May 24, 2016 · RegTask: Failed to send registration request message. Error: 0x87d00231 ClientIDManagerStartup 5/18/2016 12:20:21 PM 456 (0x01C8) RegTask: Failed to send registration request. Error: 0x87d00231 ClientIDManagerStartup 5/18/2016 12:20:21 PM 456 (0x01C8) [RegTask] – Sleeping for 960 seconds … You are right regarding the security concerns but actually it's a POC server and after that we will replicate to a production environment. And regarding the certificate the CRLis listed on the server and client certificate as below screenshots.Error: 0x87d00231" Reinstall the agent seems to solve the issue when we try on one of the client but just thought checking up what could be the possible issue. Its will be hard on patch compliance if user lost connection to CMG due to this issue. We currently on MECM version 2010 and using PKI cert for CMG communication. Appreciate all the input!Jan 9, 2018 · The CRL is not reachable from internet so I disabled CRL check on the site and during setup. Does it matter if I disabled CRL checking on site after everything was setup I can't exactly remember when I changed the setting. Nov 27, 2017 · but the client did not get it !!! what could be the issue? in ClientIDManagerStartup.log [RegTask] - Client is not registered. Sending registration request for GUID:0F401FC7-A72A-468C-8949-D07C22A761D0 ... ClientIDManagerStartup 11/20/2017 3:58:31 PM 2888 (0x0B48) RegTask: Failed to send registration request message. Feb 3, 2021 · CMG-<cloud_service_name>-ProxyService_IN_0-CMGSetup.log: Records details about the second phase of the cloud management gateway deployment (local deployment in Azure). CloudMgr.log : Records details about deploying the cloud management gateway service, ongoing service status, and use data associated with the service. Connect to the CMG service to see if it's running. Failed to connect to the CMG service. Unexpected response status code is NameResolutionFailure. For more information, see SmsAdminUI.log. Check configuration settings of the CMG service is up to date. Configuration version of the CMG service should be 5. Failed to get CMG service metadata.Failed to get ConfigMgr token with Azure AD token. Status code is '403' and status description is 'CMGConnector_Un-authorizedrequest'. A possible reason for this failure is the CMG connection point failed to forward the message to the management point. The management point returned the following error: 'Un-authorizedrequest'.Hi All, I uncheck the check box from Site Properties which disable CRL check. I reinstalled client with SMSMP and /NoCRLCheck switches and Client is now appearing in the Console as Active.Client verifies the CMG server authentication certificate: PKI certificate: Client requires the root CA of the CMG certificate in its local store. Third-party certificate: Clients automatically validate a certificate with its root CA published on the internet. CMG, CMG connection point, and management point validate Azure AD and CCM tokens.Error: 0x87d00231" Reinstall the agent seems to solve the issue when we try on one of the client but just thought checking up what could be the possible issue. Its will be hard on patch compliance if user lost connection to CMG due to this issue. We currently on MECM version 2010 and using PKI cert for CMG communication. Appreciate all the input!Expert-led, virtual classes. Microsoft Virtual Academy. Free Windows Server 2012 courses. Microsoft Official Courses On-Demand. MCSE Cloud Platform and Infrastructure. MCSE: Mobility. MCSE: Data Management and Analytics. MCSE Productivity. Find technical communities in your area.Jun 22, 2017 · We decided to tackle the errors in SMS_CloudConnector.log that indicated the connector role was unable to connect on port 10140, even though according to the documentation that port (and the rest of the range, 10124-10156) were only required if running more than one VM instance for the CMG. This required a firewall change to allow the ... We had the wrong root cert in our CMG properties which is why the client didn’t register properly with PKI once that was replaced and the client restarted, it registered fine. Reply Justin Chalfant on August 8, 2021 at 11:01 AMSep 27, 2020 · CMG Connection point. CMG status is ready and connection point is in Connected status. On the client machine--> Control panel--> Configuration Manager-->Network tab shows the Internet-based MP FQDN correctly which is the CMG. Assigned the new MP site system to the boundary group and confirmed that the client is able to identify the available MPs. Good afternoon Everyone! So my SCCM client will not install nor adequately communicate with any systems that did not already have the client installed prior to my MP failing. Luckily I fixed my MP, but