client value is 250,000 bytes |
Debug logging is configured under:
HKLMSOFTWAREMicrosoftCCMLoggingDebugLogging
Enabled = True or FalseDisable debug logging after collecting the required evidence. Excessive output can consume disk space, accelerate log rotation, and make the original event harder to find. For CMG-specific logs, use the documented CMG cloud-service trace-level controls—Information (default), Verbose, or Error—rather than enabling debug logging everywhere. The exact console presentation can vary by current-branch release.
Use the CMG Connection Analyzer as an active test
The Connection Analyzer tests the current CMG path; logs provide historical and request-level evidence. Run it before changing certificates, firewall rules, or client settings.
- Fails before reaching the service: investigate DNS, proxy, firewall, TLS, endpoint, and certificate trust.
- Service responds but the connection-point test fails: inspect
SMS_Cloud_ProxyConnector.log, connection-point service state, internal firewall/proxy rules, and certificates. - The connection point reaches the MP but authorization fails: inspect client identity, certificates or tokens, management-point authentication, and
CCM_STS.log. - Analyzer passes but one client fails: focus on that client’s location, policy, authentication, proxy, registration, and local logs.
Microsoft’s CMG monitoring documentation covers the analyzer and service-monitoring workflow. Console labels may vary slightly by release.
Log rotation and evidence handling
Configuration Manager rotates logs when they reach the configured maximum size and retains history according to the log-history setting. If the failure is not in the active file, inspect the matching .lo_ files. Keep timestamps consistent: CMG, Azure, site-system, and client entries may use different time-zone displays.
Before sharing logs, redact hostnames, URLs, usernames, certificate details, tenant or subscription identifiers, and other internal infrastructure data. Preserve enough timestamps, request identifiers, HTTP status codes, and role-instance information for correlation.
Escalation checklist
Collect the following before opening a Microsoft support case:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →- Configuration Manager current-branch version and update level.
- CMG name, region, service status, and role-instance information.
- Connection Analyzer results.
- Affected client name and client version.
- Exact failure time and time zone.
- Client logs, especially
LocationServices.log,CcmMessaging.log, authentication logs, and content logs where relevant. CloudMgr.log,CMGSetup.log,CMGService.log, andSMS_Cloud_ProxyConnector.log.- Relevant management-point logs.
- Authentication model: client certificate, Microsoft Entra authentication, or site-issued token.
- Proxy, firewall, DNS, TLS, and certificate-chain details.
- Scope of impact: one client, a boundary, a connection point, or all internet clients.
Use Microsoft’s CMG setup and troubleshooting guidance alongside the log-file configuration reference.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
