MOMCertImport.exe tool error: ‘The application failed to initialize properly (0xc0150002). Click OK to terminate the application.’

At a customers site I got the above mentioned error on a W2K08 SP2 x64 server. Strange. I had run the tool successfully before and I was using the latest version and the one for the correct architecture (x64) as well. So what was happening here? The application wasn’t blocked either. Double clicking it, right clicking it and running it as an administrator or running it from an elevated cmd-prompt, every time I got the same error.

I know that this tool needs certain .NET components (and some even say MSXML6.0 as well, but I doubt that) but these are present and functional on that server. So time to dive a bit deeper.

Hmmm. It turned out DEP was set at its highest level. And I wasn’t allowed to add the tool since it is x64 based. At least that’s what the error message told me when I wanted to make an exception on DEP. And simply adjusting DEP wasn’t a problem first. But when it is adjusted the servers needs a reboot. But rebooting a server during production hours isn’t really a good decision.

So how to go further?

Actually the MOMCertImport.exe is nothing more than a convenient tool to help us lazy OpsMgr administrators to get through the day without too much manual labor. The tool adds an entry to the registry where it ‘tells’ the OpsMgr Health Service what certificate it needs to load from the computer certificate store. That’s it. Oh and a small pitfall: the serial number is used here, but some pesky OpsMgr developer decided to store that serial the other way round…

But when one keeps that in mind, no problem what so ever.

This is what I did in order to work around the MOMCertImport.exe tool on the problematic server:

Process 1: Finding out the serial number of the certificate:

1. Open the MMC, add a snap-in. Select Certificates for the Computer Account. Go to Personal, expand it and select the certificate OpsMgr will use.
2. Double click it and go to the second tab, ‘Details'.
3. The second entry has the field name ‘Serial Number’. Write it down or use the button ‘Copy To File’. The latter is the best option since no errors will be made with the serial number.

Process 2: Adding the found serial number in REVERSE order in the registry:

1. Open the registry
2. Go to HKLM\Software\Microsoft\Microsoft OperationsManager\3.0\Machine Settings
3. Create here a new sub-regkey with a Binary Value, named ChannelCertificateSerialNumber
4. Put here the earlier found serial number of the Certificate. Remember to REVERSE the order. Do not use spaces, these will be added automatically.
   Example: suppose the serial number is 34 56 85, you must enter it as 85 56 34. DO NOT REVERSE THE ORDER OF THE DIGITS IN THE PAIRS!

Now the health service can be restarted. Soon enough EventID 20053 will show up, telling that the certificate has been successfully loaded. When EventID 20066 is displayed instead of it, the wrong serial number has been entered into the registry. Go back and double check it.

This way production doesn’t suffer a single second down-time and the OpsMgr implementation can continue as well. A win-win situation actually…