I can only communicate with clients that were previously installed. And it communicates...Error: 0x87d00231 ClientIDManagerStartup 08/11/2022 5:48:12 PM 5540 (0x15A4) RegTask: Failed to send registration request. Error: 0x87d00231 ClientIDManagerStartup 08/11/2022 5:48:12 PM 5540 (0x15A4) [RegTask] - Sleeping for 60 seconds ...Jul 15, 2019 · Once the device token works, the request is sent to internal MP via CMG to get a CCM token. Client must get a CCM token successfully before accessing internal resources. CCM_STS.log available on the Management Point enabled for CMG traffic is a good place to know if CCM token was issued successfully. ProcessRequest - Start CCM_STS In here your CMG certificate chain should include the correct certificate chain. as you can see in the illustration, the issuer of this certificate can’t be found, and as such our trust is broken. To fix the issue, copy and import your missing root certificate(s) to the Azure cloud management gateway server.MCSE Cloud Platform and Infrastructure. MCSE: Mobility. MCSE: Data Management and Analytics. MCSE Productivity. Find technical communities in your area. MSDN Forums. Security Bulletins & Advisories. Microsoft Community Forums.Below are the result from the CA. [Green] CMG in ready state. [Red] Connect to the CMG service to see if it's running. [Red] Check configuration setting of the CMG service is up to date. [Yellow] Check connection status of CMG connection points. [Green] Check CMG enabled site systems roles. [Red] testing the CMG channel for management point.After the process of installing the workgroup clients in the internal network is completed and the clients go to the Internet, they are unable to communicate the cmg. I think the root problem is that they were unable to register to the internal MP-HTTPS server during the task and get the token. PKI cert for cmg issued from our internal CA.Apr 10, 2019 · Failed to get ConfigMgr token with Azure AD token. Status code is '403' and status description is 'CMGConnector_Un-authorizedrequest'. A possible reason for this failure is the CMG connection point failed to forward the message to the management point. The management point returned the following error: 'Un-authorizedrequest'. One of our stations fails to connect to SCCM, the log errors are: RegTask: Failed to send registration request message. Error: 0x87d00231. RegTask: Failed to send registration request. Error: 0x87d00231. If this is related then the MP is set to HTTP.ERROR: TaskManager: Task [AnalyticsCollectionTask: Service MyServicecmg] has failed. Exception Microsoft.WindowsAzure.Storage.StorageException, The remote server returned an error: (404) Not Found.. We have attempted to delete and recreate the CMG multiple times but come across the same issue.Failed to get ConfigMgr token with Azure AD token. Status code is '403' and status description is 'CMGConnector_Un-authorizedrequest'. A possible reason for this failure is the CMG connection point failed to forward the message to the management point. The management point returned the following error: 'Un-authorizedrequest'.This check occurs every 25 hours, when the SMS Agent Host service starts or when it detects a network change. When the client connects to the site and learns of a CMG, it automatically updates this valu e. After learning about CMG, Internet Management Point values will be updated. SCCM Client side log validationJun 21, 2020 · we do have the cmg configured as a distribution point. CMG distro was up and working prior to the upgrade, however this would be the first time a client upgrade would have happened over cmg. we now have around 20 devices with a client, however I believe these were likely devices that came back on the intranet and got the client while onsite. Press J to jump to the feed. Press question mark to learn the rest of the keyboard shortcutsJun 27, 2021 · 1st and foremost you're absolutely welcome. 2nd, if all you need for the time being is an image in wim format than forget about combining ConfigMgr and MDT. You honestly don't need to combine them at this point. SCCM is your deployment and management tool. MDT is the imaging tool. Hell, you don't... Good afternoon Team. I hope you are well. I have a question, in my client we are installing the client via client push, at the end gives me as code 0 but the client still does not register. When reviewing the log file…Failed to get ConfigMgr token with Azure AD token. Status code is ‘503’ and status description is ‘CMGConnector_ServiceUnavailable’. A possible reason for this failure is the CMG connection point failed to forward the message to the management point. The management point returned the following error: ‘ServiceUnavailable’.Locationservices.log indicates "Failed to get