Cisco Secure Client NAM Module Service auto start issue

[Abheesh Kumar]

Hello,

I encountered an issue with the NAM module during the deployment of the new Cisco Secure Client via Microsoft SCCM. Despite the successful installation of all modules, the NAM component fails to start. Upon checking the Windows services for Cisco Secure Client - Network Access Manager (csc_nam), I noticed that the startup type was set to manual. Whenever I try to change it to auto and start the services, it throws another error.

Note: The depended service WLAN AutoConfig is running and the startup type was Automatic by default

Thanks,

Abheesh

[ahollifield]

What is the use-case for NAM?  Why not use the native Windows supplicant?  Do you have a MACSEC requirement?

[Abheesh Kumar]

hello @ahollifield , Yes we have certain use cases that requires NAM module.

[ahollifield]

What are they? MACSEC is the only thing I see of value anymore with the NAM module. 

[poongarg]

If you install the module without the use of SCCM, if it works fine?

You need to enable extended DART logging and then check the NAM logs for any error.

[Abheesh Kumar · Accepted solution]

Hello @poongarg

Without SCCM it works.

We did a workaround using a .bat script to do the installation of all modules and used SCCM only to run the script on all machines and the rollout went successfully.

[sot01]

Hello @Abheesh Kumar,

We also encountered the same issue, may you share more detail on workaround solution that you have apply?

[oem-thea]

Hello @Abheesh Kumar 

I have face this issue too. if you do not mind, could you share me .bat script for SCCM deployment?

[eric_stephens]

Thanks for the info on the solution you found noted below in this thread.  I'm just curious if you ever worked with Cisco on this and got any feedback from them on why this happened with the normal SCCM deployment.  We're running into the exact same issue trying to deploy fresh OS images with SC 5 using MECM.  We see the same issue with NAM where the service is disabled and fails to start.  If we manually reinstall NAM, it works as expected, but obviously not a good solution.  We'll look at the solution you discovered with the batch script.  We have a TAC case now, but so far they have been unable to find a reason why the deployments cause NAM to fail.

[eric_stephens]

For those interested, we've been working with Microsoft support and they found in the MECM logs that the deployment of SC 5 is using "user context", even though "system context" was defined in the deployment configuration.

And they also confirmed that using a batch file allows NAM to deploy successfully and work as expected.  MECM is used to run the batch file instead of executing the MSI directly.  Here is the batch script they used:

Install-NAM.bat

=============

"C:\Windows\system32\msiexec.exe" /i "cisco-secure-client-win-5.0.05040-nam-predeploy-k9.msi" /q /qn

We're still working with them and Cisco to determine why the normal deployment isn't working for SC 5 NAM when it always worked previously with AC 4.

[sot01]

hello @eric_stephens ,

We have follow to your suggestion and it work as expected. But we counter another issue that we cannot deloy as onetime off. That lead to after the PC restart NAM module cannot deploy it. so, how we could deploy all file one time off? 
Below are what we did:

1. Create task sequence for 5 application

2. Create script for NAM Application