CMG metadata 0x87d00231" and if I restart the smsagent service while internet connected I'm seeing what looks like it's referencing a certificate error: Successfully queued event on HTTP/HTTPS failure for server 'CMG.CENTRALUS.CLOUDAPP.AZURE.COM'. In here your CMG certificate chain should include the correct certificate chain. as you can see in the illustration, the issuer of this certificate can’t be found, and as such our trust is broken. To fix the issue, copy and import your missing root certificate(s) to the Azure cloud management gateway server.RegTask: Failed to send registration request message. Error: 0x87d00231 ClientIDManagerStartup 5/18/2016 12:20:21 PM 456 (0x01C8) RegTask: Failed to send registration request. Error: 0x87d00231 ClientIDManagerStartup 5/18/2016 12:20:21 PM 456 (0x01C8) [RegTask] – Sleeping for 960 seconds …Apr 10, 2019 · Failed to get ConfigMgr token with Azure AD token. Status code is '403' and status description is 'CMGConnector_Un-authorizedrequest'. A possible reason for this failure is the CMG connection point failed to forward the message to the management point. The management point returned the following error: 'Un-authorizedrequest'. My lab recently started playing up when I noticed clients weren’t receiving any new policies. TDLR (it’s not even that long!): a while ago I moved my SUP/WSUS off host from the site server that also hosted a MP.Apr 30, 2020 · Today I wanted to share with you a series of short videos that offer tips on how to address and mitigate common issues you might encounter when setting up the cloud management gateway (CMG) as part of your Configuration Manager environment. Before we begin, a quick reminder that the Microsoft Endpoint Manager admin center can be accessed ... Jun 27, 2021 · Hi, I have installed in our environment SCCM CMG and the client is unable to receive software updates. This is what I see in WUAHandler.log: Its a WSUS Update Source type ({A4BF5916-DF74-44C1-BF58-68AE14A43278}), adding it. … Morning, I'm pushing out client to some of our DMZ servers. Client installation finished successfully as far as I can see from ccmsetup.log file. Investigating further, I noticed I kept getting the following in ClientIDManagerStartup.log: RegTask: Failed to send registration request message. Error: 0x87d00231.ClientLocation 19/08/2020 17:39:37 2624 (0x0A40) Raising pending event: instance of CCM_CcmHttp_Status { DateTime = "20200819163937.494000+000"; HostName = "cmg.cmg.net"; HRESULT = "0x80072f8f"; ProcessID = 444; StatusCode = 8; ThreadID = 2624; }; ClientLocation 19/08/2020 17:39:37 2624 (0x0A40) Failed in WinHttpSendRequest API, ErrorCode ...Sep 30, 2020 · Unfortunately, 0x87d00231 is a fairly generic error message that pretty much just means “something went wrong”. If you Google it, you will see a variety of solutions ranging from reinstalling the client to checking your PKI environment is functioning correctly or checking the health of your Management Point (s). Failed to get ConfigMgr token with Azure AD token. Status code is '403' and status description is 'CMGConnector_Un-authorizedrequest'. A possible reason for this failure is the CMG connection point failed to forward the message to the management point. The management point returned the following error: 'Un-authorizedrequest'.Post to https:///ccm_system/request failed with 0x87d00231. LOCATIONSERVICES: Unable to retrieve AD site membershipHello guys, Since two days ago, our Windows 10 client computers stopped reporting currently logged on users and are showing offline, although they're..Feb 2, 2021, 2:30 AM Hi all, We have SCCM 2002 , after the CMG implementation , when we force the client to internet , sccm client not reporting to SCCM site server, with below error , any suggestion pls Failed to get CMG metadata 0x87d00227 Failed to get management points from XXXXX. Error 0x87d00227 Not Monitored Sign in to follow 0 commentsSince we are using Internal PKI cert on CMG, I have exported the Root certificate and imported into DMZ server, Installation went fine and client was able to communicate well after the installation. It received all policies and able to push software updates/apps. Locationservices.log indicates "Failed to get CMG metadata 0x87d00231" and if I restart the smsagent service while internet connected I'm seeing what looks like it's referencing a certificate error: Successfully queued event on HTTP/HTTPS failure for server 'CMG.CENTRALUS.CLOUDAPP.AZURE.COM'.Error: 0x87d00231 ClientIDManagerStartup 08/11/2022 5:48:12 PM 5540 (0x15A4) RegTask: Failed to send registration request. Error: 0x87d00231 ClientIDManagerStartup 08/11/2022 5:48:12 PM 5540 (0x15A4) [RegTask] - Sleeping for 60 seconds ...It works fine by changing the "UserCost" value as '0', after that CM client installation gets worked.This check looks at the following settings: In the Configuration Manager console, go to the Administration workspace, expand Site Configuration, and select the Sites node. Select a site, and then in the ribbon select Properties. Switch to the Communication Security tab. Configure one of the following options:by MrOarsome Issue with CMG and clients authenticating via Hybrid Azure AD: Failed to send registration request message. Error: 0x87d00231 I have gone through the steps of setting up a CMG with with SCCM CB 1906 and all seems to be behaving. However, when my test clients seem to be unable to connect to the CMG service.Hi, I have installed in our environment SCCM CMG and the client is unable to receive software updates. This is what I see in WUAHandler.log: Its a WSUS Update Source type ({A4BF5916-DF74-44C1-BF58-68AE14A43278}), adding it. …Only this laptop have issue in installing SCCM client. What are the other ways to make SCCM communcation with MP.Posts about 0x87d00231 written by Leldance40k. I am torn between two lines of thought. It’s down to the “No CRL checking” option being set on the Config Manager site server; whilst this may bypass some CRL “stuff”, it’s needed for to get other things going. Go to Monitoring / Cloud Management. Natiguate to the bottom of the Dashboard, in the Cloud Management Gateway Statistics section. From there you can validate that there’s some client communicating and their authentication methods. If there’s anything wrong, the next step is to use the Cloud Management Gateway Connection Analyser.When running the CMG validation checker All checks are successful except the last one and it reports the following error: Succeed to get ConfigMgr token with Azure AD token. Failed to refresh MP location. Status code is ‘500’ and status description is ‘CMGConnector_InternalServerError’. A possible reason for this failure is the CMG ...Locationservices.log indicates "Failed to get CMG metadata 0x87d00231" and if I restart the smsagent service while internet connected I'm seeing what looks like it's referencing a certificate error: Successfully queued event on HTTP/HTTPS failure for server 'CMG.CENTRALUS.CLOUDAPP.AZURE.COM'.Mar 19, 2018 · ClientIDManagerStartup 3/16/2018 9:13:33 AM 7968 (0x1F20) CCM Identity is in sync with Identity stores ClientIDManagerStartup 3/16/2018 9:13:33 AM 7968 (0x1F20) Begin searching client certificates based on Certificate Issuers ClientIDManagerStartup 3/16/2018 9:13:33 AM 7968 (0x1F20) Certificate Issuer 1 [CN=Entrust Root Certification Authority ... One of our stations fails to connect to SCCM, the log errors are: RegTask: Failed to send registration request message. Error: 0x87d00231. RegTask: Failed to send registration request. Error: 0x87d00231. If this is related then the MP is set to HTTP.Jun 22, 2017 · We decided to tackle the errors in SMS_CloudConnector.log that indicated the connector role was unable to connect on port 10140, even though according to the documentation that port (and the rest of the range, 10124-10156) were only required if running more than one VM instance for the CMG. This required a firewall change to allow the ... Hi, I have installed in our environment SCCM CMG and the client is unable to receive software updates. This is what I see in WUAHandler.log: Its a WSUS Update Source type ({A4BF5916-DF74-44C1-BF58-68AE14A43278}), adding it. …Click on Add. Click on Search and then you will be prompted to login to your Azure tenant and then select the existing group in Azure AD. Click on Apply. The Azure AD synchronization happens every five minutes. It’s a one-way process, from SCCM to Azure AD.marking this as solved as it seems like i am stuck with PKI for the time being :( it's a pain because it stops the SCCM client registering quickly enough after a task sequence and I get loads of PCs without hardware inventory because IT shut them down and shipped them out to someone before the client registered, or before it ran hardware inventory.MCSE Cloud Platform and Infrastructure. MCSE: Mobility. MCSE: Data Management and Analytics. MCSE Productivity. Find technical communities in your area. MSDN Forums. Security Bulletins & Advisories. Microsoft Community Forums.we set up a testing environment for bitlocker purposes and because of new features for bitlocker we updated yesterday from 1910 to 2002. Update was done fine but now our 3 clients dont contact SCCM anymore. we tried to install new ccm client manually but ccmsetup.log shows a lot of errors. After checking PKI we solved on problem and clients can ...we do have the cmg configured as a distribution point. CMG distro was up and working prior to the upgrade, however this would be the first time a client upgrade would have happened over cmg. we now have around 20 devices with a client, however I believe these were likely devices that came back on the intranet and got the client while onsite.MDM Session: Failed to get AAD Token for sync session User Token: (The parameter is incorrect.) Device Token: (Incorrect function.). Long story short, I kept removing Device Configuration profiles I had assigned to the device, and the policy causing the issue was to upgrade Pro to Enterprise using an MAK key using the “Edition upgrade” policy. Hi, I have configured a CMG and deployed to PKI certificate to Client for authentication. However still clients not get registered through CMG. Please help. Location Service ...You are right regarding the security concerns but actually it's a POC server and after that we will replicate to a production environment. And regarding the certificate the CRLis listed on the server and client certificate as below screenshots.May 18, 2022 · SCCM 1806 onwards, you have a new in-console utility called CMG connection analyzer. This utility is for real-time verification to help CMG-related troubleshooting. The SCCM in-console utility checks the current status of the service and the communication channel through the CMG connection point to any management points that allow CMG traffic. Client verifies the CMG server authentication certificate: PKI certificate: Client requires the root CA of the CMG certificate in its local store. Third-party certificate: Clients automatically validate a certificate with its root CA published on the internet. CMG, CMG connection point, and management point validate Azure AD and CCM tokens.Feb 3, 2021 · CMG-<cloud_service_name>-ProxyService_IN_0-CMGSetup.log: Records details about the second phase of the cloud management gateway deployment (local deployment in Azure). CloudMgr.log : Records details about deploying the cloud management gateway service, ongoing service status, and use data associated with the service. The first thing we checked here is the port 443 connectivity from this test machine to the CMG public IP using the port query UI tool. Port connectivity was fine, and it was listening for port 443 without any issue. After hours of troubleshooting, we identified that the PKI infrastructure has multiple CAs.Apr 6, 2015 · Most clients (I didn't check all) look ok (packages are being downloaded and installed). This is one primary site (ad domain) with one MP and few DPs . Clients are installed via push wizard. What i did: client reinstall (ccmsetup.exe /uninstall and also try with ccmclean.exe from sms2003 pack) telnet to MP port 80 (is ok) delete client account ... Nov 1, 2022 · After upgrading from SCCM 2203 to 2207, the upgrade failed, we were getting an error, failed to update key vault, bad request. so in an effort to work around the problem, we decided we could try to tear out the existing CMG and reimplement using all new names and to a new resource group, However, the new cmg fails to deploy with the same exact ... Nov 9, 2022 · Error: 0x87d00231 ClientIDManagerStartup 08/11/2022 5:49:12 PM 5540 (0x15A4) RegTask: Failed to send registration request. Error: 0x87d00231 ClientIDManagerStartup 08/11/2022 5:49:12 PM 5540 (0x15A4) [RegTask] - Sleeping for 60 seconds ... Connect to the CMG service to see if it's running. Failed to connect to the CMG service. Unexpected response status code is NameResolutionFailure. For more information, see SmsAdminUI.log. Check configuration settings of the CMG service is up to date. Configuration version of the CMG service should be 5. Failed to get CMG service metadata.MCSE Cloud Platform and Infrastructure. MCSE: Mobility. MCSE: Data Management and Analytics. MCSE Productivity. Find technical communities in your area. MSDN Forums. Security Bulletins & Advisories. Microsoft Community Forums.Post to https:///ccm_system/request failed with 0x87d00231. LOCATIONSERVICES: Unable to retrieve AD site membership
Client verifies the CMG server authentication certificate: PKI certificate: Client requires the root CA of the CMG certificate in its local store. Third-party certificate: Clients automatically validate a certificate with its root CA published on the internet. CMG, CMG connection point, and management point validate Azure AD and CCM tokens.. Used ti 84
Sep 30, 2020 · Unfortunately, 0x87d00231 is a fairly generic error message that pretty much just means “something went wrong”. If you Google it, you will see a variety of solutions ranging from reinstalling the client to checking your PKI environment is functioning correctly or checking the health of your Management Point (s). I have set up a cloud management gateway in my MECM Environment. PKI Infrastructure is also in place, and it is working as expected. The MECM clients function fine when communicating with the local MP (on-premises MP); however, clients cannot discover a…Hi All, I uncheck the check box from Site Properties which disable CRL check. I reinstalled client with SMSMP and /NoCRLCheck switches and Client is now appearing in the Console as Active.Oct 3, 2022 · Client verifies the CMG server authentication certificate: PKI certificate: Client requires the root CA of the CMG certificate in its local store. Third-party certificate: Clients automatically validate a certificate with its root CA published on the internet. CMG, CMG connection point, and management point validate Azure AD and CCM tokens. Jun 27, 2021 · 1st and foremost you're absolutely welcome. 2nd, if all you need for the time being is an image in wim format than forget about combining ConfigMgr and MDT. You honestly don't need to combine them at this point. SCCM is your deployment and management tool. MDT is the imaging tool. Hell, you don't... Locationservices.log indicates "Failed to get CMG metadata 0x87d00231" and if I restart the smsagent service while internet connected I'm seeing what looks like it's referencing a certificate error: Successfully queued event on HTTP/HTTPS failure for server 'CMG.CENTRALUS.CLOUDAPP.AZURE.COM'.RegTask: Failed to refresh site code. Error: 0x8000ffff ClientIDManagerStartup 23/08/2021 14:39:42 14956 (0x3A6C) Sleeping for 289 seconds before refreshing location services. ClientIDManagerStartup 23/08/2021 14:39:43 14956 (0x3A6C) LocationService.Log - Security settings update detected, restarting CcmExec.To Resolve: Change the registry key value (DisableRenegoOnClient) from 1 to 0 and restart the CCMExec service. reg add "hklm\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL" -v DisableRenegoOnClient /t REG_DWORD /d 0 /f. powershell -executionpolicy bypass -command restart-service ccmexec. PS.Unfortunately, 0x87d00231 is a fairly generic error message that pretty much just means “something went wrong”. If you Google it, you will see a variety of solutions ranging from reinstalling the client to checking your PKI environment is functioning correctly or checking the health of your Management Point (s).Good afternoon Everyone! So my SCCM client will not install nor adequately communicate with any systems that did not already have the client installed prior to my MP failing. Luckily I fixed my MP, but I can only communicate with clients that were previously installed. And it communicates... Locationservices.log indicates "Failed to get CMG metadata 0x87d00231" and if I restart the smsagent service while internet connected I'm seeing what looks like it's referencing a certificate error: Successfully queued event on HTTP/HTTPS failure for server 'CMG.CENTRALUS.CLOUDAPP.AZURE.COM'.Mike Gorski 41. Mar 3, 2021, 2:40 PM. I have set up a CMG recently and I am having trouble trying to install the SCCM agent over the internet using token based authentication. The errors I am seeing seem to indicate a certificate trust issue but there should be no need for certs for this to work. My test PC is in a workgroup and has never ...Hi, I have configured a CMG and deployed to PKI certificate to Client for authentication. However still clients not get registered through CMG. Please help. Location Service ...Sep 27, 2020 · CMG Connection point. CMG status is ready and connection point is in Connected status. On the client machine--> Control panel--> Configuration Manager-->Network tab shows the Internet-based MP FQDN correctly which is the CMG. Assigned the new MP site system to the boundary group and confirmed that the client is able to identify the available MPs. Expert-led, virtual classes. Microsoft Virtual Academy. Free Windows Server 2012 courses. Microsoft Official Courses On-Demand. MCSE Cloud Platform and Infrastructure. MCSE: Mobility. MCSE: Data Management and Analytics. MCSE Productivity. Find technical communities in your area.Hello guys, Since two days ago, our Windows 10 client computers stopped reporting currently logged on users and are showing offline, although they're..Choose the certificate type. Globally unique name. Issue the certificate. Create a DNS CNAME alias. Next steps. Applies to: Configuration Manager (current branch) The first step when you set up a cloud management gateway (CMG) is to get the server authentication certificate. The CMG creates an HTTPS service to which internet-based clients ...Mike Gorski 41. Mar 3, 2021, 2:40 PM. I have set up a CMG recently and I am having trouble trying to install the SCCM agent over the internet using token based authentication. The errors I am seeing seem to indicate a certificate trust issue but there should be no need for certs for this to work. My test PC is in a workgroup and has never